joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002ac90
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x1400f559c], 1
je 0x14002acfc
mov r8, rdx
movabs r10, 0x842108421084211
xor r9d, r9d
nop dword [rax]
mov rax, r9
mul r10
mov rax, r9
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 4
mov edx, eax
shl eax, 5
sub edx, eax
movzx eax, byte [r8 + r9 + 0x1f]
mov r11d, r9d
add edx, r9d
movsxd rdx, edx
xor al, byte [r8 + rdx]
mov byte [rcx + r9], al
mov rax, r9
inc rax
mov r9, rax
cmp eax, 0x24
jne 0x14002acb0
mov dword [0x1400f559c], 1
mov eax, 0x9e950a9e
ret

Function at 0x14002ae10
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x1400f55b8], 1
je 0x14002ae4e
xor eax, eax
nop dword [rax + rax]
movzx r8d, byte [rdx + rax + 0x10]
mov r9d, eax
and r9d, 0xf
xor r8b, byte [rdx + r9]
mov byte [rcx + rax], r8b
mov r8, rax
inc r8
mov rax, r8
cmp r8d, 0x16
jne 0x14002ae20
mov dword [0x1400f55b8], 1
mov eax, 0x3ec870da
ret

Function at 0x14002ae60
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x1400f55d8], 1
je 0x14002ae9e
xor eax, eax
nop dword [rax + rax]
movzx r8d, byte [rdx + rax + 0x10]
mov r9d, eax
and r9d, 0xf
xor r8b, byte [rdx + r9]
mov byte [rcx + rax], r8b
mov r8, rax
inc r8
mov rax, r8
cmp r8d, 0x19
jne 0x14002ae70
mov dword [0x1400f55d8], 1
mov eax, 0xbbf86a82
ret

Function at 0x14002b600
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400f555c], 1
je 0x14002b67f
mov r8, rdx
movabs r10, 0x842108421084211
xor r9d, r9d
mov r11, rdx
mov esi, Ordinal_32
nop word cs:[rax + rax]
nop dword [rax]
mov rax, r9
mul r10
mov rax, r9
sub r9, rdx
shr r9, 1
add r9, rdx
shr r9, 4
mov rdx, r9
shl r9, 5
sub rdx, r9
movzx r9d, byte [r8 + rsi]
xor r9b, byte [r11 + rdx]
mov byte [rcx + rsi - 0x1f], r9b
mov rdx, rsi
inc rdx
mov rsi, rdx
inc r11
inc rax
cmp edx, 0x30
mov r9, rax
jne 0x14002b630
mov dword [0x1400f555c], 1
mov eax, 0xda12fc47
pop rsi
ret

Function at 0x14002b690
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400f5510], 1
je 0x14002b6f9
mov r8, rdx
movabs r10, 0xaaaaaaaaaaaaaaab
xor r9d, r9d
mov eax, Ordinal_27
nop
mov r11, rax
mov rsi, rdx
mov rax, r9
mul r10
shr rdx, 1
and rdx, 0xfffffffffffffff8
lea rax, [rdx + rdx*2]
neg rax
movzx edx, byte [r8 + r11]
xor dl, byte [rsi + rax]
mov byte [rcx + r11 - 0x18], dl
inc r11
mov rax, r11
mov edx, r11d
inc rsi
inc r9
cmp r11d, 0x30
mov rdx, rsi
jne 0x14002b6b0
mov dword [0x1400f5510], 1
mov eax, 0xbf626da7
pop rsi
ret

Function at 0x14002be20
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400f4754], 1
je 0x14002be8a
mov r8, rdx
movabs r10, 0xe38e38e38e38e38f
xor r9d, r9d
mov eax, reloc.WS2_32.dll_select
nop
mov r11, rax
mov rsi, rdx
mov rax, r9
mul r10
shr rdx, 3
and rdx, 0xfffffffffffffffe
lea rax, [rdx + rdx*8]
neg rax
movzx edx, byte [r8 + r11]
xor dl, byte [rsi + rax]
mov byte [rcx + r11 - 0x12], dl
inc r11
mov rax, r11
mov edx, r11d
inc rsi
inc r9
cmp r11d, 0x19
mov rdx, rsi
jne 0x14002be40
mov dword [0x1400f4754], 1
mov eax, 0x4f15b0d8
pop rsi
ret
Function at 0x14002d080
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400f4764], 1
je 0x14002d0f9
mov r8, rdx
movabs r10, 0x1a7b9611a7b9611b
xor r9d, r9d
mov r11, rdx
mov esi, Ordinal_32
nop word cs:[rax + rax]
nop dword [rax]
mov rax, r9
mul r10
mov rax, r9
sub r9, rdx
shr r9, 1
add r9, rdx
shr r9, 4
imul rdx, r9, 0xffffffffffffffe3
movzx r9d, byte [r8 + rsi]
xor r9b, byte [r11 + rdx]
mov byte [rcx + rsi - 0x1d], r9b
mov rdx, rsi
inc rdx
mov rsi, rdx
inc r11
inc rax
cmp edx, 0x21
mov r9, rax
jne 0x14002d0b0
mov dword [0x1400f4764], 1
mov eax, 0xd67b12ed
pop rsi
ret

Function at 0x14002d100
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x1400f4770], 1
je 0x14002d137
xor eax, eax
nop dword [rax + rax]
movzx r8d, byte [rdx + rax + 0x10]
xor r8b, byte [rdx + rax]
mov byte [rcx + rax], r8b
mov r8, rax
inc r8
mov rax, r8
cmp r8d, 5
jne 0x14002d110
mov dword [0x1400f4770], 1
mov eax, 0xdda9f232
ret

Function at 0x14002d600
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400f4748], 1
je 0x14002d663
mov r8, rdx
movabs r10, 0x97b425ed097b425f
xor r9d, r9d
mov eax, reloc.WLDAP32.dll_Ordinal_27
nop
mov r11, rax
mov rsi, rdx
mov rax, r9
mul r10
shr rdx, 4
imul rax, rdx, 0xffffffffffffffe5
movzx edx, byte [r8 + r11]
xor dl, byte [rsi + rax]
mov byte [rcx + r11 - 0x1b], dl
inc r11
mov rax, r11
mov edx, r11d
inc rsi
inc r9
cmp r11d, 0x23
mov rdx, rsi
jne 0x14002d620
mov dword [0x1400f4748], 1
mov eax, 0x1bd89df9
pop rsi
ret

Function at 0x14002dbd0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400f473c], 1
je 0x14002dc49
mov r8, rdx
movabs r10, 0x47ae147ae147ae15
xor r9d, r9d
mov r11, rdx
mov esi, Ordinal_27
nop word cs:[rax + rax]
nop dword [rax]
mov rax, r9
mul r10
mov rax, r9
sub r9, rdx
shr r9, 1
add r9, rdx
shr r9, 4
imul rdx, r9, 0xffffffffffffffe7
movzx r9d, byte [r8 + rsi]
xor r9b, byte [r11 + rdx]
mov byte [rcx + rsi - 0x19], r9b
mov rdx, rsi
inc rdx
mov rsi, rdx
inc r11
inc rax
cmp edx, 0x27
mov r9, rax
jne 0x14002dc00
mov dword [0x1400f473c], 1
mov eax, 0x73a582e7
pop rsi
ret

Function at 0x14002dc50
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400f4728], 1
je 0x14002dcb9
mov r8, rdx
movabs r10, 0xaaaaaaaaaaaaaaab
xor r9d, r9d
mov eax, Ordinal_27
nop
mov r11, rax
mov rsi, rdx
mov rax, r9
mul r10
shr rdx, 1
and rdx, 0xfffffffffffffff8
lea rax, [rdx + rdx*2]
neg rax
movzx edx, byte [r8 + r11]
xor dl, byte [rsi + rax]
mov byte [rcx + r11 - 0x18], dl
inc r11
mov rax, r11
mov edx, r11d
inc rsi
inc r9
cmp r11d, 0x1f
mov rdx, rsi
jne 0x14002dc70
mov dword [0x1400f4728], 1
mov eax, 0x59a74b4f
pop rsi
ret
Function at 0x14002e990
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x1400f4544], 1
je 0x14002e9e2
xor eax, eax
nop dword [rax + rax]
mov r8d, eax
mov r9d, eax
imul r9, r9, 0x51eb851f
shr r9, 0x23
imul r9d, r9d, 0xffffffe7
movzx r10d, byte [rdx + rax + 0x19]
add r9d, eax
movsxd r8, r9d
xor r10b, byte [rdx + r8]
mov byte [rcx + rax], r10b
mov r8, rax
inc r8
mov rax, r8
cmp r8d, 0x3f
jne 0x14002e9a0
mov dword [0x1400f4544], 1
mov eax, 0x5a096ee5
ret
Function at 0x14003c120
Capabilities:
Execute command

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0xa0
mov rax, qword [0x1400c6080]
xor rax, rsp
mov qword [rsp + 0x98], rax
mov rdi, rcx
mov qword [rsp + 0x90], rcx
mov rcx, qword [rcx + 0x10]
movabs rax, 0x7fffffffffffffff
sub rax, rcx
cmp rax, 0x2d
jb 0x14003c36b
mov rax, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x14003c172
mov rax, qword [rdi]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], reloc.WLDAP32.dll_Ordinal_45
lea r9, str.start_cmd__C__color_b__title_Error__echo
mov r8, rdi
movzx edx, byte [rsp + 0x40]
lea rcx, [rsp + 0x68]
call fcn.14002fe00
nop
mov rcx, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x80]
mov rax, rdx
sub rax, rcx
cmp rax, 0x11
jb 0x14003c1f3
lea rax, [rcx + 0x11]
mov qword [rsp + 0x78], rax
lea rbx, [rsp + 0x68]
cmp rdx, 0xf
cmova rbx, qword [rsp + 0x68]
add rbx, rcx
mov r8d, reloc.WS2_32.dll_recvfrom
lea rdx, str.__timeout__t_5_
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x11], 0
lea rax, [rsp + 0x68]
jmp 0x14003c214
mov qword [rsp + 0x20], reloc.WS2_32.dll_recvfrom
lea r9, str.__timeout__t_5_
xor r8d, r8d
lea edx, [r8 + 0x11]
lea rcx, [rsp + 0x68]
call fcn.140040020
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x58], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x58], xmm1
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rcx, [rsp + 0x48]
cmp qword [rsp + 0x60], 0xf
cmova rcx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rsp + 0x60]
cmp rdx, 0xf
jbe 0x14003c2a0
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003c29b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003c29b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14004f7d8
movdqa xmm0, xmmword [0x14009eab0]
movdqu xmmword [rsp + 0x58], xmm0
mov byte [rsp + 0x48], 0
mov rdx, qword [rsp + 0x80]
cmp rdx, 0xf
jbe 0x14003c2f6
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003c2f1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003c2f1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14004f7d8
xor ecx, ecx
int 0x29
mov rdx, qword [rdi + 0x18]
cmp rdx, 0xf
jbe 0x14003c330
inc rdx
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x14003c32b
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14003c364
mov rcx, r8
call fcn.14004f7d8
mov qword [rdi + 0x10], 0
mov qword [rdi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rdi], 0
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.14004fa00
mov rbx, qword [rsp + 0xb8]
add rsp, 0xa0
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.140001e60
nop
int3
Function at 0x14003c380
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x47], 0
je 0x14003c3a3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x6a]
xor byte [rcx + rax], dl
inc rax
cmp rax, 0x46
jb 0x14003c390
mov byte [rcx + 0x47], 0
mov rax, rcx
ret

Function at 0x14003c4e0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 7], sil
je 0x14003c514
mov eax, esi
lea ecx, [rax - 0x6a]
xor byte [r8 + rax], cl
inc rax
cmp rax, 6
jb 0x14003c500
mov byte [r8 + 7], sil
add r8, 6
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.14003c3b0
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x14003c539
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140030320
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x14003c5b3
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003c5ae
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003c5ae
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14004f7d8
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x14003c5c0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
mov rdx, rcx
cmp byte [rcx + 9], al
je 0x14003c5f3
nop dword [rax]
nop word [rax + rax]
lea ecx, [rax - 0x6a]
xor byte [rdx + rax], cl
inc rax
cmp rax, 8
jb 0x14003c5e0
mov byte [rdx + 9], 0
lea r8, [rdx + 8]
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.14003c3b0
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x14003c610
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 9], sil
je 0x14003c644
mov eax, esi
lea ecx, [rax - 0x6a]
xor byte [r8 + rax], cl
inc rax
cmp rax, 8
jb 0x14003c630
mov byte [r8 + 9], sil
add r8, 8
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.14003c3b0
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x14003c669
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140030320
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x14003c6e3
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003c6de
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003c6de
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14004f7d8
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x14003c6f0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 0xa], sil
je 0x14003c724
mov eax, esi
lea ecx, [rax - 0x6a]
xor byte [r8 + rax], cl
inc rax
cmp rax, 9
jb 0x14003c710
mov byte [r8 + 0xa], sil
add r8, 9
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.14003c3b0
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x14003c749
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140030320
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x14003c7c3
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003c7be
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003c7be
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14004f7d8
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x14003c8d0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x32], 0
je 0x14003c8f3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x6a]
xor byte [rcx + rax], dl
inc rax
cmp rax, 0x31
jb 0x14003c8e0
mov byte [rcx + 0x32], 0
mov rax, rcx
ret
Function at 0x14003cbb0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
mov rdx, rcx
cmp byte [rcx + 0x10], al
je 0x14003cbe3
nop dword [rax]
nop word [rax + rax]
lea ecx, [rax - 0x6a]
xor byte [rdx + rax], cl
inc rax
cmp rax, 0xf
jb 0x14003cbd0
mov byte [rdx + 0x10], 0
lea r8, [rdx + 0xf]
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.14003c3b0
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x14003cc00
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 0x31], sil
je 0x14003cc34
mov eax, esi
lea ecx, [rax - 0x6a]
xor byte [r8 + rax], cl
inc rax
cmp rax, 0x30
jb 0x14003cc20
mov byte [r8 + 0x31], sil
add r8, 0x30
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.14003c3b0
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x14003cc59
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140030320
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x14003ccd3
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003ccce
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003ccce
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14004f7d8
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x14003cce0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 8], 0
je 0x14003cd03
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x6a]
xor byte [rcx + rax], dl
inc rax
cmp rax, 7
jb 0x14003ccf0
mov byte [rcx + 8], 0
mov rax, rcx
ret

Function at 0x14003cd10
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
mov rdx, rcx
cmp byte [rcx + 8], al
je 0x14003cd43
nop dword [rax]
nop word [rax + rax]
lea ecx, [rax - 0x6a]
xor byte [rdx + rax], cl
inc rax
cmp rax, 7
jb 0x14003cd30
mov byte [rdx + 8], 0
lea r8, [rdx + 7]
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.14003c3b0
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x14003cd60
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x44], 0
je 0x14003cd83
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x6a]
xor byte [rcx + rax], dl
inc rax
cmp rax, 0x43
jb 0x14003cd70
mov byte [rcx + 0x44], 0
mov rax, rcx
ret

Function at 0x14003da40
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x136], 0
je 0x14003da68
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x6a]
xor byte [rcx + rax], dl
inc rax
cmp rax, 0x135
jb 0x14003da50
mov byte [rcx + 0x136], 0
mov rax, rcx
ret
Function at 0x14003da70
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 5], 0
je 0x14003da93
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x6a]
xor byte [rcx + rax], dl
inc rax
cmp rax, 4
jb 0x14003da80
mov byte [rcx + 5], 0
mov rax, rcx
ret

Function at 0x14003dd60
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r10, r8
mov rdi, rdx
mov rsi, rcx
mov qword [rsp + 0x28], rcx
xor ebx, ebx
cmp byte [r8 + 0xb], bl
je 0x14003dd94
mov ecx, ebx
lea eax, [rcx - 0x6a]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 0xa
jb 0x14003dd80
mov byte [r8 + 0xb], bl
add r8, 0xa
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x50]
call fcn.14003c3b0
nop
cmp byte [rdi + 0xb], 0
je 0x14003ddc4
lea eax, [rbx - 0x6a]
xor byte [rdi + rbx], al
inc rbx
cmp rbx, 0xa
jb 0x14003ddb1
mov byte [rdi + 0xb], 0
lea r8, [rdi + 0xa]
lea r9, [rsp + 0x20]
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.14003c3b0
nop
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
movzx edx, byte [rsp + 0x20]
mov rcx, rsi
call fcn.14002ff20
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x14003de34
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003de2e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003de2e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14004f7d8
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x14003de74
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003de6f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003de6f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14004f7d8
mov rax, rsi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret

Function at 0x14003de80
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 0xc], sil
je 0x14003deb4
mov eax, esi
lea ecx, [rax - 0x6a]
xor byte [r8 + rax], cl
inc rax
cmp rax, 0xb
jb 0x14003dea0
mov byte [r8 + 0xc], sil
add r8, 0xb
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.14003c3b0
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x14003ded9
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140030320
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x14003df53
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003df4e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003df4e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14004f7d8
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x14003e090
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 8], sil
je 0x14003e0c4
mov eax, esi
lea ecx, [rax - 0x6a]
xor byte [r8 + rax], cl
inc rax
cmp rax, 7
jb 0x14003e0b0
mov byte [r8 + 8], sil
add r8, 7
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.14003c3b0
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x14003e0e9
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140030320
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x14003e163
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003e15e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003e15e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14004f7d8
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x14003e170
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 6], sil
je 0x14003e1a4
mov eax, esi
lea ecx, [rax - 0x6a]
xor byte [r8 + rax], cl
inc rax
cmp rax, 5
jb 0x14003e190
mov byte [r8 + 6], sil
add r8, 5
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.14003c3b0
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x14003e1c9
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140030320
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x14003e243
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003e23e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003e23e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14004f7d8
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret