joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140084470
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], r8
mov qword [rax + 0x20], r9
push rbx
sub rsp, 0x40
mov rbx, qword [0x140200938]
cmp byte [rbx + 0x3050], 0
je 0x140084555
cmp qword [rbx + 0x3058], 0
mov qword [rax - 0x18], rsi
lea rsi, [rax + 0x10]
mov qword [rax - 0x20], rdi
lea rdi, [rbx + 0x3060]
je 0x14008453d
mov ecx, dword [rdi + 4]
mov qword [rax - 0x10], rbp
xor ebp, ebp
test ecx, ecx
jns 0x1400844e2
mov eax, ecx
cdq
sub eax, edx
mov edx, ebp
sar eax, 1
add eax, ecx
mov rcx, rdi
test eax, eax
cmovg edx, eax
call fcn.140092070
mov dword [rdi], ebp
mov r8, rsi
mov rdx, qword [rsp + 0x50]
mov rcx, rdi
call fcn.140091b80
mov eax, dword [rdi]
mov edx, 1
mov r9, qword [rbx + 0x3058]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rbx + 0x3068]
cmove ecx, ebp
test rax, rax
movsxd r8, ecx
lea rcx, [0x140200940]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x28]
add rsp, 0x40
pop rbx
ret
mov rdx, rcx
mov r8, rsi
mov rcx, rdi
call fcn.140091b80
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x28]
add rsp, 0x40
pop rbx
ret

Function at 0x1400898c0
Capabilities:
Hash data with crc32

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 8], rcx
push rdi
sub rsp, 0x20
mov rax, qword [0x140200938]
mov r8, rcx
mov rbx, qword [rax + 0x1be0]
add rbx, 0x108
movzx eax, r8b
lea r8, [0x140114d10]
movsxd rdx, dword [rbx]
mov r9, qword [rbx + 8]
mov edi, dword [r9 + rdx*4 - 4]
not edi
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 9]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 0xa]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 0xb]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 0xc]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 0xd]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 0xe]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 0xf]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
shr edi, 8
xor rcx, rax
xor edi, dword [r8 + rcx*4]
mov r8d, dword [rbx + 4]
not edi
cmp edx, r8d
jne 0x1400899ce
lea ecx, [rdx + 1]
test r8d, r8d
je 0x1400899b4
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
add eax, r8d
jmp 0x1400899b9
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
mov edx, ecx
mov rcx, rbx
call fcn.1400921b0
mov edx, dword [rbx]
mov r9, qword [rbx + 8]
movsxd rax, edx
mov dword [r9 + rax*4], edi
inc dword [rbx]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14008cf30
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [0x140200938]
mov rbx, rcx
xor ecx, ecx
mov dword [rax + 0x300c], ecx
test rbx, rbx
je 0x14008cf9f
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x38], rdi
call fcn.14008cfb0
lea rdx, [0x1401153cc]
mov rcx, rbx
mov rdi, rax
call fcn.1400827a0
mov rbx, rax
test rax, rax
je 0x14008cf9a
mov r8, qword [rsp + 0x30]
mov r9, rax
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret

Function at 0x140090150
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, qword [0x140200938]
cmp byte [rbx + 0x3008], 0
jne 0x1400902a3
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x14009029c
lea rdx, [0x1401153c8]
mov qword [rsp + 0x40], rdi
call fcn.1400827a0
mov rdi, rax
test rax, rax
je 0x140090297
mov qword [rsp + 0x30], rbp
mov rcx, rax
mov qword [rsp + 0x38], rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebp, eax
cmp eax, 0xffffffff
je 0x140090284
xor edx, edx
mov rcx, rdi
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140090284
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rsi, eax
cmp esi, 0xffffffff
je 0x140090284
xor r8d, r8d
mov edx, ebp
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140090284
mov rbp, rsi
cmp rsi, 0xffffffffffffffff
je 0x140090284
mov rax, qword [0x140200938]
test rax, rax
je 0x140090213
inc dword [rax + 0x3b0]
mov rdx, qword [0x140200948]
mov rcx, rbp
call qword [0x1401ffb80]
mov rsi, rax
test rax, rax
je 0x140090284
mov r9, rdi
mov r8, rbp
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rdi
cmp rax, rbp
je 0x14009024f
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
jmp 0x140090260
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rdx, rbp
mov rcx, rsi
call fcn.140084110
mov rax, qword [0x140200938]
test rax, rax
je 0x140090272
dec dword [rax + 0x3b0]
mov rdx, qword [0x140200948]
mov rcx, rsi
call qword [0x1401ffb88]
jmp 0x14009028d
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rsi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x40]
mov byte [rbx + 0x3008], 1
movss xmm0, dword [rbx + 0x300c]
xorps xmm1, xmm1
comiss xmm0, xmm1
jbe 0x1400902f4
subss xmm0, dword [rbx + 0x18]
comiss xmm1, xmm0
movss dword [rbx + 0x300c], xmm0
jb 0x1400902f4
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x1400902e3
call fcn.14008cf30
mov dword [rbx + 0x300c], 0
add rsp, 0x20
pop rbx
ret
mov byte [rbx + 0x398], 1
mov dword [rbx + 0x300c], 0
add rsp, 0x20
pop rbx
ret
Function at 0x1400b0dd0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r13
push r14
push r15
movzx r15d, dx
mov rdi, rcx
xor r13d, r13d
movabs r12, 0xb5026f5aa96619e9
lea r14, [r15 - 1]
nop dword [rax]
nop dword [rax + rax]
mov rsi, r13
mov rbp, r13
test r14, r14
je 0x1400b1004
mov r8, qword [rdi + 8]
lea ecx, [r8 + 0xff]
movabs r14, 0x38eb3ffff6d3
shl rsi, cl
add rsi, rsi
nop word [rax + rax]
mov r10, qword [rdi]
mov ecx, dword [r10]
cmp ecx, 0x138
jne 0x1400b0ea5
lea rax, [r10 + 0x10]
mov r9d, ecx
nop word [rax + rax]
mov r8d, dword [rax - 8]
xor r8d, dword [rax]
lea rax, [rax + 8]
btr r8d, 0x1f
xor r8, qword [rax - 0x10]
movzx ecx, r8b
and cl, 1
neg cl
sbb rdx, rdx
shr r8, 1
and rdx, r12
xor rdx, qword [rax + 0x4d0]
xor rdx, r8
mov qword [rax + 0x9b0], rdx
sub r9, 1
jne 0x1400b0e60
mov ecx, dword [r10]
jmp 0x1400b0f8b
cmp ecx, 0x270
jb 0x1400b0f8b
lea r11, [r10 + 0x9c8]
mov ebx, 0x9c
mov rax, qword [r11]
mov rdx, rax
lea r8, [r11 + 8]
xor rdx, qword [r8]
btr edx, 0x1f
xor rdx, rax
movzx eax, dl
and al, 1
neg al
mov rax, qword [r8]
sbb rcx, rcx
shr rdx, 1
and rcx, r12
xor rcx, qword [r11 + 0x4e0]
xor rcx, rdx
mov qword [r11 - 0x9c0], rcx
lea r11, [r8]
sub rbx, 1
jne 0x1400b0ec0
lea r11, [r10 + 0xea8]
mov ebx, 0x9b
mov rax, qword [r11]
nop dword [rax]
mov rdx, rax
lea r8, [r11 + 8]
xor rdx, qword [r8]
btr edx, 0x1f
xor rdx, rax
movzx eax, dl
and al, 1
neg al
mov rax, qword [r8]
sbb rcx, rcx
shr rdx, 1
and rcx, r12
xor rcx, qword [r11 - 0xea0]
xor rcx, rdx
mov qword [r11 - 0x9c0], rcx
lea r11, [r8]
sub rbx, 1
jne 0x1400b0f10
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 8]
btr edx, 0x1f
xor rdx, qword [r10 + 0x1380]
movzx eax, dl
and al, 1
neg al
sbb rcx, rcx
shr rdx, 1
and rcx, r12
xor rcx, qword [r10 + 0x4e0]
xor rcx, rdx
mov qword [r10 + 0x9c0], rcx
mov ecx, r13d
mov dword [r10], r13d
mov eax, ecx
mov rdx, qword [r10 + rax*8 + 8]
lea eax, [rcx + 1]
mov dword [r10], eax
mov rcx, rdx
mov rax, qword [r10 + 0x1388]
shr rcx, 0x1d
and rax, rcx
xor rdx, rax
mov rax, rdx
and rax, r14
shl rax, 0x11
xor rdx, rax
mov rax, rdx
and rax, 0xffffffffffffbf77
shl rax, 0x25
xor rdx, rax
mov rax, rdx
shr rax, 0x2b
xor rax, rdx
mov rdx, qword [rdi + 0x10]
cmp rax, rdx
ja 0x1400b0e40
mov r8, qword [rdi + 8]
lea r14, [r15 - 1]
or rsi, rax
lea ecx, [r8 + 0xff]
shl rbp, cl
add rbp, rbp
or rbp, rdx
cmp rbp, r14
jb 0x1400b0e23
xor edx, edx
mov rax, rbp
div r15
mov rcx, rax
mov r8, rdx
xor edx, edx
mov rax, rsi
div r15
cmp rax, rcx
jb 0x1400b1028
cmp r8, r14
jne 0x1400b0e10
mov rbx, qword [rsp + 0x28]
mov rax, rsi
mov rbp, qword [rsp + 0x30]
xor edx, edx
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
div r15
movzx eax, dx
pop r15
pop r14
pop r13
pop r12
ret
Function at 0x1400b2286
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, gethostname
syscall
ret
Function at 0x1400b4ea0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x40], rcx
xor esi, esi
cmp byte [r8 + 7], sil
je 0x1400b4ed4
mov eax, esi
lea ecx, [rax + 0x48]
xor byte [r8 + rax], cl
inc rax
cmp rax, 6
jb 0x1400b4ec0
mov byte [r8 + 7], sil
lea rax, [r8 + 6]
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x20], 0
cmp r9, rax
je 0x1400b4f09
mov r8d, 6
mov rdx, r9
lea rcx, [rsp + 0x20]
call fcn.14005a030
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x1400b4f17
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.14005d4e0
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x1400b4f8e
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400b4f89
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400b4f89
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401080d8
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400b4fa0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x68], rcx
xor esi, esi
cmp byte [r8 + 8], sil
je 0x1400b4fd4
mov ecx, esi
lea eax, [rcx + 0x48]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 7
jb 0x1400b4fc0
mov byte [r8 + 8], sil
lea rax, [r8 + 7]
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x48], 0
cmp r9, rax
je 0x1400b5009
mov r8d, 7
mov rdx, r9
lea rcx, [rsp + 0x48]
call fcn.14005a030
nop
cmp byte [rbx + 9], 0
je 0x1400b5033
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x48]
xor byte [rbx + rcx], al
inc rcx
cmp rcx, 8
jb 0x1400b5020
mov byte [rbx + 9], 0
lea rax, [rbx + 8]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], 0
cmp rbx, rax
je 0x1400b5068
mov r8d, 8
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.14005a030
nop
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x28]
movzx edx, byte [rsp + 0x20]
mov rcx, rdi
call fcn.1400091a0
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x1400b50c1
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400b50bb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400b50bb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401080d8
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x1400b5101
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400b50fc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400b50fc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401080d8
mov rax, rdi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400b5110
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x68], rcx
xor esi, esi
cmp byte [r8 + 9], sil
je 0x1400b5144
mov ecx, esi
lea eax, [rcx + 0x48]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 8
jb 0x1400b5130
mov byte [r8 + 9], sil
lea rax, [r8 + 8]
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x48], 0
cmp r9, rax
je 0x1400b5179
mov r8d, 8
mov rdx, r9
lea rcx, [rsp + 0x48]
call fcn.14005a030
nop
cmp byte [rbx + 9], 0
je 0x1400b51a3
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x48]
xor byte [rbx + rcx], al
inc rcx
cmp rcx, 8
jb 0x1400b5190
mov byte [rbx + 9], 0
lea rax, [rbx + 8]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], 0
cmp rbx, rax
je 0x1400b51d8
mov r8d, 8
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.14005a030
nop
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x28]
movzx edx, byte [rsp + 0x20]
mov rcx, rdi
call fcn.1400091a0
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x1400b5231
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400b522b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400b522b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401080d8
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x1400b5271
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400b526c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400b526c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401080d8
mov rax, rdi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400b5280
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x40], rcx
xor esi, esi
cmp byte [r8 + 9], sil
je 0x1400b52b4
mov eax, esi
lea ecx, [rax + 0x48]
xor byte [r8 + rax], cl
inc rax
cmp rax, 8
jb 0x1400b52a0
mov byte [r8 + 9], sil
lea rax, [r8 + 8]
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x20], 0
cmp r9, rax
je 0x1400b52e9
mov r8d, 8
mov rdx, r9
lea rcx, [rsp + 0x20]
call fcn.14005a030
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x1400b52f7
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.14005d4e0
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x1400b536e
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400b5369
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400b5369
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401080d8
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400b5380
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x68], rcx
xor esi, esi
cmp byte [r8 + 6], sil
je 0x1400b53b4
mov ecx, esi
lea eax, [rcx + 0x48]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 5
jb 0x1400b53a0
mov byte [r8 + 6], sil
lea rax, [r8 + 5]
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x48], 0
cmp r9, rax
je 0x1400b53e9
mov r8d, 5
mov rdx, r9
lea rcx, [rsp + 0x48]
call fcn.14005a030
nop
cmp byte [rbx + 0xa], 0
je 0x1400b5413
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x48]
xor byte [rbx + rcx], al
inc rcx
cmp rcx, 9
jb 0x1400b5400
mov byte [rbx + 0xa], 0
lea rax, [rbx + 9]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], 0
cmp rbx, rax
je 0x1400b5448
mov r8d, 9
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.14005a030
nop
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x28]
movzx edx, byte [rsp + 0x20]
mov rcx, rdi
call fcn.1400091a0
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x1400b54a1
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400b549b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400b549b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401080d8
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x1400b54e1
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400b54dc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400b54dc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401080d8
mov rax, rdi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400b54f0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x68], rcx
xor esi, esi
cmp byte [r8 + 9], sil
je 0x1400b5524
mov ecx, esi
lea eax, [rcx + 0x48]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 8
jb 0x1400b5510
mov byte [r8 + 9], sil
lea rax, [r8 + 8]
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x48], 0
cmp r9, rax
je 0x1400b5559
mov r8d, 8
mov rdx, r9
lea rcx, [rsp + 0x48]
call fcn.14005a030
nop
cmp byte [rbx + 0xa], 0
je 0x1400b5583
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x48]
xor byte [rbx + rcx], al
inc rcx
cmp rcx, 9
jb 0x1400b5570
mov byte [rbx + 0xa], 0
lea rax, [rbx + 9]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], 0
cmp rbx, rax
je 0x1400b55b8
mov r8d, 9
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.14005a030
nop
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x28]
movzx edx, byte [rsp + 0x20]
mov rcx, rdi
call fcn.1400091a0
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x1400b5611
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400b560b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400b560b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401080d8
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x1400b5651
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400b564c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400b564c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401080d8
mov rax, rdi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400b5660
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x40], rcx
xor esi, esi
cmp byte [r8 + 0xa], sil
je 0x1400b5694
mov eax, esi
lea ecx, [rax + 0x48]
xor byte [r8 + rax], cl
inc rax
cmp rax, 9
jb 0x1400b5680
mov byte [r8 + 0xa], sil
lea rax, [r8 + 9]
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x20], 0
cmp r9, rax
je 0x1400b56c9
mov r8d, 9
mov rdx, r9
lea rcx, [rsp + 0x20]
call fcn.14005a030
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x1400b56d7
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.14005d4e0
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x1400b574e
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400b5749
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400b5749
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401080d8
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400b5760
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x68], rcx
xor esi, esi
cmp byte [r8 + 0xc], sil
je 0x1400b5794
mov ecx, esi
lea eax, [rcx + 0x48]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 0xb
jb 0x1400b5780
mov byte [r8 + 0xc], sil
lea rax, [r8 + 0xb]
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x48], 0
cmp r9, rax
je 0x1400b57c9
mov r8d, ntohl
mov rdx, r9
lea rcx, [rsp + 0x48]
call fcn.14005a030
nop
cmp byte [rbx + 0xb], 0
je 0x1400b57f3
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x48]
xor byte [rbx + rcx], al
inc rcx
cmp rcx, 0xa
jb 0x1400b57e0
mov byte [rbx + 0xb], 0
lea rax, [rbx + 0xa]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], 0
cmp rbx, rax
je 0x1400b5828
mov r8d, 0xa
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.14005a030
nop
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x28]
movzx edx, byte [rsp + 0x20]
mov rcx, rdi
call fcn.1400091a0
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x1400b5881
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400b587b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400b587b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401080d8
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x1400b58c1
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400b58bc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400b58bc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401080d8
mov rax, rdi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400b58d0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x40], rcx
xor esi, esi
cmp byte [r8 + 0xc], sil
je 0x1400b5904
mov eax, esi
lea ecx, [rax + 0x48]
xor byte [r8 + rax], cl
inc rax
cmp rax, 0xb
jb 0x1400b58f0
mov byte [r8 + 0xc], sil
lea rax, [r8 + 0xb]
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x20], 0
cmp r9, rax
je 0x1400b5939
mov r8d, ntohl
mov rdx, r9
lea rcx, [rsp + 0x20]
call fcn.14005a030
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x1400b5947
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.14005d4e0
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x1400b59be
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400b59b9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400b59b9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401080d8
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret