joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140040bf0
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], rsi
mov rsi, rcx
mov qword [rsp + 0x40], rdi
call fcn.140066390
mov rcx, qword [rsi]
xor ebp, ebp
cmp qword [rsi + 8], 0xffffffffffffffff
je 0x140040d30
xor eax, eax
lock cmpxchg qword [rcx + 0x38], rbp
je 0x140040c3d
mov rdx, qword [rsi + 8]
lea r8, [rsi + 0x28]
mov r9b, 1
mov rcx, rax
call fcn.140042a20
mov rdi, qword [rsi + 8]
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r15
cmp rdi, 0xffffffffffffffff
je 0x140040d0b
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
mov ebx, eax
call fcn.140066390
mov r15, rax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov qword [rsp + 0x28], r15
mov r14d, eax
mov dword [rsp + 0x20], eax
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
test ebx, ebx
je 0x140040d0b
call fcn.140066390
cmp r15, rax
jne 0x140040ca4
cmp r14d, 0x2733
je 0x140040cb7
call fcn.140066390
cmp r15, rax
jne 0x140040d24
cmp r14d, 0x4d5
jne 0x140040d24
lea r8, [rsp + 0x50]
mov dword [rsp + 0x50], ebp
mov edx, 0x8004667e
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_ioctlsocket]
and byte [rsi + 0x10], 0xfc
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
mov edi, eax
call fcn.140066390
mov rbx, rax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], eax
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
test edi, edi
jne 0x140040d24
mov dword [rsp + 0x20], ebp
call fcn.140066390
mov qword [rsp + 0x28], rax
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
mov r15, qword [rsp + 0x30]
mov r14, qword [rsp + 0x38]
jmp 0x140040d49
mov dword [rsp + 0x20], ebp
call fcn.140066390
mov qword [rsp + 0x28], rax
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
mov byte [rsi + 0x10], 0
mov rdi, 0xffffffffffffffff
mov qword [rsi + 8], rdi
mov rbx, qword [rsi + 0x20]
mov qword [rsi + 0x18], rbp
mov qword [rsi + 0x20], rbp
mov rsi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
test rbx, rbx
je 0x140040d9a
mov eax, edi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x140040d9a
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x140040d9a
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
cmp dword [rsp + 0x20], 0
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x58]
jne 0x140040db0
add rsp, 0x48
ret
lea rdx, str.close
lea rcx, [rsp + 0x20]
call fcn.1400043c0
int3
Function at 0x140040dd0
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x40
xor r15d, r15d
mov rsi, r9
mov rbp, rdx
mov r14, rcx
mov edi, r15d
cmp rcx, 0xffffffffffffffff
je 0x140040f06
test r8b, r8b
je 0x140040e58
test byte [rdx], 8
je 0x140040e58
mov dword [rsp + 0x60], r15d
call fcn.140066390
or byte [rbp], 8
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_WSASetLastError]
lea r9, [rsp + 0x60]
mov dword [rsp + 0x20], 4
mov edx, 0xffff
mov r8d, 0x80
mov rcx, r14
call qword [sym.imp.WS2_32.dll_setsockopt]
mov ebx, eax
call fcn.140066390
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
test ebx, ebx
jne 0x140040e58
call fcn.140066390
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov rcx, r14
call qword [sym.imp.WS2_32.dll_closesocket]
mov edi, eax
call fcn.140066390
mov rbx, rax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], eax
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rsi], xmm0
test edi, edi
je 0x140040f06
call fcn.140066390
cmp qword [rsi + 8], rax
jne 0x140040ea1
cmp dword [rsi], 0x2733
je 0x140040eb4
call fcn.140066390
cmp qword [rsi + 8], rax
jne 0x140040f1d
cmp dword [rsi], 0x4d5
jne 0x140040f1d
lea r8, [rsp + 0x60]
mov dword [rsp + 0x60], r15d
mov edx, 0x8004667e
mov rcx, r14
call qword [sym.imp.WS2_32.dll_ioctlsocket]
and byte [rbp], 0xfc
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov rcx, r14
call qword [sym.imp.WS2_32.dll_closesocket]
mov edi, eax
call fcn.140066390
mov rbx, rax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], eax
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rsi], xmm0
test edi, edi
jne 0x140040f1d
mov dword [rsp + 0x30], r15d
call fcn.140066390
mov qword [rsp + 0x38], rax
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rsi], xmm0
mov rbx, qword [rsp + 0x68]
mov eax, edi
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x140040f40
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
call fcn.140066390
mov rdi, qword [rsi]
cmp rdi, 0xffffffffffffffff
je 0x140040ff8
xor ecx, ecx
mov qword [rsp + 0x48], r14
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
mov ebx, eax
call fcn.140066390
mov r14, rax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebp, eax
test ebx, ebx
je 0x140040fee
call fcn.140066390
cmp r14, rax
jne 0x140040f9f
cmp ebp, 0x2733
je 0x140040fb1
call fcn.140066390
cmp r14, rax
jne 0x140040ff3
cmp ebp, 0x4d5
jne 0x140040ff3
lea r8, [rsp + 0x40]
mov dword [rsp + 0x40], 0
mov edx, 0x8004667e
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_ioctlsocket]
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
mov ebx, eax
call fcn.140066390
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
test ebx, ebx
jne 0x140040ff3
call fcn.140066390
mov r14, qword [rsp + 0x48]
mov rdi, qword [rsi + 8]
cmp rdi, 0xffffffffffffffff
je 0x140041093
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
mov ebx, eax
call fcn.140066390
mov rbp, rax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
test ebx, ebx
je 0x14004108e
call fcn.140066390
cmp rbp, rax
jne 0x14004103f
cmp esi, 0x2733
je 0x140041051
call fcn.140066390
cmp rbp, rax
jne 0x140041093
cmp esi, 0x4d5
jne 0x140041093
lea r8, [rsp + 0x40]
mov dword [rsp + 0x40], 0
mov edx, 0x8004667e
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_ioctlsocket]
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
mov ebx, eax
call fcn.140066390
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
test ebx, ebx
jne 0x140041093
call fcn.140066390
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400416b0
Capabilities:
Connect socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rdi, r9
mov rsi, r8
mov rbp, rdx
mov rbx, rcx
cmp rcx, 0xffffffffffffffff
jne 0x1400416f4
mov dword [rsp + 0x20], 0x2719
call fcn.140066390
mov qword [rsp + 0x28], rax
mov eax, ebx
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rdi], xmm0
jmp 0x140041748
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov r8d, esi
mov rdx, rbp
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_connect]
mov esi, eax
call fcn.140066390
mov rbx, rax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], eax
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rdi], xmm0
test esi, esi
jne 0x140041746
mov dword [rsp + 0x20], esi
call fcn.140066390
mov qword [rsp + 0x28], rax
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rdi], xmm0
mov eax, esi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x140043d20
Capabilities:
Send data
Send data on socket

Disassembly:
push rbx
sub rsp, 0x50
lea rax, [rsp + 0x60]
mov byte [rsp + 0x60], 0
mov qword [rsp + 0x48], rax
mov rbx, rcx
mov dword [rsp + 0x40], 1
call fcn.140066390
mov rbx, qword [rbx + 8]
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_WSASetLastError]
xor eax, eax
lea r9, [rsp + 0x68]
mov qword [rsp + 0x30], rax
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov rcx, rbx
mov dword [rsp + 0x68], eax
lea r8d, [rax + 1]
mov dword [rsp + 0x20], eax
call qword [sym.imp.WS2_32.dll_WSASend]
mov ebx, eax
call fcn.140066390
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x40
je 0x140043d95
cmp eax, 0x4d2
jne 0x140043d9a
call fcn.140066390
test ebx, ebx
jne 0x140043da3
call fcn.140066390
add rsp, 0x50
pop rbx
ret

Function at 0x140043dd0
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
cmp qword [rcx + 0x78], 0
je 0x140043e49
mov rcx, qword [rcx + 0x58]
mov rcx, qword [rcx + 0x10]
test edx, edx
jne 0x140043e12
call fcn.140005230
mov rcx, qword [rdi + 0x78]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp fcn.1400049c0
xor esi, esi
mov eax, esi
xchg dword [rcx + 0x34], eax
lea ecx, [rsi + 0x18]
call fcn.140066550
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140043e3d
xor r8d, r8d
mov rdx, qword [rdi + 0x58]
mov rcx, rax
call fcn.14003a020
mov rsi, rax
mov rdx, rsi
lea rcx, [rdi + 0x78]
call fcn.140012510
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140043e60
Capabilities:
Act as tcp client
Connect tcp socket
Get local ipv4 addresses
Get socket information
Set socket configuration
Start tcp server

Disassembly:
sub rsp, 0x28
cmp edx, 2
jne 0x140043e9f
mov qword [rsp + 0x20], rbx
lea rbx, [rcx + 0x58]
mov rcx, rbx
call fcn.140040f40
mov rcx, rbx
mov qword [rbx + 8], 0xffffffffffffffff
mov qword [rbx], 0xffffffffffffffff
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
jmp fcn.1400445b0
add rsp, 0x28
ret
Function at 0x140048cc0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rbx, qword [rcx + 0x10]
mov rdi, rcx
test rbx, rbx
je 0x140048d1d
mov rbx, qword [rbx + 0x58]
test rbx, rbx
je 0x140048d15
mov qword [rsp + 0x30], rsi
mov esi, 0xffffffff
mov eax, esi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x140048d10
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], esi
cmp esi, 1
jne 0x140048d10
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rsi, qword [rsp + 0x30]
mov qword [rdi + 0x10], 0
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x140048d75
mov ecx, dword [0x14009dce4]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140048d65
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x140048d65
cmp qword [rcx], 0
jne 0x140048d65
movzx eax, byte [rbx + 0x80]
mov byte [rbx], al
mov qword [rcx], rbx
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rcx, rbx
call fcn.140066978
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140049520
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
mov rbx, rcx
xor edi, edi
mov dword [rsp + 0x20], edi
call fcn.140066390
mov qword [rsp + 0x28], rax
mov rbx, qword [rbx + 0x10]
mov eax, edi
lock xadd dword [rbx + 0x30], eax
test eax, eax
jne 0x140005b20
mov ecx, 1
mov eax, ecx
xchg dword [rbx + 0x34], eax
test eax, eax
jne 0x140005af5
xchg dword [rbx + 0x38], ecx
test ecx, ecx
jne 0x140005af5
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
test eax, eax
jne 0x140005af5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [rsp + 0x40], eax
call fcn.140066390
mov qword [rsp + 0x48], rax
test ebx, ebx
jne 0x140005bf9
mov dword [rsp + 0x40], edi
call fcn.140066390
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x20], xmm0
jmp 0x140005bd6
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
lea rax, [rbx + 0x28]
test rbx, rbx
cmove rax, rdi
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x58], rax
mov ecx, dword [0x14009dce4]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x60], rax
lea rdx, [rsp + 0x50]
mov ecx, dword [0x14009dce4]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
lea r8, [rsp + 0x20]
mov edx, 0xffffffff
mov rcx, rbx
call fcn.140005330
test rax, rax
je 0x140005ba6
nop dword [rax]
lea rax, [rdi + 1]
cmp rdi, 0xffffffffffffffff
cmove rax, rdi
mov rdi, rax
lea r8, [rsp + 0x20]
mov edx, 0xffffffff
mov rcx, rbx
call fcn.140005330
test rax, rax
jne 0x140005b80
mov rdx, qword [rsp + 0x60]
mov ecx, dword [0x14009dce4]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140005bc7
call fcn.140066978
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140005bd6
call fcn.140066978
cmp dword [rsp + 0x20], 0
jne 0x140005bee
mov rax, rdi
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
lea rcx, [rsp + 0x20]
call fcn.140004380
int3
lea rdx, str.pqcs
lea rcx, [rsp + 0x40]
call fcn.1400043c0
int3
mov rcx, qword [rcx + 0x18]
jmp 0x140005a80
Function at 0x1400672e8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140067332
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140067332
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140067332
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140067332
cmp dword [rcx + 0x84], 0xe
jbe 0x140067332
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140067334
xor al, al
add rsp, 0x28
ret
Function at 0x140069980
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rdi
push r14
push r15
sub rsp, 0x100
mov rax, qword [0x1400992c0]
xor rax, rsp
mov qword [rsp + 0xf0], rax
mov rbx, qword [rsp + 0x150]
mov r14, r9
mov rdi, r8
mov rbp, rdx
mov r15, rcx
test rcx, rcx
je 0x140069bb3
test r8, r8
jne 0x1400699cc
test r9, r9
jne 0x140069bb3
cmp rbx, 0xc8
jae 0x140069bb3
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, VarDecRound
call sub.VCRUNTIME140.dll_memset
cmp r14, rbx
jb 0x140069b3c
mov qword [rsp + 0x138], rsi
lea rsi, [rsp + 0x20]
sub rsi, rdi
xor eax, eax
test rbx, rbx
je 0x140069b18
cmp rbx, 8
jb 0x140069af2
lea rcx, [rbx - 1]
add rcx, rdi
lea r8, [rsp + 0x20]
lea rdx, [rsp + rbx + 0x1f]
cmp r8, rcx
ja 0x140069a38
cmp rdx, rdi
jae 0x140069af2
cmp rbx, 0x40
jb 0x140069ac3
mov rdx, rbx
mov r8, rbx
and edx, 0x3f
sub r8, rdx
lea rcx, [rdi + 0x20]
nop dword [rax]
nop word [rax + rax]
movdqu xmm0, xmmword [rsi + rcx - 0x20]
add rax, 0x40
movdqu xmm1, xmmword [rcx - 0x20]
lea rcx, [rcx + 0x40]
xorps xmm1, xmm0
movdqu xmmword [rsi + rcx - 0x60], xmm1
movdqu xmm0, xmmword [rsi + rcx - 0x50]
movdqu xmm1, xmmword [rcx - 0x50]
xorps xmm1, xmm0
movdqu xmmword [rsi + rcx - 0x50], xmm1
movdqu xmm0, xmmword [rsi + rcx - 0x40]
movdqu xmm1, xmmword [rcx - 0x40]
xorps xmm1, xmm0
movdqu xmmword [rsi + rcx - 0x40], xmm1
movdqu xmm0, xmmword [rcx + rsi - 0x30]
movdqu xmm1, xmmword [rcx - 0x30]
xorps xmm1, xmm0
movdqu xmmword [rcx + rsi - 0x30], xmm1
cmp rax, r8
jb 0x140069a60
cmp rdx, 8
jb 0x140069aed
mov rcx, rbx
and rcx, 0xfffffffffffffff8
nop word [rax + rax]
movq xmm0, qword [rsp + rax + 0x20]
movq xmm1, qword [rax + rdi]
xorps xmm1, xmm0
movq qword [rsp + rax + 0x20], xmm1
add rax, 8
cmp rax, rcx
jb 0x140069ad0
cmp rax, rbx
jae 0x140069b18
lea rcx, [rsp + 0x40]
mov r8, rdi
sub r8, rcx
nop dword [rax]
lea rdx, [rsp + 0x20]
add rdx, rax
inc rax
movzx ecx, byte [rdx + r8 + 0x20]
xor byte [rdx], cl
cmp rax, rbx
jb 0x140069b00
lea rcx, [rsp + 0x20]
call fcn.140069be0
add rdi, rbx
sub rsi, rbx
sub r14, rbx
cmp r14, rbx
jae 0x140069a04
mov rsi, qword [rsp + 0x138]
movzx eax, byte [rsp + 0x158]
lea rcx, [rsp + 0x20]
xor byte [rsp + r14 + 0x20], al
mov r8, r14
xor byte [rsp + rbx + 0x1f], 0x80
mov rdx, rdi
call fcn.14006a1d0
lea rcx, [rsp + 0x20]
call fcn.140069be0
cmp rbp, rbx
jb 0x140069b9a
nop dword [rax]
test rbx, rbx
je 0x140069b85
mov r8, rbx
lea rdx, [rsp + 0x20]
mov rcx, r15
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rsp + 0x20]
call fcn.140069be0
add r15, rbx
sub rbp, rbx
cmp rbp, rbx
jae 0x140069b70
test rbp, rbp
je 0x140069baf
mov r8, rbp
lea rdx, [rsp + 0x20]
mov rcx, r15
call sub.VCRUNTIME140.dll_memcpy
xor eax, eax
jmp 0x140069bb8
mov eax, 0xffffffff
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.140066410
add rsp, 0x100
pop r15
pop r14
pop rdi
pop rbp
pop rbx
ret
Function at 0x14006a1d0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
xor r9d, r9d
mov r10, rcx
test r8, r8
je 0x14006a2e0
cmp r8, 8
jb 0x14006a2c5
lea rcx, [r8 - 1]
lea rax, [rdx - 1]
add rcx, r10
add rax, r8
cmp r10, rax
ja 0x14006a209
cmp rcx, rdx
jae 0x14006a2c5
mov rcx, rdx
cmp r8, 0x40
jb 0x14006a294
mov r11, r8
mov qword [rsp], rbx
and r11d, 0x3f
mov rbx, r8
sub rbx, r11
lea rax, [r10 + 0x10]
sub rcx, r10
nop
movdqu xmm0, xmmword [rax - 0x10]
add r9, 0x40
movdqu xmm1, xmmword [rcx + rax - 0x10]
movdqu xmm2, xmmword [rcx + rax]
lea rax, [rax + 0x40]
xorps xmm1, xmm0
movdqu xmmword [rax - 0x50], xmm1
movdqu xmm0, xmmword [rax - 0x40]
movdqu xmm1, xmmword [rcx + rax - 0x30]
xorps xmm2, xmm0
movdqu xmmword [rax - 0x40], xmm2
movdqu xmm0, xmmword [rax - 0x30]
xorps xmm1, xmm0
movdqu xmmword [rax - 0x30], xmm1
movdqu xmm0, xmmword [rax - 0x20]
movdqu xmm1, xmmword [rcx + rax - 0x20]
xorps xmm1, xmm0
movdqu xmmword [rax - 0x20], xmm1
cmp r9, rbx
jb 0x14006a230
mov rbx, qword [rsp]
cmp r11, 8
jb 0x14006a2c0
jmp 0x14006a297
sub rcx, r10
mov r11, r8
and r11, 0xfffffffffffffff8
lea rax, [r9 + r10]
movq xmm0, qword [rax]
add r9, 8
movq xmm1, qword [rcx + rax]
lea rax, [rax + 8]
xorps xmm1, xmm0
movq qword [rax - 8], xmm1
cmp r9, r11
jb 0x14006a2a2
cmp r9, r8
jae 0x14006a2e0
sub rdx, r10
lea rax, [r9 + r10]
sub r8, r9
nop
movzx ecx, byte [rax + rdx]
xor byte [rax], cl
lea rax, [rax + 1]
sub r8, 1
jne 0x14006a2d0
add rsp, 8
ret
Function at 0x14006ac30
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rdi
push r14
push r15
sub rsp, 0x100
mov rax, qword [0x1400992c0]
xor rax, rsp
mov qword [rsp + 0xf0], rax
mov rbx, qword [rsp + 0x150]
mov r14, r9
mov rdi, r8
mov rbp, rdx
mov r15, rcx
test rcx, rcx
je 0x14006ae63
test r8, r8
jne 0x14006ac7c
test r9, r9
jne 0x14006ae63
cmp rbx, 0xc8
jae 0x14006ae63
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, VarDecRound
call sub.VCRUNTIME140.dll_memset
cmp r14, rbx
jb 0x14006adec
mov qword [rsp + 0x138], rsi
lea rsi, [rsp + 0x20]
sub rsi, rdi
xor eax, eax
test rbx, rbx
je 0x14006adc8
cmp rbx, 8
jb 0x14006ada2
lea rcx, [rbx - 1]
add rcx, rdi
lea r8, [rsp + 0x20]
lea rdx, [rsp + rbx + 0x1f]
cmp r8, rcx
ja 0x14006ace8
cmp rdx, rdi
jae 0x14006ada2
cmp rbx, 0x40
jb 0x14006ad73
mov rdx, rbx
mov r8, rbx
and edx, 0x3f
sub r8, rdx
lea rcx, [rdi + 0x20]
nop dword [rax]
nop word [rax + rax]
movdqu xmm0, xmmword [rsi + rcx - 0x20]
add rax, 0x40
movdqu xmm1, xmmword [rcx - 0x20]
lea rcx, [rcx + 0x40]
xorps xmm1, xmm0
movdqu xmmword [rsi + rcx - 0x60], xmm1
movdqu xmm0, xmmword [rsi + rcx - 0x50]
movdqu xmm1, xmmword [rcx - 0x50]
xorps xmm1, xmm0
movdqu xmmword [rsi + rcx - 0x50], xmm1
movdqu xmm0, xmmword [rsi + rcx - 0x40]
movdqu xmm1, xmmword [rcx - 0x40]
xorps xmm1, xmm0
movdqu xmmword [rsi + rcx - 0x40], xmm1
movdqu xmm0, xmmword [rcx + rsi - 0x30]
movdqu xmm1, xmmword [rcx - 0x30]
xorps xmm1, xmm0
movdqu xmmword [rcx + rsi - 0x30], xmm1
cmp rax, r8
jb 0x14006ad10
cmp rdx, 8
jb 0x14006ad9d
mov rcx, rbx
and rcx, 0xfffffffffffffff8
nop word [rax + rax]
movq xmm0, qword [rsp + rax + 0x20]
movq xmm1, qword [rax + rdi]
xorps xmm1, xmm0
movq qword [rsp + rax + 0x20], xmm1
add rax, 8
cmp rax, rcx
jb 0x14006ad80
cmp rax, rbx
jae 0x14006adc8
lea rcx, [rsp + 0x40]
mov r8, rdi
sub r8, rcx
nop dword [rax]
lea rdx, [rsp + 0x20]
add rdx, rax
inc rax
movzx ecx, byte [rdx + r8 + 0x20]
xor byte [rdx], cl
cmp rax, rbx
jb 0x14006adb0
lea rcx, [rsp + 0x20]
call fcn.14006ae90
add rdi, rbx
sub rsi, rbx
sub r14, rbx
cmp r14, rbx
jae 0x14006acb4
mov rsi, qword [rsp + 0x138]
movzx eax, byte [rsp + 0x158]
lea rcx, [rsp + 0x20]
xor byte [rsp + r14 + 0x20], al
mov r8, r14
xor byte [rsp + rbx + 0x1f], 0x80
mov rdx, rdi
call fcn.14006a1d0
lea rcx, [rsp + 0x20]
call fcn.14006ae90
cmp rbp, rbx
jb 0x14006ae4a
nop dword [rax]
test rbx, rbx
je 0x14006ae35
mov r8, rbx
lea rdx, [rsp + 0x20]
mov rcx, r15
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rsp + 0x20]
call fcn.14006ae90
add r15, rbx
sub rbp, rbx
cmp rbp, rbx
jae 0x14006ae20
test rbp, rbp
je 0x14006ae5f
mov r8, rbp
lea rdx, [rsp + 0x20]
mov rcx, r15
call sub.VCRUNTIME140.dll_memcpy
xor eax, eax
jmp 0x14006ae68
mov eax, 0xffffffff
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.140066410
add rsp, 0x100
pop r15
pop r14
pop rdi
pop rbp
pop rbx
ret
Function at 0x1400014b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 0x72]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r11d, r11d
lea rsi, [0x140010040]
mov r10, rax
sub rbx, rax
movabs rdi, 0x3091b51f5e1a4ef
lea r9, [rax + 1]
nop dword [rax + rax]
movsxd r8, r11d
lea r9, [r9 + 2]
mov rax, rdi
mov rcx, r8
mul r8
mov rax, r8
add r11d, 2
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1fa
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [rbx + r9 - 3]
mov byte [r9 - 3], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1fa
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 - 2]
mov byte [r9 - 2], al
cmp r11d, 0x7a
jb 0x140001500
mov rbx, qword [rsp + 0x30]
mov rax, r10
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret