joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003a4b0
Capabilities:
Encode data using xor
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x60
movdqa xmm0, xmmword [0x1400b8d80]
xor esi, esi
movdqu xmmword [rsp + 0x40], xmm0
mov ecx, esi
mov dword [rsp + 0x50], 0x6c6f3350
mov dword [rsp + 0x54], 0x1004e6d
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x2f]
xor byte [rsp + rcx + 0x40], al
inc rcx
cmp rcx, 0x16
jb 0x14003a4f0
lea rcx, [rsp + 0x40]
mov byte [rsp + 0x57], sil
call fcn.1400018a0
mov rbx, qword [0x1400eda20]
test rbx, rbx
je 0x14003a574
mov rbx, qword [rbx + 0x98]
test rbx, rbx
je 0x14003a574
cmp qword [rbx], rsi
je 0x14003a574
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14003a53f
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov qword [rbx + 8], rsi
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x14003a552
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov qword [rbx + 0x10], rsi
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x14003a574
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rax, qword [0x1400eda20]
mov qword [rbx + 0x18], rsi
mov rcx, qword [rax + 0x50]
mov qword [rcx + 8], rsi
call fcn.140028f50
mov rax, qword [0x1400eda20]
test rax, rax
je 0x14003a58e
mov rbx, qword [rax + 0x90]
jmp 0x14003a591
mov rbx, rsi
mov rcx, qword [rbx + 0x30]
lea rdi, [rax + 8]
test rcx, rcx
je 0x14003a5ab
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rax, qword [0x1400eda20]
mov qword [rdi + 0x78], rsi
mov qword [rdi + 0x88], rsi
test rax, rax
je 0x14003a5c1
dec dword [rax + 0xec]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rbx, qword [0x1400eda20]
mov qword [0x1400eda20], rbx
call fcn.140008500
mov qword [0x1400eda20], rsi
test rbx, rbx
je 0x14003a60c
mov rcx, rbx
call fcn.1400182b0
mov rax, qword [0x1400eda20]
test rax, rax
je 0x14003a603
dec dword [rax + 0xec]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [0x1400edb88]
mov r9d, 1
movss xmm0, dword [0x1400b87d4]
xor r8d, r8d
mov dword [rsp + 0x30], esi
xor edx, edx
movss dword [rsp + 0x28], xmm0
mov rax, qword [rcx]
mov dword [rsp + 0x20], esi
call qword [rax + 0x158]
mov rcx, qword [0x1400edb88]
lea rdx, [0x1400eda70]
mov rax, qword [rcx]
call qword [rax + 0x80]
mov rcx, qword [0x1400eda68]
test rcx, rcx
je 0x14003a666
call qword [sym.imp.USER32.dll_DestroyWindow]
mov rcx, qword [0x1400edb88]
test rcx, rcx
je 0x14003a688
mov rax, qword [rcx]
call qword [rax + 0x150]
mov rcx, qword [0x1400edb88]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [0x1400edaf8]
test rcx, rcx
je 0x14003a69a
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
xor ecx, ecx
mov dword [0x1400eda4c], esi
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x14003a960
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 0x33], al
je 0x14003a983
lea edx, [rax + 0x2f]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x32
jb 0x14003a970
mov byte [rcx + 0x33], 0
lea r8, [rcx + 0x32]
mov rdx, rcx
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.1400305e0
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x14003acd0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x14003acf8
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x14003ad1e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x14003ad20
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x14003ad79
test ecx, ecx
jle 0x14003ad59
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x14003ad79
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x14003ad79
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret
Function at 0x14003ada0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x14003add1
xor eax, eax
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rcx + 0x68], 0
je 0x14003adef
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x30], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x14003ae0b
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14003ae0d
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14003ae49
mov qword [rsp + 0x38], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x38]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x14003aede
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x14003ae84
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x14003aebe
nop dword [rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x14003aede
cmp rbx, rax
ja 0x14003ae90
test rbx, rbx
je 0x14003aede
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
mov rsi, qword [rsp + 0x48]
sub rbp, rbx
mov rbx, qword [rsp + 0x30]
mov rax, rbp
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x14003b310
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x70
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14003b334
xor eax, eax
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x14003b36b
mov rax, qword [rcx + 0x58]
movsxd rcx, dword [rax]
add rcx, rdx
cmp rdx, rcx
jae 0x14003b36b
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], dil
mov eax, edi
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0x80], rsi
je 0x14003b49c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14003b3ae
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x14003b3d9
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14003b4a1
lea rax, [rsp + 0x90]
mov byte [rsp + 0x40], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x41]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x40]
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14003b44e
sub eax, 1
je 0x14003b44e
cmp eax, 2
jne 0x14003b49c
movsx ecx, byte [rsp + 0x40]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14003b4a1
mov rsi, qword [rsp + 0x90]
lea rax, [rsp + 0x48]
sub rsi, rax
je 0x14003b47f
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x48]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x14003b49c
lea rax, [rsp + 0x40]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x98], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x14003b4a1
mov eax, 0xffffffff
mov rsi, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret

Function at 0x14003b6c0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 9], al
je 0x14003b6e3
lea edx, [rax + 0x2f]
xor byte [rax + rcx], dl
inc rax
cmp rax, 8
jb 0x14003b6d0
mov byte [rcx + 9], 0
lea r8, [rcx + 8]
mov rdx, rcx
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.1400305e0
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x14003b700
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 0x12], al
je 0x14003b723
lea edx, [rax + 0x2f]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x11
jb 0x14003b710
mov byte [rcx + 0x12], 0
lea r8, [rcx + 0x11]
mov rdx, rcx
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.1400305e0
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x14003b740
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 8], al
je 0x14003b763
lea edx, [rax + 0x2f]
xor byte [rax + rcx], dl
inc rax
cmp rax, 7
jb 0x14003b750
mov byte [rcx + 8], 0
lea r8, [rcx + 7]
mov rdx, rcx
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.1400305e0
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x14003be60
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x50
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x14003bf29
cmp byte [rcx + 0x71], 0
je 0x14003bf29
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x68], rdi
call qword [rax + Ordinal_26]
cmp eax, 0xffffffff
je 0x14003bf1c
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x60]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14003bed8
sub eax, 1
je 0x14003bedc
cmp eax, 2
jne 0x14003bf1c
mov rdi, qword [rsp + 0x68]
mov al, 1
mov byte [rbx + 0x71], 0
add rsp, 0x50
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x60]
lea rax, [rsp + 0x30]
sub rdi, rax
je 0x14003bf0a
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x30]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14003bf1c
cmp byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x68]
sete al
add rsp, 0x50
pop rbx
ret
mov rdi, qword [rsp + 0x68]
xor al, al
add rsp, 0x50
pop rbx
ret
mov al, 1
add rsp, 0x50
pop rbx
ret

Function at 0x14003c8a0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rbx, rdx
mov rdi, rcx
mov ecx, 8
call fcn.1400a062c
mov qword [rax], rbx
mov qword [rsp + 0x40], rax
lea rbx, [rdi + 8]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x14003d880]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rdi], rax
test rax, rax
je 0x14003c8fd
mov rax, rdi
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov dword [rbx], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x14003dfe0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x50
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor edi, edi
cmp byte [r8 + 7], dil
je 0x14003e014
mov eax, edi
nop dword [rax]
lea ecx, [rax + 0x34]
xor byte [r8 + rax], cl
inc rax
cmp rax, 6
jb 0x14003e000
mov byte [r8 + 7], dil
lea rax, [r8 + 6]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x14003e044
mov qword [rsp + 0x30], rdi
mov byte [rsp + 0x20], dil
jmp 0x14003e05e
mov qword [rsp + 0x30], 6
mov eax, dword [r8]
mov dword [rsp + 0x20], eax
movzx eax, word [r8 + 4]
mov word [rsp + 0x24], ax
mov r9, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x14003e06c
mov rdx, qword [rdx]
mov r8, rdx
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.14004b7c0
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x14003e0e6
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003e0e1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003e0e1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400a00cc
mov rax, rbx
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x14003e100
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rbx, rcx
mov qword [rbp - 0x10], rcx
xor r9d, r9d
cmp byte [r8 + 9], r9b
je 0x14003e144
mov ecx, r9d
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x34]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 8
jb 0x14003e130
mov byte [r8 + 9], r9b
lea rax, [r8 + 8]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
mov qword [rbp - 0x28], r9
mov qword [rbp - 0x20], r9
mov qword [rbp - 0x20], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x14003e16e
mov qword [rbp - 0x28], r9
mov byte [rbp - 0x38], r9b
jmp 0x14003e17d
mov qword [rbp - 0x28], 8
mov rax, qword [r8]
mov qword [rbp - 0x38], rax
cmp byte [rdx + 9], 0
je 0x14003e1a3
mov rcx, r9
nop word [rax + rax]
lea eax, [rcx + 0x34]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 8
jb 0x14003e190
mov byte [rdx + 9], 0
lea rax, [rdx + 8]
xorps xmm0, xmm0
movups xmmword [rbp - 0x58], xmm0
mov qword [rbp - 0x48], r9
mov qword [rbp - 0x40], r9
mov qword [rbp - 0x40], reloc.WS2_32.dll_ntohs
cmp rdx, rax
jne 0x14003e1cd
mov qword [rbp - 0x48], r9
mov byte [rbp - 0x58], 0
jmp 0x14003e1dc
mov qword [rbp - 0x48], 8
mov rax, qword [rdx]
mov qword [rbp - 0x58], rax
lea r9, [rbp - 0x38]
lea r8, [rbp - 0x58]
movzx edx, byte [rbp - 0x60]
mov rcx, rbx
call fcn.140044740
nop
mov rdx, qword [rbp - 0x40]
cmp rdx, 0x10
jb 0x14003e230
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003e22a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003e22a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400a00cc
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x14003e26e
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003e269
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003e269
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400a00cc
mov rax, rbx
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rbp
ret
Function at 0x14003e290
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x50
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor edi, edi
cmp byte [r8 + 9], dil
je 0x14003e2c4
mov eax, edi
nop dword [rax]
lea ecx, [rax + 0x34]
xor byte [r8 + rax], cl
inc rax
cmp rax, 8
jb 0x14003e2b0
mov byte [r8 + 9], dil
lea rax, [r8 + 8]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x14003e2f4
mov qword [rsp + 0x30], rdi
mov byte [rsp + 0x20], dil
jmp 0x14003e305
mov qword [rsp + 0x30], 8
mov rax, qword [r8]
mov qword [rsp + 0x20], rax
mov r9, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x14003e313
mov rdx, qword [rdx]
mov r8, rdx
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.14004b7c0
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x14003e38d
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003e388
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003e388
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400a00cc
mov rax, rbx
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x14003e3a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rbx, rcx
mov qword [rbp - 0x10], rcx
xor r9d, r9d
cmp byte [r8 + 6], r9b
je 0x14003e3e4
mov ecx, r9d
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x34]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 5
jb 0x14003e3d0
mov byte [r8 + 6], r9b
lea rax, [r8 + 5]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
mov qword [rbp - 0x28], r9
mov qword [rbp - 0x20], r9
mov qword [rbp - 0x20], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x14003e40e
mov qword [rbp - 0x28], r9
mov byte [rbp - 0x38], r9b
jmp 0x14003e424
mov qword [rbp - 0x28], 5
mov eax, dword [r8]
mov dword [rbp - 0x38], eax
movzx eax, byte [r8 + 4]
mov byte [rbp - 0x34], al
cmp byte [rdx + 0xa], 0
je 0x14003e443
mov rcx, r9
nop dword [rax]
lea eax, [rcx + 0x34]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 9
jb 0x14003e430
mov byte [rdx + 0xa], 0
lea rax, [rdx + 9]
xorps xmm0, xmm0
movups xmmword [rbp - 0x58], xmm0
mov qword [rbp - 0x48], r9
mov qword [rbp - 0x40], r9
mov qword [rbp - 0x40], reloc.WS2_32.dll_ntohs
cmp rdx, rax
jne 0x14003e46d
mov qword [rbp - 0x48], r9
mov byte [rbp - 0x58], 0
jmp 0x14003e485
mov qword [rbp - 0x48], 9
movsd xmm0, qword [rdx]
movsd qword [rbp - 0x58], xmm0
movzx eax, byte [rdx + 8]
mov byte [rbp - 0x50], al
lea r9, [rbp - 0x38]
lea r8, [rbp - 0x58]
movzx edx, byte [rbp - 0x60]
mov rcx, rbx
call fcn.140044740
nop
mov rdx, qword [rbp - 0x40]
cmp rdx, 0x10
jb 0x14003e4d9
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003e4d3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003e4d3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400a00cc
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x14003e517
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003e512
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003e512
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400a00cc
mov rax, rbx
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rbp
ret
Function at 0x14003e530
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x50
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor edi, edi
cmp byte [r8 + 0xa], dil
je 0x14003e564
mov eax, edi
nop dword [rax]
lea ecx, [rax + 0x34]
xor byte [r8 + rax], cl
inc rax
cmp rax, 9
jb 0x14003e550
mov byte [r8 + 0xa], dil
lea rax, [r8 + 9]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x14003e594
mov qword [rsp + 0x30], rdi
mov byte [rsp + 0x20], dil
jmp 0x14003e5b1
mov qword [rsp + 0x30], 9
movsd xmm0, qword [r8]
movsd qword [rsp + 0x20], xmm0
movzx eax, byte [r8 + 8]
mov byte [rsp + 0x28], al
mov r9, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x14003e5bf
mov rdx, qword [rdx]
mov r8, rdx
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.14004b7c0
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x14003e639
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003e634
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003e634
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400a00cc
mov rax, rbx
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x14003e650
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x50
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor edi, edi
cmp byte [r8 + 0xc], dil
je 0x14003e684
mov eax, edi
nop dword [rax]
lea ecx, [rax + 0x34]
xor byte [r8 + rax], cl
inc rax
cmp rax, 0xb
jb 0x14003e670
mov byte [r8 + 0xc], dil
lea rax, [r8 + 0xb]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x14003e6b4
mov qword [rsp + 0x30], rdi
mov byte [rsp + 0x20], dil
jmp 0x14003e6db
mov qword [rsp + 0x30], recv
movsd xmm0, qword [r8]
movsd qword [rsp + 0x20], xmm0
movzx eax, word [r8 + 8]
mov word [rsp + 0x28], ax
movzx eax, byte [r8 + 0xa]
mov byte [rsp + 0x2a], al
mov r9, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x14003e6e9
mov rdx, qword [rdx]
mov r8, rdx
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.14004b7c0
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x14003e763
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003e75e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003e75e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400a00cc
mov rax, rbx
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret