joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140074410
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x140126080]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor edi, edi
lea r9, [rsp + 0x20]
mov rsi, rcx
mov dword [rsp + 0x20], edi
xor r8d, r8d
xor edx, edx
mov ebx, edi
lea ecx, [rdi + 0xb]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x14007449c
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rsp + 0x20]
xor ecx, ecx
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
mov rdx, rax
mov ecx, listen
mov rbx, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x140074453
test eax, eax
jns 0x1400744bd
test rbx, rbx
je 0x1400744c2
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
jmp 0x14007458d
test rbx, rbx
jne 0x1400744c9
xor eax, eax
jmp 0x14007458d
mov qword [rsp + 0x68], rbp
cmp dword [rbx], edi
jbe 0x140074575
nop word [rax + rax]
mov eax, edi
imul rcx, rax, 0x128
movzx edx, word [rcx + rbx + 0x2e]
lea rbp, [rcx + rbx]
add rcx, 0x30
add rdx, rcx
lea rcx, [rsp + 0x28]
add rdx, rbx
call fcn.140066b60
cmp qword [rsi + 0x18], 0xf
mov rdx, rsi
jbe 0x140074513
mov rdx, qword [rsi]
cmp qword [rsp + 0x40], 0xf
lea rcx, [rsp + 0x28]
cmova rcx, qword [rsp + 0x28]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x1400745aa
mov rdx, qword [rsp + 0x40]
cmp rdx, 0xf
jbe 0x14007456b
mov rcx, qword [rsp + 0x28]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140074566
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400745f3
call fcn.1400efe10
inc edi
cmp edi, dword [rbx]
jb 0x1400744e0
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov rbp, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400ef6e0
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
mov rdi, qword [rbp + 0x18]
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rdx, qword [rsp + 0x40]
cmp rdx, 0xf
jbe 0x1400745ff
mov rcx, qword [rsp + 0x28]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400745fa
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400745fa
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400efe10
mov rax, rdi
jmp 0x140074588
Function at 0x140074a00
Capabilities:
Interact with driver via ioctl

Disassembly:
mov r11, rsp
sub rsp, 0x78
mov rax, qword [0x140126080]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor r9d, r9d
mov eax, r8d
cmp byte [0x140377ad0], r9b
lea r8, [r11 - 0x38]
mov qword [r11 - 0x40], r9
mov qword [r11 - 0x48], r9
mov dword [r11 - 0x50], r9d
mov qword [r11 - 0x20], rax
mov eax, dword [0x140377ac0]
mov dword [r11 - 0x34], r9d
mov qword [r11 - 0x30], rcx
mov rcx, qword [0x140377ac8]
mov qword [r11 - 0x28], rdx
mov edx, 0x222404
mov qword [r11 - 0x58], r9
mov r9d, reloc.WLDAP32.dll_Ordinal_32
mov dword [rsp + 0x40], eax
jne 0x140074a6a
mov edx, 0x220c58
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
setne al
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400ef6e0
add rsp, 0x78
ret
Function at 0x140075a30
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x40
xor r9d, r9d
lea rdi, [rbp + 0x18]
mov rbx, qword [rdi]
movabs r14, 0xff03ceeb64ac707b
mov qword [rdi], r9
mov r11, r14
mov byte [rbp - 0x20], 0x3e
mov r10d, r9d
mov byte [rbp - 0x1f], reloc.WS2_32.dll_ntohs
lea esi, [r9 + 0xf]
mov byte [rbp - 0x1e], Ordinal_41
mov byte [rbp - 0x1d], 0xa
mov byte [rbp - 0x1c], reloc.WLDAP32.dll_Ordinal_22
mov byte [rbp - 0x1b], 0xf8
mov byte [rbp - 0x1a], 0xcc
mov byte [rbp - 0x19], 0xea
mov byte [rbp - 0x18], 0xe2
mov byte [rbp - 0x17], 0xef
mov byte [rbp - 0x16], 0xe8
mov byte [rbp - 0x15], 0xfe
mov byte [rbp - 0x14], 0xc9
mov byte [rbp - 0x13], 0xe7
mov byte [rbp - 0x12], 0xf3
mov byte [rbp - 0x11], 0xf6
mov byte [rbp - 0x10], 0xe5
mov byte [rbp - 0xf], 0xc2
mov byte [rbp - 0xe], 0xe3
mov byte [rbp - 0xd], 0xf9
mov byte [rbp - 0xc], 0xf6
mov byte [rbp - 0xb], 0xee
mov byte [rbp - 0xa], __WSAFDIsSet
movzx eax, byte [rbp - 0x20]
lea rax, [rbp - 0x20]
sub r11, rax
nop dword [rax]
mov rcx, r10
lea rdx, [rbp - 0x20]
add rdx, r10
and ecx, esi
cmp rcx, rsi
mov rax, r14
cmovae rcx, rsi
movsx r8, byte [rdx]
add dl, r11b
shl cl, 2
shr rax, cl
and al, sil
xor al, dl
xor al, r8b
mov byte [rbp + r10 - 0x20], al
inc r10
cmp r10, 0x17
jb 0x140075ad0
mov byte [rbp + 0x20], 0x87
movabs r11, 0xabbee66ee4cca5fb
mov byte [rbp + 0x21], 0x9a
mov r10, r11
mov byte [rbp + 0x22], __WSAFDIsSet
mov byte [rbp + 0x23], Ordinal_200
mov byte [rbp + 0x24], 0xc1
mov byte [rbp + 0x25], 0x79
mov byte [rbp + 0x26], 5
movzx eax, byte [rbp + 0x20]
lea rax, [rbp + 0x20]
sub r10, rax
nop dword [rax]
mov rcx, r9
lea rdx, [rbp + 0x20]
add rdx, r9
and ecx, esi
cmp rcx, rsi
mov rax, r11
cmovae rcx, rsi
movzx r8d, byte [rdx]
add dl, r10b
shl cl, 2
shr rax, cl
and al, sil
xor al, dl
xor al, r8b
mov byte [rbp + r9 + 0x20], al
inc r9
cmp r9, 7
jb 0x140075b40
lea rcx, [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
test rax, rax
jne 0x140075be2
lea rcx, str.user32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtUserInjectMouseInput
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
test rax, rax
jne 0x140075be2
lea rcx, str.user32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.InjectMouseInput
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
test rax, rax
je 0x140075c3f
movups xmm1, xmmword [rcx]
movdqu xmmword [0x1403776a8], xmm1
movsd xmm0, qword [rcx + 0x10]
movsd qword [0x1403776b8], xmm0
mov eax, dword [rcx + 0x18]
movdqa xmm0, xmmword [0x140114010]
mov dword [0x1403776c0], eax
xorps xmm0, xmm1
movzx eax, word [rcx + 0x1c]
lea rcx, [0x1403776a8]
mov word [0x1403776c4], ax
mov eax, reloc.WS2_32.dll_recv
movdqu xmmword [0x1403776a8], xmm0
nop dword [rax]
xor byte [rax + rcx], 0xfa
inc rax
cmp rax, 0x1e
jb 0x140075c30
mov al, 1
mov rsi, qword [rsp + 0x70]
mov qword [rdi], rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop r14
pop rdi
pop rbp
ret
Function at 0x1400829f0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x2b0
mov rax, qword [0x140126080]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
mov rbx, rdx
mov rsi, rcx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x50], rdx
mov dword [rsp + 0x20], 1
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
xor r14d, r14d
mov qword [rcx], r14
mov qword [rcx + 8], r14
mov qword [rcx + 0x10], r14
mov dword [rsp + 0x20], 1
cmp qword [rdx + 0x10], r14
jne 0x140082a5a
mov rdx, qword [rdx + 0x18]
jmp 0x140082b7b
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbp, rax
mov dword [rsp + 0x60], 0x238
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140082b6d
nop word [rax + rax]
lea rdx, [rsp + 0x8c]
lea rcx, [rsp + 0x30]
call fcn.140071380
mov r8, rax
mov rcx, rbx
cmp qword [rbx + 0x18], 7
jbe 0x140082ab2
mov rcx, qword [rbx]
mov rdx, qword [rax + 0x10]
cmp qword [rax + 0x18], 7
jbe 0x140082ac0
mov r8, qword [rax]
cmp rdx, qword [rbx + 0x10]
jne 0x140082ae9
test rdx, rdx
je 0x140082ae4
sub r8, rcx
nop
movzx eax, word [r8 + rcx]
cmp ax, word [rcx]
jne 0x140082ae9
add rcx, 2
sub rdx, 1
jne 0x140082ad0
mov dil, 1
jmp 0x140082aec
xor dil, dil
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x140082b2e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140082b29
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140082bed
call fcn.1400efe10
test dil, dil
je 0x140082b57
mov rdx, qword [rsi + 8]
cmp rdx, qword [rsi + 0x10]
je 0x140082b4a
mov eax, dword [rsp + 0x68]
mov dword [rdx], eax
add qword [rsi + 8], 4
jmp 0x140082b57
lea r8, [rsp + 0x68]
mov rcx, rsi
call fcn.14008d6e0
lea rdx, [rsp + 0x60]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140082a90
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 7
jbe 0x140082bb2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x140082bad
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140082bf4
mov rcx, r8
call fcn.1400efe10
mov word [rbx], r14w
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], r14
mov rax, rsi
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.1400ef6e0
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x14008c9e0
Capabilities:
Interact with driver via ioctl

Disassembly:
mov r11, rsp
sub rsp, 0x78
mov rax, qword [0x140126080]
xor rax, rsp
mov qword [rsp + 0x68], rax
xor ecx, ecx
mov dword [rsp + 0x40], 0
cmp byte [0x140377ad0], cl
lea rax, [r11 - 0x38]
mov qword [r11 - 0x40], rcx
lea r8, [r11 - 0x30]
mov dword [rsp + 0x4c], ecx
mov qword [r11 - 0x48], rcx
lea r9d, [rcx + 0x20]
mov dword [rsp + 0x28], ecx
mov qword [r11 - 0x20], rax
mov eax, dword [0x140377ac0]
mov qword [r11 - 0x28], rdx
mov edx, 0x222404
mov qword [r11 - 0x58], rcx
mov rcx, qword [0x140377ac8]
mov qword [r11 - 0x18], 4
mov dword [rsp + 0x48], eax
jne 0x14008ca53
mov edx, 0x220c58
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
movss xmm0, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1400ef6e0
add rsp, 0x78
ret

Function at 0x14008ca80
Capabilities:
Interact with driver via ioctl

Disassembly:
mov r11, rsp
sub rsp, 0x78
mov rax, qword [0x140126080]
xor rax, rsp
mov qword [rsp + 0x68], rax
xor ecx, ecx
lea rax, [r11 - 0x38]
cmp byte [0x140377ad0], cl
lea r8, [r11 - 0x30]
mov qword [r11 - 0x40], rcx
mov dword [rsp + 0x4c], ecx
mov qword [r11 - 0x48], rcx
lea r9d, [rcx + 0x20]
mov dword [rsp + 0x28], ecx
mov qword [r11 - 0x20], rax
mov eax, dword [0x140377ac0]
mov qword [r11 - 0x28], rdx
mov edx, 0x222404
mov qword [r11 - 0x58], rcx
mov dword [rsp + 0x40], ecx
mov rcx, qword [0x140377ac8]
mov qword [r11 - 0x18], 4
mov dword [rsp + 0x48], eax
jne 0x14008caef
mov edx, 0x220c58
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov eax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1400ef6e0
add rsp, 0x78
ret

