joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140023e84
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x30
movsxd rbp, ecx
mov r9, r8
mov rax, rbp
lea rcx, [0x14009e710]
and eax, 0x3f
mov r10, rbp
sar r10, 6
xor edi, edi
mov rsi, rdx
mov r14, rbp
lea r8, [rax + rax*8]
mov rax, qword [rcx + r10*8]
mov ecx, 4
mov qword [rsp + 0x78], rcx
mov r11, qword [rax + r8*8 + 0x28]
lea r12d, [rcx + 6]
test r9, r9
je 0x140023ee2
cmp word [rdx], r12w
jne 0x140023ee2
or byte [rax + r8*8 + 0x38], cl
jmp 0x140023ee8
and byte [rax + r8*8 + 0x38], 0xfb
lea rdx, [rdx + r9*2]
mov rcx, rsi
mov rbx, rsi
cmp rsi, rdx
jae 0x140024043
mov r9d, 0x1a
lea r13d, [r9 - 0xd]
movzx eax, word [rcx]
cmp ax, r9w
je 0x14002401e
lea r9, [rcx + 2]
cmp ax, r13w
je 0x140023f21
mov rcx, r9
jmp 0x140023f44
cmp r9, rdx
jae 0x140023f5b
cmp word [r9], r12w
mov eax, 2
cmove rax, qword [rsp + 0x78]
add rcx, rax
mov eax, r12d
cmp word [r9], r12w
cmovne ax, r13w
mov word [rbx], ax
mov r9d, 0x1a
add rbx, 2
cmp rcx, rdx
jb 0x140023f05
jmp 0x140024043
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rdi
mov r8d, 2
lea rdx, [rsp + 0x70]
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140024018
cmp dword [rsp + 0x80], edi
je 0x140024018
mov rdx, r14
lea r11, [0x14009e710]
sar rdx, 6
and r14d, 0x3f
mov rax, qword [r11 + rdx*8]
lea r8, [r14 + r14*8]
test byte [rax + r8*8 + 0x38], 0x48
je 0x140023ff1
movzx eax, word [rsp + 0x70]
cmp ax, r12w
jne 0x140023fc4
mov word [rbx], r12w
jmp 0x14002403f
mov word [rbx], r13w
mov word [rsp + 0x78], ax
mov rax, qword [r11 + rdx*8]
lea rcx, [rax + r8*8]
mov al, byte [rsp + rdi + 0x78]
mov byte [rcx + rdi + 0x3a], al
inc rdi
cmp rdi, 2
jl 0x140023fcd
mov rax, qword [r11 + rdx*8]
mov byte [rax + r8*8 + 0x3c], r12b
jmp 0x14002403f
cmp word [rsp + 0x70], r12w
jne 0x140023ffe
cmp rbx, rsi
je 0x140023fbe
mov rdx, 0xfffffffffffffffe
mov ecx, ebp
lea r8d, [rdx + 3]
call fcn.140024b10
cmp word [rsp + 0x70], r12w
je 0x140024043
mov word [rbx], r13w
jmp 0x14002403f
lea r11, [0x14009e710]
mov rcx, qword [r11 + r10*8]
mov al, byte [rcx + r8*8 + 0x38]
test al, 0x40
jne 0x14002403b
or al, 2
mov byte [rcx + r8*8 + 0x38], al
jmp 0x140024043
mov word [rbx], r9w
add rbx, 2
sub rbx, rsi
sar rbx, 1
lea eax, [rbx + rbx]
add rsp, 0x30
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140028a24
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x140028aab
mov rsi, rbx
cmp word [rax], bp
je 0x140028a6a
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140028a54
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140028a50
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.140020b9c
mov rdi, rax
test rax, rax
je 0x140028a98
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.14000f580
mov rbp, rdi
xor ecx, ecx
call fcn.140020b60
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x14002fad0
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.140024b10
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.140024b10
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x14002fc20
cmp rax, 0xffffffffffffffff
je 0x14002fc20
xor edi, edi
test rbp, rbp
jle 0x14002fbcb
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.140020ae8
mov rbx, rax
test rax, rax
jne 0x14002fb58
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x14002fbc1
mov edx, 0x8000
mov ecx, r14d
call fcn.14001d8bc
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.140022dc8
cmp eax, 0xffffffff
je 0x14002fba1
cdqe
sub rbp, rax
test rbp, rbp
jg 0x14002fb68
mov edx, r15d
mov ecx, r14d
call fcn.14001d8bc
jmp 0x14002fbc1
cmp byte [rsi + 0x38], dil
je 0x14002fbb8
cmp dword [rsi + 0x34], 5
jne 0x14002fbb8
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x14002fbc1
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.140020b60
jmp 0x14002fc34
jns 0x14002fc34
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.140024b10
cmp rax, 0xffffffffffffffff
jne 0x14002fbec
cmp byte [rsi + 0x30], dil
je 0x14002fc34
mov edi, dword [rsi + 0x2c]
jmp 0x14002fc34
mov ecx, r14d
call fcn.140028fa8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x14002fc34
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x14002fc34
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x14002fc2d
mov eax, dword [rsi + 0x2c]
jmp 0x14002fc32
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.140024b10
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x140036e80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rbx, qword [0x14009ed18]
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], 0xd0027
mov dword [rbp - 0x1c], 0x2b0015
mov dword [rbp - 0x18], 0x130009
mov dword [rbp - 0x14], 0x6b005f
mov dword [rbp - 0x10], 0x60021
mov dword [rbp - 0xc], 0x59000d
call fcn.14000a060
mov rcx, qword [rax]
call rbx
movdqa xmm0, xmmword [0x140046c20]
lea rcx, [rbp - 0x20]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x14009ed08], rax
mov word [rbp - 0x10], 0x3305
mov byte [rbp - 0xe], 0x65
call fcn.14000a620
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x2b150d27
mov dword [rbp - 0x1c], 0x20156509
mov dword [rbp - 0x18], 0x3c151f26
mov word [rbp - 0x14], 0x6d20
call fcn.140009c20
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rbp
ret

Function at 0x1400370b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
movsxd rax, dword [rcx + 0x3c]
xor ebx, ebx
mov r13, rdx
mov rbp, rcx
mov edi, dword [rax + rcx + 0x88]
add rdi, rcx
mov r14d, dword [rdi + 0x1c]
mov r15d, dword [rdi + 0x20]
add r14, rcx
mov r12d, dword [rdi + 0x24]
add r15, rcx
add r12, rcx
cmp dword [rdi + 0x18], ebx
jbe 0x140037127
nop dword [rax]
movzx eax, word [r12 + rbx*2]
mov rdx, r13
mov ecx, dword [r15 + rbx*4]
add rcx, rbp
mov esi, dword [r14 + rax*4]
add rsi, rbp
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x140037146
inc ebx
cmp ebx, dword [rdi + 0x18]
jb 0x140037100
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov rax, rsi
jmp 0x140037129
Function at 0x140037af0
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x50
mov dword [rax - 0x2c], 0x20003f
lea rcx, [rsp + 0x2c]
mov dword [rax - 0x28], 0x90022
mov dword [rax - 0x24], 0x6c0020
mov dword [rax - 0x20], 0x4002f
mov dword [rax - 0x1c], 0x2f0016
mov eax, 0x61
mov word [rsp + 0x40], ax
call fcn.14000bbd0
mov rsi, qword [rax]
mov rax, qword gs:[0x60]
mov rdi, qword [rax + 0x18]
add rdi, 0x20
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x140037b7d
nop dword [rax]
mov rcx, qword [rbx + 0x40]
mov rdx, rsi
call fcn.14000e518
test rax, rax
jne 0x140037bf8
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x140037b60
xor eax, eax
lea rcx, [rsp + 0x20]
mov qword [0x14009ed10], rax
mov dword [rsp + 0x20], 0x11001a
mov dword [rsp + 0x24], 0x2b0014
mov dword [rsp + 0x28], 0x200009
call fcn.14000b9c0
mov rsi, qword [rax]
mov rax, qword gs:[0x60]
mov rdi, qword [rax + 0x18]
add rdi, 0x20
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x140037bdd
mov rcx, qword [rbx + 0x40]
mov rdx, rsi
call fcn.14000e518
test rax, rax
jne 0x140037bdd
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x140037bc4
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r14
ret
mov rax, qword [rbx + 0x20]
jmp 0x140037b7f
Function at 0x140003e10
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x60
mov rax, qword [0x14009a080]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov esi, eax
mov ebx, 0x41
xor ebp, ebp
test sil, 1
je 0x140003f79
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rbp
xor r8d, r8d
lea rdx, [0x14008b65c]
lea rcx, [rsp + 0x30]
call fcn.140013b60
nop
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
cmp rcx, rdx
jae 0x140003ea6
lea rax, [rcx + 1]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x30]
cmp rdx, 8
cmovae rax, qword [rsp + 0x30]
mov word [rax + rcx*2], bx
mov word [rax + rcx*2 + 2], bp
jmp 0x140003eb4
movzx r9d, bx
lea rcx, [rsp + 0x30]
call fcn.1400137e0
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x140003eeb
lea rax, [rcx + 1]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x30]
cmp rdx, 8
cmovae rax, qword [rsp + 0x30]
mov dword [rax + rcx*2], Ordinal_60
jmp 0x140003f0c
mov qword [rsp + 0x20], 1
lea r9, [0x14008b660]
xor r8d, r8d
lea edx, [r8 + 1]
lea rcx, [rsp + 0x30]
call fcn.140013990
mov rax, qword [rdi + 8]
cmp rax, qword [rdi + 0x10]
je 0x140003f2a
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.140012750
add qword [rdi + 8], 0x20
jmp 0x140003f3b
lea r8, [rsp + 0x30]
mov rdx, rax
mov rcx, rdi
call fcn.140014ba0
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x140003f79
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003f74
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003faa
call fcn.140078acc
shr esi, 1
inc bx
cmp bx, 0x5a
jbe 0x140003e43
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140078820
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x140004020
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
sub rsp, 0x290
mov rax, qword [0x14009a080]
xor rax, rsp
mov qword [rsp + 0x280], rax
xor edx, edx
mov rsi, rcx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x14000405d
xor al, al
jmp 0x1400041dc
mov qword [rsp + 0x2a0], rbx
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x2a8], rdi
mov rcx, rbp
mov qword [rsp + 0x2b0], r14
mov dword [rsp + 0x40], 0x238
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1400041b9
xor r14d, r14d
nop word [rax + rax]
xorps xmm0, xmm0
mov qword [rsp + 0x30], r14
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x38], r14
lea rax, [rsp + 0x6c]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], r14w
jne 0x1400040c0
lea rdx, [rsp + 0x6c]
lea rcx, [rsp + 0x20]
call fcn.140013b60
cmp qword [rsi + 0x18], 8
mov rax, rsi
jb 0x1400040e6
mov rax, qword [rsi]
mov rdi, qword [rsp + 0x38]
lea r8, [rsp + 0x20]
mov rbx, qword [rsp + 0x20]
cmp rdi, 8
mov rdx, qword [rsp + 0x30]
cmovae r8, rbx
cmp rdx, qword [rsi + 0x10]
jne 0x14000416c
test rdx, rdx
je 0x140004124
sub r8, rax
movzx ecx, word [r8 + rax]
cmp cx, word [rax]
jne 0x14000416c
add rax, 2
sub rdx, 1
jne 0x140004110
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp rdi, 8
jb 0x140004168
lea rdx, [rdi*2 + 2]
mov rax, rbx
cmp rdx, 0x1000
jb 0x140004160
mov rbx, qword [rbx - 8]
add rdx, 0x27
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400041fd
mov rcx, rbx
call fcn.140078acc
mov al, 1
jmp 0x1400041c4
cmp rdi, 8
jb 0x1400041a3
lea rdx, [rdi*2 + 2]
mov rax, rbx
cmp rdx, 0x1000
jb 0x14000419b
mov rbx, qword [rbx - 8]
add rdx, 0x27
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400041fd
mov rcx, rbx
call fcn.140078acc
lea rdx, [rsp + 0x40]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1400040a0
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov rdi, qword [rsp + 0x2a8]
mov rbx, qword [rsp + 0x2a0]
mov r14, qword [rsp + 0x2b0]
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.140078820
mov rbp, qword [rsp + 0x2b8]
add rsp, 0x290
pop rsi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x140015a80
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 7], sil
je 0x140015ab4
mov eax, esi
lea ecx, [rax - 0x65]
xor byte [r8 + rax], cl
inc rax
cmp rax, 6
jb 0x140015aa0
mov byte [r8 + 7], sil
add r8, 6
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.140015440
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140015ad9
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140014710
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140015b53
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140015b4e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140015b4e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140078acc
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x140015b60
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r10, r8
mov rdi, rdx
mov rsi, rcx
mov qword [rsp + 0x28], rcx
xor ebx, ebx
cmp byte [r8 + 9], bl
je 0x140015b94
mov ecx, ebx
lea eax, [rcx - 0x65]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 8
jb 0x140015b80
mov byte [r8 + 9], bl
add r8, 8
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x50]
call fcn.140015440
nop
cmp byte [rdi + 9], 0
je 0x140015bc4
lea eax, [rbx - 0x65]
xor byte [rbx + rdi], al
inc rbx
cmp rbx, 8
jb 0x140015bb1
mov byte [rdi + 9], 0
lea r8, [rdi + 8]
lea r9, [rsp + 0x20]
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.140015440
nop
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
movzx edx, byte [rsp + 0x20]
mov rcx, rsi
call fcn.14001b7d0
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140015c34
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140015c2e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140015c2e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140078acc
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x140015c74
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140015c6f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140015c6f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140078acc
mov rax, rsi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x140015c80
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 9], sil
je 0x140015cb4
mov eax, esi
lea ecx, [rax - 0x65]
xor byte [r8 + rax], cl
inc rax
cmp rax, 8
jb 0x140015ca0
mov byte [r8 + 9], sil
add r8, 8
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.140015440
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140015cd9
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140014710
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140015d53
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140015d4e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140015d4e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140078acc
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x140015d60
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 0xa], sil
je 0x140015d94
mov eax, esi
lea ecx, [rax - 0x65]
xor byte [r8 + rax], cl
inc rax
cmp rax, 9
jb 0x140015d80
mov byte [r8 + 0xa], sil
add r8, 9
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.140015440
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140015db9
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140014710
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140015e33
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140015e2e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140015e2e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140078acc
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x140015e40
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 0xc], sil
je 0x140015e74
mov eax, esi
lea ecx, [rax - 0x65]
xor byte [r8 + rax], cl
inc rax
cmp rax, 0xb
jb 0x140015e60
mov byte [r8 + 0xc], sil
add r8, 0xb
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.140015440
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140015e99
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140014710
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140015f13
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140015f0e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140015f0e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140078acc
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x14001ca20
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 9], al
je 0x14001ca43
lea edx, [rax - 0x65]
xor byte [rax + rcx], dl
inc rax
cmp rax, 8
jb 0x14001ca30
mov byte [rcx + 9], 0
lea r8, [rcx + 8]
mov rdx, rcx
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.140015440
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x14001ca60
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 0x10], al
je 0x14001ca83
lea edx, [rax - 0x65]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xf
jb 0x14001ca70
mov byte [rcx + 0x10], 0
lea r8, [rcx + 0xf]
mov rdx, rcx
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.140015440
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x14001e8f0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 5], 0
je 0x14001e913
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x65]
xor byte [rax + rcx], dl
inc rax
cmp rax, 4
jb 0x14001e900
mov byte [rcx + 5], 0
mov rax, rcx
ret

Function at 0x14001e920
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x136], 0
je 0x14001e948
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x65]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x135
jb 0x14001e930
mov byte [rcx + 0x136], 0
mov rax, rcx
ret

Function at 0x14001e950
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x44], 0
je 0x14001e973
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x65]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x43
jb 0x14001e960
mov byte [rcx + 0x44], 0
mov rax, rcx
ret

Function at 0x14001e980
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x47], 0
je 0x14001e9a3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x65]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x46
jb 0x14001e990
mov byte [rcx + 0x47], 0
mov rax, rcx
ret
Function at 0x14001fd20
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
mov r10, rcx
mov ecx, r9d
test r8, r8
je 0x14001fe07
sub r10, rdx
cmp r8, 8
jb 0x14001fde3
mov rax, r8
lea r9, [rdx + 4]
and rax, 0xfffffffffffffff8
xorps xmm3, xmm3
xorps xmm2, xmm2
movd xmm1, dword [r10 + r9 - 4]
add rcx, 8
movd xmm0, dword [r9 - 4]
lea r9, [r9 + 8]
punpcklbw xmm1, xmm1
punpcklwd xmm1, xmm1
punpcklbw xmm0, xmm0
psrad xmm1, 0x18
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
pxor xmm1, xmm0
movd xmm0, dword [r9 - 8]
punpcklbw xmm0, xmm0
por xmm3, xmm1
movd xmm1, dword [r10 + r9 - 8]
punpcklbw xmm1, xmm1
punpcklwd xmm1, xmm1
punpcklwd xmm0, xmm0
psrad xmm1, 0x18
psrad xmm0, 0x18
pxor xmm1, xmm0
por xmm2, xmm1
cmp rcx, rax
jb 0x14001fd50
por xmm2, xmm3
movdqa xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movdqa xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movd r9d, xmm2
cmp rcx, r8
jae 0x14001fe07
lea rax, [rcx + rdx]
sub r8, rcx
nop word [rax + rax]
movsx edx, byte [r10 + rax]
movsx ecx, byte [rax]
lea rax, [rax + 1]
xor edx, ecx
or r9d, edx
sub r8, 1
jne 0x14001fdf0
test r9d, r9d
sete al
ret