joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140074810
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov r14, rcx
xor ebp, ebp
mov ebx, ebp
mov dword [rsp + 0x68], ebp
lea r9, [rsp + 0x68]
xor r8d, r8d
xor edx, edx
lea ecx, [rbp + 0xb]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x140074895
test rbx, rbx
je 0x14007485d
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rsp + 0x68]
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
lea r9, [rsp + 0x68]
mov r8d, dword [rsp + 0x68]
mov rdx, rax
mov ecx, ntohl
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x140074847
test eax, eax
jns 0x1400748c4
test rbx, rbx
je 0x1400748af
mov r8d, 0x8000
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
test rbx, rbx
je 0x1400748af
mov edi, ebp
cmp dword [rbx], ebp
jbe 0x14007489e
nop
mov esi, edi
imul rax, rsi, 0x128
movzx ecx, word [rax + rbx + 0x2e]
add rcx, rax
lea rdx, [rbx + 0x30]
add rdx, rcx
mov qword [rsp + 0x20], rbp
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], 0
jne 0x140074902
lea rcx, [rsp + 0x20]
call fcn.14006f7a0
mov rdx, r14
cmp qword [r14 + 0x18], 0x10
jb 0x140074923
mov rdx, qword [r14]
lea rcx, [rsp + 0x20]
cmp qword [rsp + 0x38], 0x10
cmovae rcx, qword [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x140074986
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x140074977
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140074972
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400749d7
call fcn.140139edc
inc edi
cmp edi, dword [rbx]
jb 0x1400748d0
jmp 0x14007489e
imul rax, rsi, 0x128
mov rdi, qword [rax + rbx + 0x18]
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x1400749e3
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400749de
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400749de
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140139edc
mov rax, rdi
jmp 0x1400748b1

Function at 0x140074f10
Capabilities:
Delete file

Disassembly:
sub rsp, 0x58
call fcn.14006b6b0
mov rdx, qword [0x140197190]
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x48], rcx
mov rcx, rax
mov qword [0x140196ee8], rax
mov dword [rsp + 0x60], 0
call fcn.1400721d0
mov rcx, qword [0x140196ee8]
add rsp, 0x58
jmp fcn.14006bb40
Function at 0x140078070
Capabilities:
Query service status

Disassembly:
push rbx
sub rsp, 0x40
xor edx, edx
mov rbx, rcx
xor ecx, ecx
lea r8d, [rdx + 1]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
cmp qword [rbx + 0x18], 0x10
mov rdx, rbx
jb 0x140078094
mov rdx, qword [rbx]
mov r8d, 4
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp dword [rsp + 0x24], 4
mov rax, qword [rbx + 0x18]
jne 0x1400780f3
cmp rax, 0x10
jb 0x1400780ef
mov rcx, qword [rbx]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x1400780ea
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140078141
mov rcx, r8
call fcn.140139edc
mov al, 1
jmp 0x140078128
cmp rax, 0x10
jb 0x140078126
mov rcx, qword [rbx]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140078121
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140078141
mov rcx, r8
call fcn.140139edc
xor al, al
mov byte [rbx], 0
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
add rsp, 0x40
pop rbx
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x14007d5c0
Capabilities:
Create thread
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x70
mov edi, r8d
mov rsi, rdx
xor r14d, r14d
mov edx, r14d
cmp ecx, 0x7b
ja 0x14007d5f4
movsxd rax, ecx
lea rdx, [0x140195920]
mov rdx, qword [rdx + rax*8]
mov qword [rbp - 0x28], r14
mov qword [rbp - 0x18], r14
mov qword [rbp - 0x10], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x28], 0
test rdx, rdx
jne 0x14007d662
mov dword [rbp - 0x40], 0xd4dccafd
mov dword [rbp - 0x3c], 0xfe94c7d1
mov dword [rbp - 0x38], 0x100ced3
mov rcx, r14
nop word [rax + rax]
lea eax, [rcx - 0x52]
xor byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xa
jb 0x14007d630
mov byte [rbp - 0x35], 0
lea rax, [rbp - 0x40]
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x14007d652
lea rdx, [rbp - 0x40]
jmp 0x14007d67a
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop dword [rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x14007d670
lea rcx, [rbp - 0x28]
call fcn.14006f7a0
cmp edi, 1
jne 0x14007d6e9
movdqa xmm0, xmmword [0x14016c710]
movdqu xmmword [rbp - 0x40], xmm0
mov word [rbp - 0x30], 0xda
mov byte [rbp - 0x2e], dil
mov rcx, r14
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x52]
xor byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0x11
jb 0x14007d6b0
mov byte [rbp - 0x2e], 0
lea rax, [rbp - 0x40]
nop dword [rax + rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x14007d6d0
mov r8, rbx
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x28]
call fcn.14006f7a0
movzx eax, word [0x140168bfc]
mov word [rbp + 0x20], ax
cmp byte [0x140168bfd], 0
je 0x14007d705
mov byte [rbp + reloc.WLDAP32.dll_Ordinal_32], 0x20
xor byte [rbp + 0x21], 0x35
lea rcx, [rbp + 0x20]
call fcn.14004ff70
movss xmm1, dword [0x14016c02c]
xorps xmm0, xmm0
call fcn.14002e9c0
movss xmm4, dword [0x14016be0c]
movss dword [rbp + 0x38], xmm4
movss xmm5, dword [0x14016bd58]
movss dword [rbp + 0x3c], xmm5
lea rcx, [rbp - 0x28]
cmp qword [rbp - 0x10], 0x10
cmovae rcx, qword [rbp - 0x28]
lea rdx, [rbp + 0x38]
call fcn.1400508c0
test al, al
je 0x14007d772
test edi, edi
jne 0x14007d772
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], r14d
xor r9d, r9d
mov r8, rsi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
nop
mov rdx, qword [rbp - 0x10]
cmp rdx, 0x10
jb 0x14007d7b0
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007d7ab
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14007d7ab
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140139edc
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x1400b5610
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov eax, 0x13b8
call fcn.14013abe0
sub rsp, rax
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov dword [rsp + 0x13a4], 0xffffffff
mov ecx, 1
mov dword [rsp + 0x24], eax
nop word [rax + rax]
mov edx, eax
shr edx, 0x1e
xor edx, eax
imul eax, edx, 0x6c078965
add eax, ecx
mov dword [rsp + rcx*4 + 0x24], eax
inc rcx
cmp rcx, 0x270
jb 0x1400b5640
mov dword [rsp + 0x20], 0x270
nop word [rax + rax]
lea rcx, [rsp + 0x20]
call fcn.1400d7d30
mov ecx, eax
mov eax, 0xcccccccd
mul ecx
shr edx, 2
cmp edx, 0x33333333
jae 0x1400b5670
mov r8d, 0x80000000
mov eax, 0xcccccccd
mul ecx
shr edx, 2
lea eax, [rdx + rdx*4]
sub ecx, eax
lea edx, [rcx - 0x7fffffff]
cmp edx, r8d
lea ecx, [rdx - 0x80000000]
lea eax, [rdx + r8]
cmovae eax, ecx
add rsp, 0x13b8
ret
Function at 0x1400bdc70
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x150
xor edx, edx
mov rbx, rcx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x1400bdca7
xor eax, eax
mov rbx, qword [rsp + 0x168]
add rsp, 0x150
pop rdi
ret
xor edx, edx
mov qword [rsp + 0x160], rsi
mov r8d, Ordinal_301
lea rcx, [rsp + 0x24]
call sub.VCRUNTIME140.dll_memset
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rdi
xor sil, sil
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x1400bdd34
nop
lea rcx, [rsp + 0x4c]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [rcx + rax], sil
jne 0x1400bdcf0
cmp qword [rbx + 0x18], 0x10
mov rcx, rbx
mov r8, qword [rbx + 0x10]
jb 0x1400bdd0a
mov rcx, qword [rbx]
cmp r8, rax
jne 0x1400bdd1d
lea rdx, [rsp + 0x4c]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400bdd31
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x1400bdce0
jmp 0x1400bdd34
mov sil, 1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x168]
xor eax, eax
test sil, sil
mov rsi, qword [rsp + 0x160]
cmovne eax, dword [rsp + 0x28]
add rsp, 0x150
pop rdi
ret

Function at 0x1400bdd60
Capabilities:
Enumerate gui resources

Disassembly:
sub rsp, 0x38
mov dword [rsp + 0x28], ecx
lea rdx, [rsp + 0x20]
lea rcx, [0x1400bddb0]
mov qword [rsp + 0x20], 0
call qword [sym.imp.USER32.dll_EnumWindows]
test eax, eax
jne 0x1400bdd9c
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xffffffff
jne 0x1400bdd9c
mov rax, qword [rsp + 0x20]
test rax, rax
jne 0x1400bdd9e
xor eax, eax
add rsp, 0x38
ret

Function at 0x1400be880
Capabilities:
Register raw input devices

Disassembly:
sub rsp, 0x38
mov edx, 1
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x20001
mov dword [rsp + 0x24], 0x100
lea r8d, [rdx + 0xf]
call qword [sym.imp.USER32.dll_RegisterRawInputDevices]
test eax, eax
jne 0x1400be8f1
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Failed_to_register_raw_input_devices._Error_code:
mov ebx, eax
call fcn.140072c00
mov edx, ebx
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x140072df0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rbx, qword [rsp + 0x30]
add rsp, 0x38
ret
Function at 0x1400d3bb0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rsi, rcx
mov rax, qword gs:[0x58]
mov r14, qword [rax]
mov ecx, 0x170
mov eax, dword [rcx + r14]
mov ebp, 0x130
xor edi, edi
test al, 1
jne 0x1400d3c51
or eax, 1
mov dword [rcx + r14], eax
lea rbx, [r14 + rbp]
mov qword [rsp + 0x40], rbx
mov dword [rbx], edi
mov qword [rbx + 8], rdi
mov qword [rbx + 0x10], rdi
lea ecx, [rdi + 0x30]
call fcn.14013a3cc
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rbx + 8], rax
lea rcx, [rbx + 0x18]
mov qword [rcx], rdi
mov qword [rcx + 8], rdi
mov qword [rcx + 0x10], rdi
mov qword [rbx + 0x30], 7
mov qword [rbx + 0x38], 8
mov dword [rbx], 0x3f800000
mov r8, qword [rbx + 8]
lea edx, [rdi + 0x10]
call fcn.1400d43d0
nop
lea rcx, [0x14013f1f0]
call fcn.14013a704
nop
movzx edx, sil
movabs rax, 0xcbf29ce484222325
xor rdx, rax
movabs r8, 0x100000001b3
imul rdx, r8
mov rax, rsi
shr rax, 8
movzx ecx, al
xor rdx, rcx
imul rdx, r8
mov rax, rsi
shr rax, 0x10
movzx ecx, al
xor rdx, rcx
imul rdx, r8
mov rax, rsi
shr rax, 0x18
movzx ecx, al
xor rdx, rcx
imul rdx, r8
mov rax, rsi
shr rax, 0x20
movzx ecx, al
xor rdx, rcx
imul rdx, r8
mov rax, rsi
shr rax, 0x28
movzx ecx, al
xor rdx, rcx
imul rdx, r8
mov rax, rsi
shr rax, 0x30
movzx ecx, al
xor rdx, rcx
imul rdx, r8
mov rax, rsi
shr rax, 0x38
xor rdx, rax
imul rdx, r8
mov rcx, qword [r14 + rbp + 0x30]
and rcx, rdx
add rcx, rcx
mov rdx, qword [r14 + rbp + 0x18]
mov rax, qword [rdx + rcx*8 + 8]
mov r8, qword [r14 + rbp + 8]
cmp rax, r8
je 0x1400d3d22
mov rcx, qword [rdx + rcx*8]
cmp rsi, qword [rax + 0x10]
je 0x1400d3d1f
nop dword [rax]
cmp rax, rcx
je 0x1400d3d22
mov rax, qword [rax + 8]
cmp rsi, qword [rax + 0x10]
jne 0x1400d3d10
mov rdi, rax
test rdi, rdi
cmove rdi, r8
cmp rdi, r8
je 0x1400d3d33
mov eax, dword [rdi + 0x18]
jmp 0x1400d3d38
mov eax, 0xffffffff
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret

Function at 0x1400d5010
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rbx, rdx
mov rdi, rcx
mov ecx, 8
call fcn.14013a3cc
mov qword [rax], rbx
mov qword [rsp + 0x40], rax
lea rbx, [rdi + 8]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x1400d7ec0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rdi], rax
test rax, rax
je 0x1400d506d
mov rax, rdi
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov dword [rbx], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x1400d7d30
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r10, rcx
mov r9d, 0x270
mov ecx, dword [rcx]
cmp ecx, r9d
jne 0x1400d7d91
lea r8, [r10 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x1400d7d50
mov ecx, dword [r10]
jmp 0x1400d7e7a
cmp ecx, 0x4e0
jb 0x1400d7e7a
lea r11, [r10 + 0x9c4]
mov qword [rsp], rbx
mov eax, dword [r11]
mov ebx, 0xe3
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x1400d7db0
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x1400d7e00
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
xor ecx, ecx
mov dword [r10], ecx
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x1400da990
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x50
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor edi, edi
cmp byte [r8 + 7], dil
je 0x1400da9c4
mov ecx, edi
nop dword [rax]
lea eax, [rcx + 0x7d]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 6
jb 0x1400da9b0
mov byte [r8 + 7], dil
lea rax, [r8 + 6]
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x1400da9f1
mov qword [rsp + 0x30], rdi
mov byte [rsp + 0x20], dil
jmp 0x1400daa10
mov qword [rsp + 0x30], 6
mov eax, dword [r8]
mov dword [rsp + 0x20], eax
movzx eax, word [r8 + 4]
mov word [rsp + 0x24], ax
mov byte [rsp + 0x26], dil
mov r9, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x1400daa1e
mov rdx, qword [rdx]
mov r8, rdx
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.1400d69b0
mov qword [rbx], rdi
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x1400daa95
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400daa90
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400daa90
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140139edc
mov rax, rbx
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x1400daab0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x50
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor edi, edi
cmp byte [r8 + 9], dil
je 0x1400daae4
mov ecx, edi
nop dword [rax]
lea eax, [rcx + 0x7d]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 8
jb 0x1400daad0
mov byte [r8 + 9], dil
lea rax, [r8 + 8]
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x1400dab11
mov qword [rsp + 0x30], rdi
mov byte [rsp + 0x20], dil
jmp 0x1400dab27
mov qword [rsp + 0x30], 8
mov rax, qword [r8]
mov qword [rsp + 0x20], rax
mov byte [rsp + 0x28], dil
mov r9, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x1400dab35
mov rdx, qword [rdx]
mov r8, rdx
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.1400d69b0
mov qword [rbx], rdi
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x1400dabac
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400daba7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400daba7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140139edc
mov rax, rbx
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x1400dabc0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rbx, rcx
mov qword [rbp - 0x10], rcx
xor r9d, r9d
cmp byte [r8 + 6], r9b
je 0x1400dac04
mov ecx, r9d
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x7d]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 5
jb 0x1400dabf0
mov byte [r8 + 6], r9b
lea rax, [r8 + 5]
mov qword [rbp - 0x38], r9
mov qword [rbp - 0x28], r9
mov qword [rbp - 0x20], r9
mov qword [rbp - 0x20], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x1400dac2b
mov qword [rbp - 0x28], r9
mov byte [rbp - 0x38], r9b
jmp 0x1400dac45
mov qword [rbp - 0x28], 5
mov eax, dword [r8]
mov dword [rbp - 0x38], eax
movzx eax, byte [r8 + 4]
mov byte [rbp - 0x34], al
mov byte [rbp - 0x33], r9b
cmp byte [rdx + 0xa], 0
je 0x1400dac63
mov rcx, r9
nop
lea eax, [rcx + 0x7d]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 9
jb 0x1400dac50
mov byte [rdx + 0xa], 0
lea rax, [rdx + 9]
mov qword [rbp - 0x58], r9
mov qword [rbp - 0x48], r9
mov qword [rbp - 0x40], r9
mov qword [rbp - 0x40], reloc.WS2_32.dll_ntohs
cmp rdx, rax
jne 0x1400dac8a
mov qword [rbp - 0x48], r9
mov byte [rbp - 0x58], 0
jmp 0x1400daca6
mov qword [rbp - 0x48], 9
movsd xmm0, qword [rdx]
movsd qword [rbp - 0x58], xmm0
movzx eax, byte [rdx + 8]
mov byte [rbp - 0x50], al
mov byte [rbp - 0x4f], 0
lea r9, [rbp - 0x38]
lea r8, [rbp - 0x58]
movzx edx, byte [rbp - 0x60]
mov rcx, rbx
call fcn.1400d6670
nop
mov rdx, qword [rbp - 0x40]
cmp rdx, 0x10
jb 0x1400dacfa
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400dacf4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400dacf4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140139edc
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x1400dad38
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400dad33
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400dad33
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140139edc
mov rax, rbx
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rbp
ret
Function at 0x1400dad50
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x50
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor edi, edi
cmp byte [r8 + 0xa], dil
je 0x1400dad84
mov ecx, edi
nop dword [rax]
lea eax, [rcx + 0x7d]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 9
jb 0x1400dad70
mov byte [r8 + 0xa], dil
lea rax, [r8 + 9]
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x1400dadb1
mov qword [rsp + 0x30], rdi
mov byte [rsp + 0x20], dil
jmp 0x1400dadd3
mov qword [rsp + 0x30], 9
movsd xmm0, qword [r8]
movsd qword [rsp + 0x20], xmm0
movzx eax, byte [r8 + 8]
mov byte [rsp + 0x28], al
mov byte [rsp + 0x29], dil
mov r9, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x1400dade1
mov rdx, qword [rdx]
mov r8, rdx
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.1400d69b0
mov qword [rbx], rdi
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x1400dae58
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400dae53
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400dae53
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140139edc
mov rax, rbx
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x1400dae70
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x50
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor edi, edi
cmp byte [r8 + 0xc], dil
je 0x1400daea4
mov ecx, edi
nop dword [rax]
lea eax, [rcx + 0x7d]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 0xb
jb 0x1400dae90
mov byte [r8 + 0xc], dil
lea rax, [r8 + 0xb]
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x1400daed1
mov qword [rsp + 0x30], rdi
mov byte [rsp + 0x20], dil
jmp 0x1400daefd
mov qword [rsp + 0x30], send
movsd xmm0, qword [r8]
movsd qword [rsp + 0x20], xmm0
movzx eax, word [r8 + 8]
mov word [rsp + 0x28], ax
movzx eax, byte [r8 + 0xa]
mov byte [rsp + 0x2a], al
mov byte [rsp + 0x2b], dil
mov r9, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x1400daf0b
mov rdx, qword [rdx]
mov r8, rdx
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.1400d69b0
mov qword [rbx], rdi
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x1400daf82
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400daf7d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400daf7d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140139edc
mov rax, rbx
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret