joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002c330
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rsi, rax
lea rdi, [0x14002c24e]
mov rcx, qword [rdi + 0x1c]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r15, rax
mov ecx, dword [rdi + 0x6c]
mov r14, qword [rsi + 0x2e5e0]
call r14
mov r12, rax
xor ecx, ecx
mov rdx, r12
loop 0x14002c356
mov eax, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov rcx, r12
call fcn.14002c422
mov r12, qword [rdi + 4]
mov r13, rax
cmp dword [r12], 0
je 0x14002c36c
mov rcx, r13
call fcn.14002c446
movzx eax, al
cmp al, byte [r12]
je 0x14002c352
cmp al, byte [r12 + 1]
jne 0x14002c417
mov rcx, r13
call fcn.14002c45a
cmp eax, dword [r12 + 4]
je 0x14002c36c
cmp eax, dword [r12 + 8]
jne 0x14002c417
mov ecx, dword [rdi + 0x6c]
mov dword [rsp + 0x20], 0
call r14
mov rdx, rax
xor r9d, r9d
mov rax, qword [rdi + 0x3c]
mov r8d, dword [rax + r9]
mov dword [r9 + rdx], r8d
add r9, 4
cmp r9, 0x40
jl 0x14002c380
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r13, rax
test r13, r13
je 0x14002c417
mov r12, qword [rdi + 0x7c]
mov rcx, r12
mov edx, 0x7000
lea r9, [rsp + 0x20]
mov r8d, dword [rdi + 0x58]
call r13
mov eax, dword [rdi + 0x5c]
push 8
pop rdx
add rsi, rax
mov r8d, dword [rsi + 4]
mov eax, dword [rdx + rsi]
add eax, r8d
mov dword [rdx + r12], eax
add rdx, 4
cmp rdx, 0x7000
jl 0x14002c3cc
mov eax, dword [rdi + 0x54]
mov rcx, r12
mov dword [r12 + 8], eax
mov edx, 0x7000
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
call r13
mov eax, dword [rdi]
mov edi, dword [rdi]
mov edx, dword [r12 + 0xc]
add rdx, r12
add r12, rdi
add rdx, rax
mov rcx, r12
call rdx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x140004000
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
cld
and rsp, 0xfffffffffffffff0
call fcn.1400040d6
push r9
push r8
push rdx
push rcx
push rsi
xor rdx, rdx
mov rdx, qword gs:[rdx + 0x60]
mov rdx, qword [rdx + 0x18]
mov rdx, qword [rdx + 0x20]
mov rsi, qword [rdx + 0x50]
xor r9, r9
movzx rcx, word [rdx + 0x4a]
xor rax, rax
lodsb al, byte [rsi]
cmp al, 0x61
jl 0x140004037
sub al, 0x20
ror r9d, 0xd
add r9d, eax
loop 0x14000402d
push rdx
push r9
mov rdx, qword [rdx + 0x20]
mov eax, dword [rdx + 0x3c]
add rax, rdx
cmp word [rax + 0x18], 0x20b
jne 0x1400040cb
mov eax, dword [rax + 0x88]
test rax, rax
je 0x1400040cb
add rax, rdx
push rax
mov ecx, dword [rax + 0x18]
mov r8d, dword [rax + 0x20]
add r8, rdx
jrcxz 0x1400040ca
xor r9, r9
dec rcx
mov esi, dword [r8 + rcx*4]
add rsi, rdx
xor rax, rax
lodsb al, byte [rsi]
ror r9d, 0xd
add r9d, eax
cmp al, ah
jne 0x140004081
add r9, qword [rsp + 8]
cmp r9d, r10d
jne 0x140004072
pop rax
mov r8d, dword [rax + 0x24]
add r8, rdx
mov cx, word [r8 + rcx*2]
mov r8d, dword [rax + 0x1c]
add r8, rdx
mov eax, dword [r8 + rcx*4]
add rax, rdx
pop r8
pop r8
pop rsi
pop rcx
pop rdx
pop r8
pop r9
pop r10
sub rsp, 0x20
push r10
jmp rax
pop rax
pop r9
pop rdx
mov rdx, qword [rdx]
jmp 0x140004021
Function at 0x140001b14
Capabilities:
Allocate or change rwx memory
Attach user process memory
Find process by pid

Disassembly:
mov rax, rsp
push rbx
sub rsp, 0x70
mov rbx, rdx
and qword [rax + 0x20], 0
xorps xmm0, xmm0
movups xmmword [rax - 0x40], xmm0
movups xmmword [rax - 0x30], xmm0
movups xmmword [rax - 0x20], xmm0
and qword [rax + 0x18], 0
lea rdx, [rax + 0x18]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
nop
lea rax, [rbx + 1]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 0x1000
lea r9, [rsp + 0x30]
xor r8d, r8d
lea rdx, [rsp + 0x98]
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_ZwAllocateVirtualMemory]
test eax, eax
jns 0x140001b91
xor eax, eax
jmp 0x140001bc6
mov r8, rbx
xor edx, edx
mov rcx, qword [rsp + 0x98]
call fcn.140003ac0
jmp 0x140001ba5
lea rcx, [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rax, qword [rsp + 0x98]
add rsp, 0x70
pop rbx
ret
Function at 0x140002114
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x38
mov rcx, qword [rcx + 8]
test rcx, rcx
je 0x140002156
call qword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
lea rax, [0x140004070]
mov dword [rsp + 0x20], 0x220020
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x28], rax
call qword [sym.imp.ntoskrnl.exe_IoDeleteSymbolicLink]
test eax, eax
jns 0x140002156
lea rcx, [0x1400040a0]
call sub.ntoskrnl.exe_DbgPrint
add rsp, 0x38
ret

Function at 0x140002164
Capabilities:
Create device object
Print debug messages

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
and qword [rbp + 0x10], 0
lea rax, [0x1400040b0]
mov qword [rbp - 0x18], rax
lea rsi, [fcn.140002114]
lea rax, [0x140004070]
mov qword [rcx + 0x68], rsi
mov qword [rbp - 8], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x10]
mov dword [rbp - 0x20], 0x2a0028
mov qword [r11 - 0x38], rax
mov r9d, 0x22
mov byte [rsp + 0x28], 0
xor edx, edx
mov dword [rsp + 0x20], 0x100
mov rbx, rcx
mov dword [rbp - 0x10], 0x220020
call qword [sym.imp.ntoskrnl.exe_IoCreateDevice]
mov edi, eax
test eax, eax
jns 0x140002202
lea rcx, [0x1400040e0]
call sub.ntoskrnl.exe_DbgPrint
mov rdx, qword [rbx + 0x68]
mov rcx, rbx
cmp rdx, rsi
jne 0x1400021fe
call fcn.140002114
jmp 0x14000225f
call rdx
jmp 0x14000225f
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x10]
call qword [sym.imp.ntoskrnl.exe_IoCreateSymbolicLink]
mov edi, eax
test eax, eax
jns 0x14000222c
lea rcx, [0x1400040f0]
call sub.ntoskrnl.exe_DbgPrint
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
lea rax, [0x1400020cc]
mov qword [rbx + 0x70], rax
lea rcx, [0x140004100]
lea rax, [0x1400020f4]
mov qword [rbx + 0x80], rax
lea rax, [0x140001f00]
mov qword [rbx + 0xe0], rax
call sub.ntoskrnl.exe_DbgPrint
lea r11, [rsp + 0x60]
mov eax, edi
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140002e84
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
sub rsp, 0x50
xorps xmm0, xmm0
mov esi, r8d
mov rdi, rdx
xor ebx, ebx
lea rdx, [rax + 0x20]
mov qword [rax + 0x20], rbx
movups xmmword [rax - 0x38], xmm0
movups xmmword [rax - 0x28], xmm0
movups xmmword [rax - 0x18], xmm0
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jns 0x140002ed9
mov r9d, eax
lea r8, [0x140004140]
xor edx, edx
lea ecx, [rbx + 0x4d]
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
xor al, al
jmp 0x140002f59
mov rcx, qword [rsp + 0x78]
lea rdx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
and rdi, 0xfffffffffffff000
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_MmGetPhysicalAddress]
mov rdi, rax
test rax, rax
jne 0x140002f15
lea r8, [0x140004170]
xor edx, edx
lea ecx, [rax + 0x4d]
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
jmp 0x140002f41
call fcn.140002f70
mov rcx, rax
shr rdi, 0xc
mov bl, 1
lea rax, [rdi + rdi*2]
shl rax, 4
add rcx, rax
mov rax, rsi
shl rax, 5
xor eax, dword [rcx + 0x10]
and eax, 0x3e0
xor qword [rcx + 0x10], rax
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov al, bl
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x140003044
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x60
and qword [rbp + 0x38], 0
xorps xmm0, xmm0
and qword [rbp - 0x40], 0
mov r14, rdx
xor ebx, ebx
lea rdx, [rbp + 0x38]
movups xmmword [rbp - 0x38], xmm0
mov qword [rbp + 0x30], rbx
mov rsi, rcx
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov edi, eax
test eax, eax
jns 0x1400030a6
mov r8d, eax
lea rcx, [0x140003e80]
mov dl, 1
call fcn.140003004
mov eax, edi
jmp 0x140003158
mov rcx, qword [rbp + 0x38]
lea rdx, [rbp - 0x38]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov rcx, r14
call fcn.1400031f0
mov rdi, rax
test rax, rax
jne 0x1400030cb
mov esi, 0xc0000001
jmp 0x140003101
lea r9, [rbp + 0x30]
mov rdx, rdi
lea r8, [rbp - 0x40]
mov rcx, rsi
call fcn.140003384
mov esi, eax
test eax, eax
js 0x1400030ef
mov rcx, qword [rbp - 0x40]
call fcn.140003174
mov esi, eax
mov rbx, qword [rbp + 0x30]
test rbx, rbx
je 0x140003101
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
xor ecx, ecx
call fcn.140003174
test rbx, rbx
je 0x140003125
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x140003125
mov rax, qword [rbx + 0x18]
mov byte [rax], 0
mov byte [rbx + 0x32], 1
mov rcx, qword [rbp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
lea rcx, [rbp - 0x38]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
test rdi, rdi
je 0x140003156
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x140003156
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, esi
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x1400031f0
Capabilities:
Get file attributes
Read file on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x37]
sub rsp, 0xc0
and qword [rbp + 0x67], 0
lea r9, [rbp - 0x29]
xor eax, eax
mov qword [rbp + 0xf], rcx
and dword [rsp + 0x50], eax
lea r8, [rbp - 1]
and qword [rsp + 0x48], rax
lea rcx, [rbp + 0x67]
and dword [rsp + 0x40], eax
xorps xmm0, xmm0
and qword [rbp + 7], rax
mov edx, 0xc0000000
mov dword [rsp + 0x38], 1
mov qword [rbp + 0x6f], rax
mov qword [rbp - 9], rax
mov qword [rbp + 0x77], rax
lea rax, [rbp + 0x6f]
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], rax
movups xmmword [rbp - 0x29], xmm0
mov dword [rbp - 1], 0x30
movups xmmword [rbp - 0x19], xmm0
mov dword [rbp + 0x17], 0x40
movdqu xmmword [rbp + 0x1f], xmm0
call qword [sym.imp.ntoskrnl.exe_ZwCreateFile]
test eax, eax
jns 0x14000329d
lea rcx, [0x140004210]
mov r8d, eax
mov dl, 1
call fcn.140003004
xor eax, eax
jmp 0x14000336f
mov rcx, qword [rbp + 0x67]
lea r8, [rbp - 0x19]
mov r9d, 0x18
mov dword [rsp + 0x20], 5
lea rdx, [rbp - 0x29]
