joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140004640
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rax, qword gs:[0x58]
mov rbx, qword [rax]
mov ecx, 0x13b0
mov eax, dword [rcx + rbx]
mov edi, reloc.WLDAP32.dll_Ordinal_32
test al, 1
jne 0x1400046cd
or eax, 1
mov dword [rcx + rbx], eax
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov ecx, eax
movabs rax, 0x5555555555555555
mov qword [rbx + rdi + 0x1388], rax
mov qword [rbx + rdi + 8], rcx
mov edx, 1
lea r8, [rdi + 0x10]
add r8, rbx
movabs r9, 0x5851f42d4c957f2d
mov rax, rcx
shr rax, 0x3e
xor rcx, rax
imul rcx, r9
add rcx, rdx
mov qword [r8], rcx
inc rdx
lea r8, [r8 + 8]
cmp rdx, 0x138
jb 0x1400046a2
mov dword [rbx + rdi], 0x138
add rbx, rdi
mov rcx, rbx
call fcn.14001a9f0
mov rcx, rax
mov eax, reloc.WLDAP32.dll_Ordinal_26
mul rcx
cmp rax, 0x1a
jae 0x140004709
cmp rax, 0x10
jae 0x140004709
nop
mov rcx, rbx
call fcn.14001a9f0
mov rcx, rax
mov eax, reloc.WLDAP32.dll_Ordinal_26
mul rcx
cmp rax, 0x10
jb 0x1400046f0
mov ecx, 0x40
and ecx, 0x3f
shr rdx, cl
lea eax, [rdx + 0x61]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x14000ce10
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x14000ce38
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x14000ce5e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x14000ce60
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x14000ceb9
test ecx, ecx
jle 0x14000ce99
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x14000ceb9
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x14000ceb9
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret

Function at 0x14000cee0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x14000cf02
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x14000cf18
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x14000cf34
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14000cf36
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14000cf72
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x14000d00e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x14000cfad
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x14000cfee
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x14000d00e
cmp rbx, rax
ja 0x14000cfc0
test rbx, rbx
je 0x14000d00e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
Function at 0x14000d480
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x1400a3080]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14000d4ad
xor eax, eax
jmp 0x14000d619
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x14000d4e7
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x14000d4e7
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x14000d619
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x14000d60c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14000d52a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x14000d555
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14000d611
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14000d5c4
sub eax, 1
je 0x14000d5c4
cmp eax, 2
jne 0x14000d60c
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14000d611
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x14000d5f2
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x14000d60c
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x14000d611
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14007fbf0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x14000ea20
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1400a3080]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x14000eaf3
cmp byte [rcx + 0x71], 0
je 0x14000eaf3
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + Ordinal_26]
cmp eax, 0xffffffff
je 0x14000eaef
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14000eab4
sub eax, 1
je 0x14000eab8
cmp eax, 2
jne 0x14000eaef
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14007fbf0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x14000eae6
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14000eaef
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14000ea9c
xor al, al
jmp 0x14000ea9c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14007fbf0
add rsp, 0x60
pop rbx
ret

Function at 0x14000fb60
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
sub rsp, 0xd8
mov rax, qword [0x1400a3080]
xor rax, rsp
mov qword [rsp + 0xc8], rax
mov rcx, qword [0x1400a4480]
lea rax, [r11 - 0x18]
mov qword [rsp + 0x40], rax
xor r8d, r8d
cmp qword [rcx + 0x20], 0xf
lea rax, [0x140092631]
mov qword [rsp + 0x50], rax
mov rax, qword [rcx + 0x30]
mov qword [rsp + 0x30], rdx
lea rdx, [rcx + 8]
mov qword [r11 - 0x78], rax
mov rax, qword [rcx + 0x28]
mov qword [rsp + 0x38], 8
mov qword [rsp + 0x48], r8
mov dword [r11 - 0x80], r8d
movups xmm0, xmmword [rsp + 0x30]
mov qword [r11 - 0x70], rax
lea rax, str.__C:_test.exe
movups xmm1, xmmword [rsp + 0x40]
mov qword [r11 - 0x60], rax
lea rax, [rsp + 0x30]
movaps xmmword [r11 - 0x58], xmm0
movups xmm0, xmmword [rsp + 0x50]
mov qword [r11 - 0x28], rax
mov qword [r11 - 0x18], r8
mov qword [r11 - 0x68], 0x3a9fdb6
movaps xmmword [r11 - 0x48], xmm1
movaps xmmword [r11 - 0x38], xmm0
jbe 0x14000fc0e
mov rdx, qword [rdx]
mov rcx, qword [rcx]
lea rax, [rsp + 0x60]
mov dword [rsp + 0x28], 0x58
mov r9d, 3
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rax, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0xc8]
xor rcx, rsp
call fcn.14007fbf0
add rsp, 0xd8
ret
Function at 0x14000fc50
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
sub rsp, 0xd8
mov rax, qword [0x1400a3080]
xor rax, rsp
mov qword [rsp + 0xc8], rax
mov rcx, qword [0x1400a4480]
lea rax, [r11 - 0x18]
mov qword [rsp + 0x40], rax
xor r8d, r8d
cmp qword [rcx + 0x20], 0xf
lea rax, [0x140092631]
mov qword [rsp + 0x50], rax
mov rax, qword [rcx + 0x30]
mov qword [rsp + 0x30], rdx
lea rdx, [rcx + 8]
mov qword [r11 - 0x78], rax
mov rax, qword [rcx + 0x28]
mov qword [rsp + 0x38], 4
mov qword [rsp + 0x48], r8
mov dword [r11 - 0x80], r8d
movups xmm0, xmmword [rsp + 0x30]
mov qword [r11 - 0x70], rax
lea rax, str.__C:_test.exe
movups xmm1, xmmword [rsp + 0x40]
mov qword [r11 - 0x60], rax
lea rax, [rsp + 0x30]
movaps xmmword [r11 - 0x58], xmm0
movups xmm0, xmmword [rsp + 0x50]
mov qword [r11 - 0x28], rax
mov dword [r11 - 0x18], r8d
mov qword [r11 - 0x68], 0x3a9fdb6
movaps xmmword [r11 - 0x48], xmm1
movaps xmmword [r11 - 0x38], xmm0
jbe 0x14000fcfe
mov rdx, qword [rdx]
mov rcx, qword [rcx]
lea rax, [rsp + 0x60]
mov dword [rsp + 0x28], 0x58
mov r9d, 3
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [rsp + 0xc0]
mov rcx, qword [rsp + 0xc8]
xor rcx, rsp
call fcn.14007fbf0
add rsp, 0xd8
ret

Function at 0x14000fd40
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
sub rsp, 0xd8
mov rax, qword [0x1400a3080]
xor rax, rsp
mov qword [rsp + 0xc8], rax
mov rcx, qword [0x1400a4480]
lea rax, [r11 - 0x18]
mov qword [rsp + 0x40], rax
lea rax, [0x140092631]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x30], rdx
xor edx, edx
cmp qword [rcx + 0x20], 0xf
mov rax, qword [rcx + 0x30]
mov qword [r11 - 0x78], rax
mov rax, qword [rcx + 0x28]
mov qword [r11 - 0x70], rax
lea rax, str.__C:_test.exe
mov qword [rsp + 0x48], rdx
movups xmm1, xmmword [rsp + 0x40]
mov dword [rsp + 0x58], edx
lea rdx, [rcx + 8]
mov qword [rsp + 0x38], 1
movups xmm0, xmmword [rsp + 0x30]
mov qword [r11 - 0x60], rax
lea rax, [rsp + 0x30]
mov qword [r11 - 0x28], rax
movaps xmmword [r11 - 0x58], xmm0
movups xmm0, xmmword [rsp + 0x50]
mov byte [r11 - 0x18], 0
mov qword [r11 - 0x68], 0x3a9fdb6
movaps xmmword [r11 - 0x48], xmm1
movaps xmmword [r11 - 0x38], xmm0
jbe 0x14000fdee
mov rdx, qword [rdx]
mov rcx, qword [rcx]
lea rax, [rsp + 0x60]
mov dword [rsp + 0x28], 0x58
mov r9d, 3
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
movzx eax, byte [rsp + 0xc0]
mov rcx, qword [rsp + 0xc8]
xor rcx, rsp
call fcn.14007fbf0
add rsp, 0xd8
ret
Function at 0x14000fe40
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
sub rsp, 0xe8
mov rax, qword [0x1400a3080]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov rcx, qword [0x1400a4480]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x48], rax
xor r8d, r8d
cmp qword [rcx + 0x20], 0xf
lea rax, [0x140092631]
mov qword [rsp + 0x58], rax
mov rax, qword [rcx + 0x30]
mov qword [r11 - 0x78], rax
mov rax, qword [rcx + 0x28]
mov qword [rsp + 0x38], rdx
lea rdx, [rcx + 8]
mov qword [r11 - 0x70], rax
lea rax, str.__C:_test.exe
mov qword [rsp + 0x40], 8
movups xmm0, xmmword [rsp + 0x38]
mov qword [rsp + 0x50], r8
movups xmm1, xmmword [rsp + 0x48]
mov dword [rsp + 0x60], r8d
movaps xmmword [r11 - 0x58], xmm0
movups xmm0, xmmword [rsp + 0x58]
mov qword [r11 - 0x60], rax
lea rax, [rsp + 0x38]
mov qword [r11 - 0x28], rax
mov qword [rsp + 0x30], r8
mov qword [r11 - 0x68], 0x3a9fdb6
movaps xmmword [r11 - 0x48], xmm1
movaps xmmword [r11 - 0x38], xmm0
jbe 0x14000fef1
mov rdx, qword [rdx]
mov rcx, qword [rcx]
lea rax, [rsp + 0x70]
mov dword [rsp + 0x28], 0x58
mov r9d, 3
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.14007fbf0
add rsp, 0xe8
ret

Function at 0x14000ff30
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
sub rsp, 0xd8
mov rax, qword [0x1400a3080]
xor rax, rsp
mov qword [rsp + 0xc8], rax
mov dword [r11 - 0x18], r8d
lea rax, [r11 - 0x18]
mov rcx, qword [0x1400a4480]
mov qword [rsp + 0x40], rax
xor eax, eax
cmp qword [rcx + 0x20], 0xf
mov qword [rsp + 0x48], rax
lea rax, [0x140092631]
movups xmm1, xmmword [rsp + 0x40]
mov qword [rsp + 0x50], rax
mov rax, qword [rcx + 0x30]
mov qword [r11 - 0x78], rax
mov rax, qword [rcx + 0x28]
mov qword [rsp + 0x30], rdx
lea rdx, [rcx + 8]
mov qword [r11 - 0x70], rax
lea rax, str.__C:_test.exe
mov qword [rsp + 0x38], 4
movups xmm0, xmmword [rsp + 0x30]
mov dword [rsp + 0x58], 1
mov qword [r11 - 0x60], rax
lea rax, [rsp + 0x30]
movaps xmmword [r11 - 0x58], xmm0
movups xmm0, xmmword [rsp + 0x50]
mov qword [r11 - 0x28], rax
mov qword [r11 - 0x68], 0x3a9fdb6
movaps xmmword [r11 - 0x48], xmm1
movaps xmmword [r11 - 0x38], xmm0
jbe 0x14000ffe1
mov rdx, qword [rdx]
mov rcx, qword [rcx]
lea rax, [rsp + 0x60]
mov dword [rsp + 0x28], 0x58
mov r9d, 3
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0xc8]
xor rcx, rsp
call fcn.14007fbf0
add rsp, 0xd8
ret
Function at 0x14001a9f0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r10, rcx
mov r9d, 0x138
mov ecx, dword [rcx]
cmp ecx, r9d
jne 0x14001aa57
lea r8, [r10 + 0x10]
movabs r11, 0xb5026f5aa96619e9
mov rdx, qword [r8]
xor rdx, qword [r8 - 8]
lea r8, [r8 + 8]
and rdx, 0xffffffff80000000
xor rdx, qword [r8 - 8]
movzx eax, dl
and al, 1
neg al
sbb rcx, rcx
shr rdx, 1
and rcx, r11
xor rcx, qword [r8 + 0x4d0]
xor rcx, rdx
mov qword [r8 + 0x9b0], rcx
sub r9, 1
jne 0x14001aa12
mov ecx, dword [r10]
jmp 0x14001ab78
cmp ecx, 0x270
jb 0x14001ab78
mov qword [rsp + 0x10], rbx
movabs r11, 0xb5026f5aa96619e9
lea rbx, [r10 + 0x9c8]
mov qword [rsp], rdi
mov rax, qword [rbx]
mov edi, 0x9c
nop word [rax + rax]
mov r9, qword [rbx + 8]
mov r8, rbx
add rbx, 8
mov rdx, r9
xor rdx, rax
and rdx, 0xffffffff80000000
xor rdx, r9
movzx eax, dl
and al, 1
neg al
mov rax, r9
sbb rcx, rcx
shr rdx, 1
and rcx, r11
xor rcx, qword [r8 + 0x4e0]
xor rcx, rdx
mov qword [r8 - 0x9c0], rcx
sub rdi, 1
jne 0x14001aa90
lea rbx, [r10 + 0xea8]
mov edi, 0x9b
mov r9, qword [rbx]
nop dword [rax]
nop dword [rax + rax]
mov r8, qword [rbx + 8]
mov rdx, rbx
xor r9, r8
add rbx, 8
and r9, 0xffffffff80000000
xor r9, r8
movzx eax, r9b
and al, 1
neg al
sbb rcx, rcx
shr r9, 1
and rcx, r11
xor rcx, qword [rdx - 0xea0]
xor rcx, r9
mov r9, r8
mov qword [rdx - 0x9c0], rcx
sub rdi, 1
jne 0x14001aaf0
mov rdx, qword [r10 + 8]
xor rdx, qword [r10 + 0x1380]
mov rdi, qword [rsp]
and rdx, 0xffffffff80000000
xor rdx, qword [r10 + 8]
mov rbx, qword [rsp + 0x10]
movzx eax, dl
and al, 1
neg al
sbb rcx, rcx
shr rdx, 1
and rcx, r11
xor rcx, qword [r10 + 0x4e0]
xor rcx, rdx
mov qword [r10 + 0x9c0], rcx
xor ecx, ecx
mov dword [r10], ecx
mov eax, ecx
mov rdx, qword [r10 + rax*8 + 8]
lea eax, [rcx + 1]
mov dword [r10], eax
mov rcx, rdx
mov rax, qword [r10 + 0x1388]
shr rcx, 0x1d
and rax, rcx
movabs rcx, 0x38eb3ffff6d3
xor rdx, rax
mov rax, rdx
and rax, rcx
shl rax, 0x11
xor rdx, rax
mov rax, rdx
and rax, 0xffffffffffffbf77
shl rax, 0x25
xor rdx, rax
mov rax, rdx
shr rax, 0x2b
xor rax, rdx
add rsp, 8
ret
Function at 0x14001d1d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x50
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor edi, edi
cmp byte [r8 + 6], dil
je 0x14001d204
mov ecx, edi
nop dword [rax]
lea eax, [rcx + 0x4a]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 5
jb 0x14001d1f0
mov byte [r8 + 6], dil
lea rax, [r8 + 5]
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x14001d231
mov qword [rsp + 0x30], rdi
mov byte [rsp + 0x20], dil
jmp 0x14001d24f
mov qword [rsp + 0x30], 5
mov eax, dword [r8]
mov dword [rsp + 0x20], eax
movzx eax, byte [r8 + 4]
mov byte [rsp + 0x24], al
mov byte [rsp + 0x25], dil
mov r9, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x14001d25d
mov rdx, qword [rdx]
mov r8, rdx
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.140028ac0
mov qword [rbx], rdi
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x14001d2d4
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001d2cf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001d2cf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007ff64
mov rax, rbx
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x14001d2f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x50
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor edi, edi
cmp byte [r8 + 7], dil
je 0x14001d324
mov ecx, edi
nop dword [rax]
lea eax, [rcx + 0x4a]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 6
jb 0x14001d310
mov byte [r8 + 7], dil
lea rax, [r8 + 6]
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x14001d351
mov qword [rsp + 0x30], rdi
mov byte [rsp + 0x20], dil
jmp 0x14001d370
mov qword [rsp + 0x30], 6
mov eax, dword [r8]
mov dword [rsp + 0x20], eax
movzx eax, word [r8 + 4]
mov word [rsp + 0x24], ax
mov byte [rsp + 0x26], dil
mov r9, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x14001d37e
mov rdx, qword [rdx]
mov r8, rdx
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.140028ac0
mov qword [rbx], rdi
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x14001d3f5
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001d3f0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001d3f0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007ff64
mov rax, rbx
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x14001d410
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x50
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor edi, edi
cmp byte [r8 + 9], dil
je 0x14001d444
mov ecx, edi
nop dword [rax]
lea eax, [rcx + 0x4a]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 8
jb 0x14001d430
mov byte [r8 + 9], dil
lea rax, [r8 + 8]
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x14001d471
mov qword [rsp + 0x30], rdi
mov byte [rsp + 0x20], dil
jmp 0x14001d487
mov qword [rsp + 0x30], 8
mov rax, qword [r8]
mov qword [rsp + 0x20], rax
mov byte [rsp + 0x28], dil
mov r9, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x14001d495
mov rdx, qword [rdx]
mov r8, rdx
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.140028ac0
mov qword [rbx], rdi
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x14001d50c
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001d507
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001d507
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007ff64
mov rax, rbx
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x14001d520
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rbx, rcx
mov qword [rbp - 0x10], rcx
xor r9d, r9d
cmp byte [r8 + 6], r9b
je 0x14001d564
mov ecx, r9d
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x4a]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 5
jb 0x14001d550
mov byte [r8 + 6], r9b
lea rax, [r8 + 5]
mov qword [rbp - 0x38], r9
mov qword [rbp - 0x28], r9
mov qword [rbp - 0x20], r9
mov qword [rbp - 0x20], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x14001d58b
mov qword [rbp - 0x28], r9
mov byte [rbp - 0x38], r9b
jmp 0x14001d5a5
mov qword [rbp - 0x28], 5
mov eax, dword [r8]
mov dword [rbp - 0x38], eax
movzx eax, byte [r8 + 4]
mov byte [rbp - 0x34], al
mov byte [rbp - 0x33], r9b
cmp byte [rdx + 0xa], 0
je 0x14001d5c3
mov rcx, r9
nop
lea eax, [rcx + 0x4a]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 9
jb 0x14001d5b0
mov byte [rdx + 0xa], 0
lea rax, [rdx + 9]
mov qword [rbp - 0x58], r9
mov qword [rbp - 0x48], r9
mov qword [rbp - 0x40], r9
mov qword [rbp - 0x40], reloc.WS2_32.dll_ntohs
cmp rdx, rax
jne 0x14001d5ea
mov qword [rbp - 0x48], r9
mov byte [rbp - 0x58], 0
jmp 0x14001d606
mov qword [rbp - 0x48], 9
movsd xmm0, qword [rdx]
movsd qword [rbp - 0x58], xmm0
movzx eax, byte [rdx + 8]
mov byte [rbp - 0x50], al
mov byte [rbp - 0x4f], 0
lea r9, [rbp - 0x38]
lea r8, [rbp - 0x58]
movzx edx, byte [rbp - 0x60]
mov rcx, rbx
call fcn.1400237c0
nop
mov rdx, qword [rbp - 0x40]
cmp rdx, 0x10
jb 0x14001d65a
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001d654
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001d654
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007ff64
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x14001d698
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001d693
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001d693
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007ff64
mov rax, rbx
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rbp
ret