joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140041b90
Capabilities:
Allocate or change rwx memory

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov r14, r9
mov r15, r8
mov rbx, rdx
mov rsi, rcx
cmp byte [rcx + 0x14], 0
jne 0x140041b73
mov rdi, qword [rsi + 0x18]
lea rcx, [0x14004c3fe]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp byte [rsi + 0x14], 0
jne 0x140041b73
xor ecx, ecx
cmp rdi, rax
sete cl
mov dword [rsi + 0x10], ecx
mov byte [rsi + 0x14], 1
mov rcx, rsi
mov rdx, rbx
mov r8, r15
mov r9, r14
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp 0x140041b90
push r14
push rsi
push rdi
push rbx
sub rsp, 0xd8
mov rsi, r9
mov r14, r8
mov r8, rdx
mov rdi, rcx
mov rax, qword [0x140054018]
xor rax, rsp
mov qword [rsp + 0xd0], rax
lea rdx, [rsp + 0x68]
call fcn.140041d80
mov r8d, dword [rdi + 0x10]
and r8d, 1
shl r8, 0x1e
lea rdx, [rsp + 0xb8]
mov rcx, rdi
mov r9d, r8d
call fcn.140044130
cmp byte [rsp + 0xc8], 0
je 0x140041d39
call fcn.140044200
lea rbx, [0x140056908]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rsp + 0xc0]
lea rdx, [rsp + 0x80]
call fcn.140044b70
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp byte [rsp + 0xb0], 0
je 0x140041d3d
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov eax, dword [rsp + 0x88]
mov dword [rsp + 0x40], eax
movups xmm0, xmmword [rsp + 0x90]
movups xmmword [rsp + 0x48], xmm0
mov eax, dword [rsp + 0xa0]
mov dword [rsp + 0x58], eax
mov rax, qword [rsp + 0xa4]
mov qword [rsp + 0x5c], rax
mov al, byte [rsp + 0xac]
mov byte [rsp + 0x64], al
mov dword [rsp + 0x88], 0
mov byte [rsp + 0xac], 0
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], r14
lea rdx, [rsp + 0x68]
lea r8, [rsp + 0xb8]
lea r9, [rsp + 0x38]
mov rcx, rdi
call fcn.140041e90
cmp qword [rsi], 0
setne sil
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140041ce6
mov r8d, dword [rsp + 0x40]
test r8d, r8d
je 0x140041ce6
lea r9, [rsp + 0x40]
mov edx, dword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp byte [rsp + 0xb0], 0
je 0x140041d08
mov rcx, qword [rsp + 0x90]
test rcx, rcx
je 0x140041d00
mov r8d, dword [rsp + 0x88]
test r8d, r8d
jne 0x140041d4b
mov byte [rsp + 0xb0], 0
cmp byte [rsp + 0xc8], 0
je 0x140041d1a
mov byte [rsp + 0xc8], 0
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.140045f60
mov eax, esi
add rsp, 0xd8
pop rbx
pop rdi
pop rsi
pop r14
ret
xor esi, esi
jmp 0x140041d1a
xor esi, esi
cmp byte [rsp + 0xc8], 0
jne 0x140041d12
jmp 0x140041d1a
lea rdi, [rsp + 0x88]
mov edx, dword [rsp + 0xa8]
mov r9, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [rsp + 0x88], 0
mov byte [rsp + 0xac], 0
xorps xmm0, xmm0
movups xmmword [rdi + 8], xmm0
jmp 0x140041d00
Function at 0x140044b70
Capabilities:
Allocate or change rwx memory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x140054018]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov ebx, dword [rcx + 0x10]
shl ebx, 7
mov edx, ebx
call fcn.140044c90
test al, al
je 0x140044c61
mov ecx, ebx
add rcx, qword [rdi]
mov qword [rsp + 0x28], rdi
lea r9, [rsp + 0x30]
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x50], 0x80
mov byte [rsp + 0x54], 1
mov edx, 0x80
mov r8d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x140044c67
mov r8, qword [rsp + 0x28]
test r8, r8
je 0x140044c74
mov rdx, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov eax, dword [rsp + 0x30]
mov cl, byte [rsp + 0x54]
test cl, cl
je 0x140044c1f
test rdx, rdx
je 0x140044c1f
test rbx, rbx
je 0x140044c1f
test eax, eax
je 0x140044c1f
add dword [rdi + 0x10], 1
mov qword [rsi], r8
mov dword [rsi + 8], eax
mov qword [rsi + 0x10], rdx
mov qword [rsi + 0x18], rbx
mov eax, dword [rsp + 0x48]
mov dword [rsi + 0x20], eax
mov eax, dword [rsp + 0x4c]
mov dword [rsi + 0x24], eax
mov eax, dword [rsp + 0x50]
mov dword [rsi + 0x28], eax
mov byte [rsi + 0x2c], cl
mov byte [rsi + 0x30], 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140045f60
mov rax, rsi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
mov byte [rsi + 0x30], 0
jmp 0x140044c49
mov dword [rsp + 0x30], 0
jmp 0x140044bed
mov eax, dword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov cl, byte [rsp + 0x54]
jmp 0x140044c1b

Function at 0x140045080
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rbx, r9
mov rdi, r8
mov rsi, rcx
mov rax, qword [0x140054018]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov qword [rcx], rdx
movaps xmm0, xmmword [0x1400482d0]
movups xmmword [rcx + 0x10], xmm0
lea rax, [rcx + 0x20]
mov qword [rcx + 8], rax
call fcn.14000c290
lea rcx, [rdi + rbx]
add rcx, 0xffffffffffffffff
mov r14d, eax
mov rax, rcx
xor edx, edx
div r14
mov r13, rax
mov rax, rdi
xor edx, edx
div r14
sub r13, rax
inc r13
je 0x14004514d
mov rdi, rax
imul rdi, r14
xor ebx, ebx
lea r15, [rsp + 0x2c]
mov rbp, qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea rax, [rsi + 8]
mov qword [rsp + 0x20], rax
mov rcx, rdi
mov rdx, r14
mov r8d, 0x40
mov r9, r15
call rbp
test eax, eax
je 0x14004516e
mov r12d, dword [rsp + 0x2c]
mov rax, qword [rsi + 0x10]
cmp rax, qword [rsi + 0x18]
je 0x140045180
mov rcx, qword [rsi + 8]
shl rax, 4
mov dword [rcx + rax], r12d
mov qword [rcx + rax + 8], rdi
add qword [rsi + 0x10], 1
add rbx, 1
add rdi, r14
cmp rbx, r13
jb 0x140045107
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140045f60
mov rax, rsi
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov dword [rsp + 0x2c], 0
mov rcx, rsi
call fcn.1400451a0
jmp 0x14004514d
mov edx, 1
mov rcx, qword [rsp + 0x20]
call fcn.14000c420
test al, al
je 0x140045176
mov rax, qword [rsi + 0x10]
jmp 0x14004512b
Function at 0x140012050
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push rbx
sub rsp, 0x90
mov rax, qword [0x140092010]
xor rax, rsp
mov qword [rsp + 0x80], rax
xor eax, eax
mov dword [rsp + 0x28], r9d
xorps xmm0, xmm0
mov dword [rsp + 0x2c], eax
mov dword [rsp + 0x3c], eax
xor r9d, r9d
mov dword [rsp + 0x4c], eax
mov rbx, rcx
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0xc8]
mov dword [rsp + 0x38], edx
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x40], r8
lea r8d, [r9 + 0x30]
mov dword [rsp + 0x48], eax
mov qword [rsp + 0x20], 0x7f244536
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x140012109
xor r9d, r9d
lea rdx, [rsp + 0x50]
mov rcx, rbx
lea r8d, [r9 + 0x30]
call qword [sym.imp.WS2_32.dll_recv]
movsxd rcx, eax
cmp rcx, 8
jb 0x140012109
cmp dword [rsp + 0x50], 0x7f244536
jne 0x140012109
cmp dword [rsp + 0x54], 3
jne 0x140012109
mov eax, dword [rsp + 0x58]
jmp 0x14001210b
xor eax, eax
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14006c830
add rsp, 0x90
pop rbx
ret

Function at 0x140013c30
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x140013c8d
lea rbx, [0x140070630]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x140013c74
cmp r10, 2
jb 0x140013c74
cmp byte [r9], r8b
jne 0x140013c74
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x140013c50
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x140013ccf
lea rbx, [0x140070630]
cmp r8b, 0x23
jne 0x140013cb3
cmp byte [r9], r8b
jne 0x140013cb3
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x140013ca0
mov rbx, qword [rsp + 8]
not eax
ret
Function at 0x140022460
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x140092010]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x140093060]
mov edi, ecx
cmp byte [rbx + 0x424d], 0
jne 0x1400224c1
cmp byte [rbx + 0x424e], 0
jne 0x1400224c1
movsx r9d, word [rbx + 0x5332]
lea r8, str.Tooltip__02d
mov edx, reloc.WS2_32.dll_recv
lea rcx, [rsp + 0x20]
call fcn.140013ac0
test dil, 1
je 0x1400225e8
jmp 0x14002254a
movss xmm1, dword [rbx + 0x38b0]
lea r8, str.Tooltip__02d
movsx r9d, word [rbx + 0x5332]
lea rcx, [rsp + 0x20]
movaps xmm0, xmm1
xor eax, eax
mulss xmm0, dword [0x140086788]
mulss xmm1, dword [0x140086768]
lea edx, [rax + 0x10]
addss xmm0, dword [rbx + 0xd94]
addss xmm1, dword [rbx + 0xd98]
mov qword [rbx + 0x3fc8], rax
mov dword [rbx + 0x3fb4], 1
movss dword [rbx + 0x3fc0], xmm0
movss dword [rbx + 0x3fc4], xmm1
movss xmm0, dword [rbx + 0x390c]
mulss xmm0, dword [0x1400866c4]
or dword [rbx + 0x3fb0], 0x41
movss dword [rbx + 0x4010], xmm0
call fcn.140013ac0
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x1400225a0
lea r11, [0x140070630]
nop word [rax + rax]
cmp r9b, 0x23
jne 0x140022583
cmp byte [r8], r9b
jne 0x140022583
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140022570
not ecx
call fcn.14001b390
test rax, rax
je 0x1400225e8
cmp byte [rax + 0x96], 0
je 0x1400225e8
mov byte [rax + 0x9d], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xb8], 1
lea rcx, [rsp + 0x20]
inc word [rbx + 0x5332]
mov edx, reloc.WS2_32.dll_recv
movsx r9d, word [rbx + 0x5332]
call fcn.140013ac0
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20c0347
call fcn.14001db60
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14006c830
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x140027710
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x53e0], 0
lea rbx, [rcx + 0x53e8]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x1400277b7
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x14002776a
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.140029680
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.140014640
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x53e0]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x53f0]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x140093058]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x1400277bf
mov rcx, rbx
call fcn.140014640
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x14004d870
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xd8
mov rax, qword [0x140092010]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov rsi, r9
mov rdi, r8
mov rbx, rdx
mov r15, rcx
mov edx, 4
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
xor r14d, r14d
mov eax, dword [rdx + rcx]
cmp dword [0x140096898], eax
jle 0x14004d969
lea rcx, [0x140096898]
call fcn.14006cb20
cmp dword [0x140096898], 0xffffffff
jne 0x14004d969
mov qword [rbp - 0x11], r14
mov qword [rbp - 1], r14
mov qword [rbp + 7], recv
mov byte [rbp - 0x11], r14b
lea r8d, [r14 + 0x15]
lea rdx, str.MmAllocatePagesForMdl
lea rcx, [rbp - 0x11]
call fcn.140054920
nop
lea r8, [rbp - 0x11]
mov rdx, qword [0x140093078]
mov rcx, r15
call fcn.14004e500
mov qword [0x140096840], rax
mov rdx, qword [rbp + 7]
cmp rdx, 0x10
jb 0x14004d95d
inc rdx
mov rcx, qword [rbp - 0x11]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004d957
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004d957
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006c920
nop
lea rcx, [0x140096898]
call fcn.14006cac0
mov r8, qword [0x140096840]
test r8, r8
jne 0x14004da4b
mov dword [rbp - 0x71], 0x17de17a5
mov dword [rbp - 0x6d], 0x1821185d
mov dword [rbp - 0x69], 0x18621844
mov dword [rbp - 0x65], 0x1869186d
mov dword [rbp - 0x61], 0x18631863
mov dword [rbp - 0x5d], 0x187d1828
mov dword [rbp - 0x59], 0x182b1865
mov dword [rbp - 0x55], 0x1864186a
mov dword [rbp - 0x51], 0x186b1860
mov dword [rbp - 0x4d], 0x185c1830
mov dword [rbp - 0x49], 0x1852187f
mov dword [rbp - 0x45], 0x187a1878
mov dword [rbp - 0x41], 0x18761875
mov dword [rbp - 0x3d], 0x187c186c
mov dword [rbp - 0x39], 0x187a184a
mov dword [rbp - 0x35], 0x1878187b
mov dword [rbp - 0x31], 0x1859186d
mov dword [rbp - 0x2d], 0x1853184f
mov dword [rbp - 0x29], 0x1847186f
mov dword [rbp - 0x25], 0x1848
mov byte [rbp - 0x21], 1
mov ecx, 0x17fe
nop
lea eax, [rcx + r14]
xor word [rbp + r14*2 - 0x71], ax
inc r14
cmp r14, 0x27
jb 0x14004da10
mov byte [rbp - 0x21], 0
lea rdx, [rbp - 0x71]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140054ad0
lea rdx, [0x140054cb0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xor eax, eax
jmp 0x14004da7e
mov qword [rbp + 0xf], r14
mov rax, qword [rbp + 0x7f]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rdi
mov r9, rbx
lea rdx, [rbp + 0xf]
mov rcx, r15
call fcn.140054d10
mov rcx, qword [rbp + 0xf]
test al, al
cmove rcx, r14
mov rax, rcx
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.14006c830
add rsp, 0xd8
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x14004dcf0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xc0
mov rax, qword [0x140092010]
xor rax, rsp
mov qword [rbp + 0x3f], rax
mov rsi, rdx
mov rdi, rcx
mov edx, 4
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
xor ebx, ebx
mov eax, dword [rdx + rcx]
cmp dword [0x1400968bc], eax
jle 0x14004dde0
lea rcx, [0x1400968bc]
call fcn.14006cb20
cmp dword [0x1400968bc], 0xffffffff
jne 0x14004dde0
mov qword [rbp + 0x17], rbx
mov qword [rbp + 0x27], rbx
mov qword [rbp + 0x2f], recv
mov byte [rbp + 0x17], bl
lea r8d, [rbx + 0x19]
lea rdx, str.MmProtectMdlSystemAddress
lea rcx, [rbp + 0x17]
call fcn.140054920
nop
lea r8, [rbp + 0x17]
mov rdx, qword [0x140093078]
mov rcx, rdi
call fcn.14004e500
mov qword [0x140096880], rax
mov rdx, qword [rbp + 0x2f]
cmp rdx, 0x10
jb 0x14004ddd4
inc rdx
mov rcx, qword [rbp + 0x17]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004ddce
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004ddce
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006c920
nop
lea rcx, [0x1400968bc]
call fcn.14006cac0
mov r8, qword [0x140096880]
test r8, r8
jne 0x14004ded9
mov dword [rbp - 0x49], 0x17de17a5
mov dword [rbp - 0x45], 0x1821185d
mov dword [rbp - 0x41], 0x18621844
mov dword [rbp - 0x3d], 0x1869186d
mov dword [rbp - 0x39], 0x18631863
mov dword [rbp - 0x35], 0x187d1828
mov dword [rbp - 0x31], 0x182b1865
mov dword [rbp - 0x2d], 0x1864186a
mov dword [rbp - 0x29], 0x186b1860
mov dword [rbp - 0x25], 0x185c1830
mov dword [rbp - 0x21], 0x1843187f
mov dword [rbp - 0x1d], 0x187a1866
mov dword [rbp - 0x19], 0x18721862
mov dword [rbp - 0x15], 0x186d187b
mov dword [rbp - 0x11], 0x187f1857
mov dword [rbp - 0xd], 0x184e1870
mov dword [rbp - 9], 0x186c1867
mov dword [rbp - 5], 0x18441854
mov dword [rbp - 1], 0x1862184f
mov dword [rbp + 3], 0x18411840
mov dword [rbp + 7], 0x18421854
mov dword [rbp + 0xb], 0x185a185b
mov word [rbp + 0xf], bx
mov byte [rbp + 0x11], 1
mov ecx, 0x17fe
nop word [rax + rax]
lea eax, [rcx + rbx]
xor word [rbp + rbx*2 - 0x49], ax
inc rbx
cmp rbx, 0x2c
jb 0x14004dea0
mov byte [rbp + 0x11], 0
lea rdx, [rbp - 0x49]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140054ad0
lea rdx, [0x140054cb0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xor al, al
jmp 0x14004defb
mov dword [rsp + 0x20], 0x40
mov r9, rsi
lea rdx, [rbp + 0x37]
mov rcx, rdi
call fcn.140055aa0
test al, al
je 0x14004ded5
cmp dword [rbp + 0x37], 0
setge al
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.14006c830
mov rbx, qword [rsp + 0xf0]
add rsp, 0xc0
pop rdi
pop rsi
pop rbp
ret
Function at 0x14004df20
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x37]
sub rsp, 0xb0
mov rax, qword [0x140092010]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov r14, r8
mov rsi, rdx
mov rdi, rcx
mov edx, 4
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
xor ebx, ebx
mov eax, dword [rdx + rcx]
cmp dword [0x140096828], eax
jle 0x14004e012
lea rcx, [0x140096828]
call fcn.14006cb20
cmp dword [0x140096828], 0xffffffff
jne 0x14004e012
mov qword [rbp + 7], rbx
mov qword [rbp + 0x17], rbx
mov qword [rbp + 0x1f], recv
mov byte [rbp + 7], bl
lea r8d, [rbx + 0x12]
lea rdx, str.MmUnmapLockedPages
lea rcx, [rbp + 7]
call fcn.140054920
nop
lea r8, [rbp + 7]
mov rdx, qword [0x140093078]
mov rcx, rdi
call fcn.14004e500
mov qword [0x1400968e8], rax
mov rdx, qword [rbp + 0x1f]
cmp rdx, 0x10
jb 0x14004e006
inc rdx
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004e000
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004e000
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006c920
nop
lea rcx, [0x140096828]
call fcn.14006cac0
mov r8, qword [0x1400968e8]
test r8, r8
jne 0x14004e0e9
mov dword [rbp - 0x49], 0x17de17a5
mov dword [rbp - 0x45], 0x1821185d
mov dword [rbp - 0x41], 0x18621844
mov dword [rbp - 0x3d], 0x1869186d
mov dword [rbp - 0x39], 0x18631863
mov dword [rbp - 0x35], 0x187d1828
mov dword [rbp - 0x31], 0x182b1865
mov dword [rbp - 0x2d], 0x1864186a
mov dword [rbp - 0x29], 0x186b1860
mov dword [rbp - 0x25], 0x185c1830
mov dword [rbp - 0x21], 0x1846187f
mov dword [rbp - 0x1d], 0x1878187a
mov dword [rbp - 0x19], 0x18671877
mov dword [rbp - 0x15], 0x18761854
mov dword [rbp - 0x11], 0x18701879
mov dword [rbp - 0xd], 0x18791879
mov dword [rbp - 9], 0x187e184e
mov dword [rbp - 5], 0x18441847
mov dword [rbp - 1], 0x1851
mov byte [rbp + 3], 1
mov ecx, 0x17fe
lea eax, [rcx + rbx]
xor word [rbp + rbx*2 - 0x49], ax
inc rbx
cmp rbx, 0x25
jb 0x14004e0b0
mov byte [rbp + 3], 0
lea rdx, [rbp - 0x49]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140054ad0
lea rdx, [0x140054cb0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xor al, al
jmp 0x14004e0fd
mov qword [rsp + 0x20], r14
mov r9, rsi
lea rdx, [rbp + 0x27]
mov rcx, rdi
call fcn.140056160
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.14006c830
add rsp, 0xb0
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x14004e120
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xa0
mov rax, qword [0x140092010]
xor rax, rsp
mov qword [rbp + 0x3f], rax
mov rsi, rdx
mov rdi, rcx
mov edx, 4
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
xor ebx, ebx
mov eax, dword [rdx + rcx]
cmp dword [0x140096800], eax
jle 0x14004e210
lea rcx, [0x140096800]
call fcn.14006cb20
cmp dword [0x140096800], 0xffffffff
jne 0x14004e210
mov qword [rbp + 0x17], rbx
mov qword [rbp + 0x27], rbx
mov qword [rbp + 0x2f], recv
mov byte [rbp + 0x17], bl
lea r8d, [rbx + 0x12]
lea rdx, str.MmFreePagesFromMdl
lea rcx, [rbp + 0x17]
call fcn.140054920
nop
lea r8, [rbp + 0x17]
mov rdx, qword [0x140093078]
mov rcx, rdi
call fcn.14004e500
mov qword [0x1400968c0], rax
mov rdx, qword [rbp + 0x2f]
cmp rdx, 0x10
jb 0x14004e204
inc rdx
mov rcx, qword [rbp + 0x17]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004e1fe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004e1fe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006c920
nop
lea rcx, [0x140096800]
call fcn.14006cac0
mov r8, qword [0x1400968c0]
test r8, r8
jne 0x14004e2e9
mov dword [rbp - 0x39], 0x17de17a5
mov dword [rbp - 0x35], 0x1821185d
mov dword [rbp - 0x31], 0x18621844
mov dword [rbp - 0x2d], 0x1869186d
mov dword [rbp - 0x29], 0x18631863
mov dword [rbp - 0x25], 0x187d1828
mov dword [rbp - 0x21], 0x182b1865
mov dword [rbp - 0x1d], 0x1864186a
mov dword [rbp - 0x19], 0x186b1860
mov dword [rbp - 0x15], 0x185c1830
mov dword [rbp - 0x11], 0x1855187f
mov dword [rbp - 0xd], 0x18701866
mov dword [rbp - 9], 0x18471873
mov dword [rbp - 5], 0x187e1879
mov dword [rbp - 1], 0x1868187f
mov dword [rbp + 3], 0x186f185a
mov dword [rbp + 7], 0x18721871
mov dword [rbp + 0xb], 0x1845186d
mov dword [rbp + 0xf], 0x184e
mov byte [rbp + 0x13], 1
mov ecx, 0x17fe
nop
lea eax, [rcx + rbx]
xor word [rbp + rbx*2 - 0x39], ax
inc rbx
cmp rbx, 0x25
jb 0x14004e2b0
mov byte [rbp + 0x13], 0
lea rdx, [rbp - 0x39]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140054ad0
lea rdx, [0x140054cb0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xor al, al
jmp 0x14004e2f8
mov r9, rsi
lea rdx, [rbp + 0x37]
mov rcx, rdi
call fcn.140056830
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.14006c830
mov rbx, qword [rsp + 0xd0]
add rsp, 0xa0
pop rdi
pop rsi
pop rbp
ret