joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14006127c
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x1400612ac
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x140061324
mov rax, qword [rcx + 0x40]
mov rsi, rbx
mov r9, qword [rax]
test r9, r9
je 0x1400612c3
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x1400612c5
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x14006131e
test ecx, ecx
jle 0x1400612fe
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x14006131e
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x14006131e
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
sub rsi, rbx
mov rax, rsi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret

Function at 0x140061340
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140061360
xor eax, eax
jmp 0x140061449
cmp qword [rcx + 0x68], 0
je 0x140061372
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
jmp 0x140061449
mov rax, qword [rcx + 0x38]
mov rdi, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140061389
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14006138b
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x1400613bd
cmp rax, rbp
mov rbx, rbp
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rbx
sub rdi, rbx
sub dword [rax], ebx
mov rcx, qword [rsi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x140061443
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x1400613f4
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
mov ebx, 0xfff
jmp 0x14006141e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rdi, rax
cmp rax, rbx
jne 0x140061443
cmp rdi, rbx
ja 0x1400613fb
test rdi, rdi
je 0x140061443
mov r9, qword [rsi + 0x80]
mov r8, rdi
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rdi, rax
sub rbp, rdi
mov rax, rbp
add rsp, 0x20
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140061824
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x140148f00]
xor rax, rsp
mov qword [rbp - 8], rax
or edi, 0xffffffff
mov esi, edx
mov rbx, rcx
cmp edx, edi
jne 0x14006185d
xor eax, eax
jmp 0x14006197d
mov rax, qword [rcx + 0x40]
cmp qword [rax], 0
je 0x140061897
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
mov rcx, r8
add rcx, qword [rax]
cmp qword [rax], rcx
jae 0x140061897
lea ecx, [r8 - 1]
mov eax, esi
mov dword [rdx], ecx
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], sil
jmp 0x14006197d
cmp qword [rbx + 0x80], 0
je 0x14006197b
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x1400618d2
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x1400618f3
movsx ecx, sil
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
cmp eax, edi
jmp 0x140061978
lea rax, [rbp - 0x40]
mov byte [rbp - 0x30], sil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rbp - 8]
mov qword [rsp + 0x30], rax
lea r9, [rbp - 0x2f]
lea rax, [rbp - 0x28]
mov qword [rsp + 0x28], rax
lea r8, [rbp - 0x30]
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140061941
sub eax, 1
je 0x140061941
cmp eax, 2
jne 0x14006197b
movsx ecx, byte [rbp - 0x30]
jmp 0x1400618df
mov r14, qword [rbp - 0x40]
lea rax, [rbp - 0x28]
sub r14, rax
je 0x14006196c
mov r9, qword [rbx + 0x80]
lea rcx, [rbp - 0x28]
mov r8, r14
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp r14, rax
jne 0x14006197b
lea rax, [rbp - 0x30]
mov byte [rbx + 0x71], 1
cmp qword [rbp - 0x38], rax
cmovne edi, esi
mov eax, edi
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14010a620
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x140062138
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x140148f00]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x1400621a7
cmp byte [rcx + 0x71], 0
je 0x1400621a7
mov rax, qword [rcx]
or edx, 0xffffffff
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x1400621fc
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400621c1
sub eax, 1
je 0x1400621c5
cmp eax, 2
jne 0x1400621fc
mov byte [rbx + 0x71], 0
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14010a620
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x1400621f3
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x1400621fc
cmp byte [rbx + 0x71], 0
sete al
jmp 0x1400621a9
xor al, al
jmp 0x1400621a9

Function at 0x1400639b8
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x140148f00]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rdx
mov rdi, rcx
mov ecx, 8
call fcn.14010a724
mov qword [rax], rbx
mov qword [rsp + 0x30], rax
lea rbx, [rdi + 8]
mov qword [rsp + 0x28], rbx
and dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x140063b44]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rdi], rax
test rax, rax
je 0x140063a2b
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14010a620
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
and dword [rbx], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x140063d1c
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140148f00]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rsi, rdx
mov rbx, rcx
mov qword [rbp - 0x30], rcx
mov eax, 0x5a4d
cmp word [rdx], ax
jne 0x140063e4e
movsxd rax, dword [rdx + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
jne 0x140063e4e
test rax, rax
je 0x140063e4e
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x28], xmm1
xor edx, edx
mov qword [rbp - 0x18], rdx
mov ecx, dword [rax + 0xb0]
test ecx, ecx
jne 0x140063da4
and qword [rbx], rdx
and qword [rbx + 8], rdx
and qword [rbx + 0x10], rdx
lea rcx, [rbp - 0x28]
call fcn.140058644
jmp 0x140063e5c
lea rdi, [rsi + rcx]
mov r14d, dword [rax + 0xb4]
add r14, rdi
mov rcx, qword [rbp - 0x20]
mov eax, dword [rdi]
test eax, eax
je 0x140063e2b
mov r8d, eax
cmp r8, r14
jae 0x140063e2b
cmp dword [rdi + 4], 0
je 0x140063e2b
lea rax, [r8 + rsi]
mov qword [rbp - 0x48], rax
lea rax, [rdi + 8]
mov qword [rbp - 0x40], rax
mov eax, dword [rdi + 4]
sub rax, 8
shr rax, 1
mov dword [rbp - 0x38], eax
cmp rcx, rdx
je 0x140063e0b
movups xmm0, xmmword [rbp - 0x48]
movups xmmword [rcx], xmm0
movsd xmm1, qword [rbp - 0x38]
movsd qword [rcx + 0x10], xmm1
mov rcx, qword [rbp - 0x20]
add rcx, 0x18
mov qword [rbp - 0x20], rcx
jmp 0x140063e1f
lea r8, [rbp - 0x48]
mov rdx, rcx
lea rcx, [rbp - 0x28]
call fcn.1400644d0
mov rcx, qword [rbp - 0x20]
mov eax, dword [rdi + 4]
add rdi, rax
mov rdx, qword [rbp - 0x18]
jmp 0x140063db6
and qword [rbp - 0x18], 0
and qword [rbp - 0x20], 0
mov rax, qword [rbp - 0x28]
and qword [rbp - 0x28], 0
mov qword [rbx], rax
mov qword [rbx + 8], rcx
mov qword [rbx + 0x10], rdx
jmp 0x140063d96
and qword [rcx], 0
and qword [rcx + 8], 0
and qword [rcx + 0x10], 0
mov rax, rbx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14010a620
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x140064c30
Capabilities:
Enumerate services
Query service configuration

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [r11 - 0x5f]
sub rsp, 0x90
mov rax, qword [0x140148f00]
xor rax, rsp
mov qword [rbp + 0x27], rax
xor ebx, ebx
lea rax, [rbp + 0x1b]
mov qword [r11 - 0x80], rbx
xor r9d, r9d
mov qword [rsp + 0x30], rax
mov r12, rcx
lea rax, [rbp + 0x17]
mov dword [rbp + 0x17], ebx
mov qword [rsp + 0x28], rax
lea edi, [rbx + 3]
lea r14d, [rbx + 0xb]
mov dword [rbp + 0x1b], ebx
mov r8d, edi
mov dword [rsp + 0x20], ebx
mov edx, r14d
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusA]
test eax, eax
jne 0x140064caf
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
je 0x140064caf
mov al, 1
jmp 0x140064d9c
mov eax, dword [rbp + 0x17]
add eax, 0x30
mov ecx, eax
mov dword [rbp + 0x17], eax
call fcn.14010aaa4
mov ecx, dword [rbp + 0x17]
mov rsi, rax
mov qword [rsp + 0x38], rbx
lea rax, [rbp + 0x1b]
mov qword [rsp + 0x30], rax
mov r9, rsi
lea rax, [rbp + 0x17]
mov r8d, edi
mov qword [rsp + 0x28], rax
mov edx, r14d
mov dword [rsp + 0x20], ecx
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusA]
test eax, eax
je 0x140064d90
mov edi, ebx
cmp dword [rbp + 0x1b], ebx
jbe 0x140064d92
mov eax, edi
mov r8d, 1
lea rcx, [rax + rax*2]
add rcx, rcx
mov rdx, qword [rsi + rcx*8]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov r14, rax
test rax, rax
je 0x140064d72
mov ecx, 0x1fa0
call fcn.14010aaa4
lea r9, [rbp + 0x1f]
mov dword [rbp + 0x1f], ebx
mov r8d, 0x1fa0
mov rdx, rax
mov rcx, r14
mov r15, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigA]
test eax, eax
je 0x140064d69
mov rcx, qword [r15 + 0x10]
lea rdx, str.iqvw64e.sys
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
jne 0x140064d7b
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
inc edi
cmp edi, dword [rbp + 0x1b]
jb 0x140064d05
jmp 0x140064d92
mov rcx, rsi
call fcn.14010a9a0
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor al, al
jmp 0x140064d9c
mov bl, 1
mov rcx, rsi
call fcn.14010a9a0
mov al, bl
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.14010a620
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x140064dc4
Capabilities:
Enumerate services

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
push rbp
lea rbp, [r11 - 0x5f]
sub rsp, 0x90
mov rax, qword [0x140148f00]
xor rax, rsp
mov qword [rbp + 0x4f], rax
xor ebx, ebx
lea rax, [rbp + 0x4b]
mov qword [r11 - 0x60], rbx
xor r9d, r9d
mov qword [r11 - 0x68], rax
mov rdi, rcx
lea rax, [rbp + 0x47]
mov dword [rbp + 0x47], ebx
mov qword [r11 - 0x70], rax
lea edx, [rbx + 0xb]
lea r8d, [rbx + 3]
mov dword [rsp + 0x20], ebx
mov dword [rbp + 0x4b], ebx
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusA]
test eax, eax
jne 0x140064e38
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
je 0x140064e38
mov al, 1
jmp 0x140064ef0
mov eax, dword [rbp + 0x47]
add eax, 0x30
mov ecx, eax
mov dword [rbp + 0x47], eax
call fcn.14010aaa4
mov r9d, dword [rbp + 0x47]
mov rsi, rax
mov qword [rsp + 0x38], rbx
lea rax, [rbp + 0x4b]
mov qword [rsp + 0x30], rax
mov edx, ntohs
lea rax, [rbp + 0x47]
mov rcx, rdi
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r9d
mov r9, rsi
lea r8d, [rdx - 8]
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusA]
test eax, eax
je 0x140064ee4
mov edi, ebx
cmp dword [rbp + 0x4b], ebx
jbe 0x140064ee6
mov eax, edi
lea rdx, [0x140136e10]
lea rcx, [rax + rax*2]
add rcx, rcx
movups xmm0, xmmword [rsi + rcx*8 + 0x10]
mov rcx, qword [rsi + rcx*8]
movups xmmword [rbp + 7], xmm0
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
je 0x140064eca
movups xmm0, xmmword [rbp + 7]
psrldq xmm0, 4
movd eax, xmm0
add eax, 0xfffffffe
test eax, 0xfffffffd
je 0x140064ed3
inc edi
cmp edi, dword [rbp + 0x4b]
jb 0x140064e8b
jmp 0x140064ee6
lea rcx, str._n_____Valorant_service_running_n
call fcn.140064be0
jmp 0x140064e31
mov bl, 1
mov rcx, rsi
call fcn.14010a9a0
mov al, bl
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.14010a620
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x1400655bc
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x140148f00]
xor rax, rsp
mov qword [rbp - 8], rax
xor ebx, ebx
lea r9, [rbp - 0x30]
and dword [rbp - 0x30], ebx
mov r14, rcx
xor r8d, r8d
xor edx, edx
lea edi, [rbx + 0xb]
mov ecx, edi
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov esi, 0xc0000004
jmp 0x14006563e
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rbp - 0x30]
xor ecx, ecx
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, dword [rbp - 0x30]
lea r9, [rbp - 0x30]
mov rdx, rax
mov ecx, edi
mov rbx, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, esi
je 0x140065602
test eax, eax
js 0x1400656fe
xor edi, edi
cmp dword [rbx], edi
jbe 0x1400656fe
and qword [rbp - 0x18], 0
xorps xmm0, xmm0
and qword [rbp - 0x10], 0
mov eax, edi
imul rsi, rax, 0x128
movups xmmword [rbp - 0x28], xmm0
movzx edx, word [rsi + rbx + 0x2e]
add rdx, 0x30
add rdx, rsi
add rdx, rbx
or r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], 0
jne 0x140065681
lea rcx, [rbp - 0x28]
call fcn.140057e48
cmp qword [r14 + 0x18], 0xf
mov rdx, r14
jbe 0x1400656a1
mov rdx, qword [r14]
cmp qword [rbp - 0x10], 0xf
lea rcx, [rbp - 0x28]
cmova rcx, qword [rbp - 0x28]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x140065732
mov rdx, qword [rbp - 0x10]
cmp rdx, 0xf
jbe 0x1400656f4
mov rcx, qword [rbp - 0x28]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400656ef
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006577a
call fcn.14010a9a0
inc edi
cmp edi, dword [rbx]
jb 0x140065654
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14010a620
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
mov rdi, qword [rsi + rbx + 0x18]
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rdx, qword [rbp - 0x10]
cmp rdx, 0xf
jbe 0x140065786
mov rcx, qword [rbp - 0x28]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140065781
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140065781
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14010a9a0
mov rax, rdi
jmp 0x140065711
Function at 0x140066190
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 7], sil
je 0x1400661c4
mov eax, esi
lea ecx, [rax - 0x6a]
xor byte [r8 + rax], cl
inc rax
cmp rax, 6
jb 0x1400661b0
mov byte [r8 + 7], sil
add r8, 6
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.140065810
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x1400661e9
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.14007a820
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140066263
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006625e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14006625e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14010a9a0
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x140066270
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 0xa], sil
je 0x1400662a4
mov eax, esi
lea ecx, [rax - 0x6a]
xor byte [r8 + rax], cl
inc rax
cmp rax, 9
jb 0x140066290
mov byte [r8 + 0xa], sil
add r8, 9
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.140065810
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x1400662c9
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.14007a820
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140066343
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006633e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14006633e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14010a9a0
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x140066350
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 0x31], sil
je 0x140066384
mov eax, esi
lea ecx, [rax - 0x6a]
xor byte [r8 + rax], cl
inc rax
cmp rax, 0x30
jb 0x140066370
mov byte [r8 + 0x31], sil
add r8, 0x30
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.140065810
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x1400663a9
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.14007a820
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140066423
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006641e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14006641e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14010a9a0
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x140066430
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 0xc], sil
je 0x140066464
mov eax, esi
lea ecx, [rax - 0x6a]
xor byte [r8 + rax], cl
inc rax
cmp rax, 0xb
jb 0x140066450
mov byte [r8 + 0xc], sil
add r8, 0xb
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.140065810
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140066489
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.14007a820
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140066503
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400664fe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400664fe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14010a9a0
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x14006dc50
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 8], al
je 0x14006dc73
lea edx, [rax - 0x6a]
xor byte [rax + rcx], dl
inc rax
cmp rax, 7
jb 0x14006dc60
mov byte [rcx + 8], 0
lea r8, [rcx + 7]
mov rdx, rcx
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.140065810
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x14006dc90
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 9], al
je 0x14006dcb3
lea edx, [rax - 0x6a]
xor byte [rax + rcx], dl
inc rax
cmp rax, 8
jb 0x14006dca0
mov byte [rcx + 9], 0
lea r8, [rcx + 8]
mov rdx, rcx
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.140065810
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x14006dcd0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 0xa], al
je 0x14006dcf3
lea edx, [rax - 0x6a]
xor byte [rax + rcx], dl
inc rax
cmp rax, 9
jb 0x14006dce0
mov byte [rcx + 0xa], 0
lea r8, [rcx + 9]
mov rdx, rcx
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.140065810
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x14006dd10
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 0x10], al
je 0x14006dd33
lea edx, [rax - 0x6a]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xf
jb 0x14006dd20
mov byte [rcx + 0x10], 0
lea r8, [rcx + 0xf]
mov rdx, rcx
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.140065810
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x14006dd50
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 0xb], al
je 0x14006dd73
lea edx, [rax - 0x6a]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xa
jb 0x14006dd60
mov byte [rcx + 0xb], 0
lea r8, [rcx + 0xa]
mov rdx, rcx
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.140065810
mov rax, rbx
add rsp, 0x30
pop rbx
ret