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
test eax, eax
jns 0x1400032ca
lea rcx, [0x140003d50]
jmp 0x14000328c
mov esi, dword [rbp - 0x19]
mov r8d, 0x446c6c70
add esi, 0x1000
mov ecx, 1
and esi, 0xfffff000
mov edx, esi
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov ecx, esi
xor r9d, r9d
mov r14, rax
mov rdi, rax
xor eax, eax
xor r8d, r8d
and qword [rsp + 0x40], rax
xor edx, edx
rep stosb byte [rdi], al
mov rcx, qword [rbp + 0x67]
lea rax, [rbp + 0x77]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x29]
mov dword [rsp + 0x30], esi
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
mov rcx, qword [rbp + 0x67]
lea rdx, [rbp - 0x29]
mov edi, eax
call qword [sym.imp.ntoskrnl.exe_ZwFlushBuffersFile]
test edi, edi
jns 0x140003362
xor edx, edx
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rbp + 0x67]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov r8d, edi
lea rcx, [0x140003d90]
jmp 0x14000328f
mov rcx, qword [rbp + 0x67]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rax, r14
add rsp, 0xc0
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140004220
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x47], 0
je 0x140004243
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x14]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x46
jb 0x140004230
mov byte [rcx + 0x47], 0
mov rax, rcx
ret

Function at 0x140004250
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x68], rcx
xor esi, esi
cmp byte [r8 + 6], sil
je 0x140004284
mov ecx, esi
lea eax, [rcx - 0x14]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 5
jb 0x140004270
mov byte [r8 + 6], sil
lea rax, [r8 + 5]
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x48], sil
cmp r9, rax
je 0x1400042b9
mov r8d, 5
mov rdx, r9
lea rcx, [rsp + 0x48]
call fcn.14000a560
nop
cmp byte [rbx + 0xa], 0
je 0x1400042e3
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x14]
xor byte [rcx + rbx], al
inc rcx
cmp rcx, 9
jb 0x1400042d0
mov byte [rbx + 0xa], 0
lea rax, [rbx + 9]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], 0
cmp rbx, rax
je 0x140004318
mov r8d, 9
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.14000a560
nop
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x28]
mov rcx, rdi
call fcn.14000c4e0
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x14000436c
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004366
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004366
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007d94c
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x1400043ac
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400043a7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400043a7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007d94c
mov rax, rdi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400043c0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x48], rcx
xor esi, esi
cmp byte [r8 + 7], sil
je 0x1400043f4
mov ecx, esi
lea eax, [rcx - 0x14]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 6
jb 0x1400043e0
mov byte [r8 + 7], sil
lea rax, [r8 + 6]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], sil
cmp r9, rax
je 0x140004429
mov r8d, 6
mov rdx, r9
lea rcx, [rsp + 0x28]
call fcn.14000a560
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140004437
mov rbx, qword [rbx]
mov r8, rbx
lea rcx, [rsp + 0x28]
call fcn.14000d4b0
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x1400044ac
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400044a7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400044a7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007d94c
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x1400044c0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x48], rcx
xor esi, esi
cmp byte [r8 + 0xa], sil
je 0x1400044f4
mov ecx, esi
lea eax, [rcx - 0x14]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 9
jb 0x1400044e0
mov byte [r8 + 0xa], sil
lea rax, [r8 + 9]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], sil
cmp r9, rax
je 0x140004529
mov r8d, 9
mov rdx, r9
lea rcx, [rsp + 0x28]
call fcn.14000a560
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140004537
mov rbx, qword [rbx]
mov r8, rbx
lea rcx, [rsp + 0x28]
call fcn.14000d4b0
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x1400045ac
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400045a7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400045a7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007d94c
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x1400045c0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x136], 0
je 0x1400045e8
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x14]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x135
jb 0x1400045d0
mov byte [rcx + 0x136], 0
mov rax, rcx
ret
Function at 0x140005170
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x68], rcx
xor esi, esi
cmp byte [r8 + 0xb], sil
je 0x1400051a4
mov ecx, esi
lea eax, [rcx - 0x14]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 0xa
jb 0x140005190
mov byte [r8 + 0xb], sil
lea rax, [r8 + 0xa]
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x48], sil
cmp r9, rax
je 0x1400051d9
mov r8d, 0xa
mov rdx, r9
lea rcx, [rsp + 0x48]
call fcn.14000a560
nop
cmp byte [rbx + 0xb], 0
je 0x140005203
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x14]
xor byte [rcx + rbx], al
inc rcx
cmp rcx, 0xa
jb 0x1400051f0
mov byte [rbx + 0xb], 0
lea rax, [rbx + 0xa]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], 0
cmp rbx, rax
je 0x140005238
mov r8d, 0xa
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.14000a560
nop
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x28]
mov rcx, rdi
call fcn.14000c4e0
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x14000528c
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005286
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005286
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007d94c
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x1400052cc
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400052c7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400052c7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007d94c
mov rax, rdi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400052e0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x48], rcx
xor esi, esi
cmp byte [r8 + 0xc], sil
je 0x140005314
mov ecx, esi
lea eax, [rcx - 0x14]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 0xb
jb 0x140005300
mov byte [r8 + 0xc], sil
lea rax, [r8 + 0xb]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], sil
cmp r9, rax
je 0x140005349
mov r8d, ntohl
mov rdx, r9
lea rcx, [rsp + 0x28]
call fcn.14000a560
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140005357
mov rbx, qword [rbx]
mov r8, rbx
lea rcx, [rsp + 0x28]
call fcn.14000d4b0
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x1400053cc
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400053c7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400053c7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007d94c
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x140006040
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x68], rcx
xor esi, esi
cmp byte [r8 + 0xb], sil
je 0x140006074
mov ecx, esi
lea eax, [rcx - 0x14]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 0xa
jb 0x140006060
mov byte [r8 + 0xb], sil
lea rax, [r8 + 0xa]
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x48], sil
cmp r9, rax
je 0x1400060a9
mov r8d, 0xa
mov rdx, r9
lea rcx, [rsp + 0x48]
call fcn.14000a560
nop
cmp byte [rbx + 0xe], 0
je 0x1400060d3
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x14]
xor byte [rcx + rbx], al
inc rcx
cmp rcx, 0xd
jb 0x1400060c0
mov byte [rbx + 0xe], 0
lea rax, [rbx + 0xd]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], 0
cmp rbx, rax
je 0x140006108
mov r8d, reloc.WS2_32.dll_listen
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.14000a560
nop
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x28]
mov rcx, rdi
call fcn.14000c4e0
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x14000615c
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006156
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006156
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007d94c
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x14000619c
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006197
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006197
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007d94c
mov rax, rdi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400061b0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x48], rcx
xor esi, esi
cmp byte [r8 + 6], sil
je 0x1400061e4
mov ecx, esi
lea eax, [rcx - 0x14]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 5
jb 0x1400061d0
mov byte [r8 + 6], sil
lea rax, [r8 + 5]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], sil
cmp r9, rax
je 0x140006219
mov r8d, 5
mov rdx, r9
lea rcx, [rsp + 0x28]
call fcn.14000a560
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140006227
mov rbx, qword [rbx]
mov r8, rbx
lea rcx, [rsp + 0x28]
call fcn.14000d4b0
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x14000629c
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006297
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006297
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007d94c
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret