joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140072e20
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov eax, 0xa3ac
xor r10d, r10d
mov word [rsp + 0x40], ax
mov r9d, r10d
mov eax, 0xa3a9
mov edi, 0x5c07
mov word [rsp + 0x42], ax
movabs r11, 0x719724727eb4a3f9
mov eax, 0xa3d6
lea ebx, [r10 + 0xf]
mov word [rsp + 0x44], ax
mov eax, 0xa3aa
mov word [rsp + 0x46], ax
mov eax, 0xa3a1
mov word [rsp + 0x48], ax
mov eax, 0xa394
mov word [rsp + 0x4a], ax
mov eax, 0xa39f
mov word [rsp + 0x4c], ax
mov eax, 0xa407
mov word [rsp + 0x4e], ax
movzx eax, word [rsp + 0x40]
nop dword [rax + rax]
movzx r8d, word [rsp + r9*2 + 0x40]
mov rcx, r9
and ecx, ebx
movzx eax, r9w
cmp rcx, rbx
mov rdx, r11
cmovae rcx, rbx
sub ax, di
shl cl, 2
shr rdx, cl
and dx, bx
xor dx, ax
xor dx, r8w
mov word [rsp + r9*2 + 0x40], dx
inc r9
cmp r9, 8
jb 0x140072ea0
mov qword [rsp + 0x30], r10
lea rcx, [rsp + 0x40]
xor r9d, r9d
mov dword [rsp + 0x28], r10d
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x14013f9d8], rax
test rax, rax
je 0x140072f22
cmp rax, 0xffffffffffffffff
setne al
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret

Function at 0x140072fb0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x160
mov rax, qword [0x14013f240]
xor rax, rsp
mov qword [rsp + 0x150], rax
xor edx, edx
mov rdi, rcx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], pe_nt_image_headers64
mov rcx, rax
mov rbx, rax
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x140073023
nop dword [rax + rax]
mov rdx, rdi
lea rcx, [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
mov rcx, rbx
test eax, eax
je 0x14007304f
lea rdx, [rsp + 0x20]
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x140073000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1400e50f0
mov rbx, qword [rsp + 0x178]
add rsp, 0x160
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x28]
mov dword [0x14013f9e0], eax
jmp 0x14007302e
Function at 0x140073070
Capabilities:
Create thread

Disassembly:
sub rsp, 0x68
mov rax, qword [0x14013f240]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov ecx, 8
call fcn.1400e4cb0
test rax, rax
je 0x14007309c
lea rcx, [0x14007d230]
mov qword [rax], rcx
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x140052c20]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14007310e
cmp dword [rsp + 0x38], 0
je 0x140073103
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call sub.MSVCP140.dll__Thrd_detach
test eax, eax
jne 0x140073103
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400e50f0
add rsp, 0x68
ret
mov ecx, 1
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
mov dword [rsp + 0x38], 0
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
Function at 0x14007b100
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x14013f240]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov esi, edx
mov rdi, rcx
cmp edx, 0xffffffff
jne 0x14007b12d
xor eax, eax
jmp 0x14007b296
mov qword [rsp + 0xa0], rbx
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
test rax, rax
je 0x14007b16d
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::epptr_void_const___ptr64]
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
cmp rax, rbx
jae 0x14007b16d
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], sil
mov eax, esi
jmp 0x14007b28e
cmp qword [rdi + 0x80], 0
je 0x14007b289
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::eback_void_const___ptr64]
lea rcx, [rdi + 0x70]
cmp rax, rcx
jne 0x14007b1a7
mov rdx, qword [rdi + 0x88]
mov rcx, rdi
mov r9, qword [rdi + 0x90]
mov r8, rdx
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::setg_char____ptr64__char____ptr64__char____ptr64____ptr64]
mov rcx, qword [rdi + 0x68]
test rcx, rcx
jne 0x14007b1d2
mov rdx, qword [rdi + 0x80]
movsx ecx, sil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, esi
mov eax, ecx
jmp 0x14007b28e
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], sil
mov qword [rsp + 0x38], rax
lea rdx, [rdi + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14007b241
sub eax, 1
je 0x14007b241
cmp eax, 2
jne 0x14007b289
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rdi + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, esi
mov eax, ecx
jmp 0x14007b28e
mov rbx, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rbx, rax
je 0x14007b26f
mov r9, qword [rdi + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rbx
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rbx, rax
jne 0x14007b289
lea rax, [rsp + 0x50]
mov byte [rdi + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, esi
mov eax, ecx
jmp 0x14007b28e
mov eax, 0xffffffff
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400e50f0
mov rsi, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x14007dd60
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0xb0
mov rax, qword [0x14013f240]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov byte [rbp - 0x49], 0xd5
xor r10d, r10d
mov byte [rbp - 0x48], __WSAFDIsSet
movabs rsi, 0x8e0667245367a5f9
mov byte [rbp - 0x47], 0xde
mov r11, rsi
mov byte [rbp - 0x46], reloc.WLDAP32.dll_Ordinal_211
mov r9, rdx
mov byte [rbp - 0x45], reloc.WS2_32.dll___WSAFDIsSet
lea r14d, [r10 + 0xf]
mov byte [rbp - 0x44], Ordinal_217
mov rbx, rcx
mov byte [rbp - 0x43], reloc.WLDAP32.dll_Ordinal_217
mov byte [rbp - 0x42], 0x61
mov byte [rbp - 0x41], Ordinal_45
mov byte [rbp - 0x40], 0x25
mov byte [rbp - 0x3f], 0x7d
mov byte [rbp - 0x3e], Ordinal_35
mov byte [rbp - 0x3d], Ordinal_41
mov byte [rbp - 0x3c], Ordinal_79
mov byte [rbp - 0x3b], 0x33
mov byte [rbp - 0x3a], 0x25
mov byte [rbp - 0x39], Ordinal_79
mov byte [rbp - 0x38], 0x3f
mov byte [rbp - 0x37], Ordinal_46
mov byte [rbp - 0x36], 0x55
mov byte [rbp - 0x35], Ordinal_45
mov byte [rbp - 0x34], reloc.WLDAP32.dll_Ordinal_45
mov byte [rbp - 0x33], 0x56
mov byte [rbp - 0x32], reloc.WS2_32.dll_setsockopt
movzx eax, byte [rbp - 0x49]
lea rax, [rbp - 0x49]
mov qword [rbp - 0x29], rcx
sub r11, rax
nop dword [rax]
mov rcx, r10
lea rdx, [rbp - 0x49]
add rdx, r10
and ecx, r14d
cmp rcx, r14
mov rax, rsi
cmovae rcx, r14
movzx r8d, byte [rdx]
add dl, r11b
shl cl, 2
shr rax, cl
and al, r14b
xor al, dl
xor al, r8b
mov byte [rbp + r10 - 0x49], al
inc r10
cmp r10, 0x18
jb 0x14007de10
lea r8, [rbp - 0x49]
mov edx, 0x50
lea rcx, [rbp - 0x19]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll_strftime]
xorps xmm0, xmm0
lea rax, [rbp - 0x19]
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], 0
mov r8, 0xffffffffffffffff
mov qword [rbx + 0x18], 0
nop
inc r8
cmp byte [rax + r8], 0
jne 0x14007de80
lea rdx, [rbp - 0x19]
mov rcx, rbx
call fcn.140002930
mov rax, rbx
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.1400e50f0
mov rbx, qword [rsp + 0xe0]
add rsp, 0xb0
pop r14
pop rsi
pop rbp
ret
Function at 0x140080e90
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rsi, r8
mov r14, rdx
mov rbp, rcx
test r8, r8
jg 0x140080eb2
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x140080ec8
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov qword [rsp + 0x28], rbx
mov rbx, rsi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Gnavail_void_const___ptr64]
test rax, rax
je 0x140080f12
cmp rax, rsi
mov rdi, rsi
mov rcx, rbp
cmovb rdi, rax
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gptr_void_const___ptr64]
mov r8, rdi
mov rcx, r14
mov rdx, rax
call sub.VCRUNTIME140.dll_memcpy
mov edx, edi
mov rcx, rbp
add r14, rdi
sub rbx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int____ptr64]
cmp qword [rbp + 0x80], 0
mov rdi, rbx
je 0x140080f81
mov rcx, rbp
call fcn.14006eb30
cmp rbx, 0xfff
jbe 0x140080f61
mov r9, qword [rbp + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
add r14, rax
mov rdi, rbx
cmp rax, 0xfff
jne 0x140080f9a
cmp rbx, rax
ja 0x140080f30
test rdi, rdi
je 0x140080f81
mov r9, qword [rbp + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rdi, rax
sub rsi, rdi
mov rbx, qword [rsp + 0x28]
mov rax, rsi
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
sub rsi, rbx
jmp 0x140080f84
Function at 0x140080fa0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je 0x140080fc8
add rsp, 0x20
pop r14
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov rbp, rax
test rbx, rbx
jle 0x14008103c
test rax, rax
jle 0x14008101c
cmp rbx, rax
mov rcx, rdi
cmovl rbp, rbx
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, rbp
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov edx, ebp
mov rcx, rdi
add r14, rbp
sub rbx, rbp
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
test rbx, rbx
jle 0x14008103c
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x14008103c
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov rbp, qword [rsp + 0x40]
sub rsi, rbx
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rbx
ret
Function at 0x140082250
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 7], sil
je 0x140082284
mov eax, esi
lea ecx, [rax - 0x65]
xor byte [r8 + rax], cl
inc rax
cmp rax, 6
jb 0x140082270
mov byte [r8 + 7], sil
add r8, 6
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.140051470
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x1400822a9
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.14008fdc0
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140082323
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14008231e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14008231e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e4cec
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x140082330
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r10, r8
mov rdi, rdx
mov rsi, rcx
mov qword [rsp + 0x28], rcx
xor ebx, ebx
cmp byte [r8 + 9], bl
je 0x140082364
mov ecx, ebx
lea eax, [rcx - 0x65]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 8
jb 0x140082350
mov byte [r8 + 9], bl
add r8, 8
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x50]
call fcn.140051470
nop
cmp byte [rdi + 9], 0
je 0x140082394
lea eax, [rbx - 0x65]
xor byte [rbx + rdi], al
inc rbx
cmp rbx, 8
jb 0x140082381
mov byte [rdi + 9], 0
lea r8, [rdi + 8]
lea r9, [rsp + 0x20]
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.140051470
nop
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
movzx edx, byte [rsp + 0x20]
mov rcx, rsi
call fcn.140054040
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140082404
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400823fe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400823fe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e4cec
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x140082444
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14008243f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14008243f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e4cec
mov rax, rsi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x140082450
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 9], sil
je 0x140082484
mov eax, esi
lea ecx, [rax - 0x65]
xor byte [r8 + rax], cl
inc rax
cmp rax, 8
jb 0x140082470
mov byte [r8 + 9], sil
add r8, 8
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.140051470
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x1400824a9
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.14008fdc0
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140082523
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14008251e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14008251e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e4cec
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x140082530
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 0xa], sil
je 0x140082564
mov eax, esi
lea ecx, [rax - 0x65]
xor byte [r8 + rax], cl
inc rax
cmp rax, 9
jb 0x140082550
mov byte [r8 + 0xa], sil
add r8, 9
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.140051470
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140082589
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.14008fdc0
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140082603
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400825fe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400825fe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e4cec
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x140082610
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 0xc], sil
je 0x140082644
mov eax, esi
lea ecx, [rax - 0x65]
xor byte [r8 + rax], cl
inc rax
cmp rax, 0xb
jb 0x140082630
mov byte [r8 + 0xc], sil
add r8, 0xb
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.140051470
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140082669
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.14008fdc0
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x1400826e3
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400826de
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400826de
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e4cec
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x140088fa0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 9], al
je 0x140088fc3
lea edx, [rax - 0x65]
xor byte [rax + rcx], dl
inc rax
cmp rax, 8
jb 0x140088fb0
mov byte [rcx + 9], 0
lea r8, [rcx + 8]
mov rdx, rcx
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.140051470
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x140088fe0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 0x10], al
je 0x140089003
lea edx, [rax - 0x65]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xf
jb 0x140088ff0
mov byte [rcx + 0x10], 0
lea r8, [rcx + 0xf]
mov rdx, rcx
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.140051470
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x14008a280
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 5], 0
je 0x14008a2a3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x65]
xor byte [rax + rcx], dl
inc rax
cmp rax, 4
jb 0x14008a290
mov byte [rcx + 5], 0
mov rax, rcx
ret

Function at 0x14008a2b0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x136], 0
je 0x14008a2d8
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x65]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x135
jb 0x14008a2c0
mov byte [rcx + 0x136], 0
mov rax, rcx
ret

Function at 0x14008a2e0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x44], 0
je 0x14008a303
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x65]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x43
jb 0x14008a2f0
mov byte [rcx + 0x44], 0
mov rax, rcx
ret
Function at 0x14008a310
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x47], 0
je 0x14008a333
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x65]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x46
jb 0x14008a320
mov byte [rcx + 0x47], 0
mov rax, rcx
ret
Function at 0x14008b570
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
mov r10, rcx
mov ecx, r9d
test r8, r8
je 0x14008b657
sub r10, rdx
cmp r8, 8
jb 0x14008b633
mov rax, r8
lea r9, [rdx + 4]
and rax, 0xfffffffffffffff8
xorps xmm3, xmm3
xorps xmm2, xmm2
movd xmm1, dword [r10 + r9 - 4]
add rcx, 8
movd xmm0, dword [r9 - 4]
lea r9, [r9 + 8]
punpcklbw xmm1, xmm1
punpcklwd xmm1, xmm1
punpcklbw xmm0, xmm0
psrad xmm1, 0x18
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
pxor xmm1, xmm0
movd xmm0, dword [r9 - 8]
punpcklbw xmm0, xmm0
por xmm3, xmm1
movd xmm1, dword [r10 + r9 - 8]
punpcklbw xmm1, xmm1
punpcklwd xmm1, xmm1
punpcklwd xmm0, xmm0
psrad xmm1, 0x18
psrad xmm0, 0x18
pxor xmm1, xmm0
por xmm2, xmm1
cmp rcx, rax
jb 0x14008b5a0
por xmm2, xmm3
movdqa xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movdqa xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movd r9d, xmm2
cmp rcx, r8
jae 0x14008b657
lea rax, [rcx + rdx]
sub r8, rcx
nop word [rax + rax]
movsx edx, byte [r10 + rax]
movsx ecx, byte [rax]
lea rax, [rax + 1]
xor edx, ecx
or r9d, edx
sub r8, 1
jne 0x14008b640
test r9d, r9d
sete al
ret