joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400efa00
Capabilities:
Accept command line arguments
Create process on windows

Disassembly:
mov r11, rsp
push rbx
push rsi
push rdi
push r12
push r14
sub rsp, 0xd0
mov rax, qword [0x14027aef8]
xor rax, rsp
mov qword [rsp + 0xc0], rax
xor eax, eax
mov r12, r8
mov dword [rsp + 0x54], eax
mov rdi, rdx
mov qword [r11 - 0x64], rax
xor ebx, ebx
mov dword [r11 - 0x5c], eax
call qword [sym.imp.KERNEL32.DLL_GetCommandLineW]
mov rcx, qword [rdi]
mov rsi, rax
test rcx, rcx
jne 0x1400efa4e
mov ecx, ebx
jmp 0x1400efa5b
mov edx, 0x1fff
call fcn.14012a854
mov rcx, rax
cmp word [rsi], 0x22
lea rax, [rcx + 2]
mov rdx, qword [rdi + 8]
cmovne rax, rcx
lea rcx, [rsi + rax*2]
call fcn.140103e20
mov r14, rax
test rax, rax
jne 0x1400efa95
lea rdx, str.Unable_to_parse_command_line._n
lea ecx, [rax + 3]
call fcn.140046fa0
mov eax, 0x708
jmp 0x1400efc4c
mov rcx, qword [rdi + 8]
mov qword [rsp + 0x100], rbp
mov qword [rsp + 0x118], r15
test rcx, rcx
jne 0x1400efab3
mov rax, rbx
jmp 0x1400efabd
mov edx, 0x1fff
call fcn.14012a854
mov edx, 0x1fff
lea r15, [r14 + rax*2]
mov rcx, rsi
call fcn.14012a854
mov rcx, qword [rdi + 8]
lea rsi, [rax + 1]
test rcx, rcx
jne 0x1400efae0
mov rax, rbx
jmp 0x1400efaea
mov edx, 0x1fff
call fcn.14012a854
mov edx, 0x1fff
lea rcx, str.server__i
sub rsi, rax
call fcn.14012a854
lea r14, [rax + 2]
add r14, rsi
lea rbp, [r14 + r14]
mov rcx, rbp
call fcn.140110008
mov rsi, rax
test rax, rax
je 0x1400efc26
mov r8, rbp
xor edx, edx
mov rcx, rax
call fcn.140102230
mov r8, rbp
xor edx, edx
mov rcx, rsi
call fcn.140102230
mov r8, qword [rdi]
mov eax, 0x22
mov rdx, r14
mov word [rsi], ax
mov rcx, rsi
call fcn.1401487bc
lea r8, [0x140232f7c]
mov rdx, r14
mov rcx, rsi
call fcn.1401487bc
lea r8, [0x140232f80]
mov rdx, r14
mov rcx, rsi
call fcn.1401487bc
mov r8, r15
mov rdx, r14
mov rcx, rsi
call fcn.1401487bc
mov qword [rsp + 0x48], r12
lea rax, [0x14022ce38]
mov qword [rsp + 0x60], rax
xorps xmm0, xmm0
lea rax, [rsp + 0x50]
mov dword [rsp + 0x50], 0x68
mov qword [rsp + 0x40], rax
xor r9d, r9d
mov qword [rsp + 0x38], rbx
xor r8d, r8d
mov qword [rsp + 0x30], rbx
mov rdx, rsi
mov dword [rsp + 0x28], 0x8000000
xor ecx, ecx
mov dword [rsp + 0x20], 1
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x80], rbx
mov dword [rsp + 0x88], ebx
mov qword [rsp + 0x8c], 1
mov qword [rsp + 0x58], rbx
movdqa xmmword [rsp + 0xa0], xmm0
mov qword [rsp + 0xb0], rbx
call qword [sym.imp.KERNEL32.DLL_CreateProcessW]
test eax, eax
mov ecx, 0x3eb
cmove ebx, ecx
mov rcx, rsi
call fcn.14010fff4
mov eax, ebx
jmp 0x1400efc3c
lea rdx, str.Unable_to_allocate_memory._n
mov ecx, 3
call fcn.140046fa0
mov eax, 0x708
mov rbp, qword [rsp + 0x100]
mov r15, qword [rsp + 0x118]
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.140100920
add rsp, 0xd0
pop r14
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400f0d20
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbx, rcx
test rcx, rcx
je 0x1400f0d77
mov rcx, qword [rcx + 0x28]
test rcx, rcx
je 0x1400f0d77
call fcn.1400f2840
test eax, eax
je 0x1400f0d77
cmp qword [rbx + 0x270], 0
je 0x1400f0d77
mov rcx, qword [rbx + 0x28]
mov r8d, edi
mov rdx, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.1400f29c0
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400f2850
Capabilities:
Read file on windows

Disassembly:
push rbx
push rdi
sub rsp, 0x48
mov rax, qword [0x14027aef8]
xor rax, rsp
mov qword [rsp + 0x38], rax
xor edi, edi
mov rbx, rcx
cmp dword [rcx + 0x210], edi
jne 0x1400f2883
lea ecx, [rdi + 0x15]
call qword [sym.imp.KERNEL32.DLL_SetLastError]
mov eax, edi
jmp 0x1400f290c
test rdx, rdx
jne 0x1400f2895
lea ecx, [rdx + 0x57]
call qword [sym.imp.KERNEL32.DLL_SetLastError]
mov eax, edi
jmp 0x1400f290c
lea r9, [rsp + 0x30]
mov rcx, qword [rcx + 0x208]
cmp dword [rbx + 0x218], edi
jne 0x1400f28b6
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.DLL_ReadFile]
jmp 0x1400f290c
mov qword [rsp + 0x40], rsi
lea rsi, [rbx + 0x228]
mov qword [rsi], rdi
mov qword [rsp + 0x20], rsi
mov qword [rbx + 0x230], rdi
call qword [sym.imp.KERNEL32.DLL_ReadFile]
mov edi, eax
test eax, eax
jne 0x1400f2907
call qword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x3e5
jne 0x1400f2905
mov rcx, qword [rbx + 0x208]
lea r9d, [rdi + 1]
lea r8, [rsp + 0x30]
mov rdx, rsi
call qword [sym.imp.KERNEL32.DLL_GetOverlappedResult]
jmp 0x1400f2907
mov eax, edi
mov rsi, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140100920
add rsp, 0x48
pop rdi
pop rbx
ret

Function at 0x1400f29c0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
sub rsp, 0x48
mov rax, qword [0x14027aef8]
xor rax, rsp
mov qword [rsp + 0x38], rax
xor edi, edi
mov rbx, rcx
cmp dword [rcx + 0x210], edi
jne 0x1400f29f3
lea ecx, [rdi + 0x15]
call qword [sym.imp.KERNEL32.DLL_SetLastError]
mov eax, edi
jmp 0x1400f2a7c
test rdx, rdx
jne 0x1400f2a05
lea ecx, [rdx + 0x57]
call qword [sym.imp.KERNEL32.DLL_SetLastError]
mov eax, edi
jmp 0x1400f2a7c
lea r9, [rsp + 0x30]
mov rcx, qword [rcx + 0x208]
cmp dword [rbx + 0x218], edi
jne 0x1400f2a26
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.DLL_WriteFile]
jmp 0x1400f2a7c
mov qword [rsp + 0x40], rsi
lea rsi, [rbx + 0x250]
mov qword [rsi], rdi
mov qword [rsp + 0x20], rsi
mov qword [rbx + 0x258], rdi
call qword [sym.imp.KERNEL32.DLL_WriteFile]
mov edi, eax
test eax, eax
jne 0x1400f2a77
call qword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x3e5
jne 0x1400f2a75
mov rcx, qword [rbx + 0x208]
lea r9d, [rdi + 1]
lea r8, [rsp + 0x30]
mov rdx, rsi
call qword [sym.imp.KERNEL32.DLL_GetOverlappedResult]
jmp 0x1400f2a77
mov eax, edi
mov rsi, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140100920
add rsp, 0x48
pop rdi
pop rbx
ret
Function at 0x1400f2c90
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
test rcx, rcx
je 0x1400f2cdf
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400f2cdf
bt eax, 0xa
jae 0x1400f2cdf
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400f2ccf
test al, 0x10
je 0x1400f2ccf
mov rcx, rdi
call fcn.14012db94
jmp 0x1400f2cd7
mov rcx, rdi
call fcn.14011295c
test eax, eax
jne 0x1400f2d64
mov ecx, 0x18
call fcn.140110008
mov rbx, rax
test rax, rax
je 0x1400f2d64
xor eax, eax
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
test rdi, rdi
je 0x1400f2d2d
xor edx, edx
mov r8d, 0x1000
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_LoadLibraryExA]
mov qword [rbx], rax
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [rbx + 8], eax
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov r8, rbx
lea rdx, [fcn.1400f2c90]
mov ecx, 4
call qword [sym.imp.KERNEL32.DLL_GetModuleHandleExA]
test eax, eax
jne 0x1400f2d4d
mov qword [rbx], 0
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [rbx + 8], eax
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x1400f3ca0
Capabilities:
Create process on windows

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x230
mov rax, qword [0x14027aef8]
xor rax, rsp
mov qword [rsp + 0x220], rax
mov eax, dword [0x1402830d8]
mov rdi, rcx
add eax, 0xfffffffd
cmp eax, 1
jbe 0x1400f3ea0
xorps xmm0, xmm0
mov qword [r11 + 0x10], rbx
xor eax, eax
mov qword [r11 + 0x18], rsi
movups xmmword [rsp + 0x80], xmm0
xor ebx, ebx
mov qword [r11 - 0x1a8], rax
xor edx, edx
mov dword [rsp + 0x104], eax
mov r8d, 0x104
lea rcx, [r11 - 0x128]
mov esi, ebx
movups xmmword [rsp + 0xa4], xmm0
movups xmmword [rsp + 0xb4], xmm0
movups xmmword [rsp + 0xc4], xmm0
movups xmmword [rsp + 0xd4], xmm0
movups xmmword [rsp + 0xe4], xmm0
movups xmmword [rsp + 0xf4], xmm0
call fcn.140102230
xor r9d, r9d
mov qword [rsp + 0x20], rbx
mov edx, 0x104
lea r8d, [rbx + 6]
lea rcx, [rsp + 0x110]
call fcn.140047820
mov r9, qword [rdi + 8]
lea r8, [rsp + 0x110]
lea rdx, str.__S_s_
lea rcx, [rsp + 0x68]
call fcn.1400e7120
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
cmp qword [rsp + 0x54], rbx
je 0x1400f3e8c
mov rdx, qword [rsp + 0x54]
lea rax, [rsp + 0x80]
mov qword [rsp + 0x48], rax
xor r9d, r9d
lea rax, [rsp + 0xa0]
mov qword [rdi + 0x10], rbx
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov qword [rsp + 0x38], rbx
xor ecx, ecx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], ebx
mov qword [rdi + 0x18], rbx
mov dword [rsp + 0xa0], 0x68
call qword [sym.imp.KERNEL32.DLL_CreateProcessW]
mov esi, eax
test eax, eax
jne 0x1400f3e65
cmp dword [0x140274810], 2
jl 0x1400f3dff
test dword [0x14027485c], 0x10000
je 0x1400f3dff
lea ebx, [rax + 1]
mov edx, 2
mov ecx, 0x10000
call fcn.1400e1c40
mov edi, eax
test ebx, ebx
jne 0x1400f3e18
test eax, eax
je 0x1400f3e82
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [rsp + 0x40], eax
mov r9d, 2
lea rax, str.Unable_to_start_capture_program._Error___d
mov r8d, 0x10000
mov qword [rsp + 0x38], rax
mov edx, edi
lea rax, str.C:jenkinsworkspacedptfSrcESIFProductsESIF_UFSourceswin_rsrc_app.c
mov dword [rsp + 0x30], 0x1c7
mov qword [rsp + 0x28], rax
mov ecx, ebx
lea rax, str.rsrc_app_start_app_in_current_session
mov qword [rsp + 0x20], rax
call fcn.1400ba210
jmp 0x1400f3e82
mov rax, qword [rsp + 0x80]
mov esi, 1
mov qword [rdi + 0x10], rax
mov rax, qword [rsp + 0x88]
mov qword [rdi + 0x18], rax
mov rcx, qword [rsp + 0x54]
call fcn.14010fff4
mov rbx, qword [rsp + 0x248]
mov eax, esi
mov rsi, qword [rsp + 0x250]
jmp 0x1400f3ea5
call fcn.1400f3ec0
mov rcx, qword [rsp + 0x220]
xor rcx, rsp
call fcn.140100920
add rsp, 0x230
pop rdi
ret
Function at 0x1400f4570
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x1400f45b2
xor edx, edx
call qword [sym.imp.KERNEL32.DLL_TerminateProcess]
mov rcx, qword [rbx + 0x10]
mov edx, 0x1388
call qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x1400f45b2
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
xor eax, eax
mov dword [rbx + 0x20], 0xffffffff
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], rax
add rsp, 0x20
pop rbx
ret
Function at 0x1400f5830
Capabilities:
Start service

Disassembly:
push rbx
sub rsp, 0x20
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.DLL_OpenSCManagerW]
mov rbx, rax
test rax, rax
jne 0x1400f586b
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov r8d, eax
lea rdx, str.Error:_Unable_to_get_handle_to_the_SCM._Status___d_n
lea ecx, [rbx + 3]
add rsp, 0x20
pop rbx
jmp fcn.140046fa0
mov r8d, 0xf01ff
mov qword [rsp + 0x30], rdi
lea rdx, str.esifsvc
mov rcx, rbx
call qword [sym.imp.ADVAPI32.DLL_OpenServiceW]
mov rdi, rax
test rax, rax
jne 0x1400f58a8
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov r8d, eax
lea rdx, str.Error:_Unable_to_open_service_handle._Status___d_n
lea ecx, [rdi + 3]
call fcn.140046fa0
jmp 0x1400f5904
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.DLL_StartServiceW]
test eax, eax
jne 0x1400f58e3
call qword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x420
je 0x1400f58e3
call qword [sym.imp.KERNEL32.DLL_GetLastError]
lea rdx, str.Error:_Unable_to_start_the_service._Status___d_n
mov ecx, 3
mov r8d, eax
call fcn.140046fa0
jmp 0x1400f58fb
lea r8, [0x140233bd0]
mov ecx, 3
lea rdx, str._S_started._n
call fcn.140046fa0
mov rcx, rdi
call qword [sym.imp.ADVAPI32.DLL_CloseServiceHandle]
mov rcx, rbx
mov rdi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.ADVAPI32.DLL_CloseServiceHandle]

Function at 0x1400f5920
Capabilities:
Stop service

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x14027aef8]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.DLL_OpenSCManagerW]
mov rbx, rax
test rax, rax
jne 0x1400f5978
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov r8d, eax
lea rdx, str.Error:_Unable_to_get_handle_to_the_SCM._Status___d_n
lea ecx, [rbx + 3]
call fcn.140046fa0
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140100920
add rsp, 0x50
pop rbx
ret
mov r8d, 0xf01ff
mov qword [rsp + 0x60], rdi
lea rdx, str.esifsvc
mov rcx, rbx
call qword [sym.imp.ADVAPI32.DLL_OpenServiceW]
mov rdi, rax
test rax, rax
jne 0x1400f59b5
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov r8d, eax
lea rdx, str.Error:_Unable_to_open_service_handle._Status___d_n
lea ecx, [rdi + 3]
call fcn.140046fa0
jmp 0x1400f5a14
lea r8, [rsp + 0x20]
mov edx, 1
mov rcx, rdi
call qword [sym.imp.ADVAPI32.DLL_ControlService]
test eax, eax
jne 0x1400f59f3
call qword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x426
je 0x1400f59f3
call qword [sym.imp.KERNEL32.DLL_GetLastError]
lea rdx, str.Error:_Unable_to_stop_the_service._Status___d_n
mov ecx, 3
mov r8d, eax
call fcn.140046fa0
lea r8, [0x140233bd0]
mov ecx, 3
lea rdx, str._S_stopped_n
call fcn.140046fa0
mov rcx, rdi
call qword [sym.imp.ADVAPI32.DLL_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.DLL_CloseServiceHandle]
mov rdi, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140100920
add rsp, 0x50
pop rbx
ret
Function at 0x140148cd0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x140148abf
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
test rax, rax
je 0x140148abf
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140148abf
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140148abf
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140148abf
cmp dword [rcx + 0x84], 0xe
jbe 0x140148abf
cmp dword [rcx + 0xf8], 0
je 0x140148abf
mov ecx, ebx
call fcn.140148bf0
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.140148844
cmp dword [rbp + 0x20], 0
je 0x140148b0c
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140148b14
int3
xor r8d, r8d
xor edx, edx
jmp 0x140148a58

Function at 0x140151d34
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.DLL_DeleteFileW]
test eax, eax
jne 0x140151d54
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov ecx, eax
call fcn.140111f88
or eax, 0xffffffff
jmp 0x140151d56
xor eax, eax
add rsp, 0x28
ret

Function at 0x140155f48
Capabilities:
Delete directory

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.DLL_RemoveDirectoryW]
test eax, eax
jne 0x140155f68
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov ecx, eax
call fcn.140111f88
or eax, 0xffffffff
jmp 0x140155f6a
xor eax, eax
add rsp, 0x28
ret
Function at 0x14000ae90
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r10, rcx
mov r9d, 0x270
mov ecx, dword [rcx]
cmp ecx, r9d
jne 0x14000aef1
lea r8, [r10 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x14000aeb0
mov ecx, dword [r10]
jmp 0x14000afda
cmp ecx, 0x4e0
jb 0x14000afda
lea r11, [r10 + 0x9c4]
mov qword [rsp], rbx
mov eax, dword [r11]
mov ebx, 0xe3
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x14000af10
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x14000af60
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
xor ecx, ecx
mov dword [r10], ecx
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x14000b720
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 7], sil
je 0x14000b754
mov eax, esi
lea ecx, [rax - 0x65]
xor byte [r8 + rax], cl
inc rax
cmp rax, 6
jb 0x14000b740
mov byte [r8 + 7], sil
add r8, 6
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.14000b320
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x14000b779
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.1400188f0
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x14000b7f3
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b7ee
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000b7ee
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006d974
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x14000b800
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 9], sil
je 0x14000b834
mov eax, esi
lea ecx, [rax - 0x65]
xor byte [r8 + rax], cl
inc rax
cmp rax, 8
jb 0x14000b820
mov byte [r8 + 9], sil
add r8, 8
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.14000b320
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x14000b859
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.1400188f0
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x14000b8d3
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b8ce
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000b8ce
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006d974
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x14000b8e0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 0xa], sil
je 0x14000b914
mov eax, esi
lea ecx, [rax - 0x65]
xor byte [r8 + rax], cl
inc rax
cmp rax, 9
jb 0x14000b900
mov byte [r8 + 0xa], sil
add r8, 9
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.14000b320
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x14000b939
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.1400188f0
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x14000b9b3
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b9ae
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000b9ae
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006d974
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x14000b9c0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 0xc], sil
je 0x14000b9f4
mov eax, esi
lea ecx, [rax - 0x65]
xor byte [r8 + rax], cl
inc rax
cmp rax, 0xb
jb 0x14000b9e0
mov byte [r8 + 0xc], sil
add r8, 0xb
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.14000b320
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x14000ba19
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.1400188f0
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x14000ba93
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ba8e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000ba8e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006d974
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x140012850
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 9], al
je 0x140012873
lea edx, [rax - 0x65]
xor byte [rax + rcx], dl
inc rax
cmp rax, 8
jb 0x140012860
mov byte [rcx + 9], 0
lea r8, [rcx + 8]
mov rdx, rcx
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.14000b320
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x140012890
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 0x10], al
je 0x1400128b3
lea edx, [rax - 0x65]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xf
jb 0x1400128a0
mov byte [rcx + 0x10], 0
lea r8, [rcx + 0xf]
mov rdx, rcx
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.14000b320
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x140013c20
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 5], 0
je 0x140013c43
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x65]
xor byte [rax + rcx], dl
inc rax
cmp rax, 4
jb 0x140013c30
mov byte [rcx + 5], 0
mov rax, rcx
ret

Function at 0x140013c50
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x136], 0
je 0x140013c78
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x65]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x135
jb 0x140013c60
mov byte [rcx + 0x136], 0
mov rax, rcx
ret

Function at 0x140013c80
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x44], 0
je 0x140013ca3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x65]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x43
jb 0x140013c90
mov byte [rcx + 0x44], 0
mov rax, rcx
ret

Function at 0x140013cb0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x47], 0
je 0x140013cd3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x65]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x46
jb 0x140013cc0
mov byte [rcx + 0x47], 0
mov rax, rcx
ret