joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400164f8
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov dword [rsp + 0x18], r8d
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r12d, r8d
mov ebx, edx
mov r15d, ecx
mov ecx, 8
call fcn.14001aa88
nop
cmp dword [0x14003d548], 1
je 0x1400164a4
mov dword [0x14003d544], 1
mov byte [0x14003d540], r12b
test ebx, ebx
jne 0x140016490
mov rcx, qword [0x14003f900]
call sub.KERNEL32.dll_DecodePointer
mov rsi, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14001647d
mov rcx, qword [0x14003f8f8]
call sub.KERNEL32.dll_DecodePointer
mov rdi, rax
mov qword [rsp + 0x20], rax
mov r14, rsi
mov qword [rsp + 0x28], rsi
mov r13, rax
mov qword [rsp + 0x38], rax
sub rdi, 8
mov qword [rsp + 0x20], rdi
cmp rdi, rsi
jb 0x14001641c
call fcn.14001a2b8
cmp qword [rdi], rax
jne 0x14001641c
jmp 0x140016402
cmp rdi, rsi
jb 0x14001647d
mov rcx, qword [rdi]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
call fcn.14001a2b8
mov qword [rdi], rax
call rbx
mov rcx, qword [0x14003f900]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
mov rcx, qword [0x14003f8f8]
call sub.KERNEL32.dll_DecodePointer
cmp r14, rbx
jne 0x14001645b
cmp r13, rax
je 0x14001647b
mov r14, rbx
mov qword [rsp + 0x28], rbx
mov rsi, rbx
mov qword [rsp + 0x30], rbx
mov r13, rax
mov qword [rsp + 0x38], rax
mov rdi, rax
mov qword [rsp + 0x20], rax
jmp 0x140016402
lea rdx, [0x1400298b8]
lea rcx, [0x1400298a0]
call fcn.14001624c
lea rdx, [0x1400298c8]
lea rcx, [0x1400298c0]
call fcn.14001624c
nop
test r12d, r12d
je 0x1400164b3
mov ecx, 8
call fcn.14001a988
test r12d, r12d
jne 0x1400164de
mov dword [0x14003d548], 1
lea ecx, [r12 + 8]
call fcn.14001a988
mov ecx, r15d
call fcn.1400161e0
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor r8d, r8d
xor edx, edx
jmp 0x14001636c

Function at 0x140016504
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x14001636c
Function at 0x140018707
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x1400381f8]
jne 0x140015c2a
rol rcx, 0x10
test cx, 0xffff
jne 0x140015c26
repz ret
ror rcx, 0x10
jmp 0x140018660
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x14003d610]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x14003d708]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x1400186e5
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x14003d610]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x140018707
mov rax, qword [rsp + 0x88]
mov qword [0x14003d708], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x14003d6a8], rax
mov rax, qword [0x14003d708]
mov qword [0x14003d580], rax
mov rax, qword [rsp + 0x90]
mov qword [0x14003d690], rax
mov dword [0x14003d570], 0xc0000409
mov dword [0x14003d574], 1
mov rax, qword [0x1400381f8]
mov qword [rsp + 0x68], rax
mov rax, qword [0x140038200]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x14003d608], eax
mov ecx, 1
call fcn.14001f6b4
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x14002d398]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x14003d608], 0
jne 0x14001878e
mov ecx, 1
call fcn.14001f6b4
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x140020658
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.14001a2b8
xor ebx, ebx
mov rdi, rax
cmp qword [0x14003e3f8], rbx
jne 0x14002075e
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x140020833
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140020833
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, [0x14002dc60]
mov rcx, rsi
mov qword [0x14003e3f8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, [0x14002dc48]
mov rcx, rsi
mov qword [0x14003e400], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
mov qword [0x14003e408], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x14003e418], rax
test rax, rax
je 0x140020755
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x14003e410], rax
jmp 0x140020765
mov rax, qword [0x14003e410]
jmp 0x14002076c
mov rax, qword [0x14003e410]
mov r11, qword [0x14003e418]
cmp rax, rdi
je 0x1400207d4
cmp r11, rdi
je 0x1400207d4
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x14003e418]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x1400207d4
test rax, rax
je 0x1400207d4
call rsi
test rax, rax
je 0x1400207ce
lea rcx, [rsp + 0x88]
mov r9d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x1400207ce
test byte [rsp + 0x38], 1
jne 0x1400207d4
bts ebp, 0x15
jmp 0x140020812
mov rcx, qword [0x14003e400]
cmp rcx, rdi
je 0x140020812
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x140020812
call rax
mov rbx, rax
test rax, rax
je 0x140020812
mov rcx, qword [0x14003e408]
cmp rcx, rdi
je 0x140020812
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x140020812
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x14003e3f8]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x140020833
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x140020835
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x180003f10
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x47], 0
je 0x180003f33
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x34]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x46
jb 0x180003f20
mov byte [rcx + 0x47], 0
mov rax, rcx
ret

Function at 0x180003f40
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x68], rcx
xor esi, esi
cmp byte [r8 + 6], sil
je 0x180003f74
mov ecx, esi
lea eax, [rcx - 0x34]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 5
jb 0x180003f60
mov byte [r8 + 6], sil
lea rax, [r8 + 5]
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x48], sil
cmp r9, rax
je 0x180003fa9
mov r8d, 5
mov rdx, r9
lea rcx, [rsp + 0x48]
call fcn.180008d50
nop
cmp byte [rbx + 0xa], 0
je 0x180003fd3
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x34]
xor byte [rcx + rbx], al
inc rcx
cmp rcx, 9
jb 0x180003fc0
mov byte [rbx + 0xa], 0
lea rax, [rbx + 9]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], 0
cmp rbx, rax
je 0x180004008
mov r8d, 9
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.180008d50
nop
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x28]
movzx edx, byte [rsp + 0x20]
mov rcx, rdi
call fcn.18000ac60
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x180004061
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000405b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000405b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800e26fc
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x1800040a1
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000409c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000409c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800e26fc
mov rax, rdi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x1800040b0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x48], rcx
xor esi, esi
cmp byte [r8 + 7], sil
je 0x1800040e4
mov ecx, esi
lea eax, [rcx - 0x34]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 6
jb 0x1800040d0
mov byte [r8 + 7], sil
lea rax, [r8 + 6]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], sil
cmp r9, rax
je 0x180004119
mov r8d, 6
mov rdx, r9
lea rcx, [rsp + 0x28]
call fcn.180008d50
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x180004127
mov rbx, qword [rbx]
mov r8, rbx
lea rcx, [rsp + 0x28]
call fcn.18000bd60
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x18000419c
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180004197
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180004197
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800e26fc
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x1800041b0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x48], rcx
xor esi, esi
cmp byte [r8 + 9], sil
je 0x1800041e4
mov ecx, esi
lea eax, [rcx - 0x34]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 8
jb 0x1800041d0
mov byte [r8 + 9], sil
lea rax, [r8 + 8]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], sil
cmp r9, rax
je 0x180004219
mov r8d, 8
mov rdx, r9
lea rcx, [rsp + 0x28]
call fcn.180008d50
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x180004227
mov rbx, qword [rbx]
mov r8, rbx
lea rcx, [rsp + 0x28]
call fcn.18000bd60
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x18000429c
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180004297
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180004297
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800e26fc
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x1800042b0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x48], rcx
xor esi, esi
cmp byte [r8 + 0xa], sil
je 0x1800042e4
mov ecx, esi
lea eax, [rcx - 0x34]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 9
jb 0x1800042d0
mov byte [r8 + 0xa], sil
lea rax, [r8 + 9]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], sil
cmp r9, rax
je 0x180004319
mov r8d, 9
mov rdx, r9
lea rcx, [rsp + 0x28]
call fcn.180008d50
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x180004327
mov rbx, qword [rbx]
mov r8, rbx
lea rcx, [rsp + 0x28]
call fcn.18000bd60
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x18000439c
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180004397
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180004397
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800e26fc
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x1800043b0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x136], 0
je 0x1800043d8
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x34]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x135
jb 0x1800043c0
mov byte [rcx + 0x136], 0
mov rax, rcx
ret
Function at 0x180005480
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x68], rcx
xor esi, esi
cmp byte [r8 + 0xb], sil
je 0x1800054b4
mov ecx, esi
lea eax, [rcx - 0x34]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 0xa
jb 0x1800054a0
mov byte [r8 + 0xb], sil
lea rax, [r8 + 0xa]
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x48], sil
cmp r9, rax
je 0x1800054e9
mov r8d, 0xa
mov rdx, r9
lea rcx, [rsp + 0x48]
call fcn.180008d50
nop
cmp byte [rbx + 0xb], 0
je 0x180005513
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x34]
xor byte [rcx + rbx], al
inc rcx
cmp rcx, 0xa
jb 0x180005500
mov byte [rbx + 0xb], 0
lea rax, [rbx + 0xa]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], 0
cmp rbx, rax
je 0x180005548
mov r8d, 0xa
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.180008d50
nop
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x28]
movzx edx, byte [rsp + 0x20]
mov rcx, rdi
call fcn.18000ac60
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x1800055a1
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000559b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000559b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800e26fc
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x1800055e1
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800055dc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800055dc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800e26fc
mov rax, rdi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x1800055f0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x48], rcx
xor esi, esi
cmp byte [r8 + 0xc], sil
je 0x180005624
mov ecx, esi
lea eax, [rcx - 0x34]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 0xb
jb 0x180005610
mov byte [r8 + 0xc], sil
lea rax, [r8 + 0xb]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], sil
cmp r9, rax
je 0x180005659
mov r8d, recv
mov rdx, r9
lea rcx, [rsp + 0x28]
call fcn.180008d50
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x180005667
mov rbx, qword [rbx]
mov r8, rbx
lea rcx, [rsp + 0x28]
call fcn.18000bd60
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x1800056dc
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800056d7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800056d7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800e26fc
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x180006520
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x68], rcx
xor esi, esi
cmp byte [r8 + 0xb], sil
je 0x180006554
mov ecx, esi
lea eax, [rcx - 0x34]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 0xa
jb 0x180006540
mov byte [r8 + 0xb], sil
lea rax, [r8 + 0xa]
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x48], sil
cmp r9, rax
je 0x180006589
mov r8d, 0xa
mov rdx, r9
lea rcx, [rsp + 0x48]
call fcn.180008d50
nop
cmp byte [rbx + 0xe], 0
je 0x1800065b3
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x34]
xor byte [rcx + rbx], al
inc rcx
cmp rcx, 0xd
jb 0x1800065a0
mov byte [rbx + 0xe], 0
lea rax, [rbx + 0xd]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], 0
cmp rbx, rax
je 0x1800065e8
mov r8d, reloc.WS2_32.dll_listen
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.180008d50
nop
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x28]
movzx edx, byte [rsp + 0x20]
mov rcx, rdi
call fcn.18000ac60
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x180006641
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000663b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000663b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800e26fc
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x180006681
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000667c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000667c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800e26fc
mov rax, rdi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x180006690
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x48], rcx
xor esi, esi
cmp byte [r8 + 6], sil
je 0x1800066c4
mov ecx, esi
lea eax, [rcx - 0x34]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 5
jb 0x1800066b0
mov byte [r8 + 6], sil
lea rax, [r8 + 5]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], sil
cmp r9, rax
je 0x1800066f9
mov r8d, 5
mov rdx, r9
lea rcx, [rsp + 0x28]
call fcn.180008d50
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x180006707
mov rbx, qword [rbx]
mov r8, rbx
lea rcx, [rsp + 0x28]
call fcn.18000bd60
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x18000677c
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006777
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180006777
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800e26fc
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x180006b70
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x68], rcx
xor esi, esi
cmp byte [r8 + 9], sil
je 0x180006ba4
mov ecx, esi
lea eax, [rcx - 0x34]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 8
jb 0x180006b90
mov byte [r8 + 9], sil
lea rax, [r8 + 8]
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x48], sil
cmp r9, rax
je 0x180006bd9
mov r8d, 8
mov rdx, r9
lea rcx, [rsp + 0x48]
call fcn.180008d50
nop
cmp byte [rbx + 9], 0
je 0x180006c03
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x34]
xor byte [rcx + rbx], al
inc rcx
cmp rcx, 8
jb 0x180006bf0
mov byte [rbx + 9], 0
lea rax, [rbx + 8]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], 0
cmp rbx, rax
je 0x180006c38
mov r8d, 8
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.180008d50
nop
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x28]
movzx edx, byte [rsp + 0x20]
mov rcx, rdi
call fcn.18000ac60
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x180006c91
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006c8b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180006c8b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800e26fc
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x180006cd1
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006ccc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180006ccc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800e26fc
mov rax, rdi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret