joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140010e80
Capabilities:
Persist via windows service
Set registry value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x98
mov rax, qword [0x1400bb088]
xor rax, rsp
mov qword [rsp + 0x88], rax
lea rdx, str.SystemCurrentControlSetServices_
lea rcx, [rsp + 0x68]
call fcn.140003560
nop
mov rdx, qword [rsp + 0xa8]
lea rcx, [rsp + 0x68]
call fcn.14000c190
lea rcx, [rsp + 0x68]
call fcn.14000c0b0
lea r8, [rsp + 0x58]
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x140010f0a
mov byte [rsp + 0x34], 0
lea rcx, [rsp + 0x68]
call fcn.14000c1b0
movzx eax, byte [rsp + 0x34]
jmp 0x1400110c0
mov byte [rsp + 0x60], 1
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.Type
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x140010f60
mov byte [rsp + 0x35], 0
lea rcx, [rsp + 0x68]
call fcn.14000c1b0
movzx eax, byte [rsp + 0x35]
jmp 0x1400110c0
mov byte [rsp + 0x61], 3
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x61]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.ErrorControl
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x140010fb6
mov byte [rsp + 0x36], 0
lea rcx, [rsp + 0x68]
call fcn.14000c1b0
movzx eax, byte [rsp + 0x36]
jmp 0x1400110c0
mov byte [rsp + 0x62], 3
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x62]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.Start
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x14001100c
mov byte [rsp + 0x37], 0
lea rcx, [rsp + 0x68]
call fcn.14000c1b0
movzx eax, byte [rsp + 0x37]
jmp 0x1400110c0
mov rcx, qword [rsp + 0xa0]
call fcn.14000c160
mov dword [rsp + 0x40], eax
mov rcx, qword [rsp + 0xa0]
call fcn.14000c0b0
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x50], rax
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.ImagePath
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x140011087
mov byte [rsp + 0x38], 0
lea rcx, [rsp + 0x68]
call fcn.14000c1b0
movzx eax, byte [rsp + 0x38]
jmp 0x1400110c0
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x1400110a0
mov dword [rsp + 0x3c], 1
jmp 0x1400110a8
mov dword [rsp + 0x3c], 0
movzx eax, byte [rsp + 0x3c]
mov byte [rsp + 0x39], al
lea rcx, [rsp + 0x68]
call fcn.14000c1b0
movzx eax, byte [rsp + 0x39]
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140080f30
add rsp, 0x98
ret
Function at 0x140017080
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x118
mov rax, qword [rsp + 0x120]
add rax, 0x18
mov rcx, rax
call fcn.140017960
mov rax, qword [rsp + 0x120]
add rax, 0x18
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x120]
mov rax, qword [rax + 0x38]
mov eax, dword [rax + 0x50]
mov edx, eax
mov rcx, qword [rsp + 0x38]
call fcn.140017a00
mov rax, qword [rsp + 0x120]
add rax, 0x18
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0xc0]
mov rcx, qword [rsp + 0x40]
call fcn.140017900
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x120]
mov rax, qword [rax + 0x38]
mov eax, dword [rax + 0x54]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x120]
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0xc8]
mov rcx, qword [rsp + 0x50]
call fcn.140017900
mov rax, qword [rax]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x68], rax
mov r9, qword [rsp + 0x60]
mov r8d, dword [rsp + 0x30]
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0xd0]
call fcn.140017c60
mov qword [rsp + 0x28], 0
jmp 0x140017179
mov rax, qword [rsp + 0x28]
inc rax
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x120]
mov rax, qword [rax + 0x38]
movzx eax, word [rax + 6]
cmp qword [rsp + 0x28], rax
jae 0x140017303
imul rax, qword [rsp + 0x28], 0x28
mov rcx, qword [rsp + 0x120]
add rax, qword [rcx + 0x40]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x120]
add rax, 0x18
mov rcx, rax
call fcn.140012600
mov rcx, qword [rsp + 0x20]
mov ecx, dword [rcx + 0xc]
add rax, rcx
mov qword [rsp + 0xd8], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x14]
mov rcx, qword [rsp + 0x120]
add rax, qword [rcx + 0x30]
mov qword [rsp + 0xe0], rax
mov rax, qword [rsp + 0x120]
add rax, 0x18
mov qword [rsp + 0x70], rax
lea rdx, [rsp + 0xe8]
mov rcx, qword [rsp + 0x70]
call fcn.140017900
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0xc]
mov qword [rsp + 0x78], rax
mov r8, qword [rsp + 0x78]
lea rdx, [rsp + 0xf0]
mov rcx, qword [rsp + 0x80]
call fcn.1400178b0
mov rax, qword [rax]
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0xb0], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x10]
mov dword [rsp + 0x34], eax
mov rax, qword [rsp + 0x120]
mov qword [rsp + 0x90], rax
lea rdx, [rsp + 0xf8]
mov rcx, qword [rsp + 0x90]
call fcn.140017900
mov qword [rsp + 0xa0], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x14]
mov qword [rsp + 0x98], rax
mov r8, qword [rsp + 0x98]
lea rdx, [rsp + 0x100]
mov rcx, qword [rsp + 0xa0]
call fcn.1400178b0
mov rax, qword [rax]
mov qword [rsp + 0xa8], rax
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0xb8], rax
mov r9, qword [rsp + 0xb0]
mov r8d, dword [rsp + 0x34]
mov rdx, qword [rsp + 0xb8]
lea rcx, [rsp + 0x108]
call fcn.140017c60
jmp 0x14001716c
add rsp, 0x118
ret
Function at 0x140018830
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xa8
mov rax, qword [0x1400bb088]
xor rax, rsp
mov qword [rsp + 0x90], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.HARDWARERESOURCEMAPSystem_ResourcesPhysical_Memory
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x88]
xor r8d, r8d
lea rdx, str..Translated
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [rsp + 0x78]
mov ecx, eax
call fcn.140081488
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x88]
xor r8d, r8d
lea rdx, str..Translated
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 0x10]
mov dword [rsp + 0x48], eax
mov rax, qword [rsp + 0x38]
add rax, 0x18
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x30], 0
jmp 0x140018927
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x48]
cmp dword [rsp + 0x30], eax
jae 0x140018963
mov rax, qword [rsp + 0x40]
add rax, 8
mov r9, rax
mov r8, qword [rsp + 0x40]
lea rdx, [rsp + 0x68]
lea rcx, [0x1400bcf08]
call fcn.140013f90
mov rax, qword [rsp + 0x40]
add rax, 0x14
mov qword [rsp + 0x40], rax
jmp 0x14001891d
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x50]
call fcn.140080f50
cmp qword [rsp + 0x50], 0
jne 0x14001898a
mov qword [rsp + 0x60], 0
jmp 0x14001899d
mov qword [rsp + 0x38], 0x8123
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140080f30
add rsp, 0xa8
ret
Function at 0x1400189d0
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov rax, qword [0x1400bb088]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x50], 0
lea r9, [rsp + 0x50]
mov r8d, dword [rsp + 0x50]
mov rdx, qword [rsp + 0x28]
mov ecx, ntohl
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0xc0000004
jne 0x140018a76
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, dword [rsp + 0x50]
mov r9d, 4
mov r8d, 0x3000
mov edx, eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x50]
mov r8d, dword [rsp + 0x50]
mov rdx, qword [rsp + 0x28]
mov ecx, ntohl
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov dword [rsp + 0x30], eax
jmp 0x140018a1a
cmp dword [rsp + 0x30], 0
jge 0x140018a97
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
jmp 0x140018b8d
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x20], 0
jmp 0x140018ab5
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x38]
mov eax, dword [rax]
cmp dword [rsp + 0x20], eax
jae 0x140018b78
mov eax, dword [rsp + 0x20]
imul rax, rax, 0x128
mov rcx, qword [rsp + 0x38]
lea rax, [rcx + rax + 8]
mov ecx, dword [rsp + 0x20]
imul rcx, rcx, 0x128
mov rdx, qword [rsp + 0x38]
movzx ecx, word [rdx + rcx + 0x2e]
lea rax, [rax + rcx + 0x28]
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.140003560
lea rcx, [rsp + 0x58]
call fcn.14000c0b0
mov rdx, qword [rsp + 0x90]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x140018b69
mov eax, dword [rsp + 0x20]
imul rax, rax, 0x128
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx + rax + 0x18]
mov qword [rsp + 0x40], rax
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x58]
call fcn.14000c1b0
mov rax, qword [rsp + 0x48]
jmp 0x140018b8d
lea rcx, [rsp + 0x58]
call fcn.14000c1b0
jmp 0x140018aab
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140080f30
add rsp, 0x88
ret
Function at 0x1400196d0
Capabilities:
Load ntoskrnl

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0xd8
mov rax, qword [0x1400bb088]
xor rax, rsp
mov qword [rsp + 0xc0], rax
lea rcx, [0x1400bcf70]
call fcn.1400156a0
test rax, rax
jne 0x140019716
movzx eax, word [0x1400bcfa8]
test eax, eax
jne 0x140019716
cmp qword [0x1400bcfb0], 0
je 0x14001971b
jmp 0x140019903
lea rcx, [0x1400a5730]
call fcn.1400037d0
mov r8b, 1
mov rdx, rax
lea rcx, [0x1400a5320]
call fcn.140018bb0
mov dword [0x1400bcfa4], eax
xor edx, edx
mov eax, dword [0x1400bcfa4]
mov ecx, 0x1000
div ecx
mov eax, edx
mov word [0x1400bcfa8], ax
mov r8d, 1
xor edx, edx
lea rcx, [0x1400a5330]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov qword [0x1400bcfb0], rax
mov edx, Ordinal_27
lea rcx, [rsp + 0x98]
call fcn.140010240
lea rcx, [rsp + 0x98]
call fcn.140017b60
nop
lea rax, [0x1400bcf08]
mov qword [rsp + 0x38], rax
mov edx, 8
lea rcx, [rsp + 0x90]
call fcn.140010240
lea rdx, [rsp + 0x90]
mov rcx, qword [rsp + 0x38]
call fcn.140013700
lea rdx, [rsp + 0x88]
mov rcx, qword [rsp + 0x38]
call fcn.14001a7b0
jmp 0x1400197e4
lea rcx, [rsp + 0x90]
call fcn.14001a730
movzx edx, byte [rsp + 0x88]
lea rcx, [rsp + 0x90]
call fcn.14001a770
movzx eax, al
test eax, eax
je 0x140019899
lea rcx, [rsp + 0x90]
call fcn.14001a750
lea rcx, [rsp + 0xb0]
mov rdi, rcx
mov rsi, rax
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0x48], rax
lea rax, [0x140019960]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xb0]
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x78]
call fcn.14001b640
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x60], rax
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x98]
call fcn.140019930
nop
lea rcx, [rsp + 0x78]
call fcn.140002a70
jmp 0x1400197d7
lea rax, [rsp + 0x98]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x40]
call fcn.140012370
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x40]
call fcn.14001a670
mov qword [rsp + 0x68], rax
jmp 0x1400198d4
mov rax, qword [rsp + 0x30]
add rax, 0x10
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x68]
cmp qword [rsp + 0x30], rax
je 0x1400198f6
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x70], rax
mov rcx, qword [rsp + 0x70]
call fcn.1400186c0
jmp 0x1400198c6
lea rcx, [rsp + 0x98]
call fcn.14001a680
mov rax, qword [rsp + 0xf0]
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.140080f30
add rsp, 0xd8
pop rdi
pop rsi
ret
Function at 0x14001c6a0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [0x1400bb088]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov edx, 8
lea rcx, [rsp + 0x40]
call fcn.140010240
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x40]
call fcn.14001d0a0
nop
lea rax, [0x14001d140]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x60]
add rax, 8
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x40]
call fcn.140012370
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rsp + 0x38]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov rcx, qword [rsp + 0x60]
mov qword [rcx], rax
mov rax, qword [rsp + 0x60]
cmp qword [rax], 0
je 0x14001c764
lea rcx, [rsp + 0x40]
call fcn.1400163f0
jmp 0x14001c77c
mov rax, qword [rsp + 0x60]
mov dword [rax + 8], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
lea rcx, [rsp + 0x40]
call fcn.14001cce0
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140080f30
add rsp, 0x58
ret

Function at 0x14001dad0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 7], sil
je 0x14001db04
mov eax, esi
lea ecx, [rax + 0x48]
xor byte [r8 + rax], cl
inc rax
cmp rax, 6
jb 0x14001daf0
mov byte [r8 + 7], sil
add r8, 6
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.14000da50
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x14001db29
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.14000e9b0
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x14001dba3
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001db9e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001db9e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140080f50
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x14001dbb0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 9], sil
je 0x14001dbe4
mov eax, esi
lea ecx, [rax + 0x48]
xor byte [r8 + rax], cl
inc rax
cmp rax, 8
jb 0x14001dbd0
mov byte [r8 + 9], sil
add r8, 8
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.14000da50
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x14001dc09
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.14000e9b0
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x14001dc83
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001dc7e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001dc7e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140080f50
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x14001dc90
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 0xa], sil
je 0x14001dcc4
mov eax, esi
lea ecx, [rax + 0x48]
xor byte [r8 + rax], cl
inc rax
cmp rax, 9
jb 0x14001dcb0
mov byte [r8 + 0xa], sil
add r8, 9
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.14000da50
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x14001dce9
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.14000e9b0
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x14001dd63
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001dd5e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001dd5e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140080f50
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x14001dd70
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 0xc], sil
je 0x14001dda4
mov eax, esi
lea ecx, [rax + 0x48]
xor byte [r8 + rax], cl
inc rax
cmp rax, 0xb
jb 0x14001dd90
mov byte [r8 + 0xc], sil
add r8, 0xb
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.14000da50
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x14001ddc9
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.14000e9b0
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x14001de43
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001de3e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001de3e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140080f50
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x1400247d0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 9], al
je 0x1400247f3
lea edx, [rax + 0x48]
xor byte [rax + rcx], dl
inc rax
cmp rax, 8
jb 0x1400247e0
mov byte [rcx + 9], 0
lea r8, [rcx + 8]
mov rdx, rcx
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.14000da50
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x140024810
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 0x10], al
je 0x140024833
lea edx, [rax + 0x48]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xf
jb 0x140024820
mov byte [rcx + 0x10], 0
lea r8, [rcx + 0xf]
mov rdx, rcx
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.14000da50
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x140025940
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x136], 0
je 0x140025968
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x48]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x135
jb 0x140025950
mov byte [rcx + 0x136], 0
mov rax, rcx
ret

Function at 0x140025970
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x44], 0
je 0x140025993
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x48]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x43
jb 0x140025980
mov byte [rcx + 0x44], 0
mov rax, rcx
ret

Function at 0x1400259a0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x47], 0
je 0x1400259c3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x48]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x46
jb 0x1400259b0
mov byte [rcx + 0x47], 0
mov rax, rcx
ret
Function at 0x1400259d0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0xa8
xor eax, eax
cmp byte [0x1400bc298], al
jne 0x140025a81
movdqa xmm0, xmmword [0x1400894b0]
movdqa xmm1, xmmword [0x1400892f0]
movdqa xmmword [rsp + 0x40], xmm0
movdqa xmm0, xmmword [0x140089460]
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmm0, xmmword [0x1400895c0]
movdqa xmmword [rsp + 0x50], xmm1
movdqa xmm1, xmmword [0x1400895b0]
movdqa xmmword [rsp + 0x80], xmm0
movdqa xmmword [rsp + 0x70], xmm1
mov dword [rsp + 0x90], 0x100eaf6
nop dword [rax]
lea ecx, [rax + 0x48]
xor byte [rsp + rax + 0x40], cl
inc rax
cmp rax, 0x52
jb 0x140025a40
lea r9, [rsp + 0xb0]
mov byte [rsp + 0x93], 0
lea r8, [rsp + 0x92]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.14000da50
lea rcx, [rsp + 0x20]
call fcn.1400282a0
add rsp, 0xa8
ret
Function at 0x140026190
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
mov r10, rcx
mov ecx, r9d
test r8, r8
je 0x140026277
sub r10, rdx
cmp r8, 8
jb 0x14002624c
mov rax, r8
lea r9, [rdx + 4]
and rax, 0xfffffffffffffff8
xorps xmm3, xmm3
xorps xmm2, xmm2
movd xmm1, dword [r10 + r9 - 4]
add rcx, 8
movd xmm0, dword [r9 - 4]
lea r9, [r9 + 8]
punpcklbw xmm1, xmm1
punpcklwd xmm1, xmm1
punpcklbw xmm0, xmm0
psrad xmm1, 0x18
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
movd xmm0, dword [r9 - 8]
punpcklbw xmm0, xmm0
orps xmm3, xmm1
movd xmm1, dword [r10 + r9 - 8]
punpcklbw xmm1, xmm1
punpcklwd xmm1, xmm1
punpcklwd xmm0, xmm0
psrad xmm1, 0x18
psrad xmm0, 0x18
xorps xmm1, xmm0
orps xmm2, xmm1
cmp rcx, rax
jb 0x1400261c0
orps xmm2, xmm3
movdqa xmm0, xmm2
psrldq xmm0, 8
orps xmm2, xmm0
movdqa xmm0, xmm2
psrldq xmm0, 4
orps xmm2, xmm0
movd r9d, xmm2
cmp rcx, r8
jae 0x140026277
lea rax, [rcx + rdx]
sub r8, rcx
nop dword [rax]
nop word [rax + rax]
movsx edx, byte [r10 + rax]
movsx ecx, byte [rax]
lea rax, [rax + 1]
xor edx, ecx
or r9d, edx
sub r8, 1
jne 0x140026260
test r9d, r9d
sete al
ret