joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140012920
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push r15
sub rsp, 0x20
mov rdi, qword [0x1401314c0]
xor esi, esi
mov r15, rcx
mov dword [rdi + 0x2d9c], esi
test rcx, rcx
je 0x140012a3a
mov qword [rsp + 0x40], rbx
lea rbx, [rdi + 0x2da0]
mov dword [rdi + 0x2d9c], esi
mov ecx, dword [rbx + 4]
mov qword [rsp + 0x48], rbp
test ecx, ecx
jns 0x14001297a
mov eax, ecx
cdq
sub eax, edx
mov edx, esi
sar eax, 1
add eax, ecx
mov rcx, rbx
test eax, eax
cmovg edx, eax
call fcn.140013a00
mov dword [rbx], esi
cmp dword [rbx + 4], esi
jne 0x14001298e
mov edx, 8
mov rcx, rbx
call fcn.140013a00
movsxd rcx, dword [rbx]
mov ebp, esi
mov rax, qword [rbx + 8]
mov byte [rcx + rax], sil
inc dword [rbx]
cmp dword [rdi + 0x2db0], esi
jle 0x1400129da
mov qword [rsp + 0x50], r14
mov r14, rsi
nop dword [rax]
mov r9, qword [rdi + 0x2db8]
mov r8, rbx
add r9, r14
mov rcx, rdi
mov rdx, r9
call qword [r9 + reloc.WLDAP32.dll_Ordinal_32]
inc ebp
add r14, 0x30
cmp ebp, dword [rdi + 0x2db0]
jl 0x1400129b0
mov r14, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
cmp qword [rbx + 8], rsi
je 0x1400129e9
mov esi, dword [rbx]
dec esi
mov rax, qword [rdi + 0x2da8]
lea rdx, [0x1400b7334]
test rax, rax
movsxd rsi, esi
lea rdi, [0x1401314b8]
mov rcx, r15
cmovne rdi, rax
call fcn.1400030c0
mov rbx, rax
test rax, rax
je 0x140012a35
mov r9, rax
mov r8, rsi
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r15
pop rdi
pop rsi
ret
Function at 0x14001f3a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test r9d, 0xff000000
je 0x14001f557
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
movss xmm3, dword [rsp + 0x70]
xorps xmm0, xmm0
comiss xmm3, xmm0
mov esi, r9d
mov rdi, r8
mov rbp, rdx
mov rbx, rcx
jbe 0x14001f436
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x20], eax
call fcn.14001ed70
mov r8d, dword [rbx + 0x80]
mov r9d, esi
mov rdx, qword [rbx + 0x88]
mov rcx, rbx
call fcn.14001e380
mov ecx, dword [rbx + 0x84]
test ecx, ecx
jns 0x14001f427
mov eax, ecx
cdq
sub eax, edx
xor edx, edx
sar eax, 1
add eax, ecx
lea rcx, [rbx + 0x80]
test eax, eax
cmovg edx, eax
call fcn.1400136a0
mov dword [rbx + 0x80], 0
jmp 0x14001f543
mov edx, 6
movaps xmmword [rsp + 0x30], xmm6
lea r8d, [rdx - 2]
call fcn.14001d1b0
movzx edx, word [rbx + 0x48]
mov rax, qword [rbx + 0x38]
movss xmm1, dword [rdi]
movss xmm2, dword [rbp + 4]
movss xmm3, dword [rbp]
lea ecx, [rdx + 1]
movss xmm6, dword [rax + 4]
movss xmm5, dword [rax]
movss xmm4, dword [rdi + 4]
mov rax, qword [rbx + 0x58]
mov word [rax], dx
mov rax, qword [rbx + 0x58]
mov word [rax + 2], cx
lea ecx, [rdx + 2]
mov rax, qword [rbx + 0x58]
mov word [rax + 4], cx
mov rax, qword [rbx + 0x58]
mov word [rax + 6], dx
add dx, 3
mov rax, qword [rbx + 0x58]
mov word [rax + 8], cx
mov rax, qword [rbx + 0x58]
mov word [rax + 0xa], dx
movsd xmm0, qword [rbp]
mov rax, qword [rbx + 0x50]
movsd qword [rax], xmm0
mov rax, qword [rbx + 0x50]
movss dword [rax + 8], xmm5
movss dword [rax + 0xc], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x10], esi
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x14], xmm1
movss dword [rax + 0x18], xmm2
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x1c], xmm5
movss dword [rax + 0x20], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x24], esi
movsd xmm0, qword [rdi]
mov rax, qword [rbx + 0x50]
movsd qword [rax + 0x28], xmm0
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x30], xmm5
movss dword [rax + 0x34], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x38], esi
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x3c], xmm3
movss dword [rax + 0x40], xmm4
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x44], xmm5
movss dword [rax + 0x48], xmm6
mov rax, qword [rbx + 0x50]
movaps xmm6, xmmword [rsp + 0x30]
mov dword [rax + 0x4c], esi
add qword [rbx + 0x50], 0x50
add dword [rbx + 0x48], 4
add qword [rbx + 0x58], 0xc
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x1400324e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x480
mov rax, qword [0x140130080]
xor rax, rsp
mov qword [rsp + 0x470], rax
mov qword [rsp + 0x40], rcx
mov rdi, rcx
mov ecx, edx
mov ebx, edx
mov rdx, qword [0x140131580]
xor r14d, r14d
sar ecx, 0x10
add rdx, 0xf237a10
shl ecx, 3
add rdx, rcx
call fcn.140040f40
mov rcx, rax
movzx eax, bx
lea rbp, [rcx + rax*4]
mov rdx, rbp
call fcn.140040fe0
movzx esi, ax
lea rcx, [rsp + 0x70]
xor edx, edx
shr esi, 6
mov r8d, 0x400
call sub.VCRUNTIME140.dll_memset
mov ebx, r14d
test esi, esi
je 0x1400326f9
mov rcx, qword [0x1401315d0]
lea edx, [rsi + rsi]
mov qword [rsp + 0x38], r14
lea r9d, [r14 + 0x20]
mov qword [rsp + 0x68], rdx
lea r8, [rsp + 0x50]
mov edx, 0x21a68c90
mov dword [rsp + 0x54], r14d
mov eax, dword [rcx + 8]
mov rcx, qword [rcx]
mov dword [rsp + 0x50], eax
lea rax, [rbp + 4]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x50]
mov dword [rsp + 0x28], reloc.WLDAP32.dll_Ordinal_32
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x40], r14d
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
lea rdx, [rsp + 0x70]
mov ecx, Ordinal_41
dec rdx
nop
or ecx, ebx
lea rdx, [rdx + 1]
movzx eax, cl
inc ebx
not al
add ecx, ecx
xor byte [rdx], al
cmp ebx, esi
jl 0x1400325e0
cmp esi, 0x400
jae 0x140032733
xorps xmm0, xmm0
mov byte [rsp + rsi + 0x70], r14b
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], r14
lea rax, [rsp + 0x70]
mov qword [rdi + 0x18], r14
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], r14b
jne 0x140032620
movabs rsi, 0x7fffffffffffffff
cmp rbx, rsi
ja 0x14003273f
mov qword [rdi + 0x18], reloc.WS2_32.dll_ntohs
cmp rbx, 0x10
jae 0x140032667
mov r8, rbx
mov qword [rdi + 0x10], rbx
lea rdx, [rsp + 0x70]
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + rdi], r14b
jmp 0x140032708
mov rax, rbx
or rax, 0xf
cmp rax, rsi
jbe 0x14003269c
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1400a4d68
test rax, rax
je 0x1400326c3
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x1400326d7
mov ecx, reloc.WLDAP32.dll_Ordinal_22
mov rsi, rax
cmp rax, rcx
cmovb rsi, rcx
lea rcx, [rsi + 1]
cmp rcx, 0x1000
jb 0x1400326ca
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140032739
jmp 0x140032681
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x1400326d7
call fcn.1400a4d68
mov r14, rax
mov r8, rbx
mov qword [rdi], r14
lea rdx, [rsp + 0x70]
mov qword [rdi + 0x10], rbx
mov rcx, r14
mov qword [rdi + 0x18], rsi
call sub.VCRUNTIME140.dll_memcpy
mov byte [r14 + rbx], 0
jmp 0x140032708
lea rdx, [0x1400b7256]
mov rcx, rdi
call fcn.1400404a0
mov rax, rdi
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.1400a4630
lea r11, [rsp + 0x480]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call fcn.1400a4bd4
int3
call fcn.140024a70
int3
call fcn.140030e50
int3
Function at 0x1400428a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x50
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor edi, edi
cmp byte [r8 + 6], dil
je 0x1400428d4
mov ecx, edi
nop dword [rax]
lea eax, [rcx - 0x5b]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 5
jb 0x1400428c0
mov byte [r8 + 6], dil
lea rax, [r8 + 5]
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x140042901
mov qword [rsp + 0x30], rdi
mov byte [rsp + 0x20], dil
jmp 0x14004291f
mov qword [rsp + 0x30], 5
mov eax, dword [r8]
mov dword [rsp + 0x20], eax
movzx eax, byte [r8 + 4]
mov byte [rsp + 0x24], al
mov byte [rsp + 0x25], dil
mov r9, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x14004292d
mov rdx, qword [rdx]
mov r8, rdx
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.1400408a0
mov qword [rbx], rdi
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x1400429a4
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004299f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004299f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400a4a54
mov rax, rbx
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x1400429c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x50
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor edi, edi
cmp byte [r8 + 7], dil
je 0x1400429f4
mov ecx, edi
nop dword [rax]
lea eax, [rcx - 0x5b]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 6
jb 0x1400429e0
mov byte [r8 + 7], dil
lea rax, [r8 + 6]
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x140042a21
mov qword [rsp + 0x30], rdi
mov byte [rsp + 0x20], dil
jmp 0x140042a40
mov qword [rsp + 0x30], 6
mov eax, dword [r8]
mov dword [rsp + 0x20], eax
movzx eax, word [r8 + 4]
mov word [rsp + 0x24], ax
mov byte [rsp + 0x26], dil
mov r9, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x140042a4e
mov rdx, qword [rdx]
mov r8, rdx
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.1400408a0
mov qword [rbx], rdi
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x140042ac5
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140042ac0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140042ac0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400a4a54
mov rax, rbx
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x140042ae0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x50
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor edi, edi
cmp byte [r8 + 9], dil
je 0x140042b14
mov ecx, edi
nop dword [rax]
lea eax, [rcx - 0x5b]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 8
jb 0x140042b00
mov byte [r8 + 9], dil
lea rax, [r8 + 8]
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x140042b41
mov qword [rsp + 0x30], rdi
mov byte [rsp + 0x20], dil
jmp 0x140042b57
mov qword [rsp + 0x30], 8
mov rax, qword [r8]
mov qword [rsp + 0x20], rax
mov byte [rsp + 0x28], dil
mov r9, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x140042b65
mov rdx, qword [rdx]
mov r8, rdx
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.1400408a0
mov qword [rbx], rdi
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x140042bdc
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140042bd7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140042bd7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400a4a54
mov rax, rbx
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x140042bf0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rbx, rcx
mov qword [rbp - 0x10], rcx
xor r9d, r9d
cmp byte [r8 + 6], r9b
je 0x140042c34
mov ecx, r9d
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x5b]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 5
jb 0x140042c20
mov byte [r8 + 6], r9b
lea rax, [r8 + 5]
mov qword [rbp - 0x38], r9
mov qword [rbp - 0x28], r9
mov qword [rbp - 0x20], r9
mov qword [rbp - 0x20], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x140042c5b
mov qword [rbp - 0x28], r9
mov byte [rbp - 0x38], r9b
jmp 0x140042c75
mov qword [rbp - 0x28], 5
mov eax, dword [r8]
mov dword [rbp - 0x38], eax
movzx eax, byte [r8 + 4]
mov byte [rbp - 0x34], al
mov byte [rbp - 0x33], r9b
cmp byte [rdx + 0xa], 0
je 0x140042c93
mov rcx, r9
nop
lea eax, [rcx - 0x5b]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 9
jb 0x140042c80
mov byte [rdx + 0xa], 0
lea rax, [rdx + 9]
mov qword [rbp - 0x58], r9
mov qword [rbp - 0x48], r9
mov qword [rbp - 0x40], r9
mov qword [rbp - 0x40], reloc.WS2_32.dll_ntohs
cmp rdx, rax
jne 0x140042cba
mov qword [rbp - 0x48], r9
mov byte [rbp - 0x58], 0
jmp 0x140042cd6
mov qword [rbp - 0x48], 9
movsd xmm0, qword [rdx]
movsd qword [rbp - 0x58], xmm0
movzx eax, byte [rdx + 8]
mov byte [rbp - 0x50], al
mov byte [rbp - 0x4f], 0
lea r9, [rbp - 0x38]
lea r8, [rbp - 0x58]
movzx edx, byte [rbp - 0x60]
mov rcx, rbx
call fcn.140049080
nop
mov rdx, qword [rbp - 0x40]
cmp rdx, 0x10
jb 0x140042d2a
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140042d24
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140042d24
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400a4a54
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x140042d68
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140042d63
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140042d63
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400a4a54
mov rax, rbx
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rbp
ret
Function at 0x140042d80
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x50
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor edi, edi
cmp byte [r8 + 0xa], dil
je 0x140042db4
mov ecx, edi
nop dword [rax]
lea eax, [rcx - 0x5b]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 9
jb 0x140042da0
mov byte [r8 + 0xa], dil
lea rax, [r8 + 9]
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x140042de1
mov qword [rsp + 0x30], rdi
mov byte [rsp + 0x20], dil
jmp 0x140042e03
mov qword [rsp + 0x30], 9
movsd xmm0, qword [r8]
movsd qword [rsp + 0x20], xmm0
movzx eax, byte [r8 + 8]
mov byte [rsp + 0x28], al
mov byte [rsp + 0x29], dil
mov r9, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x140042e11
mov rdx, qword [rdx]
mov r8, rdx
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.1400408a0
mov qword [rbx], rdi
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x140042e88
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140042e83
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140042e83
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400a4a54
mov rax, rbx
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x140042ea0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rbx, rcx
mov qword [rbp - 0x10], rcx
xor r9d, r9d
cmp byte [r8 + 0xb], r9b
je 0x140042ee4
mov ecx, r9d
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x5b]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 0xa
jb 0x140042ed0
mov byte [r8 + 0xb], r9b
lea rax, [r8 + 0xa]
mov qword [rbp - 0x38], r9
mov qword [rbp - 0x28], r9
mov qword [rbp - 0x20], r9
mov qword [rbp - 0x20], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x140042f0b
mov qword [rbp - 0x28], r9
mov byte [rbp - 0x38], r9b
jmp 0x140042f2a
mov qword [rbp - 0x28], 0xa
movsd xmm0, qword [r8]
movsd qword [rbp - 0x38], xmm0
movzx eax, word [r8 + 8]
mov word [rbp - 0x30], ax
mov byte [rbp - 0x2e], r9b
cmp byte [rdx + 0xb], 0
je 0x140042f53
mov rcx, r9
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x5b]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xa
jb 0x140042f40
mov byte [rdx + 0xb], 0
lea rax, [rdx + 0xa]
mov qword [rbp - 0x58], r9
mov qword [rbp - 0x48], r9
mov qword [rbp - 0x40], r9
mov qword [rbp - 0x40], reloc.WS2_32.dll_ntohs
cmp rdx, rax
jne 0x140042f7a
mov qword [rbp - 0x48], r9
mov byte [rbp - 0x58], 0
jmp 0x140042f97
mov qword [rbp - 0x48], 0xa
movsd xmm0, qword [rdx]
movsd qword [rbp - 0x58], xmm0
movzx eax, word [rdx + 8]
mov word [rbp - 0x50], ax
mov byte [rbp - 0x4e], 0
lea r9, [rbp - 0x38]
lea r8, [rbp - 0x58]
movzx edx, byte [rbp - 0x60]
mov rcx, rbx
call fcn.140049080
nop
mov rdx, qword [rbp - 0x40]
cmp rdx, 0x10
jb 0x140042feb
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140042fe5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140042fe5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400a4a54
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x140043029
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140043024
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140043024
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400a4a54
mov rax, rbx
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rbp
ret
Function at 0x140043040
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rbx, rcx
mov qword [rbp - 0x10], rcx
xor r9d, r9d
cmp byte [r8 + 0xc], r9b
je 0x140043084
mov ecx, r9d
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x5b]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 0xb
jb 0x140043070
mov byte [r8 + 0xc], r9b
lea rax, [r8 + 0xb]
mov qword [rbp - 0x58], r9
mov qword [rbp - 0x48], r9
mov qword [rbp - 0x40], r9
mov qword [rbp - 0x40], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x1400430ab
mov qword [rbp - 0x48], r9
mov byte [rbp - 0x58], r9b
jmp 0x1400430d2
mov qword [rbp - 0x48], ntohl
movsd xmm0, qword [r8]
movsd qword [rbp - 0x58], xmm0
movzx eax, word [r8 + 8]
mov word [rbp - 0x50], ax
movzx eax, byte [r8 + 0xa]
mov byte [rbp - 0x4e], al
mov byte [rbp - 0x4d], r9b
cmp byte [rdx + 0xb], 0
je 0x1400430f3
mov rcx, r9
nop dword [rax + rax]
lea eax, [rcx - 0x5b]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xa
jb 0x1400430e0
mov byte [rdx + 0xb], 0
lea rax, [rdx + 0xa]
mov qword [rbp - 0x38], r9
mov qword [rbp - 0x28], r9
mov qword [rbp - 0x20], r9
mov qword [rbp - 0x20], reloc.WS2_32.dll_ntohs
cmp rdx, rax
jne 0x14004311a
mov qword [rbp - 0x28], r9
mov byte [rbp - 0x38], 0
jmp 0x140043137
mov qword [rbp - 0x28], 0xa
movsd xmm0, qword [rdx]
movsd qword [rbp - 0x38], xmm0
movzx eax, word [rdx + 8]
mov word [rbp - 0x30], ax
mov byte [rbp - 0x2e], 0
lea r9, [rbp - 0x58]
lea r8, [rbp - 0x38]
movzx edx, byte [rbp - 0x60]
mov rcx, rbx
call fcn.140049080
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x14004318b
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140043185
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140043185
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400a4a54
nop
mov rdx, qword [rbp - 0x40]
cmp rdx, 0x10
jb 0x1400431c9
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400431c4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400431c4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400a4a54
mov rax, rbx
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rbp
ret
Function at 0x1400431e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x50
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor edi, edi
cmp byte [r8 + 0xc], dil
je 0x140043214
mov ecx, edi
nop dword [rax]
lea eax, [rcx - 0x5b]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 0xb
jb 0x140043200
mov byte [r8 + 0xc], dil
lea rax, [r8 + 0xb]
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x140043241
mov qword [rsp + 0x30], rdi
mov byte [rsp + 0x20], dil
jmp 0x14004326d
mov qword [rsp + 0x30], ntohl
movsd xmm0, qword [r8]
movsd qword [rsp + 0x20], xmm0
movzx eax, word [r8 + 8]
mov word [rsp + 0x28], ax
movzx eax, byte [r8 + 0xa]
mov byte [rsp + 0x2a], al
mov byte [rsp + 0x2b], dil
mov r9, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x14004327b
mov rdx, qword [rdx]
mov r8, rdx
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.1400408a0
mov qword [rbx], rdi
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x1400432f2
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400432ed
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400432ed
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400a4a54
mov rax, rbx
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret