joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002f560
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rsi, r8
mov r14, rdx
mov rbp, rcx
test r8, r8
jg 0x14002f582
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x14002f598
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov qword [rsp + 0x28], rbx
mov rbx, rsi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Gnavail_void_const___ptr64]
test rax, rax
je 0x14002f5e2
cmp rax, rsi
mov rdi, rsi
mov rcx, rbp
cmovb rdi, rax
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gptr_void_const___ptr64]
mov r8, rdi
mov rcx, r14
mov rdx, rax
call sub.VCRUNTIME140.dll_memcpy
mov edx, edi
mov rcx, rbp
add r14, rdi
sub rbx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int____ptr64]
cmp qword [rbp + 0x80], 0
mov rdi, rbx
je 0x14002f651
mov rcx, rbp
call fcn.14001f6f0
cmp rbx, 0xfff
jbe 0x14002f631
mov r9, qword [rbp + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
add r14, rax
mov rdi, rbx
cmp rax, 0xfff
jne 0x14002f66a
cmp rbx, rax
ja 0x14002f600
test rdi, rdi
je 0x14002f651
mov r9, qword [rbp + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rdi, rax
sub rsi, rdi
mov rbx, qword [rsp + 0x28]
mov rax, rsi
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
sub rsi, rbx
jmp 0x14002f654
Function at 0x14002f670
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je 0x14002f698
add rsp, 0x20
pop r14
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov rbp, rax
test rbx, rbx
jle 0x14002f70c
test rax, rax
jle 0x14002f6ec
cmp rbx, rax
mov rcx, rdi
cmovl rbp, rbx
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, rbp
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov edx, ebp
mov rcx, rdi
add r14, rbp
sub rbx, rbp
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
test rbx, rbx
jle 0x14002f70c
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x14002f70c
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov rbp, qword [rsp + 0x40]
sub rsi, rbx
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rbx
ret
Function at 0x140057050
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
mov r10d, dword [0x14039b8e8]
mov rbp, rcx
mov rax, qword gs:[0x58]
mov rbx, r9
mov ecx, 4
mov rdi, r8
mov esi, edx
mov rax, qword [rax + r10*8]
mov eax, dword [rcx + rax]
cmp dword [0x14039b608], eax
jg 0x14005713f
mov r10, qword [0x14039b600]
test r10, r10
je 0x1400570d6
mov rax, qword [rsp + 0xa0]
mov r9, rbx
mov qword [rsp + 0x30], rax
mov r8, rdi
mov eax, dword [rsp + 0x98]
mov edx, esi
mov dword [rsp + 0x28], eax
mov rcx, rbp
mov eax, dword [rsp + 0x90]
mov dword [rsp + 0x20], eax
call r10
jmp 0x1400570e6
mov ecx, 0x7f
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, 0xc000007a
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
lea edx, [rax - 0x5c]
xor byte [rsp + rax + 0x40], dl
inc rax
cmp rax, 0xf
jb 0x140057100
mov rcx, qword [0x14039b5f8]
lea rdx, [rsp + 0x40]
mov byte [rsp + 0x50], 0
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x14039b608]
mov qword [0x14039b600], rax
call fcn.140100fcc
jmp 0x140057097
lea rcx, [0x14039b608]
call fcn.140101038
cmp dword [0x14039b608], 0xffffffff
jne 0x140057097
movdqa xmm0, xmmword [0x14030b180]
xor eax, eax
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x50], 1
jmp 0x140057100

Function at 0x140057170
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x70
mov r10d, dword [0x14039b8e8]
mov rbp, rcx
mov rax, qword gs:[0x58]
mov rbx, r9
mov ecx, 4
mov rdi, r8
mov rsi, rdx
mov rax, qword [rax + r10*8]
mov eax, dword [rcx + rax]
cmp dword [0x14039b618], eax
jg 0x14005728f
mov r10, qword [0x14039b610]
test r10, r10
je 0x14005721d
mov eax, dword [rsp + 0xc8]
mov r9, rbx
mov dword [rsp + 0x48], eax
mov r8, rdi
mov eax, dword [rsp + 0xc0]
mov rdx, rsi
mov dword [rsp + 0x40], eax
mov rcx, rbp
mov eax, dword [rsp + 0xb8]
mov dword [rsp + 0x38], eax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x20], rax
call r10
jmp 0x14005722d
mov ecx, 0x7f
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, 0xc000007a
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
lea edx, [rax - 0x5c]
xor byte [rsp + rax + 0x50], dl
inc rax
cmp rax, 0x12
jb 0x140057250
mov rcx, qword [0x14039b5f8]
lea rdx, [rsp + 0x50]
mov byte [rsp + 0x63], 0
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x14039b618]
mov qword [0x14039b610], rax
call fcn.140100fcc
jmp 0x1400571b8
lea rcx, [0x14039b618]
call fcn.140101038
cmp dword [0x14039b618], 0xffffffff
jne 0x1400571b8
movdqa xmm0, xmmword [0x14030b190]
xor eax, eax
movdqu xmmword [rsp + 0x50], xmm0
mov dword [rsp + 0x60], 0x100dbdb
jmp 0x140057250
Function at 0x1400572d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov r10d, dword [0x14039b8e8]
mov rbp, rcx
mov rax, qword gs:[0x58]
mov ebx, r9d
mov ecx, 4
mov rdi, r8
mov rsi, rdx
mov rax, qword [rax + r10*8]
mov eax, dword [rcx + rax]
cmp dword [0x14039b628], eax
jg 0x1400573af
mov r10, qword [0x14039b620]
test r10, r10
je 0x140057342
mov rax, qword [rsp + 0x80]
mov r9d, ebx
mov r8, rdi
mov qword [rsp + 0x20], rax
mov rdx, rsi
mov rcx, rbp
call r10
jmp 0x140057352
mov ecx, 0x7f
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, 0xc000007a
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
lea edx, [rax - 0x5c]
xor byte [rsp + rax + 0x30], dl
inc rax
cmp rax, 0x16
jb 0x140057370
mov rcx, qword [0x14039b5f8]
lea rdx, [rsp + 0x30]
mov byte [rsp + 0x47], 0
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x14039b628]
mov qword [0x14039b620], rax
call fcn.140100fcc
jmp 0x140057318
lea rcx, [0x14039b628]
call fcn.140101038
cmp dword [0x14039b628], 0xffffffff
jne 0x140057318
movdqa xmm0, xmmword [0x14030b1a0]
xor eax, eax
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x40], 0xd8dbd0f9
mov dword [rsp + 0x44], 0x100c0ca
jmp 0x140057370
Function at 0x1400575b0
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
test rcx, rcx
je 0x140057753
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140057753
movsxd rax, dword [rcx + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x140057753
mov edx, 0x20b
cmp word [rax + rcx + 0x18], dx
jne 0x140057753
mov qword [rbx], rcx
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
mov qword [rsp + 0x40], rdi
mov qword [rbx + 8], rcx
xor edi, edi
mov qword [rsp + 0x48], r14
lea rax, [rcx + 0x18]
mov qword [rbx + 0x18], rax
lea rdx, [rcx + 4]
mov qword [rbx + 0x10], rdx
lea rax, [rcx + 0x88]
mov qword [rbx + 0x20], rax
lea r14, [rcx + 0x18]
lea rax, [rcx + 0x90]
mov qword [rbx + 0x28], rax
lea rax, [rcx + 0x98]
mov qword [rbx + 0x30], rax
lea rax, [rcx + 0xa0]
mov qword [rbx + 0x38], rax
lea rax, [rcx + 0xa8]
mov qword [rbx + 0x40], rax
lea rax, [rcx + 0xb0]
mov qword [rbx + 0x48], rax
lea rax, [rcx + 0xb8]
mov qword [rbx + 0x50], rax
lea rax, [rcx + 0xc0]
mov qword [rbx + 0x58], rax
lea rax, [rcx + 0xc8]
mov qword [rbx + 0x60], rax
lea rax, [rcx + 0xd0]
mov qword [rbx + 0x68], rax
lea rax, [rcx + 0xd8]
mov qword [rbx + 0x70], rax
lea rax, [rcx + 0xe0]
mov qword [rbx + 0x78], rax
lea rax, [rcx + 0xe8]
mov qword [rbx + 0x80], rax
lea rax, [rcx + 0xf0]
mov qword [rbx + 0x88], rax
lea rax, [rcx + 0xf8]
mov qword [rbx + 0x90], rax
lea rax, [rcx + 0x100]
mov qword [rbx + 0x98], rax
movzx eax, word [rcx + 0x14]
add r14, rax
cmp di, word [rdx + 2]
jae 0x140057741
mov qword [rsp + 0x38], rsi
nop dword [rax]
mov rdx, qword [rbx + 0xa8]
movsxd rax, edi
lea rcx, [rax + rax*4]
lea rax, [r14 + rcx*8]
mov qword [rsp + 0x30], rax
cmp rdx, qword [rbx + 0xb0]
je 0x14005771d
mov qword [rdx], rax
add qword [rbx + 0xa8], 8
jmp 0x14005772e
lea r8, [rsp + 0x30]
lea rcx, [rbx + 0xa0]
call fcn.1400573f0
mov rax, qword [rbx + 0x10]
inc edi
movzx ecx, word [rax + 2]
cmp edi, ecx
jl 0x1400576f0
mov rsi, qword [rsp + 0x38]
mov r14, qword [rsp + 0x48]
mov al, 1
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop rbx
ret
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x1400577d0
Capabilities:
Parse pe header

Disassembly:
test rcx, rcx
je 0x1400577fd
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400577fd
movsxd rax, dword [rcx + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x1400577fd
mov edx, 0x20b
cmp word [rax + rcx + 0x18], dx
jne 0x1400577fd
mov eax, dword [rax + rcx + 0x50]
ret
xor eax, eax
ret
Function at 0x140057d90
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x60]
sub rsp, 0x160
mov rax, qword [0x14038b780]
xor rax, rsp
mov qword [rbp + 0x50], rax
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x10], xmm0
xor r15d, r15d
mov qword [rbp], r15
lea rdx, [rsp + 0x50]
call fcn.1400575b0
test al, al
je 0x140057f65
mov dword [rsp + 0x30], 0xd1cdd388
mov word [rsp + 0x34], 0xde
mov byte [rsp + 0x36], 1
mov eax, r15d
nop word [rax + rax]
lea ecx, [rax - 0x5a]
xor byte [rsp + rax + 0x30], cl
inc rax
cmp rax, 5
jb 0x140057e00
mov byte [rsp + 0x36], 0
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x50]
call fcn.140057760
mov rsi, rax
mov dword [rsp + 0x38], 0xc8ccd588
mov dword [rsp + 0x3c], 0x100cade
mov rdx, r15
nop word [rax + rax]
lea ecx, [rdx - 0x5a]
xor byte [rsp + rdx + 0x38], cl
inc rdx
cmp rdx, 6
jb 0x140057e40
mov byte [rsp + 0x3f], 0
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x50]
call fcn.140057760
mov r14, rax
test rsi, rsi
je 0x140057f65
cmp rsi, rax
jae 0x140057f65
mov dword [rbp + 0x20], 1
mov dword [rbp + 0x24], 2
mov dword [rbp + 0x28], 4
mov dword [rbp + 0x2c], 8
mov dword [rbp + 0x30], reloc.WS2_32.dll_recv
mov dword [rbp + 0x34], 0x20
mov dword [rbp + 0x38], 0x40
mov dword [rbp + 0x3c], 0x80
mov dword [rbp + 0x40], 0x100
mov dword [rbp + 0x44], 0x200
mov dword [rbp + 0x48], 0x400
mov dword [rbp + 0x4c], 0x80000000
lea rdi, [rbp + 0x20]
mov edx, dword [rsi + 8]
add edx, 0x1000
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax + 0x18]
mov qword [rbp + 0x18], rcx
mov qword [rsp + 0x40], rdx
mov dword [rbp + 0x10], r15d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rax, [rbp + 0x10]
mov qword [rsp + 0x20], rax
mov r9d, dword [rdi]
lea r8, [rsp + 0x40]
lea rdx, [rbp + 0x18]
call fcn.1400572d0
mov edx, dword [r14 + 8]
mov ecx, dword [r14 + 0xc]
mov rax, qword [rsp + 0x68]
add rcx, qword [rax + 0x18]
mov qword [rsp + 0x40], rcx
mov qword [rbp + 0x18], rdx
mov dword [rbp + 0x10], r15d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rax, [rbp + 0x10]
mov qword [rsp + 0x20], rax
mov r9d, dword [rdi]
lea r8, [rbp + 0x18]
lea rdx, [rsp + 0x40]
call fcn.1400572d0
add rdi, 4
lea rax, [rbp + 0x50]
cmp rdi, rax
jne 0x140057ed1
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x140057fa6
mov rdx, qword [rbp]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
mov rax, rcx
cmp rdx, 0x1000
jb 0x140057fa1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140057fa1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140100c6c
mov rcx, qword [rbp + 0x50]
xor rcx, rsp
call fcn.140100c10
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x140057fd0
Capabilities:
Encode data using xor
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x14038b780]
xor rax, rsp
mov qword [rbp + 0x20], rax
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x30], xmm0
xor ebx, ebx
mov qword [rbp - 0x20], rbx
lea rdx, [rsp + 0x30]
call fcn.1400575b0
test al, al
je 0x14005810e
mov dword [rsp + 0x20], 0xd1cdd388
mov word [rsp + 0x24], 0xde
mov byte [rsp + 0x26], 1
mov ecx, ebx
lea eax, [rcx - 0x5a]
xor byte [rsp + rcx + 0x20], al
inc rcx
cmp rcx, 5
jb 0x140058030
mov byte [rsp + 0x26], 0
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.140057760
mov rsi, rax
mov dword [rsp + 0x28], 0xc8ccd588
mov dword [rsp + 0x2c], 0x100cade
mov rdx, rbx
nop word [rax + rax]
lea ecx, [rdx - 0x5a]
xor byte [rsp + rdx + 0x28], cl
inc rdx
cmp rdx, 6
jb 0x140058070
mov byte [rsp + 0x2f], 0
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x30]
call fcn.140057760
mov rdi, rax
mov dword [rsp + 0x20], 0xddc9c388
mov word [rsp + 0x24], 0xcb
mov byte [rsp + 0x26], 1
nop dword [rax + rax]
lea ecx, [rbx - 0x5a]
xor byte [rsp + rbx + 0x20], cl
inc rbx
cmp rbx, 5
jb 0x1400580b0
mov byte [rsp + 0x26], 0
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.140057760
mov rbx, rax
test rsi, rsi
je 0x14005810e
cmp rsi, rdi
jae 0x14005810e
cmp rdi, rax
jae 0x14005810e
lea rcx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor edx, edx
mov eax, dword [rdi + 0xc]
mov rcx, qword [rbp + 0x18]
div ecx
test edx, edx
jne 0x14005810e
xor edx, edx
mov eax, dword [rbx + 0xc]
div ecx
test edx, edx
jne 0x14005810e
mov bl, 1
jmp 0x140058110
xor bl, bl
mov rcx, qword [rbp - 0x30]
test rcx, rcx
je 0x140058151
mov rdx, qword [rbp - 0x20]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005814c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005814c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140100c6c
movzx eax, bl
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.140100c10
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x1400593d0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 7], sil
je 0x140059404
mov eax, esi
lea ecx, [rax - 0x6a]
xor byte [r8 + rax], cl
inc rax
cmp rax, 6
jb 0x1400593f0
mov byte [r8 + 7], sil
add r8, 6
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.140058960
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140059429
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140070a80
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x1400594a3
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005949e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005949e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140100c6c
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x1400594b0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r10, r8
mov rdi, rdx
mov rsi, rcx
mov qword [rsp + 0x28], rcx
xor ebx, ebx
cmp byte [r8 + 9], bl
je 0x1400594e4
mov ecx, ebx
lea eax, [rcx - 0x6a]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 8
jb 0x1400594d0
mov byte [r8 + 9], bl
add r8, 8
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x50]
call fcn.140058960
nop
cmp byte [rdi + 9], 0
je 0x140059514
lea eax, [rbx - 0x6a]
xor byte [rbx + rdi], al
inc rbx
cmp rbx, 8
jb 0x140059501
mov byte [rdi + 9], 0
lea r8, [rdi + 8]
lea r9, [rsp + 0x20]
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.140058960
nop
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
movzx edx, byte [rsp + 0x20]
mov rcx, rsi
call fcn.14005fdd0
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140059584
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005957e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005957e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140100c6c
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x1400595c4
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400595bf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400595bf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140100c6c
mov rax, rsi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400595d0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 0xa], sil
je 0x140059604
mov eax, esi
lea ecx, [rax - 0x6a]
xor byte [r8 + rax], cl
inc rax
cmp rax, 9
jb 0x1400595f0
mov byte [r8 + 0xa], sil
add r8, 9
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.140058960
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140059629
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140070a80
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x1400596a3
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005969e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005969e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140100c6c
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x1400596b0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 0x31], sil
je 0x1400596e4
mov eax, esi
lea ecx, [rax - 0x6a]
xor byte [r8 + rax], cl
inc rax
cmp rax, 0x30
jb 0x1400596d0
mov byte [r8 + 0x31], sil
add r8, 0x30
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.140058960
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140059709
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140070a80
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140059783
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005977e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005977e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140100c6c
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x140059790
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 0xc], sil
je 0x1400597c4
mov eax, esi
lea ecx, [rax - 0x6a]
xor byte [r8 + rax], cl
inc rax
cmp rax, 0xb
jb 0x1400597b0
mov byte [r8 + 0xc], sil
add r8, 0xb
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.140058960
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x1400597e9
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140070a80
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140059863
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005985e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005985e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140100c6c
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x140061750
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 8], al
je 0x140061773
lea edx, [rax - 0x6a]
xor byte [rax + rcx], dl
inc rax
cmp rax, 7
jb 0x140061760
mov byte [rcx + 8], 0
lea r8, [rcx + 7]
mov rdx, rcx
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.140058960
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x140061790
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 9], al
je 0x1400617b3
lea edx, [rax - 0x6a]
xor byte [rax + rcx], dl
inc rax
cmp rax, 8
jb 0x1400617a0
mov byte [rcx + 9], 0
lea r8, [rcx + 8]
mov rdx, rcx
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.140058960
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x1400617d0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 0xa], al
je 0x1400617f3
lea edx, [rax - 0x6a]
xor byte [rax + rcx], dl
inc rax
cmp rax, 9
jb 0x1400617e0
mov byte [rcx + 0xa], 0
lea r8, [rcx + 9]
mov rdx, rcx
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.140058960
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x140061810
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 0x10], al
je 0x140061833
lea edx, [rax - 0x6a]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xf
jb 0x140061820
mov byte [rcx + 0x10], 0
lea r8, [rcx + 0xf]
mov rdx, rcx
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.140058960
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x140061850
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 0xb], al
je 0x140061873
lea edx, [rax - 0x6a]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xa
jb 0x140061860
mov byte [rcx + 0xb], 0
lea r8, [rcx + 0xa]
mov rdx, rcx
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.140058960
mov rax, rbx
add rsp, 0x30
pop rbx
ret