Function at 0x14008cb10
Capabilities:
Interact with driver via ioctl

Disassembly:
mov r11, rsp
sub rsp, 0x78
mov rax, qword [0x140126080]
xor rax, rsp
mov qword [rsp + 0x68], rax
xor ecx, ecx
lea rax, [r11 - 0x38]
cmp byte [0x140377ad0], cl
lea r8, [r11 - 0x30]
mov qword [r11 - 0x40], rcx
mov dword [rsp + 0x4c], ecx
mov qword [r11 - 0x48], rcx
lea r9d, [rcx + 0x20]
mov dword [rsp + 0x28], ecx
mov qword [r11 - 0x20], rax
mov eax, dword [0x140377ac0]
mov qword [r11 - 0x28], rdx
mov edx, 0x222404
mov qword [r11 - 0x58], rcx
mov qword [r11 - 0x38], rcx
mov rcx, qword [0x140377ac8]
mov qword [r11 - 0x18], 8
mov dword [rsp + 0x48], eax
jne 0x14008cb7f
mov edx, 0x220c58
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1400ef6e0
add rsp, 0x78
ret
Function at 0x14008cbf0
Capabilities:
Interact with driver via ioctl

Disassembly:
mov r11, rsp
sub rsp, 0x78
mov rax, qword [0x140126080]
xor rax, rsp
mov qword [rsp + 0x68], rax
xor ecx, ecx
lea rax, [r11 - 0x38]
cmp byte [0x140377ad0], cl
lea r8, [r11 - 0x30]
mov qword [r11 - 0x40], rcx
xorps xmm0, xmm0
mov dword [rsp + 0x4c], ecx
mov qword [r11 - 0x48], rcx
lea r9d, [rcx + 0x20]
mov dword [rsp + 0x28], ecx
mov qword [r11 - 0x20], rax
mov eax, dword [0x140377ac0]
mov qword [r11 - 0x28], rdx
mov edx, 0x222404
mov qword [r11 - 0x58], rcx
mov rcx, qword [0x140377ac8]
mov qword [r11 - 0x18], 8
movsd qword [rsp + 0x40], xmm0
mov dword [rsp + 0x48], eax
jne 0x14008cc64
mov edx, 0x220c58
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
movsd xmm0, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1400ef6e0
add rsp, 0x78
ret

Function at 0x14008ddc0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 7], sil
je 0x14008ddf4
mov eax, esi
lea ecx, [rax + 0x26]
xor byte [r8 + rax], cl
inc rax
cmp rax, 6
jb 0x14008dde0
mov byte [r8 + 7], sil
add r8, 6
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.14008d400
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x14008de19
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.14006afd0
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x14008de93
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14008de8e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14008de8e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400efe10
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x14008dea0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r10, r8
mov rdi, rdx
mov rsi, rcx
mov qword [rsp + 0x28], rcx
xor ebx, ebx
cmp byte [r8 + 9], bl
je 0x14008ded4
mov ecx, ebx
lea eax, [rcx + 0x26]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 8
jb 0x14008dec0
mov byte [r8 + 9], bl
add r8, 8
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x50]
call fcn.14008d400
nop
cmp byte [rdi + 9], 0
je 0x14008df04
lea eax, [rbx + 0x26]
xor byte [rbx + rdi], al
inc rbx
cmp rbx, 8
jb 0x14008def1
mov byte [rdi + 9], 0
lea r8, [rdi + 8]
lea r9, [rsp + 0x20]
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.14008d400
nop
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
movzx edx, byte [rsp + 0x20]
mov rcx, rsi
call fcn.140093ab0
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x14008df74
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14008df6e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14008df6e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400efe10
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x14008dfb4
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14008dfaf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14008dfaf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400efe10
mov rax, rsi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret

Function at 0x14008dfc0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 9], sil
je 0x14008dff4
mov eax, esi
lea ecx, [rax + 0x26]
xor byte [r8 + rax], cl
inc rax
cmp rax, 8
jb 0x14008dfe0
mov byte [r8 + 9], sil
add r8, 8
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.14008d400
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x14008e019
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.14006afd0
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x14008e093
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14008e08e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14008e08e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400efe10
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x14008e0a0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 0xa], sil
je 0x14008e0d4
mov eax, esi
lea ecx, [rax + 0x26]
xor byte [r8 + rax], cl
inc rax
cmp rax, 9
jb 0x14008e0c0
mov byte [r8 + 0xa], sil
add r8, 9
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.14008d400
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x14008e0f9
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.14006afd0
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x14008e173
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14008e16e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14008e16e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400efe10
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x14008e180
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 0xc], sil
je 0x14008e1b4
mov eax, esi
lea ecx, [rax + 0x26]
xor byte [r8 + rax], cl
inc rax
cmp rax, 0xb
jb 0x14008e1a0
mov byte [r8 + 0xc], sil
add r8, 0xb
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.14008d400
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x14008e1d9
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.14006afd0
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x14008e253
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14008e24e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14008e24e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400efe10
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x140094c40
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 9], al
je 0x140094c63
lea edx, [rax + 0x26]
xor byte [rax + rcx], dl
inc rax
cmp rax, 8
jb 0x140094c50
mov byte [rcx + 9], 0
lea r8, [rcx + 8]
mov rdx, rcx
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.14008d400
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x140094c80
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 0x10], al
je 0x140094ca3
lea edx, [rax + 0x26]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xf
jb 0x140094c90
mov byte [rcx + 0x10], 0
lea r8, [rcx + 0xf]
mov rdx, rcx
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.14008d400
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x140095c80
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 5], 0
je 0x140095ca3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x26]
xor byte [rax + rcx], dl
inc rax
cmp rax, 4
jb 0x140095c90
mov byte [rcx + 5], 0
mov rax, rcx
ret

Function at 0x140095cb0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x136], 0
je 0x140095cd8
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x26]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x135
jb 0x140095cc0
mov byte [rcx + 0x136], 0
mov rax, rcx
ret

Function at 0x140095ce0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x44], 0
je 0x140095d03
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x26]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x43
jb 0x140095cf0
mov byte [rcx + 0x44], 0
mov rax, rcx
ret

Function at 0x140095d10
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x47], 0
je 0x140095d33
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x26]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x46
jb 0x140095d20
mov byte [rcx + 0x47], 0
mov rax, rcx
ret
Function at 0x140096f80
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
mov r10, rcx
mov ecx, r9d
test r8, r8
je 0x140097067
sub r10, rdx
cmp r8, 8
jb 0x14009703c
mov rax, r8
lea r9, [rdx + 4]
and rax, 0xfffffffffffffff8
xorps xmm3, xmm3
xorps xmm2, xmm2
movd xmm1, dword [r10 + r9 - 4]
add rcx, 8
movd xmm0, dword [r9 - 4]
lea r9, [r9 + 8]
punpcklbw xmm1, xmm1
punpcklwd xmm1, xmm1
punpcklbw xmm0, xmm0
psrad xmm1, 0x18
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
movd xmm0, dword [r9 - 8]
punpcklbw xmm0, xmm0
orps xmm3, xmm1
movd xmm1, dword [r10 + r9 - 8]
punpcklbw xmm1, xmm1
punpcklwd xmm1, xmm1
punpcklwd xmm0, xmm0
psrad xmm1, 0x18
psrad xmm0, 0x18
xorps xmm1, xmm0
orps xmm2, xmm1
cmp rcx, rax
jb 0x140096fb0
orps xmm2, xmm3
movdqa xmm0, xmm2
psrldq xmm0, 8
orps xmm2, xmm0
movdqa xmm0, xmm2
psrldq xmm0, 4
orps xmm2, xmm0
movd r9d, xmm2
cmp rcx, r8
jae 0x140097067
lea rax, [rcx + rdx]
sub r8, rcx
nop dword [rax]
nop word [rax + rax]
movsx edx, byte [r10 + rax]
movsx ecx, byte [rax]
lea rax, [rax + 1]
xor edx, ecx
or r9d, edx
sub r8, 1
jne 0x140097050
test r9d, r9d
sete al
ret