joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400164c0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [0x1400c7de8]
mov rbx, rcx
xor ecx, ecx
mov dword [rax + 0x5bf4], ecx
test rbx, rbx
je 0x14001652f
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x38], rdi
call fcn.140016540
lea rdx, [0x14004ff74]
mov rcx, rbx
mov rdi, rax
call fcn.14000b300
mov rbx, rax
test rax, rax
je 0x14001652a
mov r8, qword [rsp + 0x30]
mov r9, rax
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret

Function at 0x14001a710
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push r14
sub rsp, 0x20
mov rbx, qword [0x1400c7de8]
cmp byte [rbx + 0x5bf1], 0
jne 0x14001a86a
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x14001a863
lea rdx, [0x14004ff70]
mov qword [rsp + 0x40], rdi
call fcn.14000b300
mov rdi, rax
test rax, rax
je 0x14001a85e
mov qword [rsp + 0x30], rbp
mov rcx, rax
mov qword [rsp + 0x38], rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebp, eax
cmp eax, 0xffffffff
je 0x14001a84b
xor edx, edx
mov rcx, rdi
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x14001a84b
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rsi, eax
cmp esi, 0xffffffff
je 0x14001a84b
xor r8d, r8d
mov edx, ebp
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x14001a84b
cmp rsi, 0xffffffffffffffff
je 0x14001a84b
mov rax, qword [0x1400c7de8]
test rax, rax
je 0x14001a7d5
inc dword [rax + 0xf4]
mov rdx, qword [0x1400c7df8]
mov rcx, rsi
call qword [0x1400ad218]
mov rbp, rax
test rax, rax
je 0x14001a84b
mov r9, rdi
mov r8, rsi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rdi
cmp rax, rsi
je 0x14001a811
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
jmp 0x14001a827
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rsi, rsi
je 0x14001a827
mov rdx, rsi
mov rcx, rbp
call fcn.14000cd40
mov rax, qword [0x1400c7de8]
test rax, rax
je 0x14001a839
dec dword [rax + 0xf4]
mov rdx, qword [0x1400c7df8]
mov rcx, rbp
call qword [0x1400ad220]
jmp 0x14001a854
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rsi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x40]
mov byte [rbx + 0x5bf1], 1
movss xmm0, dword [rbx + 0x5bf4]
xorps xmm1, xmm1
comiss xmm0, xmm1
jbe 0x14001a8ad
subss xmm0, dword [rbx + 0x18]
comiss xmm1, xmm0
movss dword [rbx + 0x5bf4], xmm0
jb 0x14001a8ad
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x14001a89c
call fcn.1400164c0
jmp 0x14001a8a3
mov byte [rbx + 0xdc], 1
mov dword [rbx + 0x5bf4], 0
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x14002f9a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1400c7de8]
mov rcx, qword [rax + 0x4b40]
mov r10, qword [rax + 0x3ed8]
movsxd rax, dword [rcx + 0x74]
movups xmm0, xmmword [rcx + 0x168]
movss xmm4, dword [rcx + 0x168]
movss xmm3, dword [rcx + 0x16c]
movss xmm2, dword [rcx + 0x170]
movss xmm1, dword [rcx + 0x174]
movss dword [rsp + 0x20], xmm4
movss dword [rsp + 0x24], xmm3
movss dword [rsp + 0x28], xmm2
movss dword [rsp + 0x2c], xmm1
imul r9, rax, 0x70
mov rax, qword [r10 + 0x298]
add r9, qword [rcx + 0x18]
movups xmmword [r10 + 0x238], xmm0
movss dword [rax + 0x88], xmm4
movss dword [rax + 0x8c], xmm3
movss dword [rax + 0x90], xmm2
movss dword [rax + 0x94], xmm1
mov rax, qword [r10 + 0x298]
movups xmm0, xmmword [rsp + 0x20]
movsxd r8, dword [rax + 0x58]
mov rdx, qword [rax + 0x60]
add r8, r8
movups xmmword [rdx + r8*8 - 0x10], xmm0
movzx r8d, word [r9 + 0x5c]
mov rdx, qword [r10 + 0x298]
mov rcx, qword [rcx + 0x198]
add rsp, 0x38
jmp 0x1400248b0

Function at 0x14002fa70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1400c7de8]
mov rcx, qword [rax + 0x4b40]
mov r9, qword [rax + 0x3ed8]
movups xmm0, xmmword [r9 + 0x238]
movups xmmword [rcx + 0x168], xmm0
mov rax, qword [r9 + 0x298]
movups xmm0, xmmword [rcx + 0x148]
movss xmm4, dword [rcx + 0x148]
movss xmm3, dword [rcx + 0x14c]
movss xmm2, dword [rcx + 0x150]
movss xmm1, dword [rcx + 0x154]
movups xmmword [r9 + 0x238], xmm0
movss dword [rsp + 0x20], xmm4
movss dword [rsp + 0x24], xmm3
movss dword [rsp + 0x28], xmm2
movss dword [rsp + 0x2c], xmm1
movss dword [rax + 0x88], xmm4
movss dword [rax + 0x8c], xmm3
movss dword [rax + 0x90], xmm2
movss dword [rax + 0x94], xmm1
mov rax, qword [r9 + 0x298]
movups xmm0, xmmword [rsp + 0x20]
movsxd r8, dword [rax + 0x58]
mov rdx, qword [rax + 0x60]
add r8, r8
movups xmmword [rdx + r8*8 - 0x10], xmm0
movzx r8d, word [rcx + 0x21e]
mov rcx, qword [rcx + 0x198]
mov rdx, qword [r9 + 0x298]
add rsp, 0x38
jmp 0x1400248b0
Function at 0x14004b4c0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14004b50a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14004b50a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14004b50a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14004b50a
cmp dword [rcx + 0x84], 0xe
jbe 0x14004b50a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14004b50c
xor al, al
add rsp, 0x28
ret
Function at 0x1400041f0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x47], 0
je 0x140004213
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x14]
xor byte [rcx + rax], dl
inc rax
cmp rax, 0x46
jb 0x140004200
mov byte [rcx + 0x47], 0
mov rax, rcx
ret

Function at 0x140004220
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x68], rcx
xor esi, esi
cmp byte [r8 + 6], sil
je 0x140004254
mov ecx, esi
lea eax, [rcx - 0x14]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 5
jb 0x140004240
mov byte [r8 + 6], sil
lea rax, [r8 + 5]
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x48], sil
cmp r9, rax
je 0x140004289
mov r8d, 5
mov rdx, r9
lea rcx, [rsp + 0x48]
call fcn.14000a520
nop
cmp byte [rbx + 0xa], 0
je 0x1400042b3
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x14]
xor byte [rbx + rcx], al
inc rcx
cmp rcx, 9
jb 0x1400042a0
mov byte [rbx + 0xa], 0
lea rax, [rbx + 9]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], 0
cmp rbx, rax
je 0x1400042e8
mov r8d, 9
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.14000a520
nop
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x28]
mov rcx, rdi
call fcn.14000c4e0
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x14000433c
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004336
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004336
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007cd7c
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x14000437c
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004377
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004377
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007cd7c
mov rax, rdi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x140004390
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x48], rcx
xor esi, esi
cmp byte [r8 + 7], sil
je 0x1400043c4
mov ecx, esi
lea eax, [rcx - 0x14]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 6
jb 0x1400043b0
mov byte [r8 + 7], sil
lea rax, [r8 + 6]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], sil
cmp r9, rax
je 0x1400043f9
mov r8d, 6
mov rdx, r9
lea rcx, [rsp + 0x28]
call fcn.14000a520
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140004407
mov rbx, qword [rbx]
mov r8, rbx
lea rcx, [rsp + 0x28]
call fcn.14000d4b0
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x14000447c
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004477
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004477
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007cd7c
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x140004490
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x48], rcx
xor esi, esi
cmp byte [r8 + 0xa], sil
je 0x1400044c4
mov ecx, esi
lea eax, [rcx - 0x14]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 9
jb 0x1400044b0
mov byte [r8 + 0xa], sil
lea rax, [r8 + 9]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], sil
cmp r9, rax
je 0x1400044f9
mov r8d, 9
mov rdx, r9
lea rcx, [rsp + 0x28]
call fcn.14000a520
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140004507
mov rbx, qword [rbx]
mov r8, rbx
lea rcx, [rsp + 0x28]
call fcn.14000d4b0
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x14000457c
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004577
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004577
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007cd7c
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x140004590
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x136], 0
je 0x1400045b8
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x14]
xor byte [rcx + rax], dl
inc rax
cmp rax, 0x135
jb 0x1400045a0
mov byte [rcx + 0x136], 0
mov rax, rcx
ret
Function at 0x140005140
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x68], rcx
xor esi, esi
cmp byte [r8 + 0xb], sil
je 0x140005174
mov ecx, esi
lea eax, [rcx - 0x14]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 0xa
jb 0x140005160
mov byte [r8 + 0xb], sil
lea rax, [r8 + 0xa]
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x48], sil
cmp r9, rax
je 0x1400051a9
mov r8d, 0xa
mov rdx, r9
lea rcx, [rsp + 0x48]
call fcn.14000a520
nop
cmp byte [rbx + 0xb], 0
je 0x1400051d3
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x14]
xor byte [rbx + rcx], al
inc rcx
cmp rcx, 0xa
jb 0x1400051c0
mov byte [rbx + 0xb], 0
lea rax, [rbx + 0xa]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], 0
cmp rbx, rax
je 0x140005208
mov r8d, 0xa
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.14000a520
nop
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x28]
mov rcx, rdi
call fcn.14000c4e0
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x14000525c
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005256
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005256
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007cd7c
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x14000529c
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005297
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005297
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007cd7c
mov rax, rdi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400052b0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x48], rcx
xor esi, esi
cmp byte [r8 + 0xc], sil
je 0x1400052e4
mov ecx, esi
lea eax, [rcx - 0x14]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 0xb
jb 0x1400052d0
mov byte [r8 + 0xc], sil
lea rax, [r8 + 0xb]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], sil
cmp r9, rax
je 0x140005319
mov r8d, ntohs
mov rdx, r9
lea rcx, [rsp + 0x28]
call fcn.14000a520
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140005327
mov rbx, qword [rbx]
mov r8, rbx
lea rcx, [rsp + 0x28]
call fcn.14000d4b0
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x14000539c
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005397
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005397
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007cd7c
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x140006010
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x68], rcx
xor esi, esi
cmp byte [r8 + 0xb], sil
je 0x140006044
mov ecx, esi
lea eax, [rcx - 0x14]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 0xa
jb 0x140006030
mov byte [r8 + 0xb], sil
lea rax, [r8 + 0xa]
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x48], sil
cmp r9, rax
je 0x140006079
mov r8d, 0xa
mov rdx, r9
lea rcx, [rsp + 0x48]
call fcn.14000a520
nop
cmp byte [rbx + 0xe], 0
je 0x1400060a3
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x14]
xor byte [rbx + rcx], al
inc rcx
cmp rcx, 0xd
jb 0x140006090
mov byte [rbx + 0xe], 0
lea rax, [rbx + 0xd]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], 0
cmp rbx, rax
je 0x1400060d8
mov r8d, reloc.WS2_32.dll_listen
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.14000a520
nop
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x28]
mov rcx, rdi
call fcn.14000c4e0
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x14000612c
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006126
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006126
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007cd7c
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x14000616c
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006167
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006167
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007cd7c
mov rax, rdi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x140006180
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x48], rcx
xor esi, esi
cmp byte [r8 + 6], sil
je 0x1400061b4
mov ecx, esi
lea eax, [rcx - 0x14]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 5
jb 0x1400061a0
mov byte [r8 + 6], sil
lea rax, [r8 + 5]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], sil
cmp r9, rax
je 0x1400061e9
mov r8d, 5
mov rdx, r9
lea rcx, [rsp + 0x28]
call fcn.14000a520
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x1400061f7
mov rbx, qword [rbx]
mov r8, rbx
lea rcx, [rsp + 0x28]
call fcn.14000d4b0
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x14000626c
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006267
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006267
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007cd7c
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x140006b70
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x68], rcx
xor esi, esi
cmp byte [r8 + 0xb], sil
je 0x140006ba4
mov ecx, esi
lea eax, [rcx - 0x14]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 0xa
jb 0x140006b90
mov byte [r8 + 0xb], sil
lea rax, [r8 + 0xa]
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x48], sil
cmp r9, rax
je 0x140006bd9
mov r8d, 0xa
mov rdx, r9
lea rcx, [rsp + 0x48]
call fcn.14000a520
nop
cmp byte [rbx + 0xd], 0
je 0x140006c03
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x14]
xor byte [rbx + rcx], al
inc rcx
cmp rcx, 0xc
jb 0x140006bf0
mov byte [rbx + 0xd], 0
lea rax, [rbx + 0xc]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], 0
cmp rbx, rax
je 0x140006c38
mov r8d, ntohs
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.14000a520
nop
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x28]
mov rcx, rdi
call fcn.14000c4e0
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x140006c8c
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006c86
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006c86
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007cd7c
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x140006ccc
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006cc7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006cc7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007cd7c
mov rax, rdi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x140007250
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x68], rcx
xor esi, esi
cmp byte [r8 + 0xc], sil
je 0x140007284
mov ecx, esi
lea eax, [rcx - 0x14]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 0xb
jb 0x140007270
mov byte [r8 + 0xc], sil
lea rax, [r8 + 0xb]
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x48], sil
cmp r9, rax
je 0x1400072b9
mov r8d, ntohs
mov rdx, r9
lea rcx, [rsp + 0x48]
call fcn.14000a520
nop
cmp byte [rbx + 9], 0
je 0x1400072e3
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x14]
xor byte [rbx + rcx], al
inc rcx
cmp rcx, 8
jb 0x1400072d0
mov byte [rbx + 9], 0
lea rax, [rbx + 8]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], 0
cmp rbx, rax
je 0x140007318
mov r8d, 8
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.14000a520
nop
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x28]
mov rcx, rdi
call fcn.14000c4e0
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x14000736c
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007366
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007366
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007cd7c
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x1400073ac
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400073a7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400073a7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007cd7c
mov rax, rdi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400078e0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x68], rcx
xor esi, esi
cmp byte [r8 + 0xc], sil
je 0x140007914
mov ecx, esi
lea eax, [rcx - 0x14]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 0xb
jb 0x140007900
mov byte [r8 + 0xc], sil
lea rax, [r8 + 0xb]
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x48], sil
cmp r9, rax
je 0x140007949
mov r8d, ntohs
mov rdx, r9
lea rcx, [rsp + 0x48]
call fcn.14000a520
nop
cmp byte [rbx + 0xb], 0
je 0x140007973
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x14]
xor byte [rbx + rcx], al
inc rcx
cmp rcx, 0xa
jb 0x140007960
mov byte [rbx + 0xb], 0
lea rax, [rbx + 0xa]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], 0
cmp rbx, rax
je 0x1400079a8
mov r8d, 0xa
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.14000a520
nop
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x28]
mov rcx, rdi
call fcn.14000c4e0
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x1400079fc
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400079f6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400079f6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007cd7c
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x140007a3c
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007a37
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007a37
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007cd7c
mov rax, rdi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret