joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140004260
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x47], 0
je 0x140004283
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x14]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x46
jb 0x140004270
mov byte [rcx + 0x47], 0
mov rax, rcx
ret

Function at 0x140004290
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x68], rcx
xor esi, esi
cmp byte [r8 + 6], sil
je 0x1400042c4
mov ecx, esi
lea eax, [rcx - 0x14]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 5
jb 0x1400042b0
mov byte [r8 + 6], sil
lea rax, [r8 + 5]
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x48], sil
cmp r9, rax
je 0x1400042f9
mov r8d, 5
mov rdx, r9
lea rcx, [rsp + 0x48]
call fcn.140009e90
nop
cmp byte [rbx + 0xa], 0
je 0x140004323
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x14]
xor byte [rcx + rbx], al
inc rcx
cmp rcx, 9
jb 0x140004310
mov byte [rbx + 0xa], 0
lea rax, [rbx + 9]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], 0
cmp rbx, rax
je 0x140004358
mov r8d, 9
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.140009e90
nop
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x28]
mov rcx, rdi
call fcn.14000bbe0
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x1400043ac
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400043a6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400043a6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140072f64
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x1400043ec
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400043e7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400043e7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140072f64
mov rax, rdi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x140004400
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x48], rcx
xor esi, esi
cmp byte [r8 + 7], sil
je 0x140004434
mov ecx, esi
lea eax, [rcx - 0x14]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 6
jb 0x140004420
mov byte [r8 + 7], sil
lea rax, [r8 + 6]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], sil
cmp r9, rax
je 0x140004469
mov r8d, 6
mov rdx, r9
lea rcx, [rsp + 0x28]
call fcn.140009e90
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140004477
mov rbx, qword [rbx]
mov r8, rbx
lea rcx, [rsp + 0x28]
call fcn.14000cbb0
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x1400044ec
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400044e7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400044e7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140072f64
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x140004500
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x48], rcx
xor esi, esi
cmp byte [r8 + 0xa], sil
je 0x140004534
mov ecx, esi
lea eax, [rcx - 0x14]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 9
jb 0x140004520
mov byte [r8 + 0xa], sil
lea rax, [r8 + 9]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], sil
cmp r9, rax
je 0x140004569
mov r8d, 9
mov rdx, r9
lea rcx, [rsp + 0x28]
call fcn.140009e90
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140004577
mov rbx, qword [rbx]
mov r8, rbx
lea rcx, [rsp + 0x28]
call fcn.14000cbb0
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x1400045ec
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400045e7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400045e7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140072f64
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x140004600
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x136], 0
je 0x140004628
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x14]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x135
jb 0x140004610
mov byte [rcx + 0x136], 0
mov rax, rcx
ret
Function at 0x140005190
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x68], rcx
xor esi, esi
cmp byte [r8 + 0xb], sil
je 0x1400051c4
mov ecx, esi
lea eax, [rcx - 0x14]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 0xa
jb 0x1400051b0
mov byte [r8 + 0xb], sil
lea rax, [r8 + 0xa]
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x48], sil
cmp r9, rax
je 0x1400051f9
mov r8d, 0xa
mov rdx, r9
lea rcx, [rsp + 0x48]
call fcn.140009e90
nop
cmp byte [rbx + 0xb], 0
je 0x140005223
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x14]
xor byte [rcx + rbx], al
inc rcx
cmp rcx, 0xa
jb 0x140005210
mov byte [rbx + 0xb], 0
lea rax, [rbx + 0xa]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], 0
cmp rbx, rax
je 0x140005258
mov r8d, 0xa
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.140009e90
nop
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x28]
mov rcx, rdi
call fcn.14000bbe0
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x1400052ac
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400052a6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400052a6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140072f64
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x1400052ec
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400052e7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400052e7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140072f64
mov rax, rdi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x140005300
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x48], rcx
xor esi, esi
cmp byte [r8 + 0xc], sil
je 0x140005334
mov ecx, esi
lea eax, [rcx - 0x14]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 0xb
jb 0x140005320
mov byte [r8 + 0xc], sil
lea rax, [r8 + 0xb]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], sil
cmp r9, rax
je 0x140005369
mov r8d, recv
mov rdx, r9
lea rcx, [rsp + 0x28]
call fcn.140009e90
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140005377
mov rbx, qword [rbx]
mov r8, rbx
lea rcx, [rsp + 0x28]
call fcn.14000cbb0
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x1400053ec
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400053e7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400053e7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140072f64
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x140006040
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x68], rcx
xor esi, esi
cmp byte [r8 + 0xb], sil
je 0x140006074
mov ecx, esi
lea eax, [rcx - 0x14]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 0xa
jb 0x140006060
mov byte [r8 + 0xb], sil
lea rax, [r8 + 0xa]
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x48], sil
cmp r9, rax
je 0x1400060a9
mov r8d, 0xa
mov rdx, r9
lea rcx, [rsp + 0x48]
call fcn.140009e90
nop
cmp byte [rbx + 0xe], 0
je 0x1400060d3
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x14]
xor byte [rcx + rbx], al
inc rcx
cmp rcx, 0xd
jb 0x1400060c0
mov byte [rbx + 0xe], 0
lea rax, [rbx + 0xd]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], 0
cmp rbx, rax
je 0x140006108
mov r8d, reloc.WS2_32.dll_listen
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.140009e90
nop
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x28]
mov rcx, rdi
call fcn.14000bbe0
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x14000615c
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006156
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006156
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140072f64
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x14000619c
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006197
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006197
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140072f64
mov rax, rdi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400061b0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x48], rcx
xor esi, esi
cmp byte [r8 + 6], sil
je 0x1400061e4
mov ecx, esi
lea eax, [rcx - 0x14]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 5
jb 0x1400061d0
mov byte [r8 + 6], sil
lea rax, [r8 + 5]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], sil
cmp r9, rax
je 0x140006219
mov r8d, 5
mov rdx, r9
lea rcx, [rsp + 0x28]
call fcn.140009e90
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140006227
mov rbx, qword [rbx]
mov r8, rbx
lea rcx, [rsp + 0x28]
call fcn.14000cbb0
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x14000629c
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006297
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006297
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140072f64
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x140006b80
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x68], rcx
xor esi, esi
cmp byte [r8 + 0xb], sil
je 0x140006bb4
mov ecx, esi
lea eax, [rcx - 0x14]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 0xa
jb 0x140006ba0
mov byte [r8 + 0xb], sil
lea rax, [r8 + 0xa]
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x48], sil
cmp r9, rax
je 0x140006be9
mov r8d, 0xa
mov rdx, r9
lea rcx, [rsp + 0x48]
call fcn.140009e90
nop
cmp byte [rbx + 0xd], 0
je 0x140006c13
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x14]
xor byte [rcx + rbx], al
inc rcx
cmp rcx, 0xc
jb 0x140006c00
mov byte [rbx + 0xd], 0
lea rax, [rbx + 0xc]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], 0
cmp rbx, rax
je 0x140006c48
mov r8d, recv
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.140009e90
nop
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x28]
mov rcx, rdi
call fcn.14000bbe0
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x140006c9c
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006c96
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006c96
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140072f64
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x140006cdc
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006cd7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006cd7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140072f64
mov rax, rdi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x140007240
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x68], rcx
xor esi, esi
cmp byte [r8 + 0xc], sil
je 0x140007274
mov ecx, esi
lea eax, [rcx - 0x14]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 0xb
jb 0x140007260
mov byte [r8 + 0xc], sil
lea rax, [r8 + 0xb]
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x48], sil
cmp r9, rax
je 0x1400072a9
mov r8d, recv
mov rdx, r9
lea rcx, [rsp + 0x48]
call fcn.140009e90
nop
cmp byte [rbx + 9], 0
je 0x1400072d3
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x14]
xor byte [rcx + rbx], al
inc rcx
cmp rcx, 8
jb 0x1400072c0
mov byte [rbx + 9], 0
lea rax, [rbx + 8]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], 0
cmp rbx, rax
je 0x140007308
mov r8d, 8
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.140009e90
nop
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x28]
mov rcx, rdi
call fcn.14000bbe0
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x14000735c
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007356
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007356
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140072f64
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x14000739c
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007397
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007397
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140072f64
mov rax, rdi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400078b0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x68], rcx
xor esi, esi
cmp byte [r8 + 0xc], sil
je 0x1400078e4
mov ecx, esi
lea eax, [rcx - 0x14]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 0xb
jb 0x1400078d0
mov byte [r8 + 0xc], sil
lea rax, [r8 + 0xb]
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x48], sil
cmp r9, rax
je 0x140007919
mov r8d, recv
mov rdx, r9
lea rcx, [rsp + 0x48]
call fcn.140009e90
nop
cmp byte [rbx + 0xb], 0
je 0x140007943
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x14]
xor byte [rcx + rbx], al
inc rcx
cmp rcx, 0xa
jb 0x140007930
mov byte [rbx + 0xb], 0
lea rax, [rbx + 0xa]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], 0
cmp rbx, rax
je 0x140007978
mov r8d, 0xa
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.140009e90
nop
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x28]
mov rcx, rdi
call fcn.14000bbe0
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x1400079cc
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400079c6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400079c6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140072f64
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x140007a0c
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007a07
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007a07
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140072f64
mov rax, rdi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x140008200
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x68], rcx
xor esi, esi
cmp byte [r8 + 9], sil
je 0x140008234
mov ecx, esi
lea eax, [rcx - 0x14]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 8
jb 0x140008220
mov byte [r8 + 9], sil
lea rax, [r8 + 8]
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x48], sil
cmp r9, rax
je 0x140008269
mov r8d, 8
mov rdx, r9
lea rcx, [rsp + 0x48]
call fcn.140009e90
nop
cmp byte [rbx + 9], 0
je 0x140008293
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x14]
xor byte [rcx + rbx], al
inc rcx
cmp rcx, 8
jb 0x140008280
mov byte [rbx + 9], 0
lea rax, [rbx + 8]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], 0
cmp rbx, rax
je 0x1400082c8
mov r8d, 8
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.140009e90
nop
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x28]
mov rcx, rdi
call fcn.14000bbe0
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x14000831c
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008316
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008316
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140072f64
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x14000835c
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008357
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008357
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140072f64
mov rax, rdi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x140018f10
Capabilities:
Set console window title

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
mov ebx, 5
lea rsi, str.0123456789qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM_________._______
lea rdi, [0x140093fb0]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov rcx, qword [0x140093fc0]
cdq
idiv dword [0x140093ed0]
movsxd rax, edx
mov rdx, qword [reloc.WS2_32.dll_ntohs]
movzx r9d, byte [rax + rsi]
cmp rcx, rdx
jae 0x140018f90
lea rax, [rcx + 1]
cmp rdx, 0x10
mov qword [0x140093fc0], rax
mov rax, rdi
cmovae rax, qword [0x140093fb0]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x140018f9f
xor r8d, r8d
mov rcx, rdi
lea edx, [r8 + 1]
call fcn.140017b00
sub rbx, 1
jne 0x140018f43
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
cmovae rdi, qword [0x140093fb0]
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
Function at 0x14001d960
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x50
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x14001da29
cmp byte [rcx + 0x71], 0
je 0x14001da29
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x68], rdi
call qword [rax + Ordinal_26]
cmp eax, 0xffffffff
je 0x14001da1c
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x60]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14001d9d8
sub eax, 1
je 0x14001d9dc
cmp eax, 2
jne 0x14001da1c
mov rdi, qword [rsp + 0x68]
mov al, 1
mov byte [rbx + 0x71], 0
add rsp, 0x50
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x60]
lea rax, [rsp + 0x30]
sub rdi, rax
je 0x14001da0a
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x30]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14001da1c
cmp byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x68]
sete al
add rsp, 0x50
pop rbx
ret
mov rdi, qword [rsp + 0x68]
xor al, al
add rsp, 0x50
pop rbx
ret
mov al, 1
add rsp, 0x50
pop rbx
ret
Function at 0x14001dac0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
cmp qword [rcx + 0x80], 0
mov rbx, rcx
je 0x14001dbc6
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::eback_void_const___ptr64]
lea rdx, [rbx + 0x70]
cmp rax, rdx
jne 0x14001db0e
mov rdx, qword [rbx + 0x88]
mov rcx, rbx
mov r9, qword [rbx + 0x90]
mov r8, rdx
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::setg_char____ptr64__char____ptr64__char____ptr64____ptr64]
cmp qword [rbx + 0x68], 0
lea rdi, [rbx + 0x71]
je 0x14001db68
cmp byte [rdi], 0
je 0x14001db68
mov rax, qword [rbx]
mov edx, 0xffffffff
mov rcx, rbx
call qword [rax + Ordinal_26]
cmp eax, 0xffffffff
jne 0x14001db35
xor al, al
jmp 0x14001db6a
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x60]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14001db89
sub eax, 1
je 0x14001db8c
cmp eax, 2
jne 0x14001db31
mov byte [rdi], 0
mov al, 1
mov rcx, qword [rbx + 0x80]
xor esi, esi
test al, al
mov ebp, esi
cmovne rbp, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test eax, eax
cmovne rbp, rsi
jmp 0x14001dbce
mov byte [rdi], 0
mov rsi, qword [rsp + 0x60]
lea rax, [rsp + 0x30]
sub rsi, rax
je 0x14001dbbe
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x30]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x14001db31
cmp byte [rdi], 0
sete al
jmp 0x14001db6a
xor esi, esi
lea rdi, [rcx + 0x71]
mov ebp, esi
mov rcx, rbx
mov byte [rbx + 0x7c], 0
mov byte [rdi], 0
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Init_void____ptr64]
mov qword [rbx + 0x80], rsi
mov rax, rbp
mov rcx, qword [0x140094e10]
mov rbp, qword [rsp + 0x70]
mov qword [rbx + 0x68], rsi
mov rsi, qword [rsp + 0x78]
mov qword [rbx + 0x74], rcx
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret