joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140057dc0
Capabilities:
Unload driver

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140130138]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov r8, rcx
lea rdx, str._registrymachineSYSTEMCurrentControlSetServices_
lea rcx, [rsp + 0x20]
call fcn.1400556d0
cmp qword [rsp + 0x38], 8
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
cmovae rdx, qword [rsp + 0x20]
call sub.ntdll.dll_RtlInitUnicodeString
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntdll.dll_NtUnloadDriver]
mov rdx, qword [rsp + 0x38]
test eax, eax
setns bl
cmp rdx, 8
jb 0x140057e59
mov rcx, qword [rsp + 0x20]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140057e54
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140057e54
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400bbea0
movzx eax, bl
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400bbe80
add rsp, 0x60
pop rbx
ret

Function at 0x140057e70
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140057e92
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x140057ea8
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140057ec4
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140057ec6
xor ecx, ecx
mov qword [rsp + 0x20], rdi
movsxd rax, ecx
test ecx, ecx
je 0x140057f00
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
sub rbx, rdi
add r14, rdi
mov r8, rbx
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x140057fa7
mov r9, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r9], rax
jne 0x140057f3b
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r9], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
mov rdi, r8
cmp r8, 0xfff
jbe 0x140057f81
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
add r14, rax
mov rdi, rbx
cmp rax, 0xfff
jne 0x140057fc0
cmp rbx, rax
ja 0x140057f50
mov r8, rdi
test rdi, rdi
je 0x140057fa7
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov r8, rdi
sub r8, rax
sub rbp, r8
mov rdi, qword [rsp + 0x20]
mov rax, rbp
mov rbx, qword [rsp + 0x28]
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
sub rbp, rbx
jmp 0x140057faa
Function at 0x140057fd0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je 0x140058007
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rsi
mov rsi, rbx
mov r9, qword [rax]
test r9, r9
je 0x140058028
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x14005802a
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140058083
test ecx, ecx
jle 0x140058063
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
sub rbx, rbp
add r14, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140058083
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140058083
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov rbp, qword [rsp + 0x30]
sub rsi, rbx
mov rbx, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x140058550
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x40], rcx
xor esi, esi
cmp byte [r8 + 7], sil
je 0x140058584
mov eax, esi
lea ecx, [rax - 0x71]
xor byte [r8 + rax], cl
inc rax
cmp rax, 6
jb 0x140058570
mov byte [r8 + 7], sil
lea rax, [r8 + 6]
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x20], sil
cmp r9, rax
je 0x1400585b9
mov r8d, 6
mov rdx, r9
lea rcx, [rsp + 0x20]
call fcn.140010a10
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x1400585c7
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.1400116e0
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x14005863e
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140058639
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140058639
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400bbea0
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x140058650
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x68], rcx
xor esi, esi
cmp byte [r8 + 9], sil
je 0x140058684
mov ecx, esi
lea eax, [rcx - 0x71]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 8
jb 0x140058670
mov byte [r8 + 9], sil
lea rax, [r8 + 8]
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x48], sil
cmp r9, rax
je 0x1400586b9
mov r8d, 8
mov rdx, r9
lea rcx, [rsp + 0x48]
call fcn.140010a10
nop
cmp byte [rbx + 9], 0
je 0x1400586e3
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x71]
xor byte [rcx + rbx], al
inc rcx
cmp rcx, 8
jb 0x1400586d0
mov byte [rbx + 9], 0
lea rax, [rbx + 8]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], 0
cmp rbx, rax
je 0x140058718
mov r8d, 8
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.140010a10
nop
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x28]
movzx edx, byte [rsp + 0x20]
mov rcx, rdi
call fcn.14005fe40
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x140058771
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005876b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005876b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400bbea0
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x1400587b1
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400587ac
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400587ac
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400bbea0
mov rax, rdi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400587c0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x40], rcx
xor esi, esi
cmp byte [r8 + 9], sil
je 0x1400587f4
mov eax, esi
lea ecx, [rax - 0x71]
xor byte [r8 + rax], cl
inc rax
cmp rax, 8
jb 0x1400587e0
mov byte [r8 + 9], sil
lea rax, [r8 + 8]
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x20], sil
cmp r9, rax
je 0x140058829
mov r8d, 8
mov rdx, r9
lea rcx, [rsp + 0x20]
call fcn.140010a10
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140058837
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.1400116e0
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x1400588ae
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400588a9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400588a9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400bbea0
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400588c0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x68], rcx
xor esi, esi
cmp byte [r8 + 6], sil
je 0x1400588f4
mov ecx, esi
lea eax, [rcx - 0x71]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 5
jb 0x1400588e0
mov byte [r8 + 6], sil
lea rax, [r8 + 5]
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x48], sil
cmp r9, rax
je 0x140058929
mov r8d, 5
mov rdx, r9
lea rcx, [rsp + 0x48]
call fcn.140010a10
nop
cmp byte [rbx + 0xa], 0
je 0x140058953
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x71]
xor byte [rcx + rbx], al
inc rcx
cmp rcx, 9
jb 0x140058940
mov byte [rbx + 0xa], 0
lea rax, [rbx + 9]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], 0
cmp rbx, rax
je 0x140058988
mov r8d, 9
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.140010a10
nop
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x28]
movzx edx, byte [rsp + 0x20]
mov rcx, rdi
call fcn.14005fe40
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x1400589e1
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400589db
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400589db
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400bbea0
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x140058a21
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140058a1c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140058a1c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400bbea0
mov rax, rdi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x140058a30
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x68], rcx
xor esi, esi
cmp byte [r8 + 9], sil
je 0x140058a64
mov ecx, esi
lea eax, [rcx - 0x71]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 8
jb 0x140058a50
mov byte [r8 + 9], sil
lea rax, [r8 + 8]
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x48], sil
cmp r9, rax
je 0x140058a99
mov r8d, 8
mov rdx, r9
lea rcx, [rsp + 0x48]
call fcn.140010a10
nop
cmp byte [rbx + 0xa], 0
je 0x140058ac3
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x71]
xor byte [rcx + rbx], al
inc rcx
cmp rcx, 9
jb 0x140058ab0
mov byte [rbx + 0xa], 0
lea rax, [rbx + 9]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], 0
cmp rbx, rax
je 0x140058af8
mov r8d, 9
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.140010a10
nop
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x28]
movzx edx, byte [rsp + 0x20]
mov rcx, rdi
call fcn.14005fe40
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x140058b51
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140058b4b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140058b4b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400bbea0
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x140058b91
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140058b8c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140058b8c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400bbea0
mov rax, rdi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x140058ba0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x40], rcx
xor esi, esi
cmp byte [r8 + 0xa], sil
je 0x140058bd4
mov eax, esi
lea ecx, [rax - 0x71]
xor byte [r8 + rax], cl
inc rax
cmp rax, 9
jb 0x140058bc0
mov byte [r8 + 0xa], sil
lea rax, [r8 + 9]
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x20], sil
cmp r9, rax
je 0x140058c09
mov r8d, 9
mov rdx, r9
lea rcx, [rsp + 0x20]
call fcn.140010a10
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140058c17
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.1400116e0
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x140058c8e
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140058c89
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140058c89
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400bbea0
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x140058ca0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x40], rcx
xor esi, esi
cmp byte [r8 + 0xc], sil
je 0x140058cd4
mov eax, esi
lea ecx, [rax - 0x71]
xor byte [r8 + rax], cl
inc rax
cmp rax, 0xb
jb 0x140058cc0
mov byte [r8 + 0xc], sil
lea rax, [r8 + 0xb]
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x20], sil
cmp r9, rax
je 0x140058d09
mov r8d, listen
mov rdx, r9
lea rcx, [rsp + 0x20]
call fcn.140010a10
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140058d17
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.1400116e0
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x140058d8e
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140058d89
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140058d89
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400bbea0
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x140058da0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x68], rcx
xor esi, esi
cmp byte [r8 + 6], sil
je 0x140058dd4
mov ecx, esi
lea eax, [rcx - 0x71]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 5
jb 0x140058dc0
mov byte [r8 + 6], sil
lea rax, [r8 + 5]
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x48], sil
cmp r9, rax
je 0x140058e09
mov r8d, 5
mov rdx, r9
lea rcx, [rsp + 0x48]
call fcn.140010a10
nop
cmp byte [rbx + 0xd], 0
je 0x140058e33
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x71]
xor byte [rcx + rbx], al
inc rcx
cmp rcx, 0xc
jb 0x140058e20
mov byte [rbx + 0xd], 0
lea rax, [rbx + 0xc]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], 0
cmp rbx, rax
je 0x140058e68
mov r8d, listen
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.140010a10
nop
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x28]
movzx edx, byte [rsp + 0x20]
mov rcx, rdi
call fcn.14005fe40
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x140058ec1
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140058ebb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140058ebb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400bbea0
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x140058f01
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140058efc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140058efc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400bbea0
mov rax, rdi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret

Function at 0x140061250
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
xor r8d, r8d
mov rdx, rcx
mov qword [rsp + 0x20], rbx
cmp byte [rcx + 5], r8b
je 0x140061283
mov ecx, r8d
nop dword [rax]
lea eax, [rcx - 0x71]
xor byte [rcx + rdx], al
inc rcx
cmp rcx, 4
jb 0x140061270
mov byte [rdx + 5], r8b
lea rcx, [rdx + 4]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x1400612ac
mov r8d, 4
mov rcx, rbx
call fcn.140010a10
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x1400612c0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
xor r8d, r8d
mov rdx, rcx
mov qword [rsp + 0x20], rbx
cmp byte [rcx + 8], r8b
je 0x1400612f3
mov ecx, r8d
nop dword [rax]
lea eax, [rcx - 0x71]
xor byte [rcx + rdx], al
inc rcx
cmp rcx, 7
jb 0x1400612e0
mov byte [rdx + 8], r8b
lea rcx, [rdx + 7]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x14006131c
mov r8d, 7
mov rcx, rbx
call fcn.140010a10
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x140061330
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
xor r8d, r8d
mov rdx, rcx
mov qword [rsp + 0x20], rbx
cmp byte [rcx + 9], r8b
je 0x140061363
mov ecx, r8d
nop dword [rax]
lea eax, [rcx - 0x71]
xor byte [rcx + rdx], al
inc rcx
cmp rcx, 8
jb 0x140061350
mov byte [rdx + 9], r8b
lea rcx, [rdx + 8]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x14006138c
mov r8d, 8
mov rcx, rbx
call fcn.140010a10
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x1400613a0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
xor r8d, r8d
mov rdx, rcx
mov qword [rsp + 0x20], rbx
cmp byte [rcx + 0x10], r8b
je 0x1400613d3
mov ecx, r8d
nop dword [rax]
lea eax, [rcx - 0x71]
xor byte [rcx + rdx], al
inc rcx
cmp rcx, 0xf
jb 0x1400613c0
mov byte [rdx + 0x10], r8b
lea rcx, [rdx + 0xf]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x1400613fc
mov r8d, reloc.WS2_32.dll_ntohs
mov rcx, rbx
call fcn.140010a10
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x140061410
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
xor r8d, r8d
mov rdx, rcx
mov qword [rsp + 0x20], rbx
cmp byte [rcx + 0xb], r8b
je 0x140061443
mov ecx, r8d
nop dword [rax]
lea eax, [rcx - 0x71]
xor byte [rcx + rdx], al
inc rcx
cmp rcx, 0xa
jb 0x140061430
mov byte [rdx + 0xb], r8b
lea rcx, [rdx + 0xa]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x14006146c
mov r8d, 0xa
mov rcx, rbx
call fcn.140010a10
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x140061480
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
xor r8d, r8d
mov rdx, rcx
mov qword [rsp + 0x20], rbx
cmp byte [rcx + 0xe], r8b
je 0x1400614b3
mov ecx, r8d
nop dword [rax]
lea eax, [rcx - 0x71]
xor byte [rcx + rdx], al
inc rcx
cmp rcx, 0xd
jb 0x1400614a0
mov byte [rdx + 0xe], r8b
lea rcx, [rdx + 0xd]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x1400614dc
mov r8d, reloc.WS2_32.dll_listen
mov rcx, rbx
call fcn.140010a10
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x140061620
Capabilities:
Read file via mapping

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x270
mov rax, qword [0x140130138]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rbx, rdx
mov dword [rsp + 0x40], 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r9, [rsp + 0x40]
xor edx, edx
mov rcx, rax
lea r8, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameW]
xor esi, esi
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [rsi + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x1400616cd
mov qword [rsp + 0x28], rsi
lea r8d, [rsi + 2]
xor r9d, r9d
mov dword [rsp + 0x20], esi
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
test rax, rax
jne 0x1400616fc
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 8], rsi
mov qword [rbx], rsi
mov rax, rbx
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1400bbe80
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rbx + 8], rax
mov qword [rbx], rdi
jmp 0x1400616d4

Function at 0x1400629e0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 5], 0
je 0x140062a03
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x71]
xor byte [rax + rcx], dl
inc rax
cmp rax, 4
jb 0x1400629f0
mov byte [rcx + 5], 0
mov rax, rcx
ret

Function at 0x140062a10
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x136], 0
je 0x140062a38
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x71]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x135
jb 0x140062a20
mov byte [rcx + 0x136], 0
mov rax, rcx
ret

Function at 0x140062a40
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x44], 0
je 0x140062a63
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x71]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x43
jb 0x140062a50
mov byte [rcx + 0x44], 0
mov rax, rcx
ret

Function at 0x140062a70
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x47], 0
je 0x140062a93
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x71]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x46
jb 0x140062a80
mov byte [rcx + 0x47], 0
mov rax, rcx
ret