joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14007c618
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
test rax, rax
je 0x14007c662
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14007c662
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14007c662
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14007c662
cmp dword [rcx + 0x84], 0xe
jbe 0x14007c662
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14007c664
xor al, al
add rsp, 0x28
ret
Function at 0x140003a00
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1400230c0]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140003ad3
cmp byte [rcx + 0x71], 0
je 0x140003ad3
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x140003acf
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140003a94
sub eax, 1
je 0x140003a98
cmp eax, 2
jne 0x140003acf
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140018430
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140003ac6
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x140003acf
cmp byte [rbx + 0x71], 0
sete al
jmp 0x140003a7c
xor al, al
jmp 0x140003a7c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140018430
add rsp, 0x60
pop rbx
ret
Function at 0x140007810
Capabilities:
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov r9, rdx
mov r10, rcx
xor esi, esi
call fcn.140003be0
movsx r11d, al
call fcn.140003bd0
movsx ecx, al
imul r11d, ecx
call fcn.140003c10
movsx ebx, al
lea edx, [r11 + r11*4]
movsx eax, byte [0x14002300c]
xorps xmm2, xmm2
movsx ecx, byte [0x14002300b]
add eax, ebx
lea edi, [rbx + r11*2]
add edi, r11d
lea eax, [rax + rdx*2]
xor edx, edx
div ecx
movsx ecx, byte [0x140023008]
xor edx, edx
sub eax, ecx
cvtsi2sd xmm2, rax
movsx eax, byte [0x14002300a]
movd xmm1, eax
movsx eax, byte [0x140023009]
cvtdq2pd xmm1, xmm1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
addsd xmm0, xmm0
subsd xmm1, xmm0
mulsd xmm1, xmm2
movsd qword [rsp + 0x40], xmm1
movsx eax, byte [0x14002300c]
movsx ecx, byte [0x14002300b]
add eax, edi
div ecx
movsx ecx, byte [0x140023008]
cmp eax, ecx
je 0x1400078f9
call fcn.140003bf0
movsx edx, al
movsx eax, byte [0x1400233d8]
imul edx, eax
add edx, edx
call fcn.140003c20
movsx ecx, al
sub edx, ecx
call fcn.140003c00
movsx ecx, al
add edx, ecx
movsx ecx, byte [0x140023009]
add ecx, edx
jne 0x140007959
movsx eax, byte [0x14002300c]
lea ecx, [r11 + rbx]
lea ecx, [rcx + r11*8]
xor edx, edx
add eax, ecx
movsx ecx, byte [0x14002300b]
div ecx
movsx ecx, byte [0x140023008]
cmp eax, ecx
je 0x140007951
movsx eax, byte [0x14002300c]
xor edx, edx
movsx ecx, byte [0x14002300b]
add eax, edi
div ecx
movsx ecx, byte [0x140023008]
xorps xmm0, xmm0
sub eax, ecx
cvtsi2sd xmm0, rax
mulsd xmm0, qword [rsp + 0x40]
cvttsd2si eax, xmm0
jmp 0x140007955
mov eax, dword [rsp + 0x40]
cmp esi, eax
jge 0x14000797e
cmp qword [r9 + 0x18], 0xf
jbe 0x140007963
mov r9, qword [r9]
cmp qword [r10 + 0x18], 0xf
jbe 0x14000796d
mov r10, qword [r10]
mov rdx, r9
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
setne al
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140007a10
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x1400230c0]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov esi, edx
mov rdi, rcx
cmp edx, 0xffffffff
jne 0x140007a3d
xor eax, eax
jmp 0x140007ba6
mov qword [rsp + 0xa0], rbx
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
test rax, rax
je 0x140007a7d
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::epptr_void_const___ptr64]
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
cmp rax, rbx
jae 0x140007a7d
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], sil
mov eax, esi
jmp 0x140007b9e
cmp qword [rdi + 0x80], 0
je 0x140007b99
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::eback_void_const___ptr64]
lea rcx, [rdi + 0x70]
cmp rax, rcx
jne 0x140007ab7
mov rdx, qword [rdi + 0x88]
mov rcx, rdi
mov r9, qword [rdi + 0x90]
mov r8, rdx
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::setg_char____ptr64__char____ptr64__char____ptr64____ptr64]
mov rcx, qword [rdi + 0x68]
test rcx, rcx
jne 0x140007ae2
mov rdx, qword [rdi + 0x80]
movsx ecx, sil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, esi
mov eax, ecx
jmp 0x140007b9e
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], sil
mov qword [rsp + 0x38], rax
lea rdx, [rdi + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140007b51
sub eax, 1
je 0x140007b51
cmp eax, 2
jne 0x140007b99
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rdi + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, esi
mov eax, ecx
jmp 0x140007b9e
mov rbx, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rbx, rax
je 0x140007b7f
mov r9, qword [rdi + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rbx
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rbx, rax
jne 0x140007b99
lea rax, [rsp + 0x50]
mov byte [rdi + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, esi
mov eax, ecx
jmp 0x140007b9e
mov eax, 0xffffffff
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140018430
mov rsi, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x140008f60
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rsi, r8
mov rbp, rdx
mov r14, rcx
test r8, r8
jg 0x140008f82
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x140008f98
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov qword [rsp + 0x28], rbx
mov rbx, rsi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Gnavail_void_const___ptr64]
test rax, rax
je 0x140008fe2
cmp rax, rsi
mov rdi, rsi
mov rcx, r14
cmovb rdi, rax
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gptr_void_const___ptr64]
mov r8, rdi
mov rcx, rbp
mov rdx, rax
call sub.VCRUNTIME140.dll_memcpy
mov edx, edi
mov rcx, r14
add rbp, rdi
sub rbx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int____ptr64]
cmp qword [r14 + 0x80], 0
mov rdi, rbx
je 0x140009051
mov rcx, r14
call fcn.140003b10
cmp rbx, 0xfff
jbe 0x140009031
mov r9, qword [r14 + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
add rbp, rax
mov rdi, rbx
cmp rax, 0xfff
jne 0x14000906a
cmp rbx, rax
ja 0x140009000
test rdi, rdi
je 0x140009051
mov r9, qword [r14 + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rdi, rax
sub rsi, rdi
mov rbx, qword [rsp + 0x28]
mov rax, rsi
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
sub rsi, rbx
jmp 0x140009054
Function at 0x140009070
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je 0x140009098
add rsp, 0x20
pop r14
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov rbp, rax
test rbx, rbx
jle 0x14000910c
test rax, rax
jle 0x1400090ec
cmp rbx, rax
mov rcx, rdi
cmovl rbp, rbx
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, rbp
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov edx, ebp
mov rcx, rdi
add r14, rbp
sub rbx, rbp
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
test rbx, rbx
jle 0x14000910c
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x14000910c
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov rbp, qword [rsp + 0x40]
sub rsi, rbx
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rbx
ret
Function at 0x140018928
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140018972
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140018972
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140018972
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140018972
cmp dword [rcx + 0x84], 0xe
jbe 0x140018972
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140018974
xor al, al
add rsp, 0x28
ret
Function at 0x140846058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1408461df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, pe_nt_image_headers64
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140846089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14084606f
add dl, dl
jne 0x140846096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1408460f6
xor eax, eax
add dl, dl
jne 0x1408460a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1408461ad
add dl, dl
jne 0x1408460b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1408460c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1408460d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1408460dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1408460ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14084607e
mov eax, 1
add dl, dl
jne 0x140846106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140846113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1408460fb
sub eax, ebx
mov ebx, 1
jne 0x14084614c
mov ecx, 1
add dl, dl
jne 0x14084612e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14084613b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140846123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14084607e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140846168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140846175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14084615d
cmp eax, 0x7d00
jae 0x14084619b
cmp eax, 0x500
jb 0x140846196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14084607e
cmp eax, 0x7f
ja 0x14084619e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14084607e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1408461d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14084607e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1400041e0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x47], 0
je 0x140004203
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x14]
xor byte [rcx + rax], dl
inc rax
cmp rax, 0x46
jb 0x1400041f0
mov byte [rcx + 0x47], 0
mov rax, rcx
ret

Function at 0x140004210
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x68], rcx
xor esi, esi
cmp byte [r8 + 6], sil
je 0x140004244
mov ecx, esi
lea eax, [rcx - 0x14]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 5
jb 0x140004230
mov byte [r8 + 6], sil
lea rax, [r8 + 5]
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x48], sil
cmp r9, rax
je 0x140004279
mov r8d, 5
mov rdx, r9
lea rcx, [rsp + 0x48]
call fcn.140009550
nop
cmp byte [rbx + 0xa], 0
je 0x1400042a3
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x14]
xor byte [rbx + rcx], al
inc rcx
cmp rcx, 9
jb 0x140004290
mov byte [rbx + 0xa], 0
lea rax, [rbx + 9]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], 0
cmp rbx, rax
je 0x1400042d8
mov r8d, 9
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.140009550
nop
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x28]
mov rcx, rdi
call fcn.14000b1b0
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x14000432c
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004326
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004326
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006fe6c
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x14000436c
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004367
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004367
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006fe6c
mov rax, rdi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x140004380
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x48], rcx
xor esi, esi
cmp byte [r8 + 7], sil
je 0x1400043b4
mov ecx, esi
lea eax, [rcx - 0x14]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 6
jb 0x1400043a0
mov byte [r8 + 7], sil
lea rax, [r8 + 6]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], sil
cmp r9, rax
je 0x1400043e9
mov r8d, 6
mov rdx, r9
lea rcx, [rsp + 0x28]
call fcn.140009550
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x1400043f7
mov rbx, qword [rbx]
mov r8, rbx
lea rcx, [rsp + 0x28]
call fcn.14000c180
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x14000446c
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004467
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004467
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006fe6c
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x140004480
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x48], rcx
xor esi, esi
cmp byte [r8 + 0xa], sil
je 0x1400044b4
mov ecx, esi
lea eax, [rcx - 0x14]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 9
jb 0x1400044a0
mov byte [r8 + 0xa], sil
lea rax, [r8 + 9]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], sil
cmp r9, rax
je 0x1400044e9
mov r8d, 9
mov rdx, r9
lea rcx, [rsp + 0x28]
call fcn.140009550
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x1400044f7
mov rbx, qword [rbx]
mov r8, rbx
lea rcx, [rsp + 0x28]
call fcn.14000c180
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x14000456c
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004567
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004567
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006fe6c
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x140004580
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x136], 0
je 0x1400045a8
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x14]
xor byte [rcx + rax], dl
inc rax
cmp rax, 0x135
jb 0x140004590
mov byte [rcx + 0x136], 0
mov rax, rcx
ret
Function at 0x140005130
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x68], rcx
xor esi, esi
cmp byte [r8 + 0xb], sil
je 0x140005164
mov ecx, esi
lea eax, [rcx - 0x14]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 0xa
jb 0x140005150
mov byte [r8 + 0xb], sil
lea rax, [r8 + 0xa]
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x48], sil
cmp r9, rax
je 0x140005199
mov r8d, 0xa
mov rdx, r9
lea rcx, [rsp + 0x48]
call fcn.140009550
nop
cmp byte [rbx + 0xb], 0
je 0x1400051c3
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x14]
xor byte [rbx + rcx], al
inc rcx
cmp rcx, 0xa
jb 0x1400051b0
mov byte [rbx + 0xb], 0
lea rax, [rbx + 0xa]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], 0
cmp rbx, rax
je 0x1400051f8
mov r8d, 0xa
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.140009550
nop
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x28]
mov rcx, rdi
call fcn.14000b1b0
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x14000524c
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005246
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005246
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006fe6c
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x14000528c
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005287
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005287
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006fe6c
mov rax, rdi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400052a0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x48], rcx
xor esi, esi
cmp byte [r8 + 0xc], sil
je 0x1400052d4
mov ecx, esi
lea eax, [rcx - 0x14]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 0xb
jb 0x1400052c0
mov byte [r8 + 0xc], sil
lea rax, [r8 + 0xb]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], sil
cmp r9, rax
je 0x140005309
mov r8d, ntohl
mov rdx, r9
lea rcx, [rsp + 0x28]
call fcn.140009550
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140005317
mov rbx, qword [rbx]
mov r8, rbx
lea rcx, [rsp + 0x28]
call fcn.14000c180
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x14000538c
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005387
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005387
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006fe6c
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x140006000
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x68], rcx
xor esi, esi
cmp byte [r8 + 0xb], sil
je 0x140006034
mov ecx, esi
lea eax, [rcx - 0x14]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 0xa
jb 0x140006020
mov byte [r8 + 0xb], sil
lea rax, [r8 + 0xa]
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x48], sil
cmp r9, rax
je 0x140006069
mov r8d, 0xa
mov rdx, r9
lea rcx, [rsp + 0x48]
call fcn.140009550
nop
cmp byte [rbx + 0xe], 0
je 0x140006093
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x14]
xor byte [rbx + rcx], al
inc rcx
cmp rcx, 0xd
jb 0x140006080
mov byte [rbx + 0xe], 0
lea rax, [rbx + 0xd]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], 0
cmp rbx, rax
je 0x1400060c8
mov r8d, reloc.WS2_32.dll_listen
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.140009550
nop
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x28]
mov rcx, rdi
call fcn.14000b1b0
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x14000611c
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006116
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006116
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006fe6c
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x14000615c
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006157
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006157
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006fe6c
mov rax, rdi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret