joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14005effc
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movdqu xmm1, xmmword [rcx]
mov r9d, 4
shl edx, 2
mov r8, rcx
movdqu xmm0, xmmword [rcx + rdx*4]
movdqu xmmword [rcx], xmm0
movdqu xmmword [rcx + rdx*4], xmm1
add edx, 0xfffffffc
cmp edx, r9d
jbe 0x14005f04b
aesimc xmm0, xmmword [r8 + rdx*4]
mov ecx, r9d
add r9d, 4
aesimc xmm1, xmmword [r8 + rcx*4]
movdqu xmmword [r8 + rcx*4], xmm0
movdqu xmmword [r8 + rdx*4], xmm1
add edx, 0xfffffffc
cmp r9d, edx
jb 0x14005f022
mov eax, r9d
aesimc xmm0, xmmword [r8 + rax*4]
movdqu xmmword [r8 + rax*4], xmm0
ret

Function at 0x14005f3ec
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x14005f426
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x14005f42b
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x14005f474
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x14006e250]
cmp byte [rcx + rax], 0
je 0x14005f474
dec r8
sub rdx, 1
jne 0x14005f45a
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x140060cfc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140060d46
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140060d46
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140060d46
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140060d46
cmp dword [rcx + 0x84], 0xe
jbe 0x140060d46
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140060d48
xor al, al
add rsp, 0x28
ret
Function at 0x14013fdc4
Capabilities:
Encode data using xor

Disassembly:
push 0x5f303187
lea rsp, [rsp + 0x20]
je 0x140132481
mov r10d, 0x3d999a21
inc r10d
push r8
movsx r8d, r10b
lea r10, [0x140137680]
mov r8d, 0xdd39cf1d
movzx r8d, byte [r9]
push 0x6abb42ab
xor r8d, edx
and r8d, 0xff
push 0x1a17041c
mov r8d, dword [r10 + r8*4]
shr edx, 8
xor edx, r8d
inc r9
xor edx, 0xd4a98535
dec rcx
not dword [rsp + 7]
lea rsp, [rsp + 0x10]
jne 0x14013242f
push 0xffffffffdea739be
mov r8, qword [rsp + 8]
lea rsp, [rsp + 0x10]
call fcn.140161e8d
jmp 0x140132409

Function at 0x14015c18b
Capabilities:
Encode data using xor

Disassembly:
not edx
mov dword [rdi], edx
jmp 0x14014b17b
call fcn.14014ebdf
xor edx, edx
test rax, rax
lea rsp, [rsp + 8]
je 0x14015c1ea
lea r10, [0x14014a828]
mov r11d, 0xcb91fc18
movzx r11d, byte [r8]
xor r11d, edx
push 0xffffffff9e1b3f94
and r11d, 0xff
push 0xffffffff81330e8d
mov r11d, dword [r10 + r11*4]
push 0x6c2ae686
shr edx, 8
xor edx, r11d
inc r8
inc byte [rsp + 0x15]
xor edx, 0x933f7390
dec rax
lea rsp, [rsp + 0x18]
jne 0x14015c1a2
jmp 0x140136c03
Function at 0x140001550
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
sub rsp, 0x40
mov rax, qword [0x140012008]
xor rax, rsp
mov qword [rsp + 0x30], rax
call fcn.140001770
mov ecx, dword [0x1400109a0]
mov rbx, rax
movsd xmm0, qword [str.qwerdxfdfiop]
mov edi, 0x927f
mov dword [rsp + 0x28], ecx
movzx ecx, byte [0x1400109a4]
mov byte [rsp + 0x2c], cl
movsd qword [rsp + 0x20], xmm0
test rax, rax
je 0x1400016cf
mov ecx, edi
mov qword [rsp + 0x50], rsi
call fcn.140005c04
mov ecx, edi
mov rsi, rax
call fcn.140005c04
mov rbp, rax
lea rdx, [rsi + 0x927e]
mov r8d, edi
nop word [rax + rax]
movzx ecx, byte [rbx]
lea rbx, [rbx + 1]
mov byte [rdx], cl
lea rdx, [rdx - 1]
sub r8, 1
jne 0x1400015d0
mov r9, rsi
nop word [rax + rax]
mov eax, 0x38e38e39
lea r9, [r9 + 1]
mul r8d
mov ecx, r8d
shr edx, 1
lea eax, [rdx + rdx*8]
sub ecx, eax
movsxd rax, ecx
movzx ecx, byte [rsp + rax + 0x20]
xor cl, byte [r9 - 1]
xor cl, r8b
inc r8d
mov byte [r9 - 1], cl
cmp r8d, edi
jl 0x1400015f0
movdqa xmm2, xmmword [str._n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n]
lea rax, [rsi + 0x20]
mov ecx, 0x249
movdqu xmm0, xmmword [rax - 0x20]
lea rax, [rax + 0x40]
movdqa xmm1, xmm2
paddb xmm1, xmm0
movdqu xmmword [rax - 0x60], xmm1
movdqu xmm0, xmmword [rax - 0x50]
paddb xmm0, xmm2
movdqu xmmword [rax - 0x50], xmm0
movdqu xmm1, xmmword [rax - 0x40]
paddb xmm1, xmm2
movdqu xmmword [rax - 0x40], xmm1
movdqu xmm0, xmmword [rax - 0x30]
paddb xmm0, xmm2
movdqu xmmword [rax - 0x30], xmm0
sub rcx, 1
jne 0x140001632
lea rax, [rsi + 0x9240]
mov ecx, 0x3f
nop dword [rax]
nop dword [rax + rax]
add byte [rax], 0xa
lea rax, [rax + 1]
sub rcx, 1
jne 0x140001690
mov ecx, 0x927e
mov rdx, rbp
nop word [rax + rax]
movzx eax, byte [rcx + rsi]
sub rcx, 1
mov byte [rdx], al
lea rdx, [rdx + 1]
jns 0x1400016b0
mov rcx, rsi
call fcn.140005bfc
mov rsi, qword [rsp + 0x50]
jmp 0x1400016d5
xor r8d, r8d
mov ebp, r8d
mov ecx, 0x124ff
call fcn.140005c04
mov rbx, rax
mov r9, rbp
mov r8, rax
mov r10d, 0x37
nop
movzx ecx, byte [r9]
mov eax, 0x30
movzx edx, cl
and cl, 0xf
shr dl, 4
cmp dl, 9
cmova eax, r10d
add al, dl
mov byte [r8], al
cmp cl, 9
ja 0x140001718
add cl, 0x30
jmp 0x14000171b
add cl, r10b
mov byte [r8 + 1], cl
inc r9
add r8, 2
sub rdi, 1
jne 0x1400016f0
mov rcx, rbp
call fcn.140005bfc
mov rcx, rbx
mov byte [rbx + 0x124fe], dil
call fcn.140001070
xor eax, eax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140005a60
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x140006500
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x50
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor edi, edi
cmp byte [r8 + 7], dil
je 0x140006531
mov eax, edi
nop dword [rax]
xor byte [r8 + rax], al
inc rax
cmp rax, 6
jb 0x140006520
mov byte [r8 + 7], dil
lea rax, [r8 + 6]
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x14000655e
mov qword [rsp + 0x30], rdi
mov byte [rsp + 0x20], dil
jmp 0x14000657d
mov qword [rsp + 0x30], 6
mov eax, dword [r8]
mov dword [rsp + 0x20], eax
movzx eax, word [r8 + 4]
mov word [rsp + 0x24], ax
mov byte [rsp + 0x26], dil
mov r9, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x14000658b
mov rdx, qword [rdx]
mov r8, rdx
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.140013fe0
mov qword [rbx], rdi
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x140006602
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400065fd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400065fd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400691fc
mov rax, rbx
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret

Function at 0x140006610
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x50
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor edi, edi
cmp byte [r8 + 9], dil
je 0x140006641
mov eax, edi
nop dword [rax]
xor byte [r8 + rax], al
inc rax
cmp rax, 8
jb 0x140006630
mov byte [r8 + 9], dil
lea rax, [r8 + 8]
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x14000666e
mov qword [rsp + 0x30], rdi
mov byte [rsp + 0x20], dil
jmp 0x140006684
mov qword [rsp + 0x30], 8
mov rax, qword [r8]
mov qword [rsp + 0x20], rax
mov byte [rsp + 0x28], dil
mov r9, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x140006692
mov rdx, qword [rdx]
mov r8, rdx
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.140013fe0
mov qword [rbx], rdi
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x140006709
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006704
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006704
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400691fc
mov rax, rbx
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x140006720
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rbx, rcx
mov qword [rbp - 0x10], rcx
xor ecx, ecx
cmp byte [r8 + 6], cl
je 0x140006752
mov eax, ecx
xor byte [r8 + rax], al
inc rax
cmp rax, 5
jb 0x140006741
mov byte [r8 + 6], cl
lea rax, [r8 + 5]
mov qword [rbp - 0x38], rcx
mov qword [rbp - 0x28], rcx
mov qword [rbp - 0x20], rcx
mov qword [rbp - 0x20], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x140006778
mov qword [rbp - 0x28], rcx
mov byte [rbp - 0x38], cl
jmp 0x140006791
mov qword [rbp - 0x28], 5
mov eax, dword [r8]
mov dword [rbp - 0x38], eax
movzx eax, byte [r8 + 4]
mov byte [rbp - 0x34], al
mov byte [rbp - 0x33], cl
cmp byte [rdx + 0xa], 0
je 0x1400067b0
mov rax, rcx
nop word [rax + rax]
xor byte [rdx + rax], al
inc rax
cmp rax, 9
jb 0x1400067a0
mov byte [rdx + 0xa], 0
lea rax, [rdx + 9]
mov qword [rbp - 0x58], rcx
mov qword [rbp - 0x48], rcx
mov qword [rbp - 0x40], rcx
mov qword [rbp - 0x40], reloc.WS2_32.dll_ntohs
cmp rdx, rax
jne 0x1400067d7
mov qword [rbp - 0x48], rcx
mov byte [rbp - 0x58], 0
jmp 0x1400067f3
mov qword [rbp - 0x48], 9
movsd xmm0, qword [rdx]
movsd qword [rbp - 0x58], xmm0
movzx eax, byte [rdx + 8]
mov byte [rbp - 0x50], al
mov byte [rbp - 0x4f], 0
lea r9, [rbp - 0x38]
lea r8, [rbp - 0x58]
movzx edx, byte [rbp - 0x60]
mov rcx, rbx
call fcn.14000cb70
nop
mov rdx, qword [rbp - 0x40]
cmp rdx, 0x10
jb 0x140006847
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006841
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006841
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400691fc
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x140006885
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006880
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006880
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400691fc
mov rax, rbx
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rbp
ret
Function at 0x1400068a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rbx, rcx
mov qword [rbp - 0x10], rcx
xor ecx, ecx
cmp byte [r8 + 9], cl
je 0x1400068d2
mov eax, ecx
xor byte [r8 + rax], al
inc rax
cmp rax, 8
jb 0x1400068c1
mov byte [r8 + 9], cl
lea rax, [r8 + 8]
mov qword [rbp - 0x38], rcx
mov qword [rbp - 0x28], rcx
mov qword [rbp - 0x20], rcx
mov qword [rbp - 0x20], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x1400068f8
mov qword [rbp - 0x28], rcx
mov byte [rbp - 0x38], cl
jmp 0x14000690a
mov qword [rbp - 0x28], 8
mov rax, qword [r8]
mov qword [rbp - 0x38], rax
mov byte [rbp - 0x30], cl
cmp byte [rdx + 0xa], 0
je 0x140006923
mov rax, rcx
xor byte [rdx + rax], al
inc rax
cmp rax, 9
jb 0x140006913
mov byte [rdx + 0xa], 0
lea rax, [rdx + 9]
mov qword [rbp - 0x58], rcx
mov qword [rbp - 0x48], rcx
mov qword [rbp - 0x40], rcx
mov qword [rbp - 0x40], reloc.WS2_32.dll_ntohs
cmp rdx, rax
jne 0x14000694a
mov qword [rbp - 0x48], rcx
mov byte [rbp - 0x58], 0
jmp 0x140006966
mov qword [rbp - 0x48], 9
movsd xmm0, qword [rdx]
movsd qword [rbp - 0x58], xmm0
movzx eax, byte [rdx + 8]
mov byte [rbp - 0x50], al
mov byte [rbp - 0x4f], 0
lea r9, [rbp - 0x38]
lea r8, [rbp - 0x58]
movzx edx, byte [rbp - 0x60]
mov rcx, rbx
call fcn.14000cb70
nop
mov rdx, qword [rbp - 0x40]
cmp rdx, 0x10
jb 0x1400069ba
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400069b4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400069b4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400691fc
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x1400069f8
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400069f3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400069f3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400691fc
mov rax, rbx
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rbp
ret
Function at 0x140006a10
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x50
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor edi, edi
cmp byte [r8 + 0xa], dil
je 0x140006a41
mov eax, edi
nop dword [rax]
xor byte [r8 + rax], al
inc rax
cmp rax, 9
jb 0x140006a30
mov byte [r8 + 0xa], dil
lea rax, [r8 + 9]
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x140006a6e
mov qword [rsp + 0x30], rdi
mov byte [rsp + 0x20], dil
jmp 0x140006a90
mov qword [rsp + 0x30], 9
movsd xmm0, qword [r8]
movsd qword [rsp + 0x20], xmm0
movzx eax, byte [r8 + 8]
mov byte [rsp + 0x28], al
mov byte [rsp + 0x29], dil
mov r9, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x140006a9e
mov rdx, qword [rdx]
mov r8, rdx
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.140013fe0
mov qword [rbx], rdi
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x140006b15
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006b10
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006b10
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400691fc
mov rax, rbx
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x140006b30
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x50
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor edi, edi
cmp byte [r8 + 0xc], dil
je 0x140006b61
mov eax, edi
nop dword [rax]
xor byte [r8 + rax], al
inc rax
cmp rax, 0xb
jb 0x140006b50
mov byte [r8 + 0xc], dil
lea rax, [r8 + 0xb]
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x140006b8e
mov qword [rsp + 0x30], rdi
mov byte [rsp + 0x20], dil
jmp 0x140006bba
mov qword [rsp + 0x30], ntohl
movsd xmm0, qword [r8]
movsd qword [rsp + 0x20], xmm0
movzx eax, word [r8 + 8]
mov word [rsp + 0x28], ax
movzx eax, byte [r8 + 0xa]
mov byte [rsp + 0x2a], al
mov byte [rsp + 0x2b], dil
mov r9, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x140006bc8
mov rdx, qword [rdx]
mov r8, rdx
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.140013fe0
mov qword [rbx], rdi
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x140006c3f
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006c3a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006c3a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400691fc
mov rax, rbx
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x140006c50
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rbx, rcx
mov qword [rbp - 0x10], rcx
xor ecx, ecx
cmp byte [r8 + 6], cl
je 0x140006c82
mov eax, ecx
xor byte [r8 + rax], al
inc rax
cmp rax, 5
jb 0x140006c71
mov byte [r8 + 6], cl
lea rax, [r8 + 5]
mov qword [rbp - 0x38], rcx
mov qword [rbp - 0x28], rcx
mov qword [rbp - 0x20], rcx
mov qword [rbp - 0x20], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x140006ca8
mov qword [rbp - 0x28], rcx
mov byte [rbp - 0x38], cl
jmp 0x140006cc1
mov qword [rbp - 0x28], 5
mov eax, dword [r8]
mov dword [rbp - 0x38], eax
movzx eax, byte [r8 + 4]
mov byte [rbp - 0x34], al
mov byte [rbp - 0x33], cl
cmp byte [rdx + 0xd], 0
je 0x140006ce0
mov rax, rcx
nop word [rax + rax]
xor byte [rdx + rax], al
inc rax
cmp rax, 0xc
jb 0x140006cd0
mov byte [rdx + 0xd], 0
lea rax, [rdx + 0xc]
mov qword [rbp - 0x58], rcx
mov qword [rbp - 0x48], rcx
mov qword [rbp - 0x40], rcx
mov qword [rbp - 0x40], reloc.WS2_32.dll_ntohs
cmp rdx, rax
jne 0x140006d07
mov qword [rbp - 0x48], rcx
mov byte [rbp - 0x58], 0
jmp 0x140006d22
mov qword [rbp - 0x48], ntohl
movsd xmm0, qword [rdx]
movsd qword [rbp - 0x58], xmm0
mov eax, dword [rdx + 8]
mov dword [rbp - 0x50], eax
mov byte [rbp - 0x4c], 0
lea r9, [rbp - 0x38]
lea r8, [rbp - 0x58]
movzx edx, byte [rbp - 0x60]
mov rcx, rbx
call fcn.14000cb70
nop
mov rdx, qword [rbp - 0x40]
cmp rdx, 0x10
jb 0x140006d76
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006d70
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006d70
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400691fc
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x140006db4
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006daf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006daf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400691fc
mov rax, rbx
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rbp
ret

Function at 0x14000dd10
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 9], al
je 0x14000dd30
xor byte [rax + rcx], al
inc rax
cmp rax, 8
jb 0x14000dd20
mov byte [rcx + 9], 0
lea r8, [rcx + 8]
mov rdx, rcx
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.1400060c0
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x14000f250
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x136], 0
je 0x14000f275
xor eax, eax
nop dword [rax + rax]
xor byte [rax + rcx], al
inc rax
cmp rax, 0x135
jb 0x14000f260
mov byte [rcx + 0x136], 0
mov rax, rcx
ret

Function at 0x14000f280
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x44], 0
je 0x14000f2a0
xor eax, eax
nop dword [rax + rax]
xor byte [rax + rcx], al
inc rax
cmp rax, 0x43
jb 0x14000f290
mov byte [rcx + 0x44], 0
mov rax, rcx
ret
Function at 0x14000f2b0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x47], 0
je 0x14000f2d0
xor eax, eax
nop dword [rax + rax]
xor byte [rax + rcx], al
inc rax
cmp rax, 0x46
jb 0x14000f2c0
mov byte [rcx + 0x47], 0
mov rax, rcx
ret
Function at 0x140015690
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1400868c0]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, rdx
mov rsi, rcx
mov qword [rbp - 0x18], rdx
xor edi, edi
mov dword [rbp - 0x50], 0x60617473
mov dword [rbp - 0x4c], 0x757661
mov byte [rbp - 0x48], 1
mov eax, edi
nop dword [rax]
xor byte [rbp + rax - 0x50], al
inc rax
cmp rax, 7
jb 0x1400156d0
mov byte [rbp - 0x48], 0
mov qword [rbp - 0x40], rdi
mov qword [rbp - 0x30], 7
mov ecx, reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x28], rcx
mov eax, dword [rbp - 0x50]
mov dword [rbp - 0x40], eax
movzx eax, word [rbp - 0x4c]
mov word [rbp - 0x3c], ax
movzx eax, byte [rbp - 0x4a]
mov byte [rbp - 0x3a], al
mov byte [rbp - 0x39], 0
cmp byte [rdx], 0
jne 0x140015724
mov byte [rdx], 1
call fcn.140008940
mov qword [rbx + 8], rax
mov rcx, qword [rbp - 0x28]
cmp byte [rbx], 1
jne 0x14001573f
lea rdx, [rbp - 0x40]
mov rcx, qword [rbx + 8]
call fcn.14000dc20
mov rdx, rax
mov rcx, qword [rbp - 0x28]
jmp 0x140015743
mov rdx, qword [rbp - 0x18]
lea rax, [rdx + 8]
cmp byte [rdx], 4
cmovne rax, rdi
movzx eax, byte [rax]
mov byte [rsi + 0x218], al
cmp rcx, 0x10
jb 0x140015792
lea rdx, [rcx + 1]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001578d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001578d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400691fc
mov dword [rbp - 0x50], 0x7071646d
mov dword [rbp - 0x4c], 0x636265
mov byte [rbp - 0x48], 1
mov rax, rdi
nop word [rax + rax]
xor byte [rbp + rax - 0x50], al
inc rax
cmp rax, 7
jb 0x1400157b0
mov byte [rbp - 0x48], 0
mov qword [rbp - 0x40], rdi
mov qword [rbp - 0x30], 7
mov qword [rbp - 0x28], reloc.WS2_32.dll_ntohs
mov eax, dword [rbp - 0x50]
mov dword [rbp - 0x40], eax
movzx eax, word [rbp - 0x4c]
mov word [rbp - 0x3c], ax
movzx eax, byte [rbp - 0x4a]
mov byte [rbp - 0x3a], al
mov byte [rbp - 0x39], 0
cmp byte [rbx], 0
jne 0x1400157ff
mov byte [rbx], 1
call fcn.140008940
mov qword [rbx + 8], rax
cmp byte [rbx], 1
jne 0x140015813
lea rdx, [rbp - 0x40]
mov rcx, qword [rbx + 8]
call fcn.14000dc20
jmp 0x140015817
mov rax, qword [rbp - 0x18]
cmp byte [rax], 3
jne 0x140015820
mov rdi, qword [rax + 8]
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x14001582d
mov rdx, qword [rdi]
lea rcx, [rsi + 0x220]
mov r8, qword [rdi + 0x10]
call fcn.14000efd0
nop
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb 0x14001587d
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140015877
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140015877
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400691fc
nop
lea rcx, [rbx + 8]
movzx edx, byte [rbx]
call fcn.1400101e0
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400692f0
mov rbx, qword [rsp + 0xa0]
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret