joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140f7934b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r12
push r13
movsx r12d, r9w
jmp 0x140f7936d
push r14
bt r12w, 0xb1
xor r12b, 0xa
test spl, r14b
sub rsp, 0x40
movzx r14d, si
setle r12b
movsx r12, ax
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
not r13w
mov qword [rsp + 0x70], rsi
bswap si
movzx rbx, r11w
movsx rbx, cx
mov qword [rsp + 0x78], rdi
mov r12, 0xffffffffa590e214
mov rsi, r9
movsx r13d, dx
movzx r14w, r10b
mov bl, r10b
mov r12, r8
bswap r13w
xchg bx, r13w
movsx rbx, r13w
mov r14, rdx
movsx r13w, r8b
mov r13, rcx
movzx ebx, r12w
movsx bx, al
mov rbx, qword [rcx + 0x10]
bswap rcx
mov rcx, rdi
movsx cx, r9b
mov qword [rsp + 0x60], rbx
mov rcx, rbx
call fcn.140f674ef
mov rax, qword [r13 + 0x10]
bsr r10w, r13w
movsx r8w, r15b
stc
mov r10, r14
btc r9w, di
ror r9b, 0x81
and r10, 0xfffffffffffffffc
cmp r14b, r14b
sub edi, edi
ror r8b, 0xb6
ror r9w, cl
xchg r8b, r8b
mov r9, rdi
mov r8, qword [rax + 0x38]
cmc
test spl, 0x30
test r8, r8
jmp 0x140f7944b
je 0x140f795c5
mov rax, qword [rax + 0x28]
sbb cx, 0xa68c
or cx, 0x8299
mov rcx, qword [rax]
cmp qword [rcx + 8], r10
jmp 0x140f7946b
je 0x140f7948d
inc r9
jmp 0x140f7947a
add rax, 8
stc
cmp r9, r8
jb 0x140f7945f
jmp 0x140f795c5
cmp dword [rcx + 0x10], edi
jmp 0x140f79495
jne 0x140f795c5
mov ecx, dword [rsp + 0x88]
cmp r10b, r8b
stc
test eax, ebx
sub ecx, 1
jmp 0x140f794b0
je 0x140f79565
sub ecx, 3
jmp 0x140f794be
je 0x140f7952b
cmp ecx, 1
jmp 0x140f794cc
je 0x140f794e1
mov edi, 0xc0000002
jmp 0x140f794dc
jmp 0x140f795ac
cmp dword [rsp + 0x80], 0x10
jmp 0x140f794ee
jae 0x140f79503
mov edi, 0xc0000004
jmp 0x140f794fe
jmp 0x140f795ac
mov dword [rsi], 0x80000
mov dword [rsi + 4], 0x104
jmp 0x140f79515
mov dword [rsi + 8], edi
jmp 0x140f7951d
mov word [rsi + 0xc], di
jmp 0x140f79526
jmp 0x140f795ac
cmp dword [rsp + 0x80], 8
jmp 0x140f79538
jae 0x140f7954d
mov edi, 0xc0000004
jmp 0x140f79548
jmp 0x140f795ac
mov dword [rsi], 7
jmp 0x140f79558
mov dword [rsi + 4], edi
jmp 0x140f79560
jmp 0x140f795ac
cmp dword [rsp + 0x80], 0x18
jmp 0x140f79572
jae 0x140f79587
mov edi, 0xc0000004
jmp 0x140f79582
jmp 0x140f795ac
mov qword [rsi], rdi
movsx ecx, r12w
mov cl, 0x3a
cmova cx, cx
mov dword [rsi + 8], edi
not ch
movsxd rcx, r10d
mov dword [rsi + 0xc], edi
mov byte [rsi + 0x10], 0
setae ch
xchg ch, ch
mov word [rsi + 0x12], di
mov dword [r12], edi
mov rcx, rbx
call fcn.140f41b13
mov eax, edi
jmp 0x140f795c0
jmp 0x140f79621
mov rcx, rbx
jmp 0x140f795cd
call fcn.140eb85b3
mov r11d, dword [rsp + 0x88]
movsx edx, r14w
mov dword [rsp + 0x20], r11d
movsx ecx, r9w
cwd
movzx rcx, r14w
mov r9d, dword [rsp + 0x80]
mov cl, r8b
movzx cx, sil
mov r8, rsi
setns cl
movsx rdx, r9w
cqo
mov rdx, r12
not rcx
mov rcx, r14
jmp 0x140f79618
call qword [r13 + 0x50]
nop
sbb dil, 0x1a
mov rbx, qword [rsp + 0x68]
xadd r12b, r13b
sub rdi, 0x2dab9f14
mov rsi, qword [rsp + 0x70]
sar r13b, 0x27
mov rdi, qword [rsp + 0x78]
bsr r12, r12
add rsp, 0x40
pop r14
bswap r13w
mov r12, r15
movzx r12d, dx
pop r13
movsx r12, si
not r12d
mov r12b, sil
pop r12
jmp 0x140f79667
ret
Function at 0x140f79668
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r12
dec r12b
not r12b
movsx r12d, r12w
push r13
clc
movsx r13d, r12w
sbb r12b, 0xae
push r14
bt r14w, 0xb5
sub rsp, 0x40
mov r12b, cl
mov r12b, 0x85
setle r12b
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov r13b, 0x32
movsx r14d, r9w
movzx r12, r12w
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], rdi
movsxd rbx, esi
movsx ebx, dx
xchg r14d, esi
mov rsi, r9
mov r12, r8
mov r14, rdx
mov r13, rcx
movzx rbx, r10w
movzx bx, bh
movsx rbx, si
mov rbx, qword [rcx + 0x10]
jmp 0x140f796e2
mov qword [rsp + 0x60], rbx
mov ch, 0x8f
movsx ecx, dx
mov rcx, rbx
jmp 0x140f796f5
call fcn.140f53c65
mov rax, qword [r13 + 0x10]
mov r10, r14
bsf r8, r10
xor r8, 0xffffffff8d10909c
bts r8, r9
and r10, 0xfffffffffffffffc
sub edi, edi
inc r8d
mov r9, rdi
xadd r8w, r8w
or r8b, r8b
mov r8, qword [rax + 0x38]
jmp 0x140f79730
test r8, r8
jmp 0x140f79738
je 0x140f79826
mov rax, qword [rax + 0x28]
and dl, 0x87
nop
bts dx, ax
mov rdx, qword [rax]
cmp qword [rdx + 8], r10
jmp 0x140f79756
je 0x140f79787
inc r9
test r9, rdi
cmp r11b, 0x87
add rax, 8
clc
test r9w, di
jmp 0x140f79774
cmp r9, r8
jmp 0x140f7977c
jb 0x140f7974a
jmp 0x140f79826
cmp dword [rdx + 0x10], edi
jmp 0x140f7978f
jne 0x140f79826
cmp dword [rsp + 0x88], 0xe
jmp 0x140f797a2
je 0x140f797b7
mov edi, 0xc0000002
jmp 0x140f797b2
jmp 0x140f79802
cmp dword [rsp + 0x80], 8
jmp 0x140f797c4
jae 0x140f797d9
mov edi, 0xc0000004
jmp 0x140f797d4
jmp 0x140f79802
cmp dword [rsi + 4], 0
jmp 0x140f797e2
je 0x140f797f5
mov dword [rsi], 0xffffffff
jmp 0x140f797f5
mov ecx, dword [rsi]
mov qword [rdx + 0x18], rcx
mov ecx, ecx
jmp 0x140f79802
mov dword [r12], edi
bswap cx
not cx
movzx cx, r15b
mov rcx, rbx
call fcn.1409e382c
mov eax, edi
jmp 0x140f79821
jmp 0x140f7986b
mov rcx, rbx
call fcn.140ec4bc6
mov r11d, dword [rsp + 0x88]
mov dword [rsp + 0x20], r11d
movzx r8w, cl
mov r9d, dword [rsp + 0x80]
mov r8, rsi
mov rdx, r12
jmp 0x140f7985d
mov rcx, r14
jmp 0x140f79865
call qword [r13 + 0x58]
nop
cmc
mov rbx, qword [rsp + 0x68]
rcl r12w, 0x9b
mov rsi, qword [rsp + 0x70]
or r14b, 6
dec r12d
mov rdi, qword [rsp + 0x78]
bt r14w, 0x92
cmp rbp, 0x4d9bc216
add rsp, 0x40
xchg r14, r14
pop r14
not r13w
movzx r13, r8w
pop r13
pop r12
jmp 0x140f798ad
ret
Function at 0x14000e400
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by fnv-1a hash
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
lea rdx, str.error_:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140012700
mov rcx, rax
mov rdx, rbx
call fcn.140012700
lea rdx, [0x1400128d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x14000e4c7
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x14000e4c7
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x14000e4c2
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x14000e4a0
cmp r8d, 0x2fa62ca8
je 0x14000e4cc
test r9d, r9d
jne 0x14000e480
mov rax, qword [rax]
jmp 0x14000e450
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
mov ecx, 0xbb8
add rax, r10
call rax
mov rbx, qword [rsp + 0x30]
mov qword [0], 1
add rsp, 0x20
pop rdi
ret
Function at 0x1400112d0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je 0x140011307
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rsi
mov rsi, rbx
mov r9, qword [rax]
test r9, r9
je 0x140011328
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x14001132a
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140011383
test ecx, ecx
jle 0x140011363
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
sub rbx, rbp
add r14, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140011383
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140011383
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov rbp, qword [rsp + 0x30]
sub rsi, rbx
mov rbx, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x1400113b0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x1400113d2
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x1400113e8
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140011404
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140011406
xor ecx, ecx
mov qword [rsp + 0x20], rdi
movsxd rax, ecx
test ecx, ecx
je 0x140011440
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
sub rbx, rdi
add r14, rdi
mov r8, rbx
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x1400114e7
mov r9, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r9], rax
jne 0x14001147b
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r9], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
mov rdi, r8
cmp r8, 0xfff
jbe 0x1400114c1
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
add r14, rax
mov rdi, rbx
cmp rax, 0xfff
jne 0x140011500
cmp rbx, rax
ja 0x140011490
mov r8, rdi
test rdi, rdi
je 0x1400114e7
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov r8, rdi
sub r8, rax
sub rbp, r8
mov rdi, qword [rsp + 0x20]
mov rax, rbp
mov rbx, qword [rsp + 0x28]
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
sub rbp, rbx
jmp 0x1400114ea
Function at 0x140011910
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140095080]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14001193d
xor eax, eax
jmp 0x140011a92
mov rdx, qword [rcx + 0x40]
mov rax, qword [rdx]
test rax, rax
je 0x140011968
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
add r8, rax
cmp rax, r8
jae 0x140011968
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], dil
mov eax, edi
jmp 0x140011a92
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x140011a85
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x1400119ab
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x1400119d6
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140011a8a
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140011a45
sub eax, 1
je 0x140011a45
cmp eax, 2
jne 0x140011a85
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140011a8a
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x140011a73
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x140011a85
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov eax, edi
jne 0x140011a8a
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400760d0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x140011f80
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140095080]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140012053
cmp byte [rcx + 0x71], 0
je 0x140012053
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + Ordinal_26]
cmp eax, 0xffffffff
je 0x14001204f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140012014
sub eax, 1
je 0x140012018
cmp eax, 2
jne 0x14001204f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400760d0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140012046
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14001204f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x140011ffc
xor al, al
jmp 0x140011ffc
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400760d0
add rsp, 0x60
pop rbx
ret

Function at 0x140014350
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x50
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor edi, edi
cmp byte [r8 + 7], dil
je 0x140014384
mov ecx, edi
nop dword [rax]
lea eax, [rcx + 0x4a]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 6
jb 0x140014370
mov byte [r8 + 7], dil
lea rax, [r8 + 6]
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x1400143b1
mov qword [rsp + 0x30], rdi
mov byte [rsp + 0x20], dil
jmp 0x1400143d0
mov qword [rsp + 0x30], 6
mov eax, dword [r8]
mov dword [rsp + 0x20], eax
movzx eax, word [r8 + 4]
mov word [rsp + 0x24], ax
mov byte [rsp + 0x26], dil
mov r9, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x1400143de
mov rdx, qword [rdx]
mov r8, rdx
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.1400121b0
mov qword [rbx], rdi
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x140014455
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140014450
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140014450
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007612c
mov rax, rbx
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x140014470
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rbx, rcx
mov qword [rbp - 0x10], rcx
xor r9d, r9d
cmp byte [r8 + 9], r9b
je 0x1400144b4
mov ecx, r9d
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x4a]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 8
jb 0x1400144a0
mov byte [r8 + 9], r9b
lea rax, [r8 + 8]
mov qword [rbp - 0x38], r9
mov qword [rbp - 0x28], r9
mov qword [rbp - 0x20], r9
mov qword [rbp - 0x20], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x1400144db
mov qword [rbp - 0x28], r9
mov byte [rbp - 0x38], r9b
jmp 0x1400144ee
mov qword [rbp - 0x28], 8
mov rax, qword [r8]
mov qword [rbp - 0x38], rax
mov byte [rbp - 0x30], r9b
cmp byte [rdx + 9], 0
je 0x140014513
mov rcx, r9
nop word [rax + rax]
lea eax, [rcx + 0x4a]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 8
jb 0x140014500
mov byte [rdx + 9], 0
lea rax, [rdx + 8]
mov qword [rbp - 0x58], r9
mov qword [rbp - 0x48], r9
mov qword [rbp - 0x40], r9
mov qword [rbp - 0x40], reloc.WS2_32.dll_ntohs
cmp rdx, rax
jne 0x14001453a
mov qword [rbp - 0x48], r9
mov byte [rbp - 0x58], 0
jmp 0x14001454d
mov qword [rbp - 0x48], 8
mov rax, qword [rdx]
mov qword [rbp - 0x58], rax
mov byte [rbp - 0x50], 0
lea r9, [rbp - 0x38]
lea r8, [rbp - 0x58]
movzx edx, byte [rbp - 0x60]
mov rcx, rbx
call fcn.14001ac00
nop
mov rdx, qword [rbp - 0x40]
cmp rdx, 0x10
jb 0x1400145a1
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001459b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001459b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007612c
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x1400145df
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400145da
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400145da
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007612c
mov rax, rbx
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rbp
ret
Function at 0x140014600
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x50
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor edi, edi
cmp byte [r8 + 9], dil
je 0x140014634
mov ecx, edi
nop dword [rax]
lea eax, [rcx + 0x4a]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 8
jb 0x140014620
mov byte [r8 + 9], dil
lea rax, [r8 + 8]
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x140014661
mov qword [rsp + 0x30], rdi
mov byte [rsp + 0x20], dil
jmp 0x140014677
mov qword [rsp + 0x30], 8
mov rax, qword [r8]
mov qword [rsp + 0x20], rax
mov byte [rsp + 0x28], dil
mov r9, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x140014685
mov rdx, qword [rdx]
mov r8, rdx
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.1400121b0
mov qword [rbx], rdi
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x1400146fc
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400146f7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400146f7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007612c
mov rax, rbx
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x140014710
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rbx, rcx
mov qword [rbp - 0x10], rcx
xor r9d, r9d
cmp byte [r8 + 6], r9b
je 0x140014754
mov ecx, r9d
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x4a]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 5
jb 0x140014740
mov byte [r8 + 6], r9b
lea rax, [r8 + 5]
mov qword [rbp - 0x38], r9
mov qword [rbp - 0x28], r9
mov qword [rbp - 0x20], r9
mov qword [rbp - 0x20], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x14001477b
mov qword [rbp - 0x28], r9
mov byte [rbp - 0x38], r9b
jmp 0x140014795
mov qword [rbp - 0x28], 5
mov eax, dword [r8]
mov dword [rbp - 0x38], eax
movzx eax, byte [r8 + 4]
mov byte [rbp - 0x34], al
mov byte [rbp - 0x33], r9b
cmp byte [rdx + 0xa], 0
je 0x1400147b3
mov rcx, r9
nop
lea eax, [rcx + 0x4a]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 9
jb 0x1400147a0
mov byte [rdx + 0xa], 0
lea rax, [rdx + 9]
mov qword [rbp - 0x58], r9
mov qword [rbp - 0x48], r9
mov qword [rbp - 0x40], r9
mov qword [rbp - 0x40], reloc.WS2_32.dll_ntohs
cmp rdx, rax
jne 0x1400147da
mov qword [rbp - 0x48], r9
mov byte [rbp - 0x58], 0
jmp 0x1400147f6
mov qword [rbp - 0x48], 9
movsd xmm0, qword [rdx]
movsd qword [rbp - 0x58], xmm0
movzx eax, byte [rdx + 8]
mov byte [rbp - 0x50], al
mov byte [rbp - 0x4f], 0
lea r9, [rbp - 0x38]
lea r8, [rbp - 0x58]
movzx edx, byte [rbp - 0x60]
mov rcx, rbx
call fcn.14001ac00
nop
mov rdx, qword [rbp - 0x40]
cmp rdx, 0x10
jb 0x14001484a
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140014844
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140014844
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007612c
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x140014888
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140014883
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140014883
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007612c
mov rax, rbx
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rbp
ret
Function at 0x1400148a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x50
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor edi, edi
cmp byte [r8 + 0xa], dil
je 0x1400148d4
mov ecx, edi
nop dword [rax]
lea eax, [rcx + 0x4a]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 9
jb 0x1400148c0
mov byte [r8 + 0xa], dil
lea rax, [r8 + 9]
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x140014901
mov qword [rsp + 0x30], rdi
mov byte [rsp + 0x20], dil
jmp 0x140014923
mov qword [rsp + 0x30], 9
movsd xmm0, qword [r8]
movsd qword [rsp + 0x20], xmm0
movzx eax, byte [r8 + 8]
mov byte [rsp + 0x28], al
mov byte [rsp + 0x29], dil
mov r9, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x140014931
mov rdx, qword [rdx]
mov r8, rdx
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.1400121b0
mov qword [rbx], rdi
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x1400149a8
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400149a3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400149a3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007612c
mov rax, rbx
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret