joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400014d0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r13
push r14
push r15
mov eax, 0x5a4d
mov rdi, rdx
mov r11, rcx
cmp word [rcx], ax
jne 0x1400015a3
movsxd r8, dword [rcx + 0x3c]
add r8, rcx
cmp dword [r8], 0x4550
jne 0x1400015a3
mov edx, 0x20b
mov eax, 0x88
cmp word [r8 + 0x18], dx
mov ecx, 0x78
cmovne eax, ecx
xor r10d, r10d
mov ebp, dword [rax + r8]
mov r15d, dword [r11 + rbp + 0x1c]
lea r14, [r11 + rbp]
mov r12d, dword [r14 + 0x24]
add r15, r11
mov esi, dword [r14 + 0x20]
add r12, r11
mov r9d, dword [r14 + 0x18]
add rsi, r11
sub r9d, 1
mov r13d, dword [rax + r8 + 4]
js 0x1400015a3
nop dword [rax + rax]
lea r8d, [r9 + r10]
mov rax, rdi
sar r8d, 1
movsxd rbx, r8d
mov edx, dword [rsi + rbx*4]
add rdx, r11
sub rdx, rdi
movzx ecx, byte [rax]
cmp cl, byte [rax + rdx]
jne 0x140001589
inc rax
test cl, cl
jne 0x140001576
xor eax, eax
jmp 0x14000158e
sbb eax, eax
or eax, 1
test eax, eax
jns 0x140001598
lea r9d, [r8 - 1]
jmp 0x14000159e
jle 0x1400015c2
lea r10d, [r8 + 1]
cmp r9d, r10d
jge 0x140001560
xor eax, eax
mov rbx, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
pop r15
pop r14
pop r13
pop r12
ret
cmp r9d, r10d
jl 0x1400015a3
cmp r8d, dword [r14 + 0x14]
jge 0x1400015a3
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
cmp ecx, ebp
jb 0x1400015e3
mov eax, r13d
add eax, ebp
cmp ecx, eax
jb 0x1400015a3
lea rax, [r11 + rcx]
jmp 0x1400015a5
Function at 0x140001f00
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x260
mov rax, qword [0x14009c900]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rdi, rdx
mov rbx, rcx
call fcn.140002010
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.ntdll.dll_RtlCreateRegistryKey]
test eax, eax
js 0x140001fe7
lea r8, [0x14007af68]
mov dword [rsp + 0x30], 1
mov edx, 5
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
mov r8, rdi
lea rcx, [rsp + 0x40]
mov edx, 0x87
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea rcx, [rsp + 0x40]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
cmp word [rcx + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x140001f80
lea eax, [rax*2 + 2]
mov r9d, 1
mov dword [rsp + 0x28], eax
lea r8, str.ImagePath
lea rax, [rsp + 0x40]
mov rdx, rbx
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_RtlWriteRegistryValue]
test eax, eax
js 0x140001fe7
lea rax, [rsp + 0x30]
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
lea r8, str.Type
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.ntdll.dll_RtlWriteRegistryValue]
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140077370
mov rbx, qword [rsp + 0x280]
add rsp, 0x260
pop rdi
ret
Function at 0x1400020b0
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov r11, rsp
push rbp
push r14
sub rsp, 0x168
mov rax, qword [0x14009c900]
xor rax, rsp
mov qword [rsp + 0x158], rax
mov r14, rdx
mov qword [rdx], 0
xor edx, edx
mov dword [r11 - 0x28], 0
mov rbp, rcx
lea r9, [r11 - 0x28]
xor r8d, r8d
lea ecx, [rdx + 0xb]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x14000225f
mov rax, qword gs:[0x30]
mov r8d, dword [rsp + 0x150]
mov qword [rsp + 0x198], rsi
add r8, r8
mov qword [rsp + 0x160], rdi
mov rdx, qword [rax + 0x60]
mov rcx, qword [rdx + 0x30]
mov edx, 8
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8d, dword [rsp + 0x150]
xor r9d, r9d
add r8d, r8d
mov rdx, rax
mov rdi, rax
lea ecx, [r9 + 0xb]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov esi, eax
test eax, eax
js 0x140002231
mov qword [rsp + 0x190], rbx
xor ebx, ebx
cmp dword [rdi], ebx
jbe 0x140002229
mov ecx, ebx
lea rax, [rsp + 0x20]
imul rcx, rcx, 0x128
mov edx, 2
add rcx, 8
add rcx, rdi
nop dword [rax]
lea rax, [rax + 0x80]
movups xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0x10]
lea rcx, [rcx + 0x80]
movups xmmword [rax - 0x80], xmm0
movups xmm0, xmmword [rcx - 0x60]
movups xmmword [rax - 0x70], xmm1
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rax - 0x60], xmm0
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rax - 0x50], xmm1
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rax - 0x40], xmm0
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rax - 0x30], xmm1
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rax - 0x20], xmm0
movups xmmword [rax - 0x10], xmm1
sub rdx, 1
jne 0x140002190
movups xmm0, xmmword [rcx]
lea rdx, [rsp + 0x48]
movups xmm1, xmmword [rcx + 0x10]
mov rcx, qword [rcx + 0x20]
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm1
mov qword [rax + 0x20], rcx
mov rcx, rbp
movzx eax, word [rsp + 0x46]
add rdx, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x14000221f
inc ebx
cmp ebx, dword [rdi]
jb 0x140002172
jmp 0x140002229
mov rax, qword [rsp + 0x30]
xor esi, esi
mov qword [r14], rax
mov rbx, qword [rsp + 0x190]
mov rax, qword gs:[0x30]
mov r8, rdi
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rdi, qword [rsp + 0x160]
mov eax, esi
mov rsi, qword [rsp + 0x198]
mov rcx, qword [rsp + 0x158]
xor rcx, rsp
call fcn.140077370
add rsp, 0x168
pop r14
pop rbp
ret
Function at 0x140002280
Capabilities:
Encode data using xor
Get system information on windows

Disassembly:
sub rsp, 0x88
mov rax, qword [0x14009c900]
xor rax, rsp
mov qword [rsp + 0x68], rax
xor r9d, r9d
mov qword [rsp + 0x60], 8
lea rdx, [rsp + 0x60]
lea r8d, [r9 + 8]
lea ecx, [r9 + 0x67]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov r9d, eax
test eax, eax
jns 0x14000249c
movups xmm0, xmmword [0x14007b018]
mov ecx, dword [0x14007b040]
movups xmm1, xmmword [0x14007b028]
movzx eax, byte [0x14007b044]
mov dword [rsp + 0x48], ecx
xor ecx, ecx
cmp dword [reloc.WS2_32.dll_accept], 2
movups xmmword [rsp + 0x20], xmm0
mov byte [rsp + 0x4c], al
movsd xmm0, qword [0x14007b038]
movsd qword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x30], xmm1
jl 0x140002451
movdqa xmm0, xmmword [str.4444444444444444]
lea rdx, [rsp + 0x24]
movdqa xmm5, xmmword [0x14007ad70]
movdqa xmm4, xmmword [0x14007b300]
movdqa xmmword [rsp + 0x50], xmm0
mov r8d, dword [rsp + 0x50]
movaps xmmword [rsp + 0x70], xmm6
movdqa xmm6, xmmword [str.8888]
nop
movd xmm2, ecx
lea eax, [rcx + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add ecx, 8
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x14007ad90]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 0xc]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rdx - 0xc], xmm2
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, r8d
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x14007ad90]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx - 8]
xorps xmm2, xmm0
movd dword [rdx - 8], xmm2
cmp ecx, 0x28
jl 0x140002340
movaps xmm6, xmmword [rsp + 0x70]
cmp ecx, 0x2d
jge 0x14000248f
movsxd rax, ecx
lea r8, [rsp + 0x20]
add r8, rax
nop dword [rax]
mov eax, 0x92492493
lea r8, [r8 + 1]
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x38
movzx eax, cl
inc ecx
sub al, dl
add al, 0x34
xor byte [r8 - 1], al
cmp ecx, 0x2d
jl 0x140002460
mov edx, r9d
lea rcx, [rsp + 0x20]
call fcn.1400018b0
mov eax, dword [rsp + 0x64]
and al, 3
cmp al, 1
sete al
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140077370
add rsp, 0x88
ret
Function at 0x1400027a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x60
xor r10d, r10d
mov rbp, r8
mov qword [r9], r10
mov rsi, rdx
mov rdi, rcx
mov ebx, r10d
mov r11d, r10d
test rdx, rdx
je 0x140002848
mov qword [rsp + 0x70], r14
lea r14, [0x14007ae64]
nop word [rax + rax]
mov rdx, r11
mov r8d, r10d
sub rdx, r14
mov rax, r14
add rdx, rdi
nop
movzx ecx, byte [rax]
cmp byte [rdx + rax], cl
je 0x1400027fc
test cl, cl
jne 0x140002844
inc r8d
inc rax
cmp r8d, 4
jb 0x1400027f0
mov cl, 1
test cl, cl
mov rax, r11
cmove rax, rbx
inc r11
mov rbx, rax
cmp r11, rsi
jb 0x1400027e0
mov r14, qword [rsp + 0x70]
test rax, rax
je 0x140002848
movsxd rax, dword [rax + rdi + 4]
add rax, 8
add rax, rbx
add rax, rbp
mov qword [r9], rax
mov eax, 1
jmp 0x140002a21
xor cl, cl
jmp 0x14000280a
cmp byte [0x14007ae89], r10b
movups xmm0, xmmword [0x14007ae70]
movzx eax, word [0x14007ae88]
mov word [rsp + 0x48], ax
movups xmmword [rsp + 0x30], xmm0
movsd xmm0, qword [0x14007ae80]
movsd qword [rsp + 0x40], xmm0
je 0x140002a15
cmp dword [reloc.WS2_32.dll_accept], 2
jl 0x1400029d6
movdqa xmm0, xmmword [str.4444444444444444]
lea rcx, [rsp + 0x34]
movdqa xmm5, xmmword [0x14007ad70]
movdqa xmm4, xmmword [0x14007b300]
movdqa xmmword [rsp + 0x20], xmm0
mov edx, dword [rsp + 0x20]
movaps xmmword [rsp + 0x50], xmm6
movdqa xmm6, xmmword [str.8888]
nop dword [rax]
movd xmm2, r10d
lea eax, [r10 + 4]
pshufd xmm2, xmm2, 0
lea rcx, [rcx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add r10d, 8
pmuldq xmm1, xmm4
mov eax, r10d
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x14007ad90]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx - 0xc]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rcx - 0xc], xmm2
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, edx
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x14007ad90]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rcx - 8]
xorps xmm2, xmm0
movd dword [rcx - 8], xmm2
cmp r10d, 0x18
jl 0x1400028c0
movaps xmm6, xmmword [rsp + 0x50]
cmp eax, 0x1a
jge 0x140002a15
movsxd rax, r10d
lea r8, [rsp + 0x30]
add r8, rax
mov eax, 0x92492493
lea r8, [r8 + 1]
imul r10d
add edx, r10d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x38
movzx eax, r10b
inc r10d
sub al, cl
add al, 0x34
xor byte [r8 - 1], al
cmp r10d, 0x1a
jl 0x1400029e1
lea rcx, [rsp + 0x30]
call fcn.1400018b0
xor eax, eax
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140008720
Capabilities:
Access peb ldr_data
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov esi, ecx
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, qword gs:[0x60]
mov rbp, rax
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
nop word [rax + rax]
mov r10, qword [rcx + 0x30]
movsxd rdx, dword [r10 + 0x3c]
mov ebx, dword [rdx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x1400087d7
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x1400087d7
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x8d466b
lea rax, [rdi + r9*4]
mov eax, dword [rax + r10]
add rax, r10
movzx edx, byte [rax]
inc rax
test dl, dl
je 0x1400087d2
nop
movsx edx, dl
lea rax, [rax + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rax - 1]
test dl, dl
jne 0x1400087b0
cmp r8d, 0x74c70d97
je 0x1400087dc
test r9d, r9d
jne 0x140008790
mov rcx, qword [rcx]
jmp 0x140008760
mov ecx, dword [rbx + 0x24]
movzx edx, si
add rcx, r10
movzx r8d, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + r8*4]
mov rcx, rbp
add rax, r10
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
jmp rax
Function at 0x1400095e0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x160
mov rax, qword [0x14009c900]
xor rax, rsp
mov qword [rsp + 0x150], rax
xor edx, edx
mov dword [rsp + 0x20], 0x130
mov rdi, rcx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400096b1
lea rdx, [rsp + 0x20]
mov rcx, rax
call sub.KERNEL32.dll_Process32First
lea rax, [rsp + 0x4c]
mov r8, rdi
sub r8, rax
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140009653
inc rax
test ecx, ecx
jne 0x140009640
test edx, edx
je 0x1400096b5
lea rdx, [rsp + 0x20]
mov rcx, rbx
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x1400096a8
nop dword [rax + rax]
lea rax, [rsp + 0x4c]
mov r8, rdi
sub r8, rax
nop dword [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140009693
inc rax
test ecx, ecx
jne 0x140009680
test edx, edx
je 0x1400096b5
lea rdx, [rsp + 0x20]
mov rcx, rbx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x140009670
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1400096c2
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x28]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140077370
mov rbx, qword [rsp + 0x170]
add rsp, 0x160
pop rdi
ret
Function at 0x140012f70
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 7], sil
je 0x140012fa4
mov eax, esi
lea ecx, [rax - 0x35]
xor byte [r8 + rax], cl
inc rax
cmp rax, 6
jb 0x140012f90
mov byte [r8 + 7], sil
add r8, 6
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.140012950
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140012fc9
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140021920
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140013043
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001303e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001303e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140077578
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x140013050
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 9], sil
je 0x140013084
mov eax, esi
lea ecx, [rax - 0x35]
xor byte [r8 + rax], cl
inc rax
cmp rax, 8
jb 0x140013070
mov byte [r8 + 9], sil
add r8, 8
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.140012950
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x1400130a9
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140021920
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140013123
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001311e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001311e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140077578
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x140013130
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 0xa], sil
je 0x140013164
mov eax, esi
lea ecx, [rax - 0x35]
xor byte [r8 + rax], cl
inc rax
cmp rax, 9
jb 0x140013150
mov byte [r8 + 0xa], sil
add r8, 9
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.140012950
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140013189
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140021920
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140013203
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400131fe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400131fe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140077578
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x140013210
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 0xc], sil
je 0x140013244
mov eax, esi
lea ecx, [rax - 0x35]
xor byte [r8 + rax], cl
inc rax
cmp rax, 0xb
jb 0x140013230
mov byte [r8 + 0xc], sil
add r8, 0xb
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.140012950
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140013269
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140021920
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x1400132e3
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400132de
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400132de
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140077578
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x140019f50
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 9], al
je 0x140019f73
lea edx, [rax - 0x35]
xor byte [rax + rcx], dl
inc rax
cmp rax, 8
jb 0x140019f60
mov byte [rcx + 9], 0
lea r8, [rcx + 8]
mov rdx, rcx
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.140012950
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x140019f90
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 0x10], al
je 0x140019fb3
lea edx, [rax - 0x35]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xf
jb 0x140019fa0
mov byte [rcx + 0x10], 0
lea r8, [rcx + 0xf]
mov rdx, rcx
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.140012950
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x14001b1f0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 5], 0
je 0x14001b213
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x35]
xor byte [rax + rcx], dl
inc rax
cmp rax, 4
jb 0x14001b200
mov byte [rcx + 5], 0
mov rax, rcx
ret

Function at 0x14001b220
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x136], 0
je 0x14001b248
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x35]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x135
jb 0x14001b230
mov byte [rcx + 0x136], 0
mov rax, rcx
ret

Function at 0x14001b250
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x44], 0
je 0x14001b273
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x35]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x43
jb 0x14001b260
mov byte [rcx + 0x44], 0
mov rax, rcx
ret

Function at 0x14001b280
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x47], 0
je 0x14001b2a3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x35]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x46
jb 0x14001b290
mov byte [rcx + 0x47], 0
mov rax, rcx
ret
Function at 0x14001bd00
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
sub rsp, 0xa8
cmp byte [0x14009d330], 0
jne 0x14001bdc7
movdqa xmm0, xmmword [0x14007d5a0]
xor edx, edx
movdqa xmm1, xmmword [0x14007d330]
movdqa xmmword [rax - 0x68], xmm0
movdqa xmm0, xmmword [0x14007d510]
movdqa xmmword [rax - 0x58], xmm1
movdqa xmm1, xmmword [0x14007d300]
movdqa xmmword [rax - 0x48], xmm0
movdqa xmm0, xmmword [0x14007d2e0]
movdqa xmmword [rax - 0x38], xmm1
movdqa xmmword [rax - 0x28], xmm0
mov dword [rax - 0x18], 0x1006f75
mov eax, edx
nop dword [rax]
nop word [rax + rax]
lea ecx, [rax - 0x35]
xor byte [rsp + rax + 0x40], cl
inc rax
cmp rax, 0x52
jb 0x14001bd70
xorps xmm0, xmm0
mov byte [rsp + 0x93], dl
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rdx
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rdx
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], dl
jne 0x14001bda5
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.140004bf0
lea rcx, [rsp + 0x20]
call fcn.14001f190
add rsp, 0xa8
ret
Function at 0x14001d040
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
mov r10, rcx
mov ecx, r9d
test r8, r8
je 0x14001d127
sub r10, rdx
cmp r8, 8
jb 0x14001d103
mov rax, r8
lea r9, [rdx + 4]
and rax, 0xfffffffffffffff8
xorps xmm3, xmm3
xorps xmm2, xmm2
movd xmm1, dword [r10 + r9 - 4]
add rcx, 8
movd xmm0, dword [r9 - 4]
lea r9, [r9 + 8]
punpcklbw xmm1, xmm1
punpcklwd xmm1, xmm1
punpcklbw xmm0, xmm0
psrad xmm1, 0x18
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
pxor xmm1, xmm0
movd xmm0, dword [r9 - 8]
punpcklbw xmm0, xmm0
por xmm3, xmm1
movd xmm1, dword [r10 + r9 - 8]
punpcklbw xmm1, xmm1
punpcklwd xmm1, xmm1
punpcklwd xmm0, xmm0
psrad xmm1, 0x18
psrad xmm0, 0x18
pxor xmm1, xmm0
por xmm2, xmm1
cmp rcx, rax
jb 0x14001d070
por xmm2, xmm3
movdqa xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movdqa xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movd r9d, xmm2
cmp rcx, r8
jae 0x14001d127
lea rax, [rcx + rdx]
sub r8, rcx
nop word [rax + rax]
movsx edx, byte [r10 + rax]
movsx ecx, byte [rax]
lea rax, [rax + 1]
xor edx, ecx
or r9d, edx
sub r8, 1
jne 0x14001d110
test r9d, r9d
sete al
ret