joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140048d50
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
xor eax, eax
mov dword [rbp + 0x11], 0xd65ed641
mov word [rbp + 0x45], ax
mov edx, eax
mov dword [rbp + 0x15], 0xd65cd65f
mov r8d, 0x29d7
mov dword [rbp + 0x19], 0xd614d65e
mov dword [rbp + 0x1d], 0xd61fd600
mov dword [rbp + 0x21], 0xd65ed653
mov dword [rbp + 0x25], 0xd653d65a
mov dword [rbp + 0x29], 0xd642d65d
mov dword [rbp + 0x2d], 0xd65bd619
mov dword [rbp + 0x31], 0xd615d65a
mov dword [rbp + 0x35], 0xd60ad60d
mov dword [rbp + 0x39], 0xd608d60b
mov dword [rbp + 0x3d], 0xd630d611
mov dword [rbp + 0x41], 0xd625d62f
mov byte [rbp + 0x47], 1
nop
movzx ecx, dx
sub cx, r8w
xor word [rbp + rdx*2 + 0x11], cx
inc rdx
cmp rdx, 0x1a
jb 0x140048dd0
mov byte [rbp + 0x47], al
mov dword [rbp - 0x19], 0xd610d66a
mov dword [rbp - 0x15], 0xd67bd677
mov dword [rbp - 0x11], 0xd640d644
mov dword [rbp - 0xd], 0xd65fd64b
mov dword [rbp - 9], 0xd641d646
mov dword [rbp - 5], 0xd602d66f
mov dword [rbp - 1], 0xd600d603
mov dword [rbp + 3], 0xd616d601
mov dword [rbp + 7], 0xd654d649
mov dword [rbp + 0xb], 0xd65c
mov byte [rbp + 0xf], 1
nop dword [rax]
nop word [rax + rax]
movzx ecx, ax
sub cx, r8w
xor word [rbp + rax*2 - 0x19], cx
inc rax
cmp rax, 0x13
jb 0x140048e40
lea rdx, [rbp - 0x19]
mov byte [rbp + 0xf], 0
lea rcx, [rbp + 0x11]
call fcn.140048890
lea rcx, [rbp - 0x19]
call fcn.140048b70
mov rbx, qword [rsp + 0xa0]
add rsp, 0x90
pop rbp
ret
Function at 0x14004d130
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 8], 0
je 0x14004d153
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x29]
xor byte [rcx + rax], dl
inc rax
cmp rax, 7
jb 0x14004d140
mov byte [rcx + 8], 0
mov rax, rcx
ret
Function at 0x14004e720
Capabilities:
Encode data using xor
Execute command

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
movdqa xmm0, xmmword [0x1400fa5f0]
xor ebx, ebx
movdqa xmm1, xmmword [0x1400fa740]
mov ecx, ebx
movdqu xmmword [rbp - 0x30], xmm0
mov word [rbp - 0x10], 0x78
movdqu xmmword [rbp - 0x20], xmm1
mov byte [rbp - 0xe], 1
nop word [rax + rax]
lea eax, [rcx + 0x29]
xor byte [rbp + rcx - 0x30], al
inc rcx
cmp rcx, 0x21
jb 0x14004e760
lea rcx, [rbp - 0x30]
mov byte [rbp - 0xe], bl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x1400fa5d0]
mov rcx, rbx
movdqa xmm1, xmmword [0x1400fa710]
movdqu xmmword [rbp - 0x30], xmm0
mov word [rbp - 0x10], 0x78
movdqu xmmword [rbp - 0x20], xmm1
mov byte [rbp - 0xe], 1
nop dword [rax]
nop dword [rax + rax]
lea eax, [rcx + 0x29]
xor byte [rbp + rcx - 0x30], al
inc rcx
cmp rcx, 0x21
jb 0x14004e7b0
lea rcx, [rbp - 0x30]
mov byte [rbp - 0xe], bl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x1400fa5d0]
mov rcx, rbx
movdqa xmm1, xmmword [0x1400fa720]
movdqu xmmword [rbp - 0x30], xmm0
mov word [rbp - 0x10], 0x78
movdqu xmmword [rbp - 0x20], xmm1
mov byte [rbp - 0xe], 1
nop dword [rax]
nop dword [rax + rax]
lea eax, [rcx + 0x29]
xor byte [rbp + rcx - 0x30], al
inc rcx
cmp rcx, 0x21
jb 0x14004e800
lea rcx, [rbp - 0x30]
mov byte [rbp - 0xe], bl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x1400fa5d0]
mov rcx, rbx
movdqa xmm1, xmmword [0x1400fa730]
movdqu xmmword [rbp - 0x30], xmm0
mov word [rbp - 0x10], 0x78
movdqu xmmword [rbp - 0x20], xmm1
mov byte [rbp - 0xe], 1
nop dword [rax]
nop dword [rax + rax]
lea eax, [rcx + 0x29]
xor byte [rbp + rcx - 0x30], al
inc rcx
cmp rcx, 0x21
jb 0x14004e850
lea rcx, [rbp - 0x30]
mov byte [rbp - 0xe], bl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x1400fa5c0]
movdqu xmmword [rbp - 0x30], xmm0
mov dword [rbp - 0x20], 0x52051a52
mov dword [rbp - 0x1c], 0x721f5248
mov dword [rbp - 0x18], 0x72647f
mov byte [rbp - 0x14], 1
nop dword [rax]
nop word [rax + rax]
lea eax, [rbx + 0x29]
xor byte [rbp + rbx - 0x30], al
inc rbx
cmp rbx, 0x1b
jb 0x14004e8a0
lea rcx, [rbp - 0x30]
mov byte [rbp - 0x14], 0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
Function at 0x14004f430
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x65], 0
je 0x14004f453
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x29]
xor byte [rcx + rax], dl
inc rax
cmp rax, 0x64
jb 0x14004f440
mov byte [rcx + 0x65], 0
mov rax, rcx
ret

Function at 0x14004f460
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x87], 0
je 0x14004f488
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x29]
xor byte [rcx + rax], dl
inc rax
cmp rax, 0x86
jb 0x14004f470
mov byte [rcx + 0x87], 0
mov rax, rcx
ret
Function at 0x1400556c0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
mov rdx, rcx
cmp byte [rcx + 0x10], al
je 0x1400556f3
nop dword [rax]
nop word [rax + rax]
lea ecx, [rax + 0x29]
xor byte [rdx + rax], cl
inc rax
cmp rax, 0xf
jb 0x1400556e0
mov byte [rdx + 0x10], 0
lea r8, [rdx + 0xf]
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.14005a3a0
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x140055710
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
mov rdx, rcx
cmp byte [rcx + 9], al
je 0x140055743
nop dword [rax]
nop word [rax + rax]
lea ecx, [rax + 0x29]
xor byte [rdx + rax], cl
inc rax
cmp rax, 8
jb 0x140055730
mov byte [rdx + 9], 0
lea r8, [rdx + 8]
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.14005a3a0
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x140055e20
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x140055e48
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x140055e6e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140055e70
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140055ec9
test ecx, ecx
jle 0x140055ea9
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140055ec9
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140055ec9
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret
Function at 0x140055ef0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140055f21
xor eax, eax
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rcx + 0x68], 0
je 0x140055f3f
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x30], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140055f5b
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140055f5d
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140055f99
mov qword [rsp + 0x38], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x38]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x14005602e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x140055fd4
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x14005600e
nop dword [rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x14005602e
cmp rbx, rax
ja 0x140055fe0
test rbx, rbx
je 0x14005602e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
mov rsi, qword [rsp + 0x48]
sub rbp, rbx
mov rbx, qword [rsp + 0x30]
mov rax, rbp
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x140056470
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x70
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x140056494
xor eax, eax
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
mov rax, qword [rcx + 0x40]
mov rcx, qword [rax]
test rcx, rcx
je 0x1400564d7
mov rdx, qword [rbx + 0x58]
movsxd r8, dword [rdx]
lea rax, [rcx + r8]
cmp rcx, rax
jae 0x1400564d7
lea eax, [r8 - 1]
mov dword [rdx], eax
mov rcx, qword [rbx + 0x40]
mov rdx, qword [rcx]
lea rax, [rdx + 1]
mov qword [rcx], rax
mov eax, edi
mov byte [rdx], dil
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0x80], rsi
je 0x140056608
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14005651a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140056545
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmove edi, ecx
mov eax, edi
jmp 0x14005660d
lea rax, [rsp + 0x90]
mov byte [rsp + 0x40], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x41]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x40]
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400565ba
sub eax, 1
je 0x1400565ba
cmp eax, 2
jne 0x140056608
movsx ecx, byte [rsp + 0x40]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmove edi, ecx
mov eax, edi
jmp 0x14005660d
mov rsi, qword [rsp + 0x90]
lea rax, [rsp + 0x48]
sub rsi, rax
je 0x1400565eb
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x48]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x140056608
lea rax, [rsp + 0x40]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x98], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x14005660d
mov eax, 0xffffffff
mov rsi, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
Function at 0x140058310
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x50
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x1400583d9
cmp byte [rcx + 0x71], 0
je 0x1400583d9
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x68], rdi
call qword [rax + Ordinal_26]
cmp eax, 0xffffffff
je 0x1400583cc
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x60]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140058388
sub eax, 1
je 0x14005838c
cmp eax, 2
jne 0x1400583cc
mov rdi, qword [rsp + 0x68]
mov al, 1
mov byte [rbx + 0x71], 0
add rsp, 0x50
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x60]
lea rax, [rsp + 0x30]
sub rdi, rax
je 0x1400583ba
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x30]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x1400583cc
cmp byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x68]
sete al
add rsp, 0x50
pop rbx
ret
mov rdi, qword [rsp + 0x68]
xor al, al
add rsp, 0x50
pop rbx
ret
mov al, 1
add rsp, 0x50
pop rbx
ret

Function at 0x14006ba60
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 7], sil
je 0x14006ba94
mov eax, esi
lea ecx, [rax - 0x15]
xor byte [r8 + rax], cl
inc rax
cmp rax, 6
jb 0x14006ba80
mov byte [r8 + 7], sil
add r8, 6
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.14005a3a0
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x14006bab9
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.14007d220
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x14006bb33
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006bb2e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14006bb2e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400d317c
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x14006bb40
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r10, r8
mov rdi, rdx
mov rsi, rcx
mov qword [rsp + 0x28], rcx
xor ebx, ebx
cmp byte [r8 + 9], bl
je 0x14006bb74
mov ecx, ebx
lea eax, [rcx - 0x15]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 8
jb 0x14006bb60
mov byte [r8 + 9], bl
add r8, 8
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x50]
call fcn.14005a3a0
nop
cmp byte [rdi + 9], 0
je 0x14006bba4
lea eax, [rbx - 0x15]
xor byte [rdi + rbx], al
inc rbx
cmp rbx, 8
jb 0x14006bb91
mov byte [rdi + 9], 0
lea r8, [rdi + 8]
lea r9, [rsp + 0x20]
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.14005a3a0
nop
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
movzx edx, byte [rsp + 0x20]
mov rcx, rsi
call fcn.140072cd0
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x14006bc14
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006bc0e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14006bc0e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400d317c
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x14006bc54
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006bc4f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14006bc4f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400d317c
mov rax, rsi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret

Function at 0x14006bc60
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 9], sil
je 0x14006bc94
mov eax, esi
lea ecx, [rax - 0x15]
xor byte [r8 + rax], cl
inc rax
cmp rax, 8
jb 0x14006bc80
mov byte [r8 + 9], sil
add r8, 8
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.14005a3a0
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x14006bcb9
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.14007d220
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x14006bd33
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006bd2e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14006bd2e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400d317c
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x14006bd40
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 0xa], sil
je 0x14006bd74
mov eax, esi
lea ecx, [rax - 0x15]
xor byte [r8 + rax], cl
inc rax
cmp rax, 9
jb 0x14006bd60
mov byte [r8 + 0xa], sil
add r8, 9
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.14005a3a0
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x14006bd99
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.14007d220
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x14006be13
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006be0e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14006be0e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400d317c
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x14006be20
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 0x31], sil
je 0x14006be54
mov eax, esi
lea ecx, [rax - 0x15]
xor byte [r8 + rax], cl
inc rax
cmp rax, 0x30
jb 0x14006be40
mov byte [r8 + 0x31], sil
add r8, 0x30
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.14005a3a0
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x14006be79
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.14007d220
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x14006bef3
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006beee
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14006beee
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400d317c
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x14006bf00
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r10, r8
mov rdi, rdx
mov rsi, rcx
mov qword [rsp + 0x28], rcx
xor ebx, ebx
cmp byte [r8 + 0xb], bl
je 0x14006bf34
mov ecx, ebx
lea eax, [rcx - 0x15]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 0xa
jb 0x14006bf20
mov byte [r8 + 0xb], bl
add r8, 0xa
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x50]
call fcn.14005a3a0
nop
cmp byte [rdi + 0xb], 0
je 0x14006bf64
lea eax, [rbx - 0x15]
xor byte [rdi + rbx], al
inc rbx
cmp rbx, 0xa
jb 0x14006bf51
mov byte [rdi + 0xb], 0
lea r8, [rdi + 0xa]
lea r9, [rsp + 0x20]
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.14005a3a0
nop
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
movzx edx, byte [rsp + 0x20]
mov rcx, rsi
call fcn.140072cd0
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x14006bfd4
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006bfce
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14006bfce
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400d317c
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x14006c014
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006c00f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14006c00f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400d317c
mov rax, rsi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret

Function at 0x14006c020
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 0xc], sil
je 0x14006c054
mov eax, esi
lea ecx, [rax - 0x15]
xor byte [r8 + rax], cl
inc rax
cmp rax, 0xb
jb 0x14006c040
mov byte [r8 + 0xc], sil
add r8, 0xb
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.14005a3a0
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x14006c079
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.14007d220
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x14006c0f3
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006c0ee
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14006c0ee
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400d317c
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x140074200
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
mov rdx, rcx
cmp byte [rcx + 8], al
je 0x140074233
nop dword [rax]
nop word [rax + rax]
lea ecx, [rax - 0x15]
xor byte [rdx + rax], cl
inc rax
cmp rax, 7
jb 0x140074220
mov byte [rdx + 8], 0
lea r8, [rdx + 7]
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.14005a3a0
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x140075440
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 5], 0
je 0x140075463
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x15]
xor byte [rcx + rax], dl
inc rax
cmp rax, 4
jb 0x140075450
mov byte [rcx + 5], 0
mov rax, rcx
ret

Function at 0x140075470
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x136], 0
je 0x140075498
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x15]
xor byte [rcx + rax], dl
inc rax
cmp rax, 0x135
jb 0x140075480
mov byte [rcx + 0x136], 0
mov rax, rcx
ret

Function at 0x1400754a0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x32], 0
je 0x1400754c3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x15]
xor byte [rcx + rax], dl
inc rax
cmp rax, 0x31
jb 0x1400754b0
mov byte [rcx + 0x32], 0
mov rax, rcx
ret

Function at 0x1400754d0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x44], 0
je 0x1400754f3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x15]
xor byte [rcx + rax], dl
inc rax
cmp rax, 0x43
jb 0x1400754e0
mov byte [rcx + 0x44], 0
mov rax, rcx
ret

Function at 0x140075500
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x47], 0
je 0x140075523
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x15]
xor byte [rcx + rax], dl
inc rax
cmp rax, 0x46
jb 0x140075510
mov byte [rcx + 0x47], 0
mov rax, rcx
ret