joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140082270
Capabilities:
Enumerate pe sections

Disassembly:
push rbx
push rbp
push r13
push r14
mov eax, 0x1078
call fcn.1400ea170
sub rsp, rax
mov rax, qword [0x140122080]
xor rax, rsp
mov qword [rsp + 0x1050], rax
mov r14, rdx
mov qword [rsp + 0x38], r9
mov rdx, qword [rsp + 0x10c0]
xor ebp, ebp
mov qword [rsp + 0x30], rdx
mov r13, r8
mov qword [rsp + 0x40], rcx
test r8, r8
jne 0x1400822c2
mov rdx, rbp
jmp 0x14008238b
mov r9d, 0x1000
lea rdx, [rsp + 0x50]
call fcn.140080fc0
test al, al
je 0x1400822ba
mov qword [rsp + 0x10a8], rsi
mov qword [rsp + 0x1070], rdi
mov rdi, 0xffffffffffffffff
mov qword [rsp + 0x1068], r12
mov qword [rsp + 0x1060], r15
nop dword [rax]
inc rdi
cmp byte [r14 + rdi], bpl
jne 0x140082300
movsxd rax, dword [rsp + 0x8c]
lea rcx, [rsp + 0x50]
add rcx, rax
mov esi, ebp
movzx eax, word [rcx + 0x14]
lea r12, [rcx + 0x18]
movzx r15d, word [rcx + 6]
add r12, rax
test r15d, r15d
je 0x140082368
mov eax, esi
mov r8, rdi
mov rdx, r14
lea rcx, [rax + rax*4]
lea rbx, [r12 + rcx*8]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140082361
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rbx + rax], bpl
jne 0x140082353
cmp rdi, rax
je 0x1400823c5
inc esi
cmp esi, r15d
jb 0x140082330
mov rdx, rbp
mov r12, qword [rsp + 0x1068]
mov rdi, qword [rsp + 0x1070]
mov rsi, qword [rsp + 0x10a8]
mov r15, qword [rsp + 0x1060]
mov rax, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
mov r8d, ebp
mov qword [rsp + 0x20], rax
call fcn.140082150
mov rcx, qword [rsp + 0x1050]
xor rcx, rsp
call fcn.1400e9540
add rsp, 0x1078
pop r14
pop r13
pop rbp
pop rbx
ret
mov eax, dword [rbx + 0xc]
test eax, eax
je 0x140082368
mov ecx, dword [rbx + 8]
mov edx, eax
lea rax, [rsp + 0x50]
add rax, rdx
je 0x140082368
test ecx, ecx
je 0x140082368
mov ebp, ecx
add rdx, r13
jmp 0x14008236b
Function at 0x140084730
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400847cf
movsxd rax, dword [rcx + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x1400847cf
mov r8d, dword [rax + rcx + 0xd8]
test r8d, r8d
je 0x1400847c2
mov rdi, qword [r8 + rcx + 0x58]
test rdi, rdi
je 0x1400847c2
sub rcx, rdx
movabs rsi, 0x2b992ddfa232
add rdi, rcx
cmp qword [rdi], rsi
jne 0x1400847cf
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov eax, eax
movabs rcx, 0x2b992ddfa233
xor rax, rbx
mov rbx, qword [rsp + 0x30]
xor rax, rsi
cmp rax, rsi
cmove rax, rcx
mov qword [rdi], rax
mov al, 1
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov al, 1
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rsi, qword [rsp + 0x38]
xor al, al
add rsp, 0x20
pop rdi
ret
Function at 0x140085020
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
push rbx
push rbp
push r14
sub rsp, 0x50
mov rax, qword [0x140122080]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor ebp, ebp
lea r9, [rsp + 0x20]
mov r14, rcx
mov dword [rsp + 0x20], ebp
xor r8d, r8d
xor edx, edx
mov ebx, ebp
lea ecx, [rbp + 0xb]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x1400850ae
nop dword [rax]
test rbx, rbx
je 0x140085076
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rsp + 0x20]
xor ecx, ecx
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
mov rdx, rax
mov ecx, listen
mov rbx, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x140085060
test eax, eax
jns 0x1400850cf
test rbx, rbx
je 0x1400850d4
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
jmp 0x1400851c6
test rbx, rbx
jne 0x1400850db
xor eax, eax
jmp 0x1400851c6
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x80], rdi
mov edi, ebp
cmp dword [rbx], ebp
jbe 0x1400851a6
mov esi, edi
lea rdx, [rbx + 0x30]
imul rax, rsi, 0x128
mov qword [rsp + 0x28], rbp
mov r8, 0xffffffffffffffff
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
movzx ecx, word [rax + rbx + 0x2e]
add rcx, rax
add rdx, rcx
inc r8
cmp byte [rdx + r8], bpl
jne 0x140085124
lea rcx, [rsp + 0x28]
call fcn.140006a80
cmp qword [r14 + 0x18], 0x10
mov rdx, r14
jb 0x140085144
mov rdx, qword [r14]
cmp qword [rsp + 0x40], 0x10
lea rcx, [rsp + 0x28]
cmovae rcx, qword [rsp + 0x28]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x1400851dc
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x14008519c
mov rcx, qword [rsp + 0x28]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140085197
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14008522d
call fcn.1400e97ec
inc edi
cmp edi, dword [rbx]
jb 0x1400850f2
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov rsi, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400e9540
add rsp, 0x50
pop r14
pop rbp
pop rbx
ret
imul rax, rsi, 0x128
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
mov rdi, qword [rax + rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x140085239
mov rcx, qword [rsp + 0x28]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140085234
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140085234
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e97ec
mov rax, rdi
jmp 0x1400851b9
Function at 0x140085610
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xa0
mov rax, qword [0x140122080]
xor rax, rsp
mov qword [rbp + 0x4f], rax
mov rbx, rcx
lea rcx, [0x1400fc150]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rsi, rax
test rax, rax
je 0x14008581f
mov rcx, qword [rbx + 0x10]
movabs rdi, 0x7ffffffffffffffe
mov rax, rdi
sub rax, rcx
cmp rax, 0x34
jb 0x14008584a
mov rax, rbx
cmp qword [rbx + 0x18], 8
jb 0x140085681
mov rax, qword [rbx]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], Ordinal_60
lea r9, str.RegistryMachineSystemCurrentControlSetServices_
lea rcx, [rbp + 0x1f]
call fcn.140083f90
nop
lea rdx, [rbp + 0x1f]
cmp qword [rbp + 0x37], 8
cmovae rdx, qword [rbp + 0x1f]
lea rcx, [rbp + 0x3f]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov rax, qword [rbx + 0x10]
sub rdi, rax
cmp rdi, 0x22
jb 0x140085844
cmp qword [rbx + 0x18], 8
jb 0x1400856d8
mov rbx, qword [rbx]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], Ordinal_35
lea r9, str.SYSTEMCurrentControlSetServices_
lea rcx, [rbp - 1]
call fcn.140083f90
nop
lea rdx, [rbp - 1]
cmp qword [rbp + 0x17], 8
cmovae rdx, qword [rbp - 1]
lea r8, [rbp - 9]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x140085727
cmp eax, 2
sete bl
jmp 0x140085784
mov rcx, qword [rbp - 9]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, str.NtUnloadDriver
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rbp + 0x3f]
call rax
lea rdx, [rbp - 1]
mov rcx, 0xffffffff80000002
test eax, eax
je 0x14008576a
cmp qword [rbp + 0x17], 8
cmovae rdx, qword [rbp - 1]
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
xor bl, bl
jmp 0x140085784
cmp qword [rbp + 0x17], 8
cmovae rdx, qword [rbp - 1]
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
test eax, eax
je 0x140085782
xor bl, bl
jmp 0x140085784
mov bl, 1
mov rdx, qword [rbp + 0x17]
cmp rdx, 8
jb 0x1400857c7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400857c2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400857c2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e97ec
xor eax, eax
mov qword [rbp + 0xf], rax
mov qword [rbp + 0x17], 7
mov word [rbp - 1], ax
mov rdx, qword [rbp + 0x37]
cmp rdx, 8
jb 0x14008581c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x1f]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140085817
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140085817
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e97ec
movzx eax, bl
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.1400e9540
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
call fcn.1400042e0
nop
call fcn.1400042e0
int3
Function at 0x140085850
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x140122080]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rsi, rdx
mov rdi, rcx
mov qword [rsp + 0x20], rcx
mov eax, 0x5a4d
cmp word [rdx], ax
jne 0x140085963
movsxd rax, dword [rdx + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x140085963
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
xor edx, edx
mov qword [rsp + 0x50], rdx
mov ecx, dword [rax + rsi + 0xb0]
test ecx, ecx
jne 0x1400858c8
mov qword [rdi], rdx
mov qword [rdi + 8], rdx
mov qword [rdi + 0x10], rdx
jmp 0x140085970
lea rbx, [rsi + rcx]
mov ebp, dword [rax + rsi + 0xb4]
add rbp, rbx
mov rcx, qword [rsp + 0x48]
cmp rbx, rbp
jae 0x140085951
mov r8d, dword [rbx + 4]
test r8d, r8d
je 0x140085951
mov eax, dword [rbx]
add rax, rsi
mov qword [rsp + 0x28], rax
lea rax, [rbx + 8]
mov qword [rsp + 0x30], rax
lea rax, [r8 - 8]
shr rax, 1
mov dword [rsp + 0x38], eax
cmp rcx, rdx
je 0x14008592a
movups xmm0, xmmword [rsp + 0x28]
movups xmmword [rcx], xmm0
movsd xmm1, qword [rsp + 0x38]
movsd qword [rcx + 0x10], xmm1
add rcx, 0x18
mov qword [rsp + 0x48], rcx
jmp 0x140085946
lea r8, [rsp + 0x28]
mov rdx, rcx
lea rcx, [rsp + 0x40]
call fcn.140085fb0
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
mov eax, dword [rbx + 4]
add rbx, rax
cmp rbx, rbp
jb 0x1400858e0
mov rax, qword [rsp + 0x40]
mov qword [rdi], rax
mov qword [rdi + 8], rcx
mov qword [rdi + 0x10], rdx
jmp 0x140085970
xor edx, edx
mov qword [rcx], rdx
mov qword [rcx + 8], rdx
mov qword [rcx + 0x10], rdx
mov rax, rdi
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400e9540
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x140086570
Capabilities:
Check for peb beingdebugged flag

Disassembly:
xor rax, rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 2]
and rax, 0xff
ret

Function at 0x140086587
Capabilities:
Check for peb ntglobalflag flag

Disassembly:
xor rax, rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0xbc]
and rax, 0x70
ret

Function at 0x1400865bd
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
mov qword [rcx], rdx
mov qword [rcx + 8], rax
xor rax, rax
mov rax, 5
shr rax, 2
sub rax, rbx
cmp rax, rcx
rdtsc
mov qword [rcx + 0x10], rdx
mov qword [rcx + 0x18], rax
ret
Function at 0x140086cd0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x40], rcx
xor esi, esi
cmp byte [r8 + 6], sil
je 0x140086d04
mov eax, esi
lea ecx, [rax - 6]
xor byte [r8 + rax], cl
inc rax
cmp rax, 5
jb 0x140086cf0
mov byte [r8 + 6], sil
lea rax, [r8 + 5]
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x20], sil
cmp r9, rax
je 0x140086d39
mov r8d, 5
mov rdx, r9
lea rcx, [rsp + 0x20]
call fcn.140006a80
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140086d47
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.1400110a0
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x140086dbe
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140086db9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140086db9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e97ec
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x140086dd0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x40], rcx
xor esi, esi
cmp byte [r8 + 7], sil
je 0x140086e04
mov eax, esi
lea ecx, [rax - 6]
xor byte [r8 + rax], cl
inc rax
cmp rax, 6
jb 0x140086df0
mov byte [r8 + 7], sil
lea rax, [r8 + 6]
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x20], sil
cmp r9, rax
je 0x140086e39
mov r8d, 6
mov rdx, r9
lea rcx, [rsp + 0x20]
call fcn.140006a80
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140086e47
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.1400110a0
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x140086ebe
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140086eb9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140086eb9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e97ec
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x140086ed0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x40], rcx
xor esi, esi
cmp byte [r8 + 8], sil
je 0x140086f04
mov eax, esi
lea ecx, [rax - 6]
xor byte [r8 + rax], cl
inc rax
cmp rax, 7
jb 0x140086ef0
mov byte [r8 + 8], sil
lea rax, [r8 + 7]
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x20], sil
cmp r9, rax
je 0x140086f39
mov r8d, 7
mov rdx, r9
lea rcx, [rsp + 0x20]
call fcn.140006a80
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140086f47
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.1400110a0
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x140086fbe
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140086fb9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140086fb9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e97ec
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x140086fd0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x40], rcx
xor esi, esi
cmp byte [r8 + 9], sil
je 0x140087004
mov eax, esi
lea ecx, [rax - 6]
xor byte [r8 + rax], cl
inc rax
cmp rax, 8
jb 0x140086ff0
mov byte [r8 + 9], sil
lea rax, [r8 + 8]
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x20], sil
cmp r9, rax
je 0x140087039
mov r8d, 8
mov rdx, r9
lea rcx, [rsp + 0x20]
call fcn.140006a80
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140087047
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.1400110a0
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x1400870be
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400870b9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400870b9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e97ec
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400870d0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x68], rcx
xor esi, esi
cmp byte [r8 + 6], sil
je 0x140087104
mov ecx, esi
lea eax, [rcx - 6]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 5
jb 0x1400870f0
mov byte [r8 + 6], sil
lea rax, [r8 + 5]
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x48], sil
cmp r9, rax
je 0x140087139
mov r8d, 5
mov rdx, r9
lea rcx, [rsp + 0x48]
call fcn.140006a80
nop
cmp byte [rbx + 0xa], 0
je 0x140087163
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 6]
xor byte [rcx + rbx], al
inc rcx
cmp rcx, 9
jb 0x140087150
mov byte [rbx + 0xa], 0
lea rax, [rbx + 9]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], 0
cmp rbx, rax
je 0x140087198
mov r8d, 9
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.140006a80
nop
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x28]
movzx edx, byte [rsp + 0x20]
mov rcx, rdi
call fcn.140010eb0
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x1400871f1
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400871eb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400871eb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e97ec
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x140087231
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14008722c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14008722c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e97ec
mov rax, rdi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x140087240
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x40], rcx
xor esi, esi
cmp byte [r8 + 0xa], sil
je 0x140087274
mov eax, esi
lea ecx, [rax - 6]
xor byte [r8 + rax], cl
inc rax
cmp rax, 9
jb 0x140087260
mov byte [r8 + 0xa], sil
lea rax, [r8 + 9]
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x20], sil
cmp r9, rax
je 0x1400872a9
mov r8d, 9
mov rdx, r9
lea rcx, [rsp + 0x20]
call fcn.140006a80
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x1400872b7
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.1400110a0
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x14008732e
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140087329
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140087329
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e97ec
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x140087340
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x68], rcx
xor esi, esi
cmp byte [r8 + 0xb], sil
je 0x140087374
mov ecx, esi
lea eax, [rcx - 6]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 0xa
jb 0x140087360
mov byte [r8 + 0xb], sil
lea rax, [r8 + 0xa]
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x48], sil
cmp r9, rax
je 0x1400873a9
mov r8d, 0xa
mov rdx, r9
lea rcx, [rsp + 0x48]
call fcn.140006a80
nop
cmp byte [rbx + 0xb], 0
je 0x1400873d3
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 6]
xor byte [rcx + rbx], al
inc rcx
cmp rcx, 0xa
jb 0x1400873c0
mov byte [rbx + 0xb], 0
lea rax, [rbx + 0xa]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], 0
cmp rbx, rax
je 0x140087408
mov r8d, 0xa
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.140006a80
nop
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x28]
movzx edx, byte [rsp + 0x20]
mov rcx, rdi
call fcn.140010eb0
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x140087461
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14008745b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14008745b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e97ec
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x1400874a1
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14008749c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14008749c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e97ec
mov rax, rdi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400874b0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x68], rcx
xor esi, esi
cmp byte [r8 + 0xc], sil
je 0x1400874e4
mov ecx, esi
lea eax, [rcx - 6]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 0xb
jb 0x1400874d0
mov byte [r8 + 0xc], sil
lea rax, [r8 + 0xb]
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x48], sil
cmp r9, rax
je 0x140087519
mov r8d, recv
mov rdx, r9
lea rcx, [rsp + 0x48]
call fcn.140006a80
nop
cmp byte [rbx + 0xb], 0
je 0x140087543
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 6]
xor byte [rcx + rbx], al
inc rcx
cmp rcx, 0xa
jb 0x140087530
mov byte [rbx + 0xb], 0
lea rax, [rbx + 0xa]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], 0
cmp rbx, rax
je 0x140087578
mov r8d, 0xa
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.140006a80
nop
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x28]
movzx edx, byte [rsp + 0x20]
mov rcx, rdi
call fcn.140010eb0
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x1400875d1
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400875cb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400875cb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e97ec
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x140087611
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14008760c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14008760c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e97ec
mov rax, rdi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret