joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140261b79
Capabilities:
Resolve dns

Disassembly:
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov r14d, eax
test eax, eax
jne 0x140060034
mov qword [rsp + 0x58], rsi
mov rsi, qword [rsp + 0x68]
mov qword [rsp + 0x60], rdi
test rsi, rsi
je 0x140060014
mov qword [rsp + 0x50], rbp
mov eax, dword [rsi + 4]
cmp eax, 2
jne 0x14005fecd
lea ebp, [rax + 0xe]
jmp 0x14005fed9
cmp eax, 0x17
jne 0x14005ff81
lea ebp, [rax + 5]
cmp qword [rsi + 0x20], r13
je 0x14005ff81
mov rax, qword [rsi + 0x10]
test rax, rax
je 0x14005ff81
cmp rax, rbp
jb 0x14005ff81
mov ecx, Ordinal_50
call qword [fcn.140087f4a]
mov rdi, rax
test rax, rax
je 0x14005ffbc
mov ecx, dword [rsi]
mov dword [rax], ecx
mov ecx, dword [rsi + 4]
mov dword [rax + 4], ecx
mov ecx, dword [rsi + 8]
mov dword [rax + 8], ecx
mov ecx, dword [rsi + 0xc]
mov dword [rax + 0xc], ecx
mov rcx, rbp
mov dword [rax + 0x10], ebp
mov qword [rax + 0x20], r13
mov qword [rax + 0x18], r13
mov qword [rax + 0x28], r13
call qword [fcn.140087f4a]
mov qword [rdi + 0x20], rax
test rax, rax
je 0x14005ffab
mov rdx, qword [rsi + 0x20]
mov r8, rbp
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [rsi + 0x18]
test rcx, rcx
je 0x14005ff6e
call qword [case.0x1400430d9.0]
mov qword [rdi + 0x18], rax
test rax, rax
je 0x14005ff90
test rbx, rbx
cmove rbx, rdi
test r15, r15
je 0x14005ff7e
mov qword [r15 + 0x28], rdi
mov r15, rdi
mov rsi, qword [rsi + 0x28]
test rsi, rsi
jne 0x14005fec0
jmp 0x14005ffc2
mov rcx, qword [rdi + 0x20]
mov r14d, 8
call qword [fcn.140087f44]
mov rcx, rdi
call qword [fcn.140087f44]
jmp 0x14005ffc2
mov rcx, rdi
mov r14d, 8
call qword [fcn.140087f44]
jmp 0x14005ffc2
mov r14d, 8
mov rcx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x50]
test rcx, rcx
je 0x14005ffd7
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
test r14d, r14d
je 0x14006000f
test rbx, rbx
je 0x14006000a
mov rcx, qword [rbx + 0x20]
call qword [fcn.140087f44]
mov rcx, qword [rbx + 0x18]
call qword [fcn.140087f44]
mov rdi, qword [rbx + 0x28]
mov rcx, rbx
call qword [fcn.140087f44]
mov rbx, rdi
test rdi, rdi
jne 0x14005ffe1
mov rbx, r13
jmp 0x140060023
test rbx, rbx
jne 0x140060023
mov r14d, 0x2af9
mov ecx, r14d
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov rdi, qword [rsp + 0x60]
mov eax, r14d
mov rsi, qword [rsp + 0x58]
mov qword [r12], rbx
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rbx
ret
movabs r13, 0x47c31d7d7fe039b9
mov r9, qword [rsp + 0x28]
push rdx
call fcn.1402a8d14
sub rcx, rdi
mov rax, qword [rsp + 0x18]
mov rax, qword [rax]
jg 0x14005fe92
mov qword [rsp + 0x18], rcx
mov rbp, r10
add edi, 0x650b3975
push r14
mov ecx, dword [rsp + 0x24]
lea rdi, [rcx + r10*8 + 0x78c23f9a]
add rcx, rdi
add qword [rsp + 0x40], 0xffffffffbfe8350c
lea rax, [rax + 0x16dc2d89]
add qword [rsp + 0x10], 0xffffffffffefed7e
mov qword [rsp + 0x20], 0x521d50cc
and byte [rsp + 0x20], r10b
movabs rbx, 0x481f0fb816e6549f
call fcn.1401cd3da
jbe 0x1400b6d40
call fcn.140271d47
call fcn.1402ee75a
Function at 0x1402644f6
Capabilities:
Encode data using xor

Disassembly:
sets byte [rsp + 0x68]
mov r13, qword [rsp + 0x18]
call fcn.14028115d
mov rbp, qword [rsp + 8]
mov rbp, qword [rbp + riz]
not byte [rsp + 0x18]
and byte [rsp + 0x28], 0x8a
add qword [rsp + 0x10], 0xffffffffbfea31a1
lea rbp, [rbp + 0x52b64571]
jno 0x14026456b
mov dh, 0x52
mov qword [rsp + 8], rdx
neg qword [rsp + 0x28]
setae byte [rsp + 8]
xor byte [rsp + 0x18], dh
cmp word [rsp + 0x18], dx
not dword [rsp + 8]
push rdi
xchg qword [rsp + 0x50], rbp
bswap edx
push rbp
mov rdi, rdx
push rdx
pop rbp
call fcn.14019a5dd
add al, 0x9d
pop rbp
js 0x140264524
mov ch, 0xa
invalid
xchg esi, eax
push rbx
and eax, 0x5e7b362c
xor dl, byte [rdx]
mov dword [rax], edx
outsd dx, dword [rsi]
adc al, 0xcb
push 0x63
jbe 0x1402645eb
pop rdx
fist dword [0xd6dd805f]
invalid
mov ah, 0x65
jae 0x140264644
stosb byte [rdi], al
shl bl, 0x90
invalid
mov ebp, 0x450e5a64
out 0xc8, eax
mov esp, 0xe9804c56
fst qword [rbx]
sbb rax, 0xffffffffccd2d5ac
ror ah, cl
cmp eax, 0x18b41ee7
sbb bl, ch
adc al, 0x46
je 0x140264631
invalid

Function at 0x14026567d
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Packed with generic packer

Disassembly:
mov rdi, qword [rsp + 0x48]
mov rdi, qword [rdi]
jge 0x14002cfd3
lea rdi, [rdi + 0x76643624]
mov qword [rsp + 0x48], 0x393836c6
mov word [rsp + 0x48], 0x40cf
add dword [rsp + 0x48], 0x49296117

Function at 0x1402683b4
Capabilities:
Set socket configuration

Disassembly:
mov r12, qword [rsp + 0x18]
jb fcn.140308ffa
call fcn.14024e86e
pushfq
test bp, 0x75ee
push r9
movabs r9, 0x87e1c004e3d4ced

Function at 0x140284bf9
Capabilities:
Hash data via wincrypt

Disassembly:
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
mov rcx, qword [rsp + 0x40]
lea r9, [rsp + 0x30]
xor r8d, r8d
mov dword [rsp + 0x30], ebp
mov dword [rsp + 0x20], ebp
lea edx, [r8 + 2]
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
cmp dword [rsp + 0x30], 0x10
jne 0x14008648e
mov rcx, qword [rsp + 0x40]
lea r9, [rsp + 0x30]
mov r8, rbx
mov dword [rsp + 0x20], ebp
mov edx, 2
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14008649e
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1400864b0
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140086c80
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
xor byte [rsp + 0x28], 0xd7
push rcx
mov rdx, qword [rsp + 0x20]
mov rdx, qword [rdx + rcx + 0x100]
jb 0x140086446
mov qword [rsp + 0x20], r15
xor byte [rsp], r15b
test ebx, ebx
mov dword [rsp + 0x40], 0x300d78f0
call fcn.14024b352
Function at 0x140285c13
Capabilities:
Resolve dns

Disassembly:
xor dword [rsp + 0x10], 0x4fdb753c
movzx r10w, byte [rsp + 0x11]
xchg qword [rsp + r10*4 - 0x400400f4], rbp
xor dil, r14b
ja 0x140268f23
xor al, byte [rax]
out dx, al
and ch, byte [rsi + 0x4c5f2970]
mov r8, qword [rsp + 0x48]
cmp dword [rsp + 0xa8], 0xbe216d5
call fcn.1401b0dc8
call fcn.1402ea7f4
mov qword [rsp + 0x10], rdi
and r10b, r10b
xor r10b, byte [rsp + 0x16]
and byte [rsp + 0x10], 0xc4
lea rbp, [rbp + 0x4fd67d2]
jg 0x14028bb9b
jns 0x140260df2

Function at 0x1402aa73c
Capabilities:
Encode data using xor

Disassembly:
and al, 0
movabs byte [0x448948ff85fff75c], al
and al, 0x20
mov dword [rsp + 0x50], r10d
call fcn.140132934
stc
or eax, 0xc6d88d2a
push rdx
cmpsd dword [rsi], dword [rdi]
push rdi
cmpsb byte [rsi], byte [rdi]
mov bl, 0xe3
cld
add al, 0x52
mov ebx, 0xdb0fcf8a
mov dword [rcx], edi
jl 0x1402aa6ef
test eax, 0x5a5b86e5
add eax, 0x95d3ee53
xor bh, ah
movsd dword [rdi], dword [rsi]
invalid

Function at 0x1402db35c
Capabilities:
Encode data using xor

Disassembly:
bswap r8
lea r8, [r8 + r8*8 + 0x697206da]
bswap r8
xchg qword [rsp + 0x48], rax
call fcn.14019f006

Function at 0x1402e944d
Capabilities:
Encode data using xor

Disassembly:
or word [rsp + 8], 0x3c45
mov qword [rsp + rbp - 0x40024c0], rbx

Function at 0x1402f26f4
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rdx
mov ebx, 0x37de4825
push r15
add qword [rsp + 0x30], 0xffffffffffec0bbf
mov rdx, rbx
not bl
cmp edx, 0x2c634e80
js 0x14004fc8c
call fcn.1402552ec

Function at 0x1402f9876
Capabilities:
Encode data using xor

Disassembly:
push r11
movabs r11, 0x25110c0353df4664
pushfq

Function at 0x1402fac1a
Capabilities:
Encode data using xor

Disassembly:
push rcx
push r9
movabs rcx, 0x71e9630c65ed5b1f
call fcn.14023f828
lahf
out 0xb8, eax
scasd eax, dword [rdi]
xchg byte [rdi - 0x50], r12b
scasd eax, dword [rdi]
mov al, 0xaf
in eax, dx
out 0xa, al
sar byte [rdx + rax*8], 1
mov dl, reloc.WLDAP32.dll_Ordinal_79
shr bl, 1
xor ecx, 0x4f
sal byte [rax - 0x2fb058c4], 1
jl 0x1402fac33
invalid

Function at 0x140308f8c
Capabilities:
Set socket configuration

Disassembly:
push r8
pushfq
movabs r8, 0x143a6c1455f21887

Function at 0x140308ffa
Capabilities:
Set socket configuration

Disassembly:
lea rcx, [rcx + rbp - 0x3cbc4633]
movabs rbp, 0x2e7d5a514f5b2e5c
push r12
push rbp
push r13
xchg qword [rsp + 0x30], rcx
bswap ebp
movabs r13, 0x18c14a0206c57ed8
setle bpl
push r13
mov rbp, qword [rsp + 0x30]
sets byte [rsp]
neg word [rsp + 0x10]
xor word [rsp], r13w
add byte [rsp + 0x10], r13b
cmp dword [rsp], r13d
not dword [rsp]
mov r13, qword [rsp + 8]
mov r12, qword [rsp + 0x10]
call fcn.1401caa8b
cmp ebx, dword [rdi - 7]
push rax
outsd dx, dword ss:[rsi]
invalid
invalid
Function at 0x1404fde8d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
pushfq
mov qword [rsp + 0x18], 0x59faa306
add qword [rsp + 0x10], 0xffffffffbf74add3
push r11
call fcn.1404764d0
call rax
mov r11, rax
test r15b, 0x66
stc
cmp r12w, 0xed6
test rax, rax
je 0x140958824
cmp r11, rsi
jmp 0x1409588c4
call rax
jmp 0x1409589f4
xor eax, eax
jmp 0x1409589f4
jne 0x140958965
cmp byte [rsp + 0x180], dil
jmp 0x1409588d7
je 0x14095894a
lea rax, [rsp + 0x40]
shl dx, 0xdc
btc rcx, 0x9a
sbb dl, 0xf3
sub rbp, rax
nop
bts cx, r8w
mov edx, esi
lea rdx, [rsp + rdi + 0x40]
mov ecx, edi
xchg ah, al
clc
movsx rax, r13w
mov eax, 0x6ed16877
stc
rol eax, cl
cmp si, sp
add al, dil
clc
test cx, 0x7c20
xor al, byte [rdx + rbp]
jmp 0x140958923
mov byte [rdx], al
jmp 0x14095892a
je 0x140958945
inc rdi
cmp rdi, 0x104
jmp 0x14095893f
jb 0x1409588f9
lea rbp, [rsp + 0x40]
mov rdx, rbp
movsx ax, r10b
mov rcx, rsi
movzx ax, bl
mov rax, qword [0x1404621f0]
jmp 0x14086dff7
cmp byte [rbx + 1], 0x23
movsx rdx, sp
lea rdx, [rbx + 1]
jne 0x1409589d8
movzx edx, byte [rbx + 2]
clc
cmc
add rbx, 2
cmp edx, 0xf255bb3
jmp 0x14095898c
test dl, dl
jmp 0x140958993
je 0x1409589d5
nop
movzx ax, r11b
lahf
lea eax, [rdx - 0x30]
inc rbx
cmp al, 9
ja 0x1409589d5
movsx eax, dl
sub cl, 0x61
rcl cx, 0x32
movzx edx, byte [rbx]
lea ecx, [rdi + rdi*4]
add dil, al
dec dil
lea edi, [rax + rcx*2 - 0x30]
test dl, dl
jmp 0x1409589cf
jne 0x1409589a0
movsxd rdx, edi
sub r8d, r8d
movsxd rcx, ecx
mov rcx, r11
jmp 0x1409589e6
call fcn.1409584a4
jmp 0x1409589f4
mov rbx, qword [rsp + 0x178]
and rbp, r10
test sil, cl
mov rdi, qword [rsp + 0x150]
movsx ebp, r10w
movsx bp, r14b
clc
add rsp, 0x158
movsxd rbp, ebp
movzx esi, r13w
movsx bp, bl
pop rsi
movsxd rbp, r15d
bswap rbp
pop rbp
jmp 0x140958a33
ret
Function at 0x140001980
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400019ca
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400019ca
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400019ca
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400019ca
cmp dword [rcx + 0x84], 0xe
jbe 0x1400019ca
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400019cc
xor al, al
add rsp, 0x28
ret
Function at 0x14034fc20
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14034fc2d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14034fc3d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x14034fc25
lea eax, [rcx + 1]
jmp 0x14034fc4b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x14034fc5e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x14034fc44
sub eax, 3
jb 0x14034fc7e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14034fccd
sar eax, 1
movsxd rbp, eax
jb 0x14034fcb4
jmp 0x14034fc8c
add ebx, ebx
jne 0x14034fc8a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x14034fcb4
inc ecx
add ebx, ebx
jne 0x14034fc9a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x14034fcb4
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14034fcad
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14034fc9c
add ecx, 2
jmp 0x14034fcb9
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.14034fbe2
jmp 0x14034fc2d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x9ae00
mov dl, 0x13
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x14034fd19
cmp rsi, rcx
jae 0x14034fd21
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x14034fd00
cmp al, 0x8f
ja 0x14034fd00
cmp byte [rsi - 2], 0xf
je 0x14034fd06
sub al, 0xe8
cmp al, 1
ja 0x14034fcea
cmp rsi, rcx
jae 0x14034fd21
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x14034fcf0
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x14034fd21
lodsb al, byte [rsi]
jmp 0x14034fd00
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x34c000]
mov eax, dword [rdi]
or eax, eax
je 0x14034fd8a
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x34f1dc]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x14034fd2e
jns 0x14034fd63
movzx rdx, word [rdi]
add rdi, 2
jmp 0x14034fd6d
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x14034fd84
mov qword [rbx], rax
add rbx, 8
jmp 0x14034fd4e
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x14034fdc4
cmp al, 0xef
ja 0x14034fdb6
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x14034fd96
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x14034fda5
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x24f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x14034fe18
sub rsp, 0xffffffffffffff80
jmp 0x14009a358
Function at 0x14000dab0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 7], sil
je 0x14000dae4
mov eax, esi
lea ecx, [rax - 0x65]
xor byte [r8 + rax], cl
inc rax
cmp rax, 6
jb 0x14000dad0
mov byte [r8 + 7], sil
add r8, 6
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.14000c270
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x14000db09
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.14000bd40
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x14000db83
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000db7e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000db7e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140071594
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x14000db90
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r10, r8
mov rdi, rdx
mov rsi, rcx
mov qword [rsp + 0x28], rcx
xor ebx, ebx
cmp byte [r8 + 9], bl
je 0x14000dbc4
mov ecx, ebx
lea eax, [rcx - 0x65]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 8
jb 0x14000dbb0
mov byte [r8 + 9], bl
add r8, 8
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x50]
call fcn.14000c270
nop
cmp byte [rdi + 9], 0
je 0x14000dbf4
lea eax, [rbx - 0x65]
xor byte [rbx + rdi], al
inc rbx
cmp rbx, 8
jb 0x14000dbe1
mov byte [rdi + 9], 0
lea r8, [rdi + 8]
lea r9, [rsp + 0x20]
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.14000c270
nop
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
movzx edx, byte [rsp + 0x20]
mov rcx, rsi
call fcn.140013440
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x14000dc64
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000dc5e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000dc5e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140071594
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x14000dca4
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000dc9f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000dc9f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140071594
mov rax, rsi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x14000dcb0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 9], sil
je 0x14000dce4
mov eax, esi
lea ecx, [rax - 0x65]
xor byte [r8 + rax], cl
inc rax
cmp rax, 8
jb 0x14000dcd0
mov byte [r8 + 9], sil
add r8, 8
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.14000c270
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x14000dd09
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.14000bd40
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x14000dd83
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000dd7e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000dd7e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140071594
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x14000dd90
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 0xa], sil
je 0x14000ddc4
mov eax, esi
lea ecx, [rax - 0x65]
xor byte [r8 + rax], cl
inc rax
cmp rax, 9
jb 0x14000ddb0
mov byte [r8 + 0xa], sil
add r8, 9
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.14000c270
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x14000dde9
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.14000bd40
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x14000de63
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000de5e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000de5e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140071594
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x14000de70
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 0xc], sil
je 0x14000dea4
mov eax, esi
lea ecx, [rax - 0x65]
xor byte [r8 + rax], cl
inc rax
cmp rax, 0xb
jb 0x14000de90
mov byte [r8 + 0xc], sil
add r8, 0xb
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.14000c270
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x14000dec9
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.14000bd40
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x14000df43
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000df3e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000df3e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140071594
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x140014560
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 9], al
je 0x140014583
lea edx, [rax - 0x65]
xor byte [rax + rcx], dl
inc rax
cmp rax, 8
jb 0x140014570
mov byte [rcx + 9], 0
lea r8, [rcx + 8]
mov rdx, rcx
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.14000c270
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x1400145a0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 0x10], al
je 0x1400145c3
lea edx, [rax - 0x65]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xf
jb 0x1400145b0
mov byte [rcx + 0x10], 0
lea r8, [rcx + 0xf]
mov rdx, rcx
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.14000c270
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x140015ee0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 5], 0
je 0x140015f03
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x65]
xor byte [rax + rcx], dl
inc rax
cmp rax, 4
jb 0x140015ef0
mov byte [rcx + 5], 0
mov rax, rcx
ret

Function at 0x140015f10
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x136], 0
je 0x140015f38
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x65]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x135
jb 0x140015f20
mov byte [rcx + 0x136], 0
mov rax, rcx
ret

Function at 0x140015f40
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x44], 0
je 0x140015f63
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x65]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x43
jb 0x140015f50
mov byte [rcx + 0x44], 0
mov rax, rcx
ret

Function at 0x140015f70
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x47], 0
je 0x140015f93
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x65]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x46
jb 0x140015f80
mov byte [rcx + 0x47], 0
mov rax, rcx
ret
Function at 0x140017e30
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
mov r10, rcx
mov ecx, r9d
test r8, r8
je 0x140017f17
sub r10, rdx
cmp r8, 8
jb 0x140017ef3
mov rax, r8
lea r9, [rdx + 4]
and rax, 0xfffffffffffffff8
xorps xmm3, xmm3
xorps xmm2, xmm2
movd xmm1, dword [r10 + r9 - 4]
add rcx, 8
movd xmm0, dword [r9 - 4]
lea r9, [r9 + 8]
punpcklbw xmm1, xmm1
punpcklwd xmm1, xmm1
punpcklbw xmm0, xmm0
psrad xmm1, 0x18
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
pxor xmm1, xmm0
movd xmm0, dword [r9 - 8]
punpcklbw xmm0, xmm0
por xmm3, xmm1
movd xmm1, dword [r10 + r9 - 8]
punpcklbw xmm1, xmm1
punpcklwd xmm1, xmm1
punpcklwd xmm0, xmm0
psrad xmm1, 0x18
psrad xmm0, 0x18
pxor xmm1, xmm0
por xmm2, xmm1
cmp rcx, rax
jb 0x140017e60
por xmm2, xmm3
movdqa xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movdqa xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movd r9d, xmm2
cmp rcx, r8
jae 0x140017f17
lea rax, [rcx + rdx]
sub r8, rcx
nop word [rax + rax]
movsx edx, byte [r10 + rax]
movsx ecx, byte [rax]
lea rax, [rax + 1]
xor edx, ecx
or r9d, edx
sub r8, 1
jne 0x140017f00
test r9d, r9d
sete al
ret