joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400a2ac0
Capabilities:
Encode data using xor
Read .ini file

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0xe0
mov rax, qword [0x1406f6480]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov rbx, r9
mov rdi, r8
mov rsi, rdx
mov rbp, rcx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x48], r8
mov qword [rsp + 0x50], rbx
xor r14d, r14d
mov r8, rdx
cmp qword [rdx + 0x18], 0xf
jbe 0x1400a2b10
mov r8, qword [rdx]
mov dword [rsp + 0x30], 0xe0e7ffe7
mov word [rsp + 0x34], 0x100
mov rcx, r14
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x57]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 4
jb 0x1400a2b30
mov byte [rsp + 0x35], 0
mov rdx, rbx
cmp qword [r9 + 0x18], 0xf
jbe 0x1400a2b52
mov rdx, qword [r9]
mov rcx, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x1400a2b5f
mov rcx, qword [rdi]
mov qword [rsp + 0x28], r8
mov dword [rsp + 0x20], 0x64
lea r9, [rsp + 0x60]
lea r8, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
mov qword [rbp + 0x10], r14
mov qword [rbp + 0x18], r14
lea rax, [rsp + 0x60]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400a2ba0
lea rdx, [rsp + 0x60]
mov rcx, rbp
call fcn.140078470
nop
mov rdx, qword [rsi + 0x18]
cmp rdx, 0xf
jbe 0x1400a2bf2
mov rcx, qword [rsi]
inc rdx
cmp rdx, 0x1000
jb 0x1400a2bed
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400a2cb0
mov rcx, r8
call fcn.14015590c
mov qword [rsi + 0x10], r14
mov qword [rsi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rsi], 0
mov rdx, qword [rdi + 0x18]
cmp rdx, 0xf
jbe 0x1400a2c3b
mov rcx, qword [rdi]
inc rdx
cmp rdx, 0x1000
jb 0x1400a2c36
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400a2cb7
mov rcx, r8
call fcn.14015590c
mov qword [rdi + 0x10], r14
mov qword [rdi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rdi], 0
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x1400a2c80
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x1400a2c7b
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400a2cbe
mov rcx, r8
call fcn.14015590c
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rax, rbp
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.140155770
add rsp, 0xe0
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x1400b2600
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
cmp dword [0x1406fdd18], 0
je 0x1400b2628
cmp dword [0x1406fdd48], 0
je 0x1400b2628
cmp dword [0x1406fdce8], 0
je 0x1400b2628
cmp dword [0x1406fdcf8], 0
jne 0x1400b2631
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
add rsp, 0x28
ret

Function at 0x1400b3210
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1406f6480]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x1400b32e3
cmp byte [rcx + 0x71], 0
je 0x1400b32e3
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + Ordinal_26]
cmp eax, 0xffffffff
je 0x1400b32df
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400b32a4
sub eax, 1
je 0x1400b32a8
cmp eax, 2
jne 0x1400b32df
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140155770
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x1400b32d6
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x1400b32df
cmp byte [rbx + 0x71], 0
sete al
jmp 0x1400b328c
xor al, al
jmp 0x1400b328c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140155770
add rsp, 0x60
pop rbx
ret

Function at 0x1400b3660
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 3], 0
je 0x1400b3683
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x57]
xor byte [rcx + rax], dl
inc rax
cmp rax, 2
jb 0x1400b3670
mov byte [rcx + 3], 0
mov rax, rcx
ret

Function at 0x1400b3690
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 4], 0
je 0x1400b36b3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x57]
xor byte [rcx + rax], dl
inc rax
cmp rax, 3
jb 0x1400b36a0
mov byte [rcx + 4], 0
mov rax, rcx
ret

Function at 0x1400b36c0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 5], 0
je 0x1400b36e3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x57]
xor byte [rcx + rax], dl
inc rax
cmp rax, 4
jb 0x1400b36d0
mov byte [rcx + 5], 0
mov rax, rcx
ret

Function at 0x1400b36f0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 6], 0
je 0x1400b3713
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x57]
xor byte [rcx + rax], dl
inc rax
cmp rax, 5
jb 0x1400b3700
mov byte [rcx + 6], 0
mov rax, rcx
ret

Function at 0x1400b3720
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 7], 0
je 0x1400b3743
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x57]
xor byte [rcx + rax], dl
inc rax
cmp rax, 6
jb 0x1400b3730
mov byte [rcx + 7], 0
mov rax, rcx
ret
Function at 0x1400b3750
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 8], 0
je 0x1400b3773
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x57]
xor byte [rcx + rax], dl
inc rax
cmp rax, 7
jb 0x1400b3760
mov byte [rcx + 8], 0
mov rax, rcx
ret

Function at 0x1400b3780
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 9], 0
je 0x1400b37a3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x57]
xor byte [rcx + rax], dl
inc rax
cmp rax, 8
jb 0x1400b3790
mov byte [rcx + 9], 0
mov rax, rcx
ret

Function at 0x1400b37b0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xa], 0
je 0x1400b37d3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x57]
xor byte [rcx + rax], dl
inc rax
cmp rax, 9
jb 0x1400b37c0
mov byte [rcx + 0xa], 0
mov rax, rcx
ret

Function at 0x1400b37e0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x10], 0
je 0x1400b3803
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x57]
xor byte [rcx + rax], dl
inc rax
cmp rax, 0xf
jb 0x1400b37f0
mov byte [rcx + 0x10], 0
mov rax, rcx
ret

Function at 0x1400b3810
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x12], 0
je 0x1400b3833
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x57]
xor byte [rcx + rax], dl
inc rax
cmp rax, 0x11
jb 0x1400b3820
mov byte [rcx + 0x12], 0
mov rax, rcx
ret

Function at 0x1400b3840
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x13], 0
je 0x1400b3863
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x57]
xor byte [rcx + rax], dl
inc rax
cmp rax, 0x12
jb 0x1400b3850
mov byte [rcx + 0x13], 0
mov rax, rcx
ret

Function at 0x1400b3870
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x15], 0
je 0x1400b3893
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x57]
xor byte [rcx + rax], dl
inc rax
cmp rax, 0x14
jb 0x1400b3880
mov byte [rcx + 0x15], 0
mov rax, rcx
ret

Function at 0x1400b38a0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x2a], 0
je 0x1400b38c3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x57]
xor byte [rcx + rax], dl
inc rax
cmp rax, 0x29
jb 0x1400b38b0
mov byte [rcx + 0x2a], 0
mov rax, rcx
ret

Function at 0x1400b38d0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xb], 0
je 0x1400b38f3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x57]
xor byte [rcx + rax], dl
inc rax
cmp rax, 0xa
jb 0x1400b38e0
mov byte [rcx + 0xb], 0
mov rax, rcx
ret

Function at 0x1400b3900
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xc], 0
je 0x1400b3923
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x57]
xor byte [rcx + rax], dl
inc rax
cmp rax, 0xb
jb 0x1400b3910
mov byte [rcx + 0xc], 0
mov rax, rcx
ret

Function at 0x1400b3930
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xd], 0
je 0x1400b3953
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x57]
xor byte [rcx + rax], dl
inc rax
cmp rax, 0xc
jb 0x1400b3940
mov byte [rcx + 0xd], 0
mov rax, rcx
ret
Function at 0x1400b3960
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xe], 0
je 0x1400b3983
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x57]
xor byte [rcx + rax], dl
inc rax
cmp rax, 0xd
jb 0x1400b3970
mov byte [rcx + 0xe], 0
mov rax, rcx
ret

Function at 0x1400b3990
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xf], 0
je 0x1400b39b3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x57]
xor byte [rcx + rax], dl
inc rax
cmp rax, 0xe
jb 0x1400b39a0
mov byte [rcx + 0xf], 0
mov rax, rcx
ret
Function at 0x1400b3ff0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x1406f6480]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov esi, edx
mov rdi, rcx
cmp edx, 0xffffffff
jne 0x1400b401d
xor eax, eax
jmp 0x1400b4186
mov qword [rsp + 0xa0], rbx
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
test rax, rax
je 0x1400b405d
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::epptr_void_const___ptr64]
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
cmp rax, rbx
jae 0x1400b405d
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], sil
mov eax, esi
jmp 0x1400b417e
cmp qword [rdi + 0x80], 0
je 0x1400b4179
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::eback_void_const___ptr64]
lea rcx, [rdi + 0x70]
cmp rax, rcx
jne 0x1400b4097
mov rdx, qword [rdi + 0x88]
mov rcx, rdi
mov r9, qword [rdi + 0x90]
mov r8, rdx
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::setg_char____ptr64__char____ptr64__char____ptr64____ptr64]
mov rcx, qword [rdi + 0x68]
test rcx, rcx
jne 0x1400b40c2
mov rdx, qword [rdi + 0x80]
movsx ecx, sil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, esi
mov eax, ecx
jmp 0x1400b417e
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], sil
mov qword [rsp + 0x38], rax
lea rdx, [rdi + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400b4131
sub eax, 1
je 0x1400b4131
cmp eax, 2
jne 0x1400b4179
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rdi + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, esi
mov eax, ecx
jmp 0x1400b417e
mov rbx, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rbx, rax
je 0x1400b415f
mov r9, qword [rdi + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rbx
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rbx, rax
jne 0x1400b4179
lea rax, [rsp + 0x50]
mov byte [rdi + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, esi
mov eax, ecx
jmp 0x1400b417e
mov eax, 0xffffffff
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140155770
mov rsi, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x1400b4520
Capabilities:
Interact with driver via ioctl

