joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001bcc0
Capabilities:
Hash data with crc32

Disassembly:
test r8d, r8d
jle 0x14001beb9
mov r11, rsp
push rbp
push rsi
sub rsp, 0x58
mov rax, qword [0x1400e9060]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov qword [r11 - 0x18], rdi
mov rbp, rcx
mov qword [r11 - 0x20], r14
lea rdi, [rdx + 0x18]
mov qword [r11 - 0x28], r15
mov r14d, 0xffffffff
lea r15, [0x1400cf7b0]
mov qword [r11 + 0x18], rbx
movsxd rsi, r8d
nop dword [rax + rax]
mov edx, dword [rdi - 0x18]
test edx, edx
je 0x14001be81
mov rcx, rbp
call fcn.14001b3b0
mov edx, dword [rdi - 0x14]
mov rbx, rax
test edx, edx
je 0x14001bd3e
lea rcx, [rbp + 0x2f88]
call fcn.1400045c0
mov rcx, rax
jmp 0x14001bd40
xor ecx, ecx
mov qword [rbx + 0x10], rcx
movsx eax, word [rdi]
movd xmm1, eax
movsx eax, word [rdi + 2]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
movss dword [rbx + 0x40], xmm1
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x44], xmm0
movsx eax, word [rdi + 4]
movd xmm1, eax
movsx eax, word [rdi + 6]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
movss dword [rbx + 0x48], xmm1
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x4c], xmm0
movsx eax, word [rdi + 8]
movd xmm1, eax
movsx eax, word [rdi + 0xa]
and dword [rbx + 0xb0], 0xfffffe49
or dword [rbx + 0xb0], 0x49
cvtdq2ps xmm1, xmm1
movd xmm0, eax
movss dword [rbx + 0x50], xmm1
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x54], xmm0
test rcx, rcx
je 0x14001bdd1
cmp qword [rcx + 0x18], 0
jne 0x14001bdc6
mov qword [rcx + 0x18], rbx
jmp 0x14001bdd1
cmp qword [rcx + 0x20], 0
jne 0x14001bdd1
mov qword [rcx + 0x20], rbx
mov eax, dword [rdi - 0xc]
mov rcx, rbx
mov dword [rbx + 0xa8], eax
movsx eax, byte [rdi - 8]
mov dword [rbx + 0x58], eax
mov eax, dword [rdi - 4]
and eax, 0x61fc20
or dword [rbx + 8], eax
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x14001be0c
nop dword [rax + rax]
mov rcx, rax
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x14001be00
mov r9d, dword [rcx]
lea r8, str.DockNode__02X
lea rcx, [rsp + 0x20]
mov edx, reloc.WS2_32.dll_sendto
call fcn.140003f20
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov edx, r14d
test r9b, r9b
je 0x14001be68
cmp r9b, 0x23
jne 0x14001be4b
cmp byte [r8], r9b
jne 0x14001be4b
cmp byte [r8 + 1], r9b
cmove edx, r14d
movzx ecx, dl
movzx eax, r9b
movzx r9d, byte [r8]
xor rcx, rax
shr edx, 8
inc r8
xor edx, dword [r15 + rcx*4]
test r9b, r9b
jne 0x14001be38
mov rcx, qword [0x1401389e0]
not edx
add rcx, 0x1b80
call fcn.1400045c0
mov qword [rbx + 0x78], rax
add rdi, 0x24
sub rsi, 1
jne 0x14001bd10
mov r15, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400bb890
add rsp, 0x58
pop rsi
pop rbp
ret
Function at 0x14001c980
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
sub rsp, 0x20
mov rax, qword [rcx + 0x10]
mov rbx, rcx
mov rbp, qword [0x1401389e0]
test rax, rax
je 0x14001c9a8
mov eax, dword [rax + 4]
mov dword [rcx + 4], eax
mov rcx, qword [rcx + 0x18]
test rcx, rcx
je 0x14001c9b6
call fcn.14001c980
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x14001c9c4
call fcn.14001c980
mov r9d, dword [rbx + 0x28]
xor esi, esi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], r14
test r9d, r9d
jle 0x14001caa6
mov r14d, esi
mov rax, qword [rbx + 0x30]
mov r8d, dword [rbx + 0x9c]
mov ecx, dword [rbp + 0x1b20]
inc r8d
mov rdi, qword [r14 + rax]
cmp r8d, ecx
jne 0x14001ca0d
mov eax, dword [rdi + 0x2d8]
inc eax
cmp eax, ecx
jge 0x14001ca0d
mov dl, 1
jmp 0x14001ca14
xor dl, dl
cmp r8d, ecx
jne 0x14001ca3c
test byte [rbx + 0xb4], 0x20
jne 0x14001ca28
mov eax, dword [rdi + 8]
cmp dword [rbx + 0xac], eax
jne 0x14001ca3c
cmp byte [rdi + 0xc8], 0
je 0x14001ca3c
test dword [rdi + 0xc], 0x100000
jne 0x14001ca3c
mov dl, 1
movzx ecx, byte [rdi + 0x472]
movzx eax, cl
shr al, 2
and al, 1
or al, dl
je 0x14001ca86
and cl, 0xfb
mov byte [rdi + 0x472], cl
cmp dword [rbx + 0x28], 1
jne 0x14001ca6c
mov eax, dword [rbx + 8]
shr eax, 0xb
test al, 1
je 0x14001cb0c
mov r8d, dword [rbx]
mov rdx, rdi
mov rcx, rbx
call fcn.14001c540
mov r9d, dword [rbx + 0x28]
dec esi
sub r14, 8
jmp 0x14001ca97
mov eax, dword [rdi + 0x28]
not eax
and dword [rbx + 8], eax
mov eax, dword [rbx + 8]
or eax, dword [rdi + 0x24]
mov dword [rbx + 8], eax
inc esi
add r14, 8
cmp esi, r9d
jl 0x14001c9e0
movzx edx, byte [rbx + 0xb5]
movzx ecx, dl
test dl, 1
je 0x14001cad5
cmp r9d, 1
jne 0x14001cad5
mov r8d, dword [rbx + 8]
mov eax, r8d
or eax, dword [rbx + 4]
test al, 0x40
je 0x14001cad5
shr r8d, 0xd
test r9b, r8b
jne 0x14001cad5
or cl, 2
and cl, 0xfe
mov byte [rbx + 0xb5], cl
movzx eax, cl
test cl, 2
je 0x14001cafd
mov rdx, qword [rbx + 0x80]
test rdx, rdx
je 0x14001cafd
test dword [rdx + 0x24], 0x2000
je 0x14001cafd
and al, 0xfd
cmp r9d, 1
jle 0x14001cb2b
and dword [rbx + 8], 0xffffdfff
jmp 0x14001cb36
mov rcx, rbx
call fcn.14001c8a0
mov r8d, dword [rbx]
mov rdx, rdi
mov rcx, rbx
mov dword [rbx + 0xc], 1
call fcn.14001c540
jmp 0x14001cb9c
test al, 2
je 0x14001cb36
xor dword [rbx + 8], 0x2000
mov ecx, dword [rbx + 8]
and al, 0xfd
mov byte [rbx + 0xb5], al
mov eax, ecx
shr eax, 0xb
shr ecx, 0xa
cmp qword [rbx + 0x10], 0
movzx eax, al
movzx edx, cl
cmovne edx, eax
test r9d, r9d
setg al
or dl, al
mov rax, qword [rbx + 0x18]
test rax, rax
je 0x14001cb73
test byte [rax + 0xb4], 1
je 0x14001cb73
mov dl, 1
mov rax, qword [rbx + 0x20]
test rax, rax
je 0x14001cb89
test byte [rax + 0xb4], 1
je 0x14001cb89
mov al, 1
jmp 0x14001cb8b
xor al, al
and byte [rbx + 0xb4], 0xfe
or al, dl
and al, 1
or byte [rbx + 0xb4], al
mov r14, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret
Function at 0x14003d0a0
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x28
mov r10, rdx
test r8, r8
je 0x14003d12b
movzx r9d, byte [rdx]
lea r8, [rdx + 1]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x14003d100
lea r10, [0x1400cf7b0]
nop dword [rax]
cmp r9b, 0x23
jne 0x14003d0e3
cmp byte [r8], r9b
jne 0x14003d0e3
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [r10 + rdx*4]
test r9b, r9b
jne 0x14003d0d0
mov rcx, qword [0x1401389e0]
not eax
cmp dword [rcx + 0x1bf0], eax
jne 0x14003d117
mov dword [rcx + 0x1bf4], eax
cmp dword [rcx + 0x1c30], eax
jne 0x14003d17d
mov byte [rcx + 0x1c34], 1
add rsp, 0x28
ret
mov qword [rsp + 0x20], rbx
xor edx, edx
mov rbx, qword [0x1401389e0]
mov rax, qword [rbx + 0x1b98]
movsxd rcx, dword [rax + 0x108]
mov rax, qword [rax + 0x110]
mov r8d, dword [rax + rcx*4 - 4]
mov rcx, r10
call fcn.140004030
cmp dword [rbx + 0x1bf0], eax
jne 0x14003d169
mov dword [rbx + 0x1bf4], eax
cmp dword [rbx + 0x1c30], eax
jne 0x14003d178
mov byte [rbx + 0x1c34], 1
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret

Function at 0x140042980
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x1400e9060]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov edi, ecx
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
movabs rax, 0x20c49ba5e353f7cf
lea rcx, [rsp + 0x20]
imul qword [rsp + 0x28]
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov qword [rsp + 0x28], rdx
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x20]
cqo
mov qword [rsp + 0x20], 0
idiv qword [rsp + 0x28]
add rdi, rax
test rdi, rdi
jle 0x140042a11
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x20]
cqo
idiv qword [rsp + 0x28]
mov qword [rsp + 0x20], rax
cmp rax, rdi
jl 0x1400429f0
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400bb890
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x1400535e0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je case.default.0x140053610
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rsi
mov rsi, rbx
mov r9, qword [rax]
test r9, r9
je 0x140053638
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x14005363a
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140053693
test ecx, ecx
jle 0x140053673
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
sub rbx, rbp
add r14, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140053693
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140053693
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov rbp, qword [rsp + 0x30]
sub rsi, rbx
mov rbx, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
in eax, 2
add byte [rax], al
add byte [rax - 0x7f], cl
invalid
Function at 0x140053c10
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x1400e9060]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x140053c3d
xor eax, eax
jmp 0x140053d92
mov rdx, qword [rcx + 0x40]
mov rax, qword [rdx]
test rax, rax
je 0x140053c68
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
add r8, rax
cmp rax, r8
jae 0x140053c68
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], dil
mov eax, edi
jmp 0x140053d92
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x140053d85
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x140053cab
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140053cd6
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140053d8a
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140053d45
sub eax, 1
je 0x140053d45
cmp eax, 2
jne 0x140053d85
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140053d8a
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x140053d73
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x140053d85
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov eax, edi
jne 0x140053d8a
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400bb890
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x1400558b0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1400e9060]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140055983
cmp byte [rcx + 0x71], 0
je 0x140055983
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + Ordinal_26]
cmp eax, 0xffffffff
je 0x14005597f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140055944
sub eax, 1
je 0x140055948
cmp eax, 2
jne 0x14005597f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400bb890
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140055976
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14005597f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14005592c
xor al, al
jmp 0x14005592c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400bb890
add rsp, 0x60
pop rbx
ret
Function at 0x14006a740
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x47], 0
je 0x14006a763
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x49]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x46
jb 0x14006a750
mov byte [rcx + 0x47], 0
mov rax, rcx
ret

Function at 0x14006a770
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x60], rcx
xor esi, esi
cmp byte [r8 + 6], sil
je 0x14006a7a4
mov ecx, esi
lea eax, [rcx - 0x49]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 5
jb 0x14006a790
mov byte [r8 + 6], sil
lea rax, [r8 + 5]
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x40], 0
cmp r9, rax
je 0x14006a7d9
mov r8d, 5
mov rdx, r9
lea rcx, [rsp + 0x40]
call fcn.140046bc0
nop
cmp byte [rbx + 0xa], 0
je 0x14006a803
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x49]
xor byte [rbx + rcx], al
inc rcx
cmp rcx, 9
jb 0x14006a7f0
mov byte [rbx + 0xa], 0
lea rax, [rbx + 9]
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x20], 0
cmp rbx, rax
je 0x14006a838
mov r8d, 9
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.140046bc0
nop
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x20]
mov rcx, rdi
call fcn.140060d50
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x14006a88c
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006a886
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14006a886
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400bbeac
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x14006a8cc
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006a8c7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14006a8c7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400bbeac
mov rax, rdi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x14006a8e0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x40], rcx
xor esi, esi
cmp byte [r8 + 7], sil
je 0x14006a914
mov ecx, esi
lea eax, [rcx - 0x49]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 6
jb 0x14006a900
mov byte [r8 + 7], sil
lea rax, [r8 + 6]
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x20], 0
cmp r9, rax
je 0x14006a949
mov r8d, 6
mov rdx, r9
lea rcx, [rsp + 0x20]
call fcn.140046bc0
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x14006a957
mov rbx, qword [rbx]
mov r8, rbx
lea rcx, [rsp + 0x20]
call fcn.1400614e0
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x14006a9cc
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006a9c7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14006a9c7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400bbeac
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x14006a9e0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x40], rcx
xor esi, esi
cmp byte [r8 + 0xa], sil
je 0x14006aa14
mov ecx, esi
lea eax, [rcx - 0x49]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 9
jb 0x14006aa00
mov byte [r8 + 0xa], sil
lea rax, [r8 + 9]
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x20], 0
cmp r9, rax
je 0x14006aa49
mov r8d, 9
mov rdx, r9
lea rcx, [rsp + 0x20]
call fcn.140046bc0
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x14006aa57
mov rbx, qword [rbx]
mov r8, rbx
lea rcx, [rsp + 0x20]
call fcn.1400614e0
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x14006aacc
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006aac7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14006aac7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400bbeac
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x14006aae0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x136], 0
je 0x14006ab08
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x49]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x135
jb 0x14006aaf0
mov byte [rcx + 0x136], 0
mov rax, rcx
ret
Function at 0x14006ab40
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x40], rcx
xor esi, esi
cmp byte [r8 + 0xc], sil
je 0x14006ab74
mov ecx, esi
lea eax, [rcx - 0x49]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 0xb
jb 0x14006ab60
mov byte [r8 + 0xc], sil
lea rax, [r8 + 0xb]
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x20], 0
cmp r9, rax
je 0x14006aba9
mov r8d, listen
mov rdx, r9
lea rcx, [rsp + 0x20]
call fcn.140046bc0
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x14006abb7
mov rbx, qword [rbx]
mov r8, rbx
lea rcx, [rsp + 0x20]
call fcn.1400614e0
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x14006ac2c
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006ac27
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14006ac27
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400bbeac
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x14006b470
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x60], rcx
xor esi, esi
cmp byte [r8 + 6], sil
je 0x14006b4a4
mov ecx, esi
lea eax, [rcx - 0x49]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 5
jb 0x14006b490
mov byte [r8 + 6], sil
lea rax, [r8 + 5]
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x40], 0
cmp r9, rax
je 0x14006b4d9
mov r8d, 5
mov rdx, r9
lea rcx, [rsp + 0x40]
call fcn.140046bc0
nop
cmp byte [rbx + 0xd], 0
je 0x14006b503
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x49]
xor byte [rbx + rcx], al
inc rcx
cmp rcx, 0xc
jb 0x14006b4f0
mov byte [rbx + 0xd], 0
lea rax, [rbx + 0xc]
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x20], 0
cmp rbx, rax
je 0x14006b538
mov r8d, listen
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.140046bc0
nop
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x20]
mov rcx, rdi
call fcn.140060d50
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x14006b58c
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006b586
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14006b586
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400bbeac
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x14006b5cc
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006b5c7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14006b5c7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400bbeac
mov rax, rdi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret