joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14005b410
Capabilities:
Hash data with crc32

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov r14, rcx
mov dl, byte [rcx]
test dl, dl
je 0x14005b47a
lea rax, [r14 + 2]
mov r8d, 0xffffffff
lea rsi, [0x1401ca9b0]
mov ecx, 0xffffffff
jmp 0x14005b45a
movzx edx, dl
movzx edi, cl
shr ecx, 8
xor edi, edx
xor ecx, dword [rsi + rdi*4]
add rax, 1
mov edx, r9d
test r9b, r9b
je 0x14005b476
movzx r9d, byte [rax - 1]
cmp dl, 0x23
jne 0x14005b440
cmp r9b, 0x23
jne 0x14005b440
cmp byte [rax], 0x23
cmove ecx, r8d
mov r9b, reloc.WLDAP32.dll_Ordinal_35
jmp 0x14005b440
not ecx
jmp 0x14005b47c
xor ecx, ecx
mov rdx, qword [0x1402808a8]
mov rsi, qword [rdx + 0x3060]
test rsi, rsi
je 0x14005b4ca
lea rbx, [rsi + 4]
xor eax, eax
nop word cs:[rax + rax]
nop
cmp dword [rbx], ecx
je 0x14005b4d3
movsxd rdi, dword [rbx - 4]
add rdi, rbx
movsxd rbx, dword [rdx + 0x3058]
add rbx, rsi
add rbx, 4
cmp rdi, rbx
cmove rdi, rax
mov rbx, rdi
test rdi, rdi
jne 0x14005b4a0
jmp 0x14005b4cc
xor eax, eax
test rax, rax
jne 0x14005b50a
jmp 0x14005b4f9
mov rax, rbx
test rax, rax
jne 0x14005b50a
jmp 0x14005b4f9
mov ecx, dword [0x14027a2b4]
lea edx, [rcx - 1]
imul edx, ecx
and edx, 1
je 0x14005b50a
mov rcx, r14
call fcn.14005b030
mov rcx, r14
call fcn.14005b030
cmp dword [0x14027a2b0], 0xa
jge 0x14005b4e0
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x1400626a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
cmp r9d, 0x1000000
jb 0x140062839
mov edi, r9d
mov r14, r8
mov rbx, rdx
mov rsi, rcx
movss xmm3, dword [rsp + 0x80]
xorps xmm0, xmm0
ucomiss xmm3, xmm0
jbe 0x140062716
mov eax, dword [rsp + 0x88]
mov dword [rsp + 0x20], eax
mov rcx, rsi
mov rdx, rbx
mov r8, r14
call fcn.140061de0
mov r8d, dword [rsi + 0x80]
mov rdx, qword [rsi + 0x88]
mov rcx, rsi
mov r9d, edi
call fcn.140061280
mov dword [rsi + 0x80], 0
jmp 0x140062839
cmp dword [0x14027d104], 0xa
jl 0x140062730
mov eax, dword [0x14027d100]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
jne 0x14006275d
mov rcx, rsi
mov edx, 6
mov r8d, 4
call fcn.140060170
cmp dword [0x14027d104], 0xa
jl 0x140062772
mov eax, dword [0x14027d100]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
je 0x140062772
mov rcx, rsi
mov edx, 6
mov r8d, 4
call fcn.140060170
jmp 0x140062730
mov r8d, dword [rbx]
mov r10d, dword [rbx + 4]
mov r11d, dword [r14]
mov r9d, dword [r14 + 4]
mov rdx, qword [rsi + 0x38]
mov r15, qword [rdx]
mov eax, dword [rsi + 0x48]
mov rcx, qword [rsi + 0x58]
mov word [rcx], ax
lea ecx, [rax + 1]
mov rdx, qword [rsi + 0x58]
mov word [rdx + 2], cx
lea ecx, [rax + 2]
mov rdx, qword [rsi + 0x58]
mov word [rdx + 4], cx
mov rdx, qword [rsi + 0x58]
mov word [rdx + 6], ax
mov rdx, qword [rsi + 0x58]
mov word [rdx + 8], cx
add eax, 3
mov rcx, qword [rsi + 0x58]
mov word [rcx + 0xa], ax
mov rax, qword [rsi + 0x50]
mov rcx, qword [rbx]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov qword [rax + 8], r15
mov rax, qword [rsi + 0x50]
mov dword [rax + 0x10], edi
mov rax, qword [rsi + 0x50]
mov dword [rax + 0x14], r11d
mov dword [rax + 0x18], r10d
mov rax, qword [rsi + 0x50]
mov qword [rax + 0x1c], r15
mov rax, qword [rsi + 0x50]
mov dword [rax + 0x24], edi
mov rax, qword [rsi + 0x50]
mov rcx, qword [r14]
mov qword [rax + 0x28], rcx
mov rax, qword [rsi + 0x50]
mov qword [rax + 0x30], r15
mov rax, qword [rsi + 0x50]
mov dword [rax + 0x38], edi
mov rax, qword [rsi + 0x50]
mov dword [rax + 0x3c], r8d
mov dword [rax + 0x40], r9d
mov rax, qword [rsi + 0x50]
mov qword [rax + 0x44], r15
mov rax, qword [rsi + 0x50]
mov dword [rax + 0x4c], edi
add qword [rsi + 0x50], 0x50
add dword [rsi + 0x48], 4
add qword [rsi + 0x58], 0xc
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1400990e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
sub rsp, 0x88
movaps xmmword [rsp + 0x70], xmm6
movaps xmm6, xmm2
mov edi, edx
mov r8, rcx
mov rax, qword [0x140279c48]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov al, byte [rcx]
jmp 0x14009911d
add r8, 1
movzx eax, byte [r8 + 1]
add r8, 1
test al, al
je 0x140099137
cmp al, 0x25
jne 0x140099114
cmp byte [r8 + 1], 0x25
je 0x140099110
mov al, 1
test al, al
jne 0x140099141
jmp 0x1400991ff
xor eax, eax
test al, al
je 0x1400991ff
cmp byte [r8 + 1], 0x25
je 0x1400991ff
lea rsi, [rsp + 0x20]
cvtss2sd xmm3, xmm6
mov edx, 0x40
mov rcx, rsi
movq r9, xmm3
call fcn.14003cfb0
nop word [rax + rax]
movzx eax, byte [rsi]
add rsi, 1
cmp al, 0x20
je 0x140099170
and edi, 0xfffffffe
cmp edi, 8
jne 0x140099199
add rsi, 0xffffffffffffffff
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atof]
xorps xmm6, xmm6
cvtsd2ss xmm6, xmm0
jmp 0x1400991ff
xor ecx, ecx
cmp al, 0x2d
sete cl
xor edx, edx
cmp byte [rsi + rcx - 1], 0x2b
sete dl
add rdx, rcx
mov cl, byte [rsi + rdx - 1]
lea edi, [rcx - 0x30]
xorps xmm6, xmm6
cmp dil, 9
ja 0x1400991f4
add rsi, rdx
xorps xmm6, xmm6
movss xmm0, dword [0x1401186d0]
nop dword [rax + rax]
movzx ecx, cl
mulss xmm6, xmm0
add ecx, 0xffffffd0
xorps xmm1, xmm1
cvtsi2ss xmm1, ecx
addss xmm6, xmm1
movzx ecx, byte [rsi]
lea edx, [rcx - 0x30]
add rsi, 1
cmp dl, 0xa
jb 0x1400991d0
cmp al, 0x2d
jne 0x1400991ff
xorps xmm6, xmmword [0x140118700]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1400c4bd0
movaps xmm0, xmm6
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x88
pop rdi
pop rsi
ret

Function at 0x140099830
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
sub rsp, 0x88
movaps xmmword [rsp + 0x70], xmm6
movdqa xmm6, xmm2
mov rax, qword [0x140279c48]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov al, byte [rcx]
test al, al
je 0x140099940
mov edi, edx
mov r8, rcx
jmp 0x140099881
movzx eax, byte [r8 + 1]
add r8, 1
test al, al
je 0x140099940
cmp al, 0x25
jne 0x140099870
cmp byte [r8 + 1], 0x25
jne 0x140099892
add r8, 1
jmp 0x140099870
lea rsi, [rsp + 0x20]
mov edx, 0x40
mov rcx, rsi
movdqa xmm3, xmm6
movq r9, xmm6
call fcn.14003cfb0
nop dword [rax]
movzx eax, byte [rsi]
add rsi, 1
cmp al, 0x20
je 0x1400998b0
and edi, 0xfffffffe
cmp edi, 8
jne 0x1400998d5
add rsi, 0xffffffffffffffff
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atof]
movaps xmm6, xmm0
jmp 0x140099940
xor ecx, ecx
cmp al, 0x2d
sete cl
xor edx, edx
cmp byte [rsi + rcx - 1], 0x2b
sete dl
add rdx, rcx
mov cl, byte [rsi + rdx - 1]
lea edi, [rcx - 0x30]
pxor xmm6, xmm6
cmp dil, 9
ja 0x140099934
add rsi, rdx
pxor xmm6, xmm6
movsd xmm0, qword [0x1401d2680]
nop dword [rax]
movzx ecx, cl
mulsd xmm6, xmm0
add ecx, 0xffffffd0
xorps xmm1, xmm1
cvtsi2sd xmm1, ecx
addsd xmm6, xmm1
movzx ecx, byte [rsi]
lea edx, [rcx - 0x30]
add rsi, 1
cmp dl, 0xa
jb 0x140099910
cmp al, 0x2d
jne 0x140099940
pxor xmm6, xmmword [0x140117180]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1400c4bd0
movdqa xmm0, xmm6
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x88
pop rdi
pop rsi
ret
Function at 0x14009ffe0
Capabilities:
Log keystrokes via polling

Disassembly:
push rsi
sub rsp, 0x50
movaps xmmword [rsp + 0x40], xmm8
movaps xmmword [rsp + 0x30], xmm7
movaps xmmword [rsp + 0x20], xmm6
movapd xmm6, xmm0
movss xmm7, dword [0x140275224]
movss xmm8, dword [0x140275220]
ucomiss xmm7, dword [0x140117160]
jne 0x1400a0019
jnp 0x1400a00a6
mov esi, dword [reloc.XINPUT1_3.dll_Ordinal_2]
cmp dword [0x14027a83c], 0xa
jl 0x1400a0039
mov eax, dword [0x14027a838]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
jne 0x1400a005b
mov ecx, esi
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp dword [0x14027a83c], 0xa
jl 0x1400a0065
mov ecx, dword [0x14027a838]
lea edx, [rcx - 1]
imul edx, ecx
and edx, 1
je 0x1400a0065
mov ecx, esi
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
jmp 0x1400a0039
test ax, ax
je 0x1400a009d
mulss xmm7, xmm8
cvtss2sd xmm1, xmm7
mulsd xmm1, qword [0x1401d4558]
mulsd xmm1, qword [0x1401d4560]
addsd xmm1, xmm1
movss xmm0, dword [0x140275228]
cvtss2sd xmm0, xmm0
divsd xmm0, qword [0x1401d2558]
jmp 0x1400a00d6
movss xmm8, dword [0x140275220]
xorps xmm0, xmm0
cvtss2sd xmm0, xmm8
mulsd xmm0, qword [0x1401d4558]
mulsd xmm0, qword [0x1401d4560]
addsd xmm0, xmm0
movss xmm1, dword [0x140275228]
cvtss2sd xmm1, xmm1
divsd xmm1, qword [0x1401d2558]
mulsd xmm0, xmm1
divsd xmm6, xmm0
xorps xmm0, xmm0
cvtsd2ss xmm0, xmm6
cvtss2sd xmm0, xmm0
movaps xmm6, xmmword [rsp + 0x20]
movaps xmm7, xmmword [rsp + 0x30]
movaps xmm8, xmmword [rsp + 0x40]
add rsp, 0x50
pop rsi
ret
Function at 0x1400a8bf0
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
setne al
add rsp, 0x28
ret
Function at 0x1400a98b0
Capabilities:
Get graphical window text

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x180
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0xf0], xmm6
mov qword [rbp + 0xe8], 0xfffffffffffffffe
mov rsi, rcx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rdx, [rbp - 0x60]
mov rcx, rax
mov r8d, 0x100
call qword [sym.imp.USER32.dll_GetWindowTextA]
cmp dword [0x14027dbac], 0xa
jl 0x1400a9912
mov eax, dword [0x14027dba8]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
je 0x1400a9912
nop word [rax + rax]
jmp 0x1400a9910
mov qword [rbp + 0xe0], rsi
xorps xmm6, xmm6
movaps xmmword [rbp + 0xb0], xmm6
movaps xmmword [rbp + 0xa0], xmm6
lea rsi, [rbp - 0x60]
mov rcx, rsi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
lea rcx, [rbp + 0xa0]
mov rdx, rsi
mov r8, rax
call fcn.1400092d0
movaps xmmword [rbp + 0xc0], xmm6
mov qword [rbp + 0xd0], 0
mov dword [rbp + 0xc0], Ordinal_32
lea rcx, [rbp + 0xc0]
call qword [sym.imp.USER32.dll_GetCursorInfo]
lea rcx, [rbp + 0xa0]
mov rdi, qword [rbp + 0xe0]
mov rdx, rdi
xor r8d, r8d
call fcn.140033d60
cmp rax, 0xffffffffffffffff
je 0x1400a999c
mov sil, 1
cmp dword [rbp + 0xc4], 1
jne 0x1400a999e
xor esi, esi
cmp dword [0x14027cfcc], 0xa
jl 0x1400a99c2
mov eax, dword [0x14027cfc8]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
je 0x1400a99c2
nop dword [rax + rax]
jmp 0x1400a99c0
mov rdx, qword [rbp + 0xb8]
cmp rdx, 0x10
jb 0x1400a99df
mov rcx, qword [rbp + 0xa0]
add rdx, 1
call fcn.1400a1390
cmp dword [0x14027da74], 0xa
jl 0x1400a9a02
mov eax, dword [0x14027da70]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
je 0x1400a9a02
nop dword [rax]
jmp 0x1400a9a00
cmp dword [0x14027cfcc], 0xa
jl 0x1400a9a22
mov eax, dword [0x14027cfc8]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
je 0x1400a9a22
nop dword [rax]
jmp 0x1400a9a20
mov rdx, qword [rdi + 0x18]
cmp rdx, 0x10
jb 0x1400a9a38
mov rcx, qword [rdi]
add rdx, 1
call fcn.1400a1390
movaps xmm0, xmmword [0x140117130]
movups xmmword [rdi + 0x10], xmm0
mov byte [rdi], 0
cmp dword [0x14027da74], 0xa
jl 0x1400a9a62
mov eax, dword [0x14027da70]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
je 0x1400a9a62
jmp 0x1400a9a60
mov eax, esi
movaps xmm6, xmmword [rbp + 0xf0]
add rsp, 0x180
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400b93a0
Capabilities:
Execute command

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x140279c48]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rsi, rcx
mov qword [rsp + 0x78], rcx
mov r8, rcx
lea rdx, str.start_cmd__C__color_b__title_Error__echo
lea rcx, [rsp + 0x58]
call fcn.1400b12c0
mov rdi, rax
mov rcx, qword [rax + 0x10]
mov rdx, qword [rax + 0x18]
mov rax, rdx
sub rax, rcx
cmp rax, 0x11
jb 0x1400b942a
lea rax, [rcx + 0x11]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x1400b940b
mov rax, qword [rdi]
lea rbx, [rax + rcx]
mov r8d, reloc.WS2_32.dll_recvfrom
lea rdx, str.__timeout__t_5_
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x11], 0
jmp 0x1400b944c
mov qword [rsp + 0x20], reloc.WS2_32.dll_recvfrom
lea r9, str.__timeout__t_5_
xor r8d, r8d
lea edx, [r8 + 0x11]
mov rcx, rdi
call fcn.1400bb100
mov rdi, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
movups xmm0, xmmword [rdi]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rdi + 0x10], 0
mov qword [rdi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rdi], 0
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 0x10
cmovae rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x1400b94d8
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400b94d3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400b94d3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c4894
movdqa xmm0, xmmword [0x140117130]
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x30], 0
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x1400b952b
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400b9526
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400b9526
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c4894
xor ecx, ecx
int 0x29
mov rdx, qword [rsi + 0x18]
cmp rdx, 0x10
jb 0x1400b9565
inc rdx
mov rcx, qword [rsi]
cmp rdx, 0x1000
jb 0x1400b9560
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400b959d
mov rcx, r8
call fcn.1400c4894
mov qword [rsi + 0x10], 0
mov qword [rsi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rsi], 0
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400c4bd0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3

Function at 0x1400b95b0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x47], 0
je 0x1400b95d3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x58]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x46
jb 0x1400b95c0
mov byte [rcx + 0x47], 0
mov rax, rcx
ret
Function at 0x1400b96d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rbx, rcx
mov qword [rbp - 0x10], rcx
xor r9d, r9d
cmp byte [r8 + 6], r9b
je 0x1400b9714
mov ecx, r9d
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x58]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 5
jb 0x1400b9700
mov byte [r8 + 6], r9b
lea rax, [r8 + 5]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
mov qword [rbp - 0x28], r9
mov qword [rbp - 0x20], r9
mov qword [rbp - 0x20], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x1400b973e
mov qword [rbp - 0x28], r9
mov byte [rbp - 0x38], r9b
jmp 0x1400b9754
mov qword [rbp - 0x28], 5
mov eax, dword [r8]
mov dword [rbp - 0x38], eax
movzx eax, byte [r8 + 4]
mov byte [rbp - 0x34], al
cmp byte [rdx + 0xa], 0
je 0x1400b9773
mov rcx, r9
nop dword [rax]
lea eax, [rcx + 0x58]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 9
jb 0x1400b9760
mov byte [rdx + 0xa], 0
lea rax, [rdx + 9]
xorps xmm0, xmm0
movups xmmword [rbp - 0x58], xmm0
mov qword [rbp - 0x48], r9
mov qword [rbp - 0x40], r9
mov qword [rbp - 0x40], reloc.WS2_32.dll_ntohs
cmp rdx, rax
jne 0x1400b979d
mov qword [rbp - 0x48], r9
mov byte [rbp - 0x58], 0
jmp 0x1400b97b5
mov qword [rbp - 0x48], 9
movsd xmm0, qword [rdx]
movsd qword [rbp - 0x58], xmm0
movzx eax, byte [rdx + 8]
mov byte [rbp - 0x50], al
lea r9, [rbp - 0x38]
lea r8, [rbp - 0x58]
movzx edx, byte [rbp - 0x60]
mov rcx, rbx
call fcn.1400963e0
nop
mov rdx, qword [rbp - 0x40]
cmp rdx, 0x10
jb 0x1400b9809
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400b9803
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400b9803
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c4894
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x1400b9847
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400b9842
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400b9842
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c4894
mov rax, rbx
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rbp
ret
Function at 0x1400b9860
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x50
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor edi, edi
cmp byte [r8 + 7], dil
je 0x1400b9894
mov eax, edi
nop dword [rax]
lea ecx, [rax + 0x58]
xor byte [r8 + rax], cl
inc rax
cmp rax, 6
jb 0x1400b9880
mov byte [r8 + 7], dil
lea rax, [r8 + 6]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x1400b98c4
mov qword [rsp + 0x30], rdi
mov byte [rsp + 0x20], dil
jmp 0x1400b98de
mov qword [rsp + 0x30], 6
mov eax, dword [r8]
mov dword [rsp + 0x20], eax
movzx eax, word [r8 + 4]
mov word [rsp + 0x24], ax
mov r9, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x1400b98ec
mov rdx, qword [rdx]
mov r8, rdx
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.1400b0c10
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x1400b9966
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400b9961
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400b9961
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c4894
mov rax, rbx
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret

Function at 0x1400b9980
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 9], al
je 0x1400b99a3
lea edx, [rax + 0x58]
xor byte [rax + rcx], dl
inc rax
cmp rax, 8
jb 0x1400b9990
mov byte [rcx + 9], 0
lea r8, [rcx + 8]
mov rdx, rcx
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.1400b95e0
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x1400b99c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x50
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor edi, edi
cmp byte [r8 + 9], dil
je 0x1400b99f4
mov eax, edi
nop dword [rax]
lea ecx, [rax + 0x58]
xor byte [r8 + rax], cl
inc rax
cmp rax, 8
jb 0x1400b99e0
mov byte [r8 + 9], dil
lea rax, [r8 + 8]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x1400b9a24
mov qword [rsp + 0x30], rdi
mov byte [rsp + 0x20], dil
jmp 0x1400b9a35
mov qword [rsp + 0x30], 8
mov rax, qword [r8]
mov qword [rsp + 0x20], rax
mov r9, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x1400b9a43
mov rdx, qword [rdx]
mov r8, rdx
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.1400b0c10
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x1400b9abd
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400b9ab8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400b9ab8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c4894
mov rax, rbx
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x1400b9ad0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x50
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor edi, edi
cmp byte [r8 + 0xa], dil
je 0x1400b9b04
mov eax, edi
nop dword [rax]
lea ecx, [rax + 0x58]
xor byte [r8 + rax], cl
inc rax
cmp rax, 9
jb 0x1400b9af0
mov byte [r8 + 0xa], dil
lea rax, [r8 + 9]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x1400b9b34
mov qword [rsp + 0x30], rdi
mov byte [rsp + 0x20], dil
jmp 0x1400b9b51
mov qword [rsp + 0x30], 9
movsd xmm0, qword [r8]
movsd qword [rsp + 0x20], xmm0
movzx eax, byte [r8 + 8]
mov byte [rsp + 0x28], al
mov r9, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x1400b9b5f
mov rdx, qword [rdx]
mov r8, rdx
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.1400b0c10
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x1400b9bd9
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400b9bd4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400b9bd4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c4894
mov rax, rbx
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret

Function at 0x1400b9bf0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 0x10], al
je 0x1400b9c13
lea edx, [rax + 0x58]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xf
jb 0x1400b9c00
mov byte [rcx + 0x10], 0
lea r8, [rcx + 0xf]
mov rdx, rcx
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.1400b95e0
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x1400b9c70
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x44], 0
je 0x1400b9c93
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x58]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x43
jb 0x1400b9c80
mov byte [rcx + 0x44], 0
mov rax, rcx
ret

Function at 0x1400b9f50
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x136], 0
je 0x1400b9f78
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x58]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x135
jb 0x1400b9f60
mov byte [rcx + 0x136], 0
mov rax, rcx
ret

Function at 0x1400b9f80
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 5], 0
je 0x1400b9fa3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x58]
xor byte [rax + rcx], dl
inc rax
cmp rax, 4
jb 0x1400b9f90
mov byte [rcx + 5], 0
mov rax, rcx
ret