joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400a6590
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r12
mov qword [rsp + 8], r12
xchg r12, rbx
xchg rbp, rdi
mov qword [rsp + 0x10], rdi
xchg rdi, rbp
xchg rsi, r12
mov qword [rsp + 0x20], r12
xchg rsi, r12
nop
mov qword [rsp - 8], rdi
sub rsp, 8
push r12
nop
sub rsp, 8
mov qword [rsp], r13
nop
mov qword [rsp - 8], r14
sub rsp, 8
nop
sub rsp, 8
mov qword [rsp], r15
add rsp, 0xffffffffffffffe0
mov dword [rsp - 0x14], 0x12c23632
mov r14d, r8d
mov rdi, rdx
mov r9d, r14d
mov dword [rsp - 0x40], 0x4767f3ea
mov r13, rcx
cmp r8d, 0x40000
jb 0x1400a6630
mov dword [rsp - 0x44], 0x327ec2d5
mov r9d, 0x3a6680e4
add r9d, 0x2db8f0d7
xor r9d, 0x41caa215
add r9d, 0x29a7da8f
sub r9d, 0x5379ae3d
nop
movabs rcx, 0xffffffff74a9edaa
sub rcx, 0x31f876b0
xor rcx, 0x2f879eb0
sub rcx, 0xfd1f2d3
add rcx, 0x7fffffff
add rcx, 0x229b0a89
mov eax, 0x5f667350
xor eax, 0x80bcae9
sub eax, 0x1c86533e
add eax, 0x33bb6275
sub eax, 0x6ea2c8ec
mul r9
mov rbp, rbp
cmovo rax, rcx
xchg r13, rcx
mov r13, rax
xchg r13, rcx
call fcn.1400bbad0
mov esi, dword [r13 + 0x18]
mov dword [rsp - 0x1c], 0x410d3cc3
lea r15d, [r14 + 0xfffff]
shr r15d, 0xa
shr r15d, 2
shr r15d, 6
shr r15d, 1
shr r15d, 1
xor ebx, ebx
mov dword [rsp - 0xc], 0x3fd8e92c
xchg rbp, rax
mov rax, rbp
xchg rbp, rax
mov r12b, 0x28
sub r12b, 7
xor r12b, 0x1a
xor r12b, 0x52
sub r12b, 0x68
test r15d, r15d
je 0x1400a67f2
mov rbp, rbp
nop
mov r8d, ebx
mov r10d, r14d
xchg r10, r10
shl r8d, 0x13
shl r8d, 1
xor eax, eax
mov dword [rsp - 0x18], esi
sub r10d, r8d
shr r8d, 1
shr r8d, 1
cmp r10d, 0x100000
xchg rsi, rsi
jbe 0x1400a6757
mov r10d, 0x5b3e43c
add r10d, 0x52775adc
sub r10d, 0x198cebae
sub r10d, 0x21339f65
sub r10d, 0x1d5ab405
mov r11d, 0x786b8c3c
sub r11d, 0x6b695f5f
add r11d, 0x859f2e5
sub r11d, 0x15581fc2
jmp 0x1400a6773
mov r11d, r10d
mov dword [rsp - 0x28], ebp
shr r11d, 2
test r11d, r11d
je 0x1400a67ae
mov dword [rsp - 0x34], 0x8b0eec9
mov r9, rbp
nop dword [rax]
lea edx, [r8 + rax]
mov dword [rsp - 0x44], 0x2dc08203
mov ecx, esi
xor ecx, dword [rdi + rdx*4]
lea r9, [r9 + 4]
mov dword [rsp - 0x10], ecx
xor ecx, 0x5d8d086a
inc eax
mov dword [r9 - 4], ecx
xchg rsi, rsi
cmp eax, r11d
jb 0x1400a677d
mov r8d, r10d
xchg rsi, rsi
xchg rdx, r15
mov r15, rbp
xchg rdx, r15
xchg r11, r13
mov rcx, r11
xchg r13, r11
call fcn.1400a3600
mov dword [rsp - 0x2c], ebx
test al, al
je 0x1400a67ef
inc ebx
cmp ebx, r15d
mov dword [rsp - 0x2c], 0x6953a9c2
jb 0x1400a66e6
jmp 0x1400a67f2
xor r12b, r12b
xchg rbp, rcx
mov rbp, rcx
xchg rbp, rcx
call fcn.1400bbae0
mov rdx, rdx
xchg rbx, r10
mov r10, qword [rsp + 0x50]
xchg r10, rbx
movzx eax, r12b
mov dword [rsp - 0x10], ebp
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
add rsp, 0x20
nop
mov r15, qword [rsp]
add rsp, 8
nop
mov r14, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov r13, qword [rsp - 8]
nop
add rsp, 8
mov r12, qword [rsp - 8]
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x1400a6860
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
xchg rbp, r8
mov qword [rsp + 0x18], r8
xchg r8, rbp
push rsi
mov dword [rsp - 0x24], 0x669c16fd
nop
sub rsp, 8
mov qword [rsp], rdi
nop
mov qword [rsp - 8], r12
sub rsp, 8
nop
sub rsp, 8
mov qword [rsp], r14
push r15
mov eax, 0x940da0d
add eax, 0x1f837108
sub eax, 0x25729349
add eax, 0x5702b499
sub eax, 0x5a545c45
call fcn.1400bc400
sub rsp, rax
xchg r14, r14
mov r15, rcx
call fcn.1400bd7c0
mov ebp, eax
and ebp, 0x3fc
xchg rcx, rcx
jbe 0x1400a6913
lea rdi, [rsp + 0x20]
mov esi, ebp
mov rbp, rbp
call fcn.1400bd7c0
movzx ebx, ax
shl ebx, 5
shl ebx, 3
shl ebx, 8
call fcn.1400bd7c0
xchg rsi, rsi
movzx ecx, ax
lea rdi, [rdi + 4]
or ecx, ebx
mov rcx, rcx
mov dword [rdi - 4], ecx
sub rsi, 1
jne 0x1400a68de
mov rbp, rbp
lea r14d, [rbp*4]
mov eax, 0x3ad83af7
xor eax, 0x7d6aa375
xor eax, 0x6bc925e8
xor eax, 0x6d33a8f1
xor eax, 0x4148149f
mov ecx, r14d
mul rcx
mov rsp, rsp
pushf
movabs rcx, 0xffffffff2ad8a615
xor rcx, 0x1d5332da
add rcx, 0x23cfc03f
sub rcx, 0x5263059f
add rcx, 0x7fffffff
xor rcx, 0x7707b091
popf
cmovo rax, rcx
mov dword [rsp - 0x18], 0x6ba1dcf2
xchg rcx, rax
mov rax, rcx
xchg rcx, rax
call fcn.1400bbad0
mov rdi, rdi
mov edi, dword [r15 + 0x18]
lea ebp, [r14 + 0xfffff]
shr ebp, 0xa
shr ebp, 1
shr ebp, 1
shr ebp, 1
shr ebp, 2
shr ebp, 2
shr ebp, 1
shr ebp, 1
shr ebp, 1
xor ebx, ebx
xchg rdx, rax
mov rsi, rdx
xchg rdx, rax
mov r12b, 0x65
xor r12b, 0xa
sub r12b, 0x48
xor r12b, 0x7d
sub r12b, 0x59
test ebp, ebp
je 0x1400a6ada
mov dword [rsp - 0x28], ebp
nop
mov r8d, ebx
mov r10d, r14d
xchg rsi, rsi
shl r8d, 0xa
shl r8d, 4
shl r8d, 5
shl r8d, 1
xor eax, eax
sub r10d, r8d
mov dword [rsp - 0x44], esp
shr r8d, 2
cmp r10d, 0x100000
jbe 0x1400a6a47
mov r10d, 0x6b565e20
xor r10d, 0x3e8ff379
xor r10d, 0x722d452c
sub r10d, 0x27e4e875
mov r11d, 0x41e95f9c
xor r11d, 0x2af7e7e
sub r11d, 0x10de64db
add r11d, 0x33af0fc3
sub r11d, 0x6612ccca
jmp 0x1400a6a5a
mov r11d, r10d
shr r11d, 2
test r11d, r11d
mov rdx, rdx
je 0x1400a6a96
mov r9, rsi
nop dword [rax]
lea edx, [r8 + rax]
mov dword [rsp - 0x38], 0x6f7b148b
mov ecx, edi
xor ecx, dword [rsp + rdx*4 + 0x20]
lea r9, [r9 + 4]
xor ecx, 0x5d8d086a
mov dword [rsp - 0x3c], esp
inc eax
mov dword [r9 - 4], ecx
cmp eax, r11d
xchg r11, r11
jb 0x1400a6a64
mov r8d, r10d
xchg rsi, rdx
mov rsi, rdx
xchg rdx, rsi
xchg rsp, r15
mov rcx, rsp
xchg rsp, r15
call fcn.1400a3600
test al, al
mov dword [rsp - 0x40], 0x7652e0b3
je 0x1400a6ad7
inc ebx
cmp ebx, ebp
jb 0x1400a69d3
mov dword [rsp - 0x1c], 0xa5326ad
jmp 0x1400a6ada
xor r12b, r12b
xchg rsi, r9
mov rcx, r9
xchg r9, rsi
call fcn.1400bbae0
xchg rbp, rbp
lea r11, [rsp + 0x1020]
movzx eax, r12b
xchg rbp, rbx
mov rbp, qword [r11 + 0x38]
xchg rbp, rbx
xchg rbp, rdi
mov rdi, qword [r11 + 0x40]
xchg rbp, rdi
xchg rcx, rsp
mov rcx, r11
xchg rcx, rsp
pop r15
pop r14
mov dword [rsp - 0x18], 0x5ee65762
nop
add rsp, 8
mov r12, qword [rsp - 8]
nop
add rsp, 8
mov rdi, qword [rsp - 8]
pop rsi
xchg rdi, rdi
ret
Function at 0x1400ac250
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400ae525
mov r10, rcx
mov eax, dword [0x1404e0064]
mov dword [rsp - 0x14], esi
cmp qword [0x1404e0078], 0
jne 0x1400ad9e0
syscall
ret
Function at 0x1400af480
Capabilities:
Encode data using xor

Disassembly:
xchg r13, rbx
mov qword [rsp + 8], r13
xchg rbx, r13
mov ebx, edx
mov r8d, ecx
mov dword [rsp - 0x18], ebp
test ecx, ecx
jne 0x1400af4aa
xor eax, eax
xchg r14, rbx
mov r14, qword [rsp + 8]
xchg r14, rbx
ret
xor r10d, r10d
mov r11d, r8d
mov rsp, rsp
mov edx, r10d
mov r9d, r8d
nop dword [rax]
mov dword [rsp - 0x10], 0x6adea641
nop word [rax + rax]
lea eax, [r9 + r9]
mov ecx, edx
xor ecx, r9d
xchg r10, r10
mov r9d, eax
test r11b, 1
cmove ecx, edx
mov dword [rsp - 0x34], 0x7566037d
xor r9d, ebx
cmp eax, 0x100
mov edx, ecx
mov r9, r9
cmovb r9d, eax
shr r11d, 1
jne 0x1400af4cf
mov dword [rsp - 0x40], 0x53cc4c2b
mov r11d, r8d
mov r9d, r10d
test ecx, ecx
je 0x1400af555
xchg rdi, rdi
lea eax, [r11 + r11]
mov ecx, r9d
xor ecx, r11d
mov r11d, eax
mov dword [rsp - 0x2c], ebp
test dl, 1
cmove ecx, r9d
xor r11d, ebx
xchg r10, r10
cmp eax, 0x100
mov r9d, ecx
cmovb r11d, eax
shr edx, 1
mov r8, r8
jne 0x1400af520
mov r11d, r9d
mov edx, r10d
mov rcx, rcx
test r9d, r9d
je 0x1400af5b3
nop dword [rax]
mov dword [rsp - 0x18], 0x70c18f26
nop word [rax + rax]
lea eax, [r11 + r11]
mov ecx, edx
xor ecx, r11d
mov dword [rsp - 0x28], ecx
mov r11d, eax
test r9b, 1
cmove ecx, edx
mov dword [rsp - 0x20], esi
xor r11d, ebx
cmp eax, 0x100
mov edx, ecx
cmovb r11d, eax
mov dword [rsp - 0x44], esp
shr r9d, 1
jne 0x1400af57d
test edx, edx
je 0x1400af603
mov dword [rsp - 0x10], 0x2e76b289
nop word [rax + rax]
mov ecx, r10d
xor ecx, r8d
mov r9, r9
test dl, 1
cmove ecx, r10d
mov r10d, ecx
mov dword [rsp - 0x3c], 0x79c850ee
lea ecx, [r8 + r8]
mov r8d, ecx
xor r8d, ebx
cmp ecx, 0x100
xchg r11, r11
cmovb r8d, ecx
shr edx, 1
jne 0x1400af5c9
xchg r12, rbx
mov r12, qword [rsp + 8]
xchg r12, rbx
mov eax, r10d
ret
Function at 0x140049bf0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x140049bfd
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x140049c0d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x140049bf5
lea eax, [rcx + 1]
jmp 0x140049c1b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x140049c2e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x140049c14
sub eax, 3
jb 0x140049c4e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x140049c9d
sar eax, 1
movsxd rbp, eax
jb 0x140049c84
jmp 0x140049c5c
add ebx, ebx
jne 0x140049c5a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140049c84
inc ecx
add ebx, ebx
jne 0x140049c6a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140049c84
call r11
adc ecx, ecx
add ebx, ebx
jne 0x140049c7d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x140049c6c
add ecx, 2
jmp 0x140049c89
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.140049bb2
jmp 0x140049bfd
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x1f000
mov dl, 9
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x140049ce9
cmp rsi, rcx
jae 0x140049cf1
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x140049cd0
cmp al, 0x8f
ja 0x140049cd0
cmp byte [rsi - 2], 0xf
je 0x140049cd6
sub al, 0xe8
cmp al, 1
ja 0x140049cba
cmp rsi, rcx
jae 0x140049cf1
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x140049cc0
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x140049cf1
lodsb al, byte [rsi]
jmp 0x140049cd0
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x47000]
mov eax, dword [rdi]
or eax, eax
je 0x140049d5a
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x62b54]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x140049cfe
jns 0x140049d33
movzx rdx, word [rdi]
add rdi, 2
jmp 0x140049d3d
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x140049d54
mov qword [rbx], rax
add rbx, 8
jmp 0x140049d1e
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x18f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x140049db2
sub rsp, 0xffffffffffffff80
jmp 0x14001f8d0
Function at 0x140902058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1409021df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140902089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14090206f
add dl, dl
jne 0x140902096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1409020f6
xor eax, eax
add dl, dl
jne 0x1409020a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1409021ad
add dl, dl
jne 0x1409020b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1409020c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1409020d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1409020dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1409020ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14090207e
mov eax, 1
add dl, dl
jne 0x140902106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140902113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1409020fb
sub eax, ebx
mov ebx, 1
jne 0x14090214c
mov ecx, 1
add dl, dl
jne 0x14090212e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14090213b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140902123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14090207e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140902168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140902175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14090215d
cmp eax, 0x7d00
jae 0x14090219b
cmp eax, 0x500
jb 0x140902196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14090207e
cmp eax, 0x7f
ja 0x14090219e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14090207e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1409021d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14090207e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140011040
Capabilities:
Encode data using xor
Execute command

Disassembly:
sub rsp, 0x28
cmp byte [0x1400875fb], 0
mov eax, dword [str._UI_]
mov dword [rsp + 0x30], eax
je 0x14001113d
xor ecx, ecx
cmp dword [reloc.WS2_32.dll_accept], 2
jl 0x140011108
movdqa xmm3, xmmword [0x1400883c0]
mov ecx, 4
movdqa xmm2, xmm3
movdqa xmm0, xmm3
punpckldq xmm2, xmm3
pmuldq xmm2, xmmword [0x140088410]
punpckhdq xmm0, xmm3
pmuldq xmm0, xmmword [0x140088410]
shufps xmm2, xmm0, 0xdd
movd xmm0, ecx
mov ecx, Ordinal_33
psrad xmm2, xmm0
movdqa xmm1, xmm2
movd xmm0, ecx
lea rcx, [rsp + 0x30]
psrld xmm1, xmm0
paddd xmm1, xmm2
pmulld xmm1, xmmword [0x1400883e0]
psubd xmm3, xmm1
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x1400883f0]
packuswb xmm2, xmm2
paddb xmm2, xmmword [str.8888888888888888O]
movd xmm0, eax
pxor xmm2, xmm0
movd dword [rsp + 0x30], xmm2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add rsp, 0x28
ret
lea r8, [rsp + 0x30]
nop dword [rax]
mov eax, 0x4ec4ec4f
lea r8, [r8 + 1]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x34
movzx eax, cl
inc ecx
sub al, dl
add al, 0x38
xor byte [r8 - 1], al
cmp ecx, 4
jl 0x140011110
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add rsp, 0x28
ret
Function at 0x140014290
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x50
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor edi, edi
cmp byte [r8 + 7], dil
je 0x1400142c4
mov ecx, edi
nop dword [rax]
lea eax, [rcx + 0x4a]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 6
jb 0x1400142b0
mov byte [r8 + 7], dil
lea rax, [r8 + 6]
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x1400142f1
mov qword [rsp + 0x30], rdi
mov byte [rsp + 0x20], dil
jmp 0x140014310
mov qword [rsp + 0x30], 6
mov eax, dword [r8]
mov dword [rsp + 0x20], eax
movzx eax, word [r8 + 4]
mov word [rsp + 0x24], ax
mov byte [rsp + 0x26], dil
mov r9, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x14001431e
mov rdx, qword [rdx]
mov r8, rdx
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.140020340
mov qword [rbx], rdi
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x140014395
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140014390
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140014390
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140074f1c
mov rax, rbx
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x1400143b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x50
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor edi, edi
cmp byte [r8 + 9], dil
je 0x1400143e4
mov ecx, edi
nop dword [rax]
lea eax, [rcx + 0x4a]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 8
jb 0x1400143d0
mov byte [r8 + 9], dil
lea rax, [r8 + 8]
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x140014411
mov qword [rsp + 0x30], rdi
mov byte [rsp + 0x20], dil
jmp 0x140014427
mov qword [rsp + 0x30], 8
mov rax, qword [r8]
mov qword [rsp + 0x20], rax
mov byte [rsp + 0x28], dil
mov r9, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x140014435
mov rdx, qword [rdx]
mov r8, rdx
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.140020340
mov qword [rbx], rdi
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x1400144ac
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400144a7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400144a7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140074f1c
mov rax, rbx
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x1400144c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rbx, rcx
mov qword [rbp - 0x10], rcx
xor r9d, r9d
cmp byte [r8 + 6], r9b
je 0x140014504
mov ecx, r9d
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x4a]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 5
jb 0x1400144f0
mov byte [r8 + 6], r9b
lea rax, [r8 + 5]
mov qword [rbp - 0x38], r9
mov qword [rbp - 0x28], r9
mov qword [rbp - 0x20], r9
mov qword [rbp - 0x20], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x14001452b
mov qword [rbp - 0x28], r9
mov byte [rbp - 0x38], r9b
jmp 0x140014545
mov qword [rbp - 0x28], 5
mov eax, dword [r8]
mov dword [rbp - 0x38], eax
movzx eax, byte [r8 + 4]
mov byte [rbp - 0x34], al
mov byte [rbp - 0x33], r9b
cmp byte [rdx + 0xa], 0
je 0x140014563
mov rcx, r9
nop
lea eax, [rcx + 0x4a]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 9
jb 0x140014550
mov byte [rdx + 0xa], 0
lea rax, [rdx + 9]
mov qword [rbp - 0x58], r9
mov qword [rbp - 0x48], r9
mov qword [rbp - 0x40], r9
mov qword [rbp - 0x40], reloc.WS2_32.dll_ntohs
cmp rdx, rax
jne 0x14001458a
mov qword [rbp - 0x48], r9
mov byte [rbp - 0x58], 0
jmp 0x1400145a6
mov qword [rbp - 0x48], 9
movsd xmm0, qword [rdx]
movsd qword [rbp - 0x58], xmm0
movzx eax, byte [rdx + 8]
mov byte [rbp - 0x50], al
mov byte [rbp - 0x4f], 0
lea r9, [rbp - 0x38]
lea r8, [rbp - 0x58]
movzx edx, byte [rbp - 0x60]
mov rcx, rbx
call fcn.14001a630
nop
mov rdx, qword [rbp - 0x40]
cmp rdx, 0x10
jb 0x1400145fa
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400145f4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400145f4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140074f1c
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x140014638
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140014633
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140014633
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140074f1c
mov rax, rbx
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rbp
ret
Function at 0x140014650
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x50
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor edi, edi
cmp byte [r8 + 0xa], dil
je 0x140014684
mov ecx, edi
nop dword [rax]
lea eax, [rcx + 0x4a]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 9
jb 0x140014670
mov byte [r8 + 0xa], dil
lea rax, [r8 + 9]
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x1400146b1
mov qword [rsp + 0x30], rdi
mov byte [rsp + 0x20], dil
jmp 0x1400146d3
mov qword [rsp + 0x30], 9
movsd xmm0, qword [r8]
movsd qword [rsp + 0x20], xmm0
movzx eax, byte [r8 + 8]
mov byte [rsp + 0x28], al
mov byte [rsp + 0x29], dil
mov r9, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x1400146e1
mov rdx, qword [rdx]
mov r8, rdx
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.140020340
mov qword [rbx], rdi
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x140014758
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140014753
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140014753
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140074f1c
mov rax, rbx
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x140014770
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x50
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor edi, edi
cmp byte [r8 + 0xc], dil
je 0x1400147a4
mov ecx, edi
nop dword [rax]
lea eax, [rcx + 0x4a]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 0xb
jb 0x140014790
mov byte [r8 + 0xc], dil
lea rax, [r8 + 0xb]
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x1400147d1
mov qword [rsp + 0x30], rdi
mov byte [rsp + 0x20], dil
jmp 0x1400147fd
mov qword [rsp + 0x30], listen
movsd xmm0, qword [r8]
movsd qword [rsp + 0x20], xmm0
movzx eax, word [r8 + 8]
mov word [rsp + 0x28], ax
movzx eax, byte [r8 + 0xa]
mov byte [rsp + 0x2a], al
mov byte [rsp + 0x2b], dil
mov r9, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x14001480b
mov rdx, qword [rdx]
mov r8, rdx
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.140020340
mov qword [rbx], rdi
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x140014882
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001487d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001487d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140074f1c
mov rax, rbx
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret