joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140035920
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14003592d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14003593d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x140035925
lea eax, [rcx + 1]
call r11
adc eax, eax
add ebx, ebx
jne 0x140035955
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x140035942
sub eax, 3
jb 0x14003596f
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x1400359a6
movsxd rbp, eax
lea eax, [rcx + 1]
call r11
adc ecx, ecx
call r11
adc ecx, ecx
jne 0x140035996
mov ecx, eax
add eax, 2
call r11
adc ecx, ecx
add ebx, ebx
jne 0x140035994
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x140035983
cmp rbp, 0xfffffffffffff300
adc ecx, eax
call fcn.1400358e2
jmp 0x14003592d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, pe_overlay
mov dl, 9
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x1400359f2
cmp rsi, rcx
jae 0x1400359fa
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x1400359d9
cmp al, 0x8f
ja 0x1400359d9
cmp byte [rsi - 2], 0xf
je 0x1400359df
sub al, 0xe8
cmp al, 1
ja 0x1400359c3
cmp rsi, rcx
jae 0x1400359fa
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x1400359c9
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x1400359fa
lodsb al, byte [rsi]
jmp 0x1400359d9
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x33000]
mov eax, dword [rdi]
or eax, eax
je 0x140035a63
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x40294]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x140035a07
jns 0x140035a3c
movzx rdx, word [rdi]
add rdi, 2
jmp 0x140035a46
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x140035a5d
mov qword [rbx], rax
add rbx, 8
jmp 0x140035a27
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x18f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x140035abb
sub rsp, 0xffffffffffffff80
jmp 0x14001bce0
Function at 0x1400042d0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x47], 0
je 0x1400042f3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x14]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x46
jb 0x1400042e0
mov byte [rcx + 0x47], 0
mov rax, rcx
ret

Function at 0x140004300
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x60], rcx
xor esi, esi
cmp byte [r8 + 6], sil
je 0x140004334
mov ecx, esi
lea eax, [rcx - 0x14]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 5
jb 0x140004320
mov byte [r8 + 6], sil
lea rax, [r8 + 5]
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x40], sil
cmp r9, rax
je 0x140004369
mov r8d, 5
mov rdx, r9
lea rcx, [rsp + 0x40]
call fcn.14000a720
nop
cmp byte [rbx + 0xa], 0
je 0x140004393
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x14]
xor byte [rcx + rbx], al
inc rcx
cmp rcx, 9
jb 0x140004380
mov byte [rbx + 0xa], 0
lea rax, [rbx + 9]
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x20], 0
cmp rbx, rax
je 0x1400043c8
mov r8d, 9
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.14000a720
nop
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x20]
mov rcx, rdi
call fcn.14000c7e0
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x14000441c
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004416
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004416
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007cf9c
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x14000445c
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004457
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004457
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007cf9c
mov rax, rdi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x140004470
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x40], rcx
xor esi, esi
cmp byte [r8 + 7], sil
je 0x1400044a4
mov ecx, esi
lea eax, [rcx - 0x14]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 6
jb 0x140004490
mov byte [r8 + 7], sil
lea rax, [r8 + 6]
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x20], sil
cmp r9, rax
je 0x1400044d9
mov r8d, 6
mov rdx, r9
lea rcx, [rsp + 0x20]
call fcn.14000a720
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x1400044e7
mov rbx, qword [rbx]
mov r8, rbx
lea rcx, [rsp + 0x20]
call fcn.14000d980
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x14000455c
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004557
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004557
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007cf9c
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x140004570
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x40], rcx
xor esi, esi
cmp byte [r8 + 0xa], sil
je 0x1400045a4
mov ecx, esi
lea eax, [rcx - 0x14]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 9
jb 0x140004590
mov byte [r8 + 0xa], sil
lea rax, [r8 + 9]
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x20], sil
cmp r9, rax
je 0x1400045d9
mov r8d, 9
mov rdx, r9
lea rcx, [rsp + 0x20]
call fcn.14000a720
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x1400045e7
mov rbx, qword [rbx]
mov r8, rbx
lea rcx, [rsp + 0x20]
call fcn.14000d980
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x14000465c
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004657
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004657
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007cf9c
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x140004670
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x136], 0
je 0x140004698
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x14]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x135
jb 0x140004680
mov byte [rcx + 0x136], 0
mov rax, rcx
ret
Function at 0x140005200
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x60], rcx
xor esi, esi
cmp byte [r8 + 0xb], sil
je 0x140005234
mov ecx, esi
lea eax, [rcx - 0x14]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 0xa
jb 0x140005220
mov byte [r8 + 0xb], sil
lea rax, [r8 + 0xa]
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x40], sil
cmp r9, rax
je 0x140005269
mov r8d, 0xa
mov rdx, r9
lea rcx, [rsp + 0x40]
call fcn.14000a720
nop
cmp byte [rbx + 0xb], 0
je 0x140005293
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x14]
xor byte [rcx + rbx], al
inc rcx
cmp rcx, 0xa
jb 0x140005280
mov byte [rbx + 0xb], 0
lea rax, [rbx + 0xa]
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x20], 0
cmp rbx, rax
je 0x1400052c8
mov r8d, 0xa
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.14000a720
nop
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x20]
mov rcx, rdi
call fcn.14000c7e0
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x14000531c
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005316
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005316
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007cf9c
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x14000535c
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005357
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005357
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007cf9c
mov rax, rdi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x140005370
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x40], rcx
xor esi, esi
cmp byte [r8 + 0xc], sil
je 0x1400053a4
mov ecx, esi
lea eax, [rcx - 0x14]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 0xb
jb 0x140005390
mov byte [r8 + 0xc], sil
lea rax, [r8 + 0xb]
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x20], sil
cmp r9, rax
je 0x1400053d9
mov r8d, recv
mov rdx, r9
lea rcx, [rsp + 0x20]
call fcn.14000a720
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x1400053e7
mov rbx, qword [rbx]
mov r8, rbx
lea rcx, [rsp + 0x20]
call fcn.14000d980
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x14000545c
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005457
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005457
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007cf9c
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400060b0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x60], rcx
xor esi, esi
cmp byte [r8 + 0xb], sil
je 0x1400060e4
mov ecx, esi
lea eax, [rcx - 0x14]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 0xa
jb 0x1400060d0
mov byte [r8 + 0xb], sil
lea rax, [r8 + 0xa]
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x40], sil
cmp r9, rax
je 0x140006119
mov r8d, 0xa
mov rdx, r9
lea rcx, [rsp + 0x40]
call fcn.14000a720
nop
cmp byte [rbx + 0xe], 0
je 0x140006143
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x14]
xor byte [rcx + rbx], al
inc rcx
cmp rcx, 0xd
jb 0x140006130
mov byte [rbx + 0xe], 0
lea rax, [rbx + 0xd]
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x20], 0
cmp rbx, rax
je 0x140006178
mov r8d, reloc.WS2_32.dll_listen
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.14000a720
nop
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x20]
mov rcx, rdi
call fcn.14000c7e0
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x1400061cc
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400061c6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400061c6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007cf9c
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x14000620c
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006207
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006207
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007cf9c
mov rax, rdi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x140006220
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x40], rcx
xor esi, esi
cmp byte [r8 + 6], sil
je 0x140006254
mov ecx, esi
lea eax, [rcx - 0x14]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 5
jb 0x140006240
mov byte [r8 + 6], sil
lea rax, [r8 + 5]
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x20], sil
cmp r9, rax
je 0x140006289
mov r8d, 5
mov rdx, r9
lea rcx, [rsp + 0x20]
call fcn.14000a720
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140006297
mov rbx, qword [rbx]
mov r8, rbx
lea rcx, [rsp + 0x20]
call fcn.14000d980
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x14000630c
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006307
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006307
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007cf9c
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x140006bf0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x60], rcx
xor esi, esi
cmp byte [r8 + 0xb], sil
je 0x140006c24
mov ecx, esi
lea eax, [rcx - 0x14]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 0xa
jb 0x140006c10
mov byte [r8 + 0xb], sil
lea rax, [r8 + 0xa]
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x40], sil
cmp r9, rax
je 0x140006c59
mov r8d, 0xa
mov rdx, r9
lea rcx, [rsp + 0x40]
call fcn.14000a720
nop
cmp byte [rbx + 0xd], 0
je 0x140006c83
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x14]
xor byte [rcx + rbx], al
inc rcx
cmp rcx, 0xc
jb 0x140006c70
mov byte [rbx + 0xd], 0
lea rax, [rbx + 0xc]
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x20], 0
cmp rbx, rax
je 0x140006cb8
mov r8d, recv
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.14000a720
nop
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x20]
mov rcx, rdi
call fcn.14000c7e0
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x140006d0c
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006d06
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006d06
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007cf9c
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x140006d4c
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006d47
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006d47
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007cf9c
mov rax, rdi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400072b0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x60], rcx
xor esi, esi
cmp byte [r8 + 0xc], sil
je 0x1400072e4
mov ecx, esi
lea eax, [rcx - 0x14]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 0xb
jb 0x1400072d0
mov byte [r8 + 0xc], sil
lea rax, [r8 + 0xb]
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x40], sil
cmp r9, rax
je 0x140007319
mov r8d, recv
mov rdx, r9
lea rcx, [rsp + 0x40]
call fcn.14000a720
nop
cmp byte [rbx + 9], 0
je 0x140007343
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x14]
xor byte [rcx + rbx], al
inc rcx
cmp rcx, 8
jb 0x140007330
mov byte [rbx + 9], 0
lea rax, [rbx + 8]
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x20], 0
cmp rbx, rax
je 0x140007378
mov r8d, 8
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.14000a720
nop
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x20]
mov rcx, rdi
call fcn.14000c7e0
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x1400073cc
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400073c6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400073c6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007cf9c
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x14000740c
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007407
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007407
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007cf9c
mov rax, rdi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x140007920
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x60], rcx
xor esi, esi
cmp byte [r8 + 0xc], sil
je 0x140007954
mov ecx, esi
lea eax, [rcx - 0x14]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 0xb
jb 0x140007940
mov byte [r8 + 0xc], sil
lea rax, [r8 + 0xb]
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x40], sil
cmp r9, rax
je 0x140007989
mov r8d, recv
mov rdx, r9
lea rcx, [rsp + 0x40]
call fcn.14000a720
nop
cmp byte [rbx + 0xb], 0
je 0x1400079b3
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x14]
xor byte [rcx + rbx], al
inc rcx
cmp rcx, 0xa
jb 0x1400079a0
mov byte [rbx + 0xb], 0
lea rax, [rbx + 0xa]
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x20], 0
cmp rbx, rax
je 0x1400079e8
mov r8d, 0xa
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.14000a720
nop
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x20]
mov rcx, rdi
call fcn.14000c7e0
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x140007a3c
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007a36
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007a36
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007cf9c
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x140007a7c
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007a77
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007a77
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007cf9c
mov rax, rdi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400086b0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x60], rcx
xor esi, esi
cmp byte [r8 + 9], sil
je 0x1400086e4
mov ecx, esi
lea eax, [rcx - 0x14]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 8
jb 0x1400086d0
mov byte [r8 + 9], sil
lea rax, [r8 + 8]
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x40], sil
cmp r9, rax
je 0x140008719
mov r8d, 8
mov rdx, r9
lea rcx, [rsp + 0x40]
call fcn.14000a720
nop
cmp byte [rbx + 0xa], 0
je 0x140008743
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x14]
xor byte [rcx + rbx], al
inc rcx
cmp rcx, 9
jb 0x140008730
mov byte [rbx + 0xa], 0
lea rax, [rbx + 9]
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x20], 0
cmp rbx, rax
je 0x140008778
mov r8d, 9
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.14000a720
nop
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x20]
mov rcx, rdi
call fcn.14000c7e0
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x1400087cc
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400087c6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400087c6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007cf9c
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x14000880c
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008807
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008807
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007cf9c
mov rax, rdi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x140017db0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x14009f258]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, rdx
mov rbx, rcx
mov ecx, 8
call fcn.14007cf60
test rax, rax
je 0x140017de1
mov qword [rax], rdi
mov qword [rsp + 0x30], rax
lea rdi, [rbx + 8]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x1400185a0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbx], rax
test rax, rax
je 0x140017e2e
mov rax, rbx
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14007cf40
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov dword [rdi], 0
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3