Disassembly:
mov r11, rsp
sub rsp, 0x78
mov rax, qword [0x1406f6480]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor r9d, r9d
mov eax, r8d
cmp byte [0x1406fda61], r9b
lea r8, [r11 - 0x38]
mov qword [r11 - 0x40], r9
mov qword [r11 - 0x48], r9
mov dword [r11 - 0x50], r9d
mov qword [r11 - 0x20], rax
mov eax, dword [0x1406fdbb4]
mov dword [r11 - 0x34], r9d
mov qword [r11 - 0x30], rcx
mov rcx, qword [0x1406fdbc8]
mov qword [r11 - 0x28], rdx
mov edx, 0x2224a4
mov qword [r11 - 0x58], r9
mov r9d, reloc.WLDAP32.dll_Ordinal_32
mov dword [rsp + 0x40], eax
jne 0x1400b458a
mov edx, 0x220d4c
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
setne al
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140155770
add rsp, 0x78
ret
Function at 0x1400b5770
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rsi, r8
mov r14, rdx
mov rbp, rcx
test r8, r8
jg 0x1400b5792
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je case.default.0x1400b57a1
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov qword [rsp + 0x28], rbx
mov rbx, rsi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Gnavail_void_const___ptr64]
test rax, rax
je 0x1400b57f2
cmp rax, rsi
mov rdi, rsi
mov rcx, rbp
cmovb rdi, rax
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gptr_void_const___ptr64]
mov r8, rdi
mov rcx, r14
mov rdx, rax
call sub.VCRUNTIME140.dll_memcpy
mov edx, edi
mov rcx, rbp
add r14, rdi
sub rbx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int____ptr64]
cmp qword [rbp + 0x80], 0
mov rdi, rbx
je 0x1400b5861
mov rcx, rbp
call int.1400b3320
cmp rbx, 0xfff
jbe 0x1400b5841
mov r9, qword [rbp + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
add r14, rax
mov rdi, rbx
cmp rax, 0xfff
jne 0x1400b587a
cmp rbx, rax
ja 0x1400b5810
test rdi, rdi
je 0x1400b5861
mov r9, qword [rbp + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rdi, rax
sub rsi, rdi
mov rbx, qword [rsp + 0x28]
mov rax, rsi
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
sub rsi, rbx
jmp 0x1400b5864
mov dl, 0x65
add al, 0xb2
mov dl, 0xb2
mov bl, 0x65
add esi, dword [rbx + 0x67b30366]
add esi, dword [rbx + 0x68b4b3b3]
add esi, dword [rcx + rbp*2 - 0x4c4c4bfd]
mov ch, 0x69
add esi, dword [rbp - 0x4b4afc96]
mov ah, 0xb6
insb byte [rdi], dx
add esi, dword [rsi + 0x6cb7b6b6]
add dh, byte [rdi + 0x6eb7026d]
add dh, byte [rdi + 0x70b8b7b7]
add bh, byte [rax + 0x70b9b7b7]
add bh, byte [rcx + 0x71bab9b9]
mov ecx, 0x271bab9
mov edx, 0x73bb0272
add bh, byte [rbx - 0x44444546]
mov ebx, 0xbc0275bc
mov esp, 0x277bdbc
mov ebp, 0x77bebcbc
add bh, byte [rsi - 0x4141fd86]
mov esi, 0xc0027bbf
rol al, 0xc1
jge 0x1402e1db2
sar dword [rsi + 1], 0xc1
jle 0x1402e1db5
rol ecx, 0xc1
ret 0x17f
rol ecx, 0xc2
jg 0x1402e1dbb
ret 0xc2c2
ret 0xc3c2
Function at 0x1400b5880
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je case.default.0x1400b58a1
add rsp, 0x20
pop r14
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov rbp, rax
test rbx, rbx
jle 0x1400b591c
test rax, rax
jle 0x1400b58fc
cmp rbx, rax
mov rcx, rdi
cmovl rbp, rbx
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, rbp
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov edx, ebp
mov rcx, rdi
add r14, rbp
sub rbx, rbp
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
test rbx, rbx
jle 0x1400b591c
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x1400b591c
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov rbp, qword [rsp + 0x40]
sub rsi, rbx
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rbx
ret
mov ecx, 0x271bab9
mov edx, 0x73bb0272
Function at 0x1400be7f0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 7], sil
je 0x1400be824
mov eax, esi
lea ecx, [rax + 0x31]
xor byte [r8 + rax], cl
inc rax
cmp rax, 6
jb 0x1400be810
mov byte [r8 + 7], sil
add r8, 6
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.1400726c0
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x1400be849
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.1400cbd10
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x1400be8c3
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400be8be
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400be8be
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14015590c
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x1400be8d0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r10, r8
mov rdi, rdx
mov rsi, rcx
mov qword [rsp + 0x28], rcx
xor ebx, ebx
cmp byte [r8 + 9], bl
je 0x1400be904
mov ecx, ebx
lea eax, [rcx + 0x31]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 8
jb 0x1400be8f0
mov byte [r8 + 9], bl
add r8, 8
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x50]
call fcn.1400726c0
nop
cmp byte [rdi + 9], 0
je 0x1400be934
lea eax, [rbx + 0x31]
xor byte [rbx + rdi], al
inc rbx
cmp rbx, 8
jb 0x1400be921
mov byte [rdi + 9], 0
lea r8, [rdi + 8]
lea r9, [rsp + 0x20]
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.1400726c0
nop
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
movzx edx, byte [rsp + 0x20]
mov rcx, rsi
call fcn.140083ee0
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x1400be9a4
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400be99e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400be99e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14015590c
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x1400be9e4
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400be9df
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400be9df
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14015590c
mov rax, rsi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400be9f0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 9], sil
je 0x1400bea24
mov eax, esi
lea ecx, [rax + 0x31]
xor byte [r8 + rax], cl
inc rax
cmp rax, 8
jb 0x1400bea10
mov byte [r8 + 9], sil
add r8, 8
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.1400726c0
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x1400bea49
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.1400cbd10
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x1400beac3
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400beabe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400beabe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14015590c
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x1400bead0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 0xa], sil
je 0x1400beb04
mov eax, esi
lea ecx, [rax + 0x31]
xor byte [r8 + rax], cl
inc rax
cmp rax, 9
jb 0x1400beaf0
mov byte [r8 + 0xa], sil
add r8, 9
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.1400726c0
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x1400beb29
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.1400cbd10
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x1400beba3
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400beb9e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400beb9e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14015590c
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret