joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140045c50
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x59], 0
mov r8, rcx
je 0x140045cc9
mov r9, 0xfffffffffffffffe
lea rax, [rcx + 2]
sub r9, rcx
nop word [rax + rax]
lea edx, [rax + r9]
lea ecx, [rdx - 0x3c]
xor byte [rax - 2], cl
lea rax, [rax + 0xb]
lea ecx, [rdx - 0x3b]
xor byte [rax - 0xc], cl
lea ecx, [rdx - 0x3a]
xor byte [rax - 0xb], cl
lea ecx, [rdx - 0x39]
xor byte [rax - 0xa], cl
lea ecx, [rdx - 0x38]
xor byte [rax - 9], cl
lea ecx, [rdx - 0x37]
xor byte [rax - 8], cl
lea ecx, [rdx - 0x36]
xor byte [rax - 7], cl
lea ecx, [rdx - 0x35]
xor byte [rax - 6], cl
lea ecx, [rdx - 0x34]
xor byte [rax - 5], cl
lea ecx, [rdx - 0x33]
xor byte [rax - 4], cl
sub dl, 0x32
xor byte [rax - 3], dl
lea rcx, [r9 + rax]
cmp rcx, 0x58
jb 0x140045c70
mov byte [r8 + 0x59], 0
mov rax, r8
ret

Function at 0x140045df0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x49], 0
mov r8, rcx
je 0x140045e93
mov r9, 0xfffffffffffffffe
lea rax, [rcx + 2]
sub r9, rcx
nop dword [rax + rax]
lea edx, [r9 + rax]
lea ecx, [rdx - 0x3c]
xor byte [rax - 2], cl
lea rax, [rax + 0x12]
lea ecx, [rdx - 0x3b]
xor byte [rax - 0x13], cl
lea ecx, [rdx - 0x3a]
xor byte [rax - 0x12], cl
lea ecx, [rdx - 0x39]
xor byte [rax - 0x11], cl
lea ecx, [rdx - 0x38]
xor byte [rax - 0x10], cl
lea ecx, [rdx - 0x37]
xor byte [rax - 0xf], cl
lea ecx, [rdx - 0x36]
xor byte [rax - 0xe], cl
lea ecx, [rdx - 0x35]
xor byte [rax - 0xd], cl
lea ecx, [rdx - 0x34]
xor byte [rax - 0xc], cl
lea ecx, [rdx - 0x33]
xor byte [rax - 0xb], cl
lea ecx, [rdx - 0x32]
xor byte [rax - 0xa], cl
lea ecx, [rdx - 0x31]
xor byte [rax - 9], cl
lea ecx, [rdx - 0x30]
xor byte [rax - 8], cl
lea ecx, [rdx - 0x2f]
xor byte [rax - 7], cl
lea ecx, [rdx - 0x2e]
xor byte [rax - 6], cl
lea ecx, [rdx - 0x2d]
xor byte [rax - 5], cl
lea ecx, [rdx - 0x2c]
xor byte [rax - 4], cl
sub dl, 0x2b
xor byte [rax - 3], dl
lea rcx, [rax + r9]
cmp rcx, 0x48
jb 0x140045e10
mov byte [r8 + 0x49], 0
mov rax, r8
ret

Function at 0x140045ea0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x5e], 0
mov r8, rcx
je 0x140045ee9
mov r9, 0xfffffffffffffffe
lea rax, [rcx + 2]
sub r9, rcx
nop word [rax + rax]
lea edx, [rax + r9]
lea ecx, [rdx - 0x3c]
xor byte [rax - 2], cl
lea rax, [rax + 3]
lea ecx, [rdx - 0x3b]
sub dl, 0x3a
xor byte [rax - 4], cl
lea rcx, [r9 + rax]
xor byte [rax - 3], dl
cmp rcx, 0x5d
jb 0x140045ec0
mov byte [r8 + 0x5e], 0
mov rax, r8
ret

Function at 0x140045ef0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x46], 0
mov r8, rcx
je 0x140045f39
mov r9, 0xfffffffffffffffe
lea rax, [rcx + 2]
sub r9, rcx
nop word [rax + rax]
lea edx, [rax + r9]
lea ecx, [rdx - 0x3c]
xor byte [rax - 2], cl
lea rax, [rax + 3]
lea ecx, [rdx - 0x3b]
sub dl, 0x3a
xor byte [rax - 4], cl
lea rcx, [r9 + rax]
xor byte [rax - 3], dl
cmp rcx, 0x45
jb 0x140045f10
mov byte [r8 + 0x46], 0
mov rax, r8
ret

Function at 0x140046010
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x6e], 0
je 0x140046033
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x3c]
xor byte [rcx + rax], dl
inc rax
cmp rax, 0x6d
jb 0x140046020
mov byte [rcx + 0x6e], 0
mov rax, rcx
ret
Function at 0x140046040
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x71], 0
mov r8, rcx
je 0x1400460d7
mov r9, 0xfffffffffffffffe
lea rax, [rcx + 2]
sub r9, rcx
nop dword [rax + rax]
lea edx, [r9 + rax]
lea ecx, [rdx - 0x3c]
xor byte [rax - 2], cl
lea rax, [rax + 0x10]
lea ecx, [rdx - 0x3b]
xor byte [rax - 0x11], cl
lea ecx, [rdx - 0x3a]
xor byte [rax - 0x10], cl
lea ecx, [rdx - 0x39]
xor byte [rax - 0xf], cl
lea ecx, [rdx - 0x38]
xor byte [rax - 0xe], cl
lea ecx, [rdx - 0x37]
xor byte [rax - 0xd], cl
lea ecx, [rdx - 0x36]
xor byte [rax - 0xc], cl
lea ecx, [rdx - 0x35]
xor byte [rax - 0xb], cl
lea ecx, [rdx - 0x34]
xor byte [rax - 0xa], cl
lea ecx, [rdx - 0x33]
xor byte [rax - 9], cl
lea ecx, [rdx - 0x32]
xor byte [rax - 8], cl
lea ecx, [rdx - 0x31]
xor byte [rax - 7], cl
lea ecx, [rdx - 0x30]
xor byte [rax - 6], cl
lea ecx, [rdx - 0x2f]
xor byte [rax - 5], cl
lea ecx, [rdx - 0x2e]
xor byte [rax - 4], cl
sub dl, 0x2d
xor byte [rax - 3], dl
lea rcx, [rax + r9]
cmp rcx, 0x70
jb 0x140046060
mov byte [r8 + 0x71], 0
mov rax, r8
ret

Function at 0x1400460e0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x6a], 0
mov r8, rcx
je 0x140046171
mov r9, 0xfffffffffffffffe
lea rax, [rcx + 2]
sub r9, rcx
nop dword [rax + rax]
lea edx, [r9 + rax]
lea ecx, [rdx - 0x3c]
xor byte [rax - 2], cl
lea rax, [rax + 0xf]
lea ecx, [rdx - 0x3b]
xor byte [rax - 0x10], cl
lea ecx, [rdx - 0x3a]
xor byte [rax - 0xf], cl
lea ecx, [rdx - 0x39]
xor byte [rax - 0xe], cl
lea ecx, [rdx - 0x38]
xor byte [rax - 0xd], cl
lea ecx, [rdx - 0x37]
xor byte [rax - 0xc], cl
lea ecx, [rdx - 0x36]
xor byte [rax - 0xb], cl
lea ecx, [rdx - 0x35]
xor byte [rax - 0xa], cl
lea ecx, [rdx - 0x34]
xor byte [rax - 9], cl
lea ecx, [rdx - 0x33]
xor byte [rax - 8], cl
lea ecx, [rdx - 0x32]
xor byte [rax - 7], cl
lea ecx, [rdx - 0x31]
xor byte [rax - 6], cl
lea ecx, [rdx - 0x30]
xor byte [rax - 5], cl
lea ecx, [rdx - 0x2f]
xor byte [rax - 4], cl
sub dl, 0x2e
xor byte [rax - 3], dl
lea rcx, [rax + r9]
cmp rcx, 0x69
jb 0x140046100
mov byte [r8 + 0x6a], 0
mov rax, r8
ret
Function at 0x140046180
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x60], 0
mov r8, rcx
je 0x14004622d
mov r9, 0xfffffffffffffffe
lea rax, [rcx + 2]
sub r9, rcx
nop dword [rax + rax]
lea edx, [rax + r9]
lea ecx, [rdx - 0x3c]
xor byte [rax - 2], cl
lea rax, [rax + 0x13]
lea ecx, [rdx - 0x3b]
xor byte [rax - 0x14], cl
lea ecx, [rdx - 0x3a]
xor byte [rax - 0x13], cl
lea ecx, [rdx - 0x39]
xor byte [rax - 0x12], cl
lea ecx, [rdx - 0x38]
xor byte [rax - 0x11], cl
lea ecx, [rdx - 0x37]
xor byte [rax - 0x10], cl
lea ecx, [rdx - 0x36]
xor byte [rax - 0xf], cl
lea ecx, [rdx - 0x35]
xor byte [rax - 0xe], cl
lea ecx, [rdx - 0x34]
xor byte [rax - 0xd], cl
lea ecx, [rdx - 0x33]
xor byte [rax - 0xc], cl
lea ecx, [rdx - 0x32]
xor byte [rax - 0xb], cl
lea ecx, [rdx - 0x31]
xor byte [rax - 0xa], cl
lea ecx, [rdx - 0x30]
xor byte [rax - 9], cl
lea ecx, [rdx - 0x2f]
xor byte [rax - 8], cl
lea ecx, [rdx - 0x2e]
xor byte [rax - 7], cl
lea ecx, [rdx - 0x2d]
xor byte [rax - 6], cl
lea ecx, [rdx - 0x2c]
xor byte [rax - 5], cl
lea ecx, [rdx - 0x2b]
xor byte [rax - 4], cl
sub dl, 0x2a
xor byte [rax - 3], dl
lea rcx, [r9 + rax]
cmp rcx, 0x5f
jb 0x1400461a0
mov byte [r8 + 0x60], 0
mov rax, r8
ret

Function at 0x140046260
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x77], 0
mov r8, rcx
mov rax, rcx
je 0x1400462a5
mov r9, rcx
neg r9
nop dword [rax]
nop word [rax + rax]
lea edx, [rax + r9]
lea ecx, [rdx - 0x3c]
sub dl, 0x3b
xor byte [rax], cl
xor byte [rax + 1], dl
lea rax, [rax + 2]
lea rcx, [r9 + rax]
cmp rcx, 0x76
jb 0x140046280
mov byte [r8 + 0x77], 0
mov rax, r8
ret

Function at 0x1400462b0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x69], 0
mov r8, rcx
je 0x140046335
mov r9, 0xfffffffffffffffe
lea rax, [rcx + 2]
sub r9, rcx
nop word [rax + rax]
lea edx, [rax + r9]
lea ecx, [rdx - 0x3c]
xor byte [rax - 2], cl
lea rax, [rax + 0xd]
lea ecx, [rdx - 0x3b]
xor byte [rax - 0xe], cl
lea ecx, [rdx - 0x3a]
xor byte [rax - 0xd], cl
lea ecx, [rdx - 0x39]
xor byte [rax - 0xc], cl
lea ecx, [rdx - 0x38]
xor byte [rax - 0xb], cl
lea ecx, [rdx - 0x37]
xor byte [rax - 0xa], cl
lea ecx, [rdx - 0x36]
xor byte [rax - 9], cl
lea ecx, [rdx - 0x35]
xor byte [rax - 8], cl
lea ecx, [rdx - 0x34]
xor byte [rax - 7], cl
lea ecx, [rdx - 0x33]
xor byte [rax - 6], cl
lea ecx, [rdx - 0x32]
xor byte [rax - 5], cl
lea ecx, [rdx - 0x31]
xor byte [rax - 4], cl
sub dl, 0x30
xor byte [rax - 3], dl
lea rcx, [r9 + rax]
cmp rcx, 0x68
jb 0x1400462d0
mov byte [r8 + 0x69], 0
mov rax, r8
ret

Function at 0x140046340
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x4a], 0
je 0x140046363
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x3c]
xor byte [rcx + rax], dl
inc rax
cmp rax, 0x49
jb 0x140046350
mov byte [rcx + 0x4a], 0
mov rax, rcx
ret

Function at 0x140046370
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x48], 0
je 0x140046393
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x3c]
xor byte [rcx + rax], dl
inc rax
cmp rax, 0x47
jb 0x140046380
mov byte [rcx + 0x48], 0
mov rax, rcx
ret
Function at 0x1400463a0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x68], 0
je 0x1400463c3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x3c]
xor byte [rcx + rax], dl
inc rax
cmp rax, 0x67
jb 0x1400463b0
mov byte [rcx + 0x68], 0
mov rax, rcx
ret

Function at 0x1400463d0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x6c], 0
je 0x1400463f3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x3c]
xor byte [rcx + rax], dl
inc rax
cmp rax, 0x6b
jb 0x1400463e0
mov byte [rcx + 0x6c], 0
mov rax, rcx
ret

Function at 0x140046400
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x65], 0
mov r8, rcx
je 0x140046473
mov r9, 0xfffffffffffffffe
lea rax, [rcx + 2]
sub r9, rcx
nop word [rax + rax]
lea edx, [rax + r9]
lea ecx, [rdx - 0x3c]
xor byte [rax - 2], cl
lea rax, [rax + 0xa]
lea ecx, [rdx - 0x3b]
xor byte [rax - 0xb], cl
lea ecx, [rdx - 0x3a]
xor byte [rax - 0xa], cl
lea ecx, [rdx - 0x39]
xor byte [rax - 9], cl
lea ecx, [rdx - 0x38]
xor byte [rax - 8], cl
lea ecx, [rdx - 0x37]
xor byte [rax - 7], cl
lea ecx, [rdx - 0x36]
xor byte [rax - 6], cl
lea ecx, [rdx - 0x35]
xor byte [rax - 5], cl
lea ecx, [rdx - 0x34]
xor byte [rax - 4], cl
sub dl, 0x33
xor byte [rax - 3], dl
lea rcx, [r9 + rax]
cmp rcx, 0x64
jb 0x140046420
mov byte [r8 + 0x65], 0
mov rax, r8
ret

Function at 0x140046480
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x63], 0
mov r8, rcx
je 0x14004650b
mov r9, 0xfffffffffffffffe
lea rax, [rcx + 2]
sub r9, rcx
nop dword [rax + rax]
lea edx, [rax + r9]
lea ecx, [rdx - 0x3c]
xor byte [rax - 2], cl
lea rax, [rax + 0xe]
lea ecx, [rdx - 0x3b]
xor byte [rax - 0xf], cl
lea ecx, [rdx - 0x3a]
xor byte [rax - 0xe], cl
lea ecx, [rdx - 0x39]
xor byte [rax - 0xd], cl
lea ecx, [rdx - 0x38]
xor byte [rax - 0xc], cl
lea ecx, [rdx - 0x37]
xor byte [rax - 0xb], cl
lea ecx, [rdx - 0x36]
xor byte [rax - 0xa], cl
lea ecx, [rdx - 0x35]
xor byte [rax - 9], cl
lea ecx, [rdx - 0x34]
xor byte [rax - 8], cl
lea ecx, [rdx - 0x33]
xor byte [rax - 7], cl
lea ecx, [rdx - 0x32]
xor byte [rax - 6], cl
lea ecx, [rdx - 0x31]
xor byte [rax - 5], cl
lea ecx, [rdx - 0x30]
xor byte [rax - 4], cl
sub dl, 0x2f
xor byte [rax - 3], dl
lea rcx, [r9 + rax]
cmp rcx, 0x62
jb 0x1400464a0
mov byte [r8 + 0x63], 0
mov rax, r8
ret

Function at 0x140046510
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x5f], 0
mov r8, rcx
mov rax, rcx
je 0x140046555
mov r9, rcx
neg r9
nop dword [rax]
nop word [rax + rax]
lea edx, [rax + r9]
lea ecx, [rdx - 0x3c]
sub dl, 0x3b
xor byte [rax], cl
xor byte [rax + 1], dl
lea rax, [rax + 2]
lea rcx, [r9 + rax]
cmp rcx, 0x5e
jb 0x140046530
mov byte [r8 + 0x5f], 0
mov rax, r8
ret
Function at 0x140046560
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x6f], 0
mov r8, rcx
je 0x1400465d9
mov r9, 0xfffffffffffffffe
lea rax, [rcx + 2]
sub r9, rcx
nop word [rax + rax]
lea edx, [rax + r9]
lea ecx, [rdx - 0x3c]
xor byte [rax - 2], cl
lea rax, [rax + 0xb]
lea ecx, [rdx - 0x3b]
xor byte [rax - 0xc], cl
lea ecx, [rdx - 0x3a]
xor byte [rax - 0xb], cl
lea ecx, [rdx - 0x39]
xor byte [rax - 0xa], cl
lea ecx, [rdx - 0x38]
xor byte [rax - 9], cl
lea ecx, [rdx - 0x37]
xor byte [rax - 8], cl
lea ecx, [rdx - 0x36]
xor byte [rax - 7], cl
lea ecx, [rdx - 0x35]
xor byte [rax - 6], cl
lea ecx, [rdx - 0x34]
xor byte [rax - 5], cl
lea ecx, [rdx - 0x33]
xor byte [rax - 4], cl
sub dl, 0x32
xor byte [rax - 3], dl
lea rcx, [r9 + rax]
cmp rcx, 0x6e
jb 0x140046580
mov byte [r8 + 0x6f], 0
mov rax, r8
ret

Function at 0x140046600
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x58], 0
mov r8, rcx
je 0x140046649
mov r9, 0xfffffffffffffffe
lea rax, [rcx + 2]
sub r9, rcx
nop word [rax + rax]
lea edx, [rax + r9]
lea ecx, [rdx - 0x3c]
xor byte [rax - 2], cl
lea rax, [rax + 3]
lea ecx, [rdx - 0x3b]
sub dl, 0x3a
xor byte [rax - 4], cl
lea rcx, [r9 + rax]
xor byte [rax - 3], dl
cmp rcx, 0x57
jb 0x140046620
mov byte [r8 + 0x58], 0
mov rax, r8
ret

Function at 0x140046650
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x16], 0x657865
lea rcx, [0x140156678]
mov dword [rbp - 0x20], 0x502d4448
mov dword [rbp - 0x1c], 0x6579616c
mov word [rbp - 0x18], 0x2e72
mov byte [rbp - 0x12], 0
call fcn.14003fea0
test eax, eax
jne 0x1400466d0
movdqa xmm0, xmmword [0x1400d10e0]
mov r8, 0xffffffffffffffff
mov byte [rbp - 0xe], al
lea rax, [rbp - 0x20]
movdqu xmmword [rbp - 0x20], xmm0
mov word [rbp - 0x10], 0x64
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400466b0
lea rdx, [rbp - 0x20]
lea rcx, reloc.WLDAP32.dll_Ordinal_32
call fcn.14003b030
add rsp, 0x40
pop rbp
ret
mov r8d, dword [0x140156678]
xor edx, edx
mov ecx, 0xc00
mov qword [rsp + 0x50], rbx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x14004676a
cmp byte [0x14015647a], 0
mov rcx, rax
jne 0x140046710
call qword [sym.imp.ntdll.dll_NtSuspendProcess]
test eax, eax
jne 0x140046720
mov byte [0x14015647a], 1
jmp 0x140046720
call qword [sym.imp.ntdll.dll_NtResumeProcess]
test eax, eax
jne 0x140046720
mov byte [0x14015647a], al
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movdqa xmm0, xmmword [0x1400d1060]
lea rax, [rbp - 0x20]
movdqu xmmword [rbp - 0x20], xmm0
mov word [rbp - 0x10], 0x64
mov r8, 0xffffffffffffffff
mov byte [rbp - 0xe], 0
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140046750
lea rdx, [rbp - 0x20]
lea rcx, reloc.WLDAP32.dll_Ordinal_32
call fcn.14003b030
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret
Function at 0x140046830
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x16], 0x657865
lea rcx, [0x140156678]
mov dword [rbp - 0x20], 0x502d4448
mov dword [rbp - 0x1c], 0x6579616c
mov word [rbp - 0x18], 0x2e72
mov byte [rbp - 0x12], 0
call fcn.14003fea0
test eax, eax
jne 0x1400468b0
movdqa xmm0, xmmword [0x1400d10e0]
mov r8, 0xffffffffffffffff
mov byte [rbp - 0xe], al
lea rax, [rbp - 0x20]
movdqu xmmword [rbp - 0x20], xmm0
mov word [rbp - 0x10], 0x64
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140046890
lea rdx, [rbp - 0x20]
lea rcx, reloc.WLDAP32.dll_Ordinal_32
call fcn.14003b030
add rsp, 0x40
pop rbp
ret
mov r8d, dword [0x140156678]
xor edx, edx
mov ecx, 0xc00
mov qword [rsp + 0x50], rbx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x14004694e
cmp byte [0x14015647a], 0
mov rcx, rax
jne 0x1400468f0
call qword [sym.imp.ntdll.dll_NtSuspendProcess]
test eax, eax
jne 0x140046900
mov byte [0x14015647a], 1
jmp 0x140046900
call qword [sym.imp.ntdll.dll_NtResumeProcess]
test eax, eax
jne 0x140046900
mov byte [0x14015647a], al
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rbp - 0x20]
mov dword [rbp - 0x14], 0x64656d
mov r8, 0xffffffffffffffff
mov dword [rbp - 0x20], 0x636f7250
mov dword [rbp - 0x1c], 0x20737365
mov dword [rbp - 0x18], 0x75736552
mov byte [rbp - 0x10], 0
inc r8
cmp byte [rax + r8], 0
jne 0x140046934
lea rdx, [rbp - 0x20]
lea rcx, reloc.WLDAP32.dll_Ordinal_32
call fcn.14003b030
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x14004b4f0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xb7], 0
je 0x14004b518
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x3c]
xor byte [rcx + rax], dl
inc rax
cmp rax, 0xb6
jb 0x14004b500
mov byte [rcx + 0xb7], 0
mov rax, rcx
ret
Function at 0x14004e790
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xba], 0
je 0x14004e7b8
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x3c]
xor byte [rcx + rax], dl
inc rax
cmp rax, 0xb9
jb 0x14004e7a0
mov byte [rcx + 0xba], 0
ret

Function at 0x14004e830
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xb7], 0
je 0x14004e858
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x3c]
xor byte [rcx + rax], dl
inc rax
cmp rax, 0xb6
jb 0x14004e840
mov byte [rcx + 0xb7], 0
ret

Function at 0x14004f780
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rbx, rdx
mov rdi, rcx
mov ecx, 8
call fcn.1400b02c4
mov qword [rax], rbx
mov qword [rsp + 0x40], rax
lea rbx, [rdi + 8]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x14004fb50]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rdi], rax
test rax, rax
je 0x14004f7da
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov dword [rbx], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3

Function at 0x140050340
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x50
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor r9d, r9d
cmp byte [r8 + 6], r9b
je 0x140050374
mov ecx, r9d
nop word [rax + rax]
lea eax, [rcx - 0x75]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 5
jb 0x140050360
mov byte [r8 + 6], r9b
mov qword [rsp + 0x20], r9
lea rax, [r8 + 5]
cmp r8, rax
jne 0x140050397
mov qword [rsp + 0x30], r9
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x20], 0
jmp 0x1400503c0
mov qword [rsp + 0x30], 5
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
mov eax, dword [r8]
mov dword [rsp + 0x20], eax
movzx eax, byte [r8 + 4]
mov byte [rsp + 0x24], al
mov byte [rsp + 0x25], r9b
nop
lea r8, [rsp + 0x20]
mov rcx, rbx
call fcn.1400502d0
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x14005040e
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140050409
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140050409
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b0618
mov rax, rbx
add rsp, 0x50
pop rbx
ret
Function at 0x140050420
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x50
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor r9d, r9d
cmp byte [r8 + 7], r9b
je 0x140050454
mov ecx, r9d
nop word [rax + rax]
lea eax, [rcx - 0x75]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 6
jb 0x140050440
mov byte [r8 + 7], r9b
mov qword [rsp + 0x20], r9
lea rax, [r8 + 6]
cmp r8, rax
jne 0x140050477
mov qword [rsp + 0x30], r9
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x20], 0
jmp 0x1400504a0
mov qword [rsp + 0x30], 6
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
mov eax, dword [r8]
mov dword [rsp + 0x20], eax
movzx eax, word [r8 + 4]
mov word [rsp + 0x24], ax
mov byte [rsp + 0x26], r9b
nop
lea r8, [rsp + 0x20]
mov rcx, rbx
call fcn.1400502d0
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x1400504ee
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400504e9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400504e9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b0618
mov rax, rbx
add rsp, 0x50
pop rbx
ret

Function at 0x140050500
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x50
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor r9d, r9d
cmp byte [r8 + 9], r9b
je 0x140050534
mov ecx, r9d
nop word [rax + rax]
lea eax, [rcx - 0x75]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 8
jb 0x140050520
mov byte [r8 + 9], r9b
mov qword [rsp + 0x20], r9
lea rax, [r8 + 8]
cmp r8, rax
jne 0x140050557
mov qword [rsp + 0x30], r9
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x20], 0
jmp 0x140050580
mov qword [rsp + 0x30], 8
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
mov rax, qword [r8]
mov qword [rsp + 0x20], rax
mov byte [rsp + 0x28], r9b
nop word [rax + rax]
lea r8, [rsp + 0x20]
mov rcx, rbx
call fcn.1400502d0
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x1400505ce
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400505c9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400505c9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b0618
mov rax, rbx
add rsp, 0x50
pop rbx
ret
Function at 0x1400505e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rbx, rcx
mov qword [rbp - 0x10], rcx
xor r9d, r9d
cmp byte [r8 + 6], r9b
je 0x140050624
mov ecx, r9d
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x75]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 5
jb 0x140050610
mov byte [r8 + 6], r9b
mov qword [rbp - 0x38], r9
lea rax, [r8 + 5]
cmp r8, rax
jne 0x140050643
mov qword [rbp - 0x28], r9
mov qword [rbp - 0x20], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x38], 0
jmp 0x140050665
mov qword [rbp - 0x28], 5
mov qword [rbp - 0x20], reloc.WS2_32.dll_ntohs
mov eax, dword [r8]
mov dword [rbp - 0x38], eax
movzx eax, byte [r8 + 4]
mov byte [rbp - 0x34], al
mov byte [rbp - 0x33], r9b
cmp byte [rdx + 0xa], 0
je 0x140050683
mov rcx, r9
nop
lea eax, [rcx - 0x75]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 9
jb 0x140050670
mov byte [rdx + 0xa], 0
mov qword [rbp - 0x58], r9
lea rax, [rdx + 9]
cmp rdx, rax
jne 0x1400506a2
mov qword [rbp - 0x48], r9
mov qword [rbp - 0x40], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x58], 0
jmp 0x1400506d0
mov qword [rbp - 0x48], 9
mov qword [rbp - 0x40], reloc.WS2_32.dll_ntohs
movsd xmm0, qword [rdx]
movsd qword [rbp - 0x58], xmm0
movzx eax, byte [rdx + 8]
mov byte [rbp - 0x50], al
mov byte [rbp - 0x4f], 0
nop word [rax + rax]
lea r9, [rbp - 0x38]
lea r8, [rbp - 0x58]
movzx edx, byte [rbp - 0x60]
mov rcx, rbx
call fcn.140055f70
nop
mov rdx, qword [rbp - 0x40]
cmp rdx, 0x10
jb 0x140050724
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005071e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005071e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b0618
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x140050762
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005075d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005075d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b0618
mov rax, rbx
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rbp
ret
Function at 0x140050780
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x50
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor r9d, r9d
cmp byte [r8 + 0xa], r9b
je 0x1400507b4
mov ecx, r9d
nop word [rax + rax]
lea eax, [rcx - 0x75]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 9
jb 0x1400507a0
mov byte [r8 + 0xa], r9b
mov qword [rsp + 0x20], r9
lea rax, [r8 + 9]
cmp r8, rax
jne 0x1400507d7
mov qword [rsp + 0x30], r9
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x20], 0
jmp 0x140050802
mov qword [rsp + 0x30], 9
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
movsd xmm0, qword [r8]
movsd qword [rsp + 0x20], xmm0
movzx eax, byte [r8 + 8]
mov byte [rsp + 0x28], al
mov byte [rsp + 0x29], r9b
lea r8, [rsp + 0x20]
mov rcx, rbx
call fcn.1400502d0
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x140050850
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005084b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005084b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b0618
mov rax, rbx
add rsp, 0x50
pop rbx
ret