joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001e840
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x3260], 0
lea rbx, [rcx + 0x3268]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x14001e8e7
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x14001e89a
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.14002e330
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.14002dba0
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x3260]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x3270]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x14016fd08]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x14001e8ef
mov rcx, rbx
call fcn.14002dba0
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x140027860
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [0x14016fd00]
mov rbx, rcx
xor ecx, ecx
mov dword [rax + 0x31fc], ecx
test rbx, rbx
je 0x1400278cf
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x38], rdi
call fcn.1400278e0
lea rdx, [0x1400cc02c]
mov rcx, rbx
mov rdi, rax
call fcn.14001c220
mov rbx, rax
test rax, rax
je 0x1400278ca
mov r8, qword [rsp + 0x30]
mov r9, rax
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret

Function at 0x14002b5b0
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, qword [0x14016fd00]
cmp byte [rbx + 0x31f8], 0
jne 0x14002b726
cmp dword [rbx + 0x3220], 0
je 0x14002b5ed
mov r8d, 0x2b0c
lea rdx, str.C:Users_vunchDesktopUniversal_Running_SimulatorKeyAuth_ImGUIimguiimgui.cpp
lea rcx, str.g.SettingsWindows.empty__
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x14002b71f
lea rdx, [0x1400cc028]
mov qword [rsp + 0x40], rdi
call fcn.14001c220
mov rdi, rax
test rax, rax
je 0x14002b71a
mov qword [rsp + 0x30], rbp
mov rcx, rax
mov qword [rsp + 0x38], rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebp, eax
cmp eax, 0xffffffff
je 0x14002b707
xor edx, edx
mov rcx, rdi
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x14002b707
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rsi, eax
cmp esi, 0xffffffff
je 0x14002b707
xor r8d, r8d
mov edx, ebp
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x14002b707
mov rbp, rsi
cmp rsi, 0xffffffffffffffff
je 0x14002b707
mov rax, qword [0x14016fd00]
test rax, rax
je 0x14002b696
inc dword [rax + 0x3b0]
mov rdx, qword [0x14016fd10]
mov rcx, rbp
call qword [section..data]
mov rsi, rax
test rax, rax
je 0x14002b707
mov r9, rdi
mov r8, rbp
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rdi
cmp rax, rbp
je 0x14002b6d2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
jmp 0x14002b6e3
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rdx, rbp
mov rcx, rsi
call fcn.14001e0f0
mov rax, qword [0x14016fd00]
test rax, rax
je 0x14002b6f5
dec dword [rax + 0x3b0]
mov rdx, qword [0x14016fd10]
mov rcx, rsi
call qword [0x14015e008]
jmp 0x14002b710
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rsi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x40]
mov byte [rbx + 0x31f8], 1
movss xmm0, dword [rbx + 0x31fc]
xorps xmm1, xmm1
comiss xmm0, xmm1
jbe 0x14002b777
subss xmm0, dword [rbx + 0x18]
comiss xmm1, xmm0
movss dword [rbx + 0x31fc], xmm0
jb 0x14002b777
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x14002b766
call fcn.140027860
mov dword [rbx + 0x31fc], 0
add rsp, 0x20
pop rbx
ret
mov byte [rbx + 0x398], 1
mov dword [rbx + 0x31fc], 0
add rsp, 0x20
pop rbx
ret
Function at 0x14004ef60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push rbp
push rdi
push r12
sub rsp, 0x78
movaps xmmword [rsp + 0x60], xmm6
movaps xmmword [rsp + 0x50], xmm7
mov rax, qword [0x14016f6f8]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rax, qword [0x14016fd00]
lea rdx, [rsp + 0x30]
movss xmm1, dword [rcx + 0x2c]
mov rdi, rcx
movss xmm0, dword [rax + 0x1674]
mov r12, qword [rax + 0x1d18]
subss xmm1, xmm0
movaps xmm2, xmm0
movss xmm0, dword [rcx + 0x30]
addss xmm2, dword [rax + 0x1a80]
movss xmm6, dword [r12 + 0x118]
movss xmm7, dword [r12 + 0x11c]
movss dword [r12 + 0x11c], xmm0
movss dword [r12 + 0x118], xmm1
addss xmm2, dword [rcx + 0x2c]
movss dword [rcx + 0x2c], xmm2
xor ecx, ecx
movups xmm0, xmmword [rax + 0x16fc]
movups xmmword [rsp + 0x30], xmm0
shufps xmm0, xmm0, 0xff
mulss xmm0, dword [0x1400ce044]
movss dword [rsp + 0x3c], xmm0
call fcn.140024140
xorps xmm0, xmm0
lea rdx, [rsp + 0x20]
mov ecx, reloc.WS2_32.dll_setsockopt
movups xmmword [rsp + 0x20], xmm0
call fcn.140024140
xor edx, edx
lea rcx, [0x1400ce1a0]
lea r8d, [rdx + 0x50]
call fcn.140046ca0
mov ecx, 2
movzx ebx, al
call fcn.140023b40
xor ebp, ebp
test bl, bl
je 0x14004f142
mov eax, dword [rdi]
mov qword [rsp + 0xa8], rsi
mov esi, ebp
test eax, eax
jle 0x14004f135
mov qword [rsp + 0xb0], r14
mov r14d, ebp
mov qword [rsp + 0x70], r15
mov r15d, ebp
test r14, r14
js 0x14004f081
cmp esi, eax
jl 0x14004f09b
mov r8d, 0x6c7
lea rdx, str.C:Users_vunchDesktopUniversal_Running_SimulatorKeyAuth_ImGUIimguiimgui.h
lea rcx, str.i___0__i___Size
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rbx, qword [rdi + 8]
add rbx, r15
test dword [rbx + 4], 0x200000
jne 0x14004f115
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14004f0b9
mov rcx, qword [rcx]
jmp 0x14004f0f1
movsx eax, word [rbx + 0x24]
cmp ax, 0xffff
je 0x14004f0cb
cmp eax, dword [rdi + 0x88]
jl 0x14004f0e5
mov r8d, 0x89d
lea rdx, str.C:Users_vunchDesktopUniversal_Running_SimulatorKeyAuth_ImGUIimguiimgui_internal.h
lea rcx, str.tab__NameOffset____1___int_tab__NameOffset___TabsNames.Buf.Size
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
movsx rcx, word [rbx + 0x24]
add rcx, qword [rdi + 0x90]
mov eax, dword [rbx]
lea r9, [rsp + 0x20]
cmp dword [rdi + 0x18], eax
mov qword [rsp + 0x20], 0
sete dl
xor r8d, r8d
call fcn.14004c980
test al, al
cmovne rbp, rbx
mov eax, dword [rdi]
inc esi
inc r14
add r15, 0x30
cmp esi, eax
jl 0x14004f078
mov r15, qword [rsp + 0x70]
mov r14, qword [rsp + 0xb0]
call fcn.140018fb0
mov rsi, qword [rsp + 0xa8]
movss dword [r12 + 0x118], xmm6
mov rax, rbp
movss dword [r12 + 0x11c], xmm7
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400c1350
movaps xmm6, xmmword [rsp + 0x60]
movaps xmm7, xmmword [rsp + 0x50]
add rsp, 0x78
pop r12
pop rdi
pop rbp
pop rbx
ret
Function at 0x140054840
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r10, qword [rcx]
mov r9d, 0x270
mov ecx, dword [r10]
cmp ecx, r9d
jne 0x1400548a1
lea r8, [r10 + 8]
nop dword [rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x140054860
mov ecx, dword [r10]
jmp 0x14005498a
cmp ecx, 0x4e0
jb 0x14005498a
lea r11, [r10 + 0x9c4]
mov qword [rsp], rbx
mov eax, dword [r11]
mov ebx, 0xe3
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x1400548c0
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x140054910
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
xor ecx, ecx
mov dword [r10], ecx
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x1400577d0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x1320]
mov eax, 0x1420
call fcn.1400c1380
sub rsp, rax
movaps xmmword [rsp + 0x1410], xmm6
movaps xmmword [rsp + 0x1400], xmm7
mov rax, qword [0x14016f6f8]
xor rax, rsp
mov qword [rbp + 0x12f0], rax
call sub.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_
mov dword [rsp + 0x64], eax
mov edx, 1
mov dword [rbp + 0x12e4], 0xffffffff
nop
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [rsp + rdx*4 + 0x64], eax
inc rdx
cmp rdx, 0x270
jb 0x140057830
lea rax, [rsp + 0x60]
mov dword [rsp + 0x60], 0x270
mov qword [rsp + 0x38], rax
mov edi, 0x190
lea rax, [rsp + 0x60]
mov dword [rsp + 0x20], 3
mov qword [rsp + 0x40], rax
mov esi, 0xffffffff
lea rax, [rsp + 0x60]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x38]
call fcn.140054840
mov eax, eax
imul rcx, rax, 0x439
cmp ecx, 0x319
ja 0x1400578cb
nop dword [rax]
lea rcx, [rsp + 0x38]
call fcn.140054840
mov eax, eax
imul rcx, rax, 0x439
cmp ecx, 0x31a
jb 0x1400578b0
shr rcx, 0x20
movd xmm6, ecx
lea rcx, [rsp + 0x40]
cvtdq2ps xmm6, xmm6
call fcn.140054840
mov eax, eax
mov rbx, rdi
movaps xmm7, xmm6
imul rcx, rax, 0x7bd
cmp ecx, 0x7bd
jae 0x14005791b
cmp ecx, 0x330
jae 0x14005791b
nop
lea rcx, [rsp + 0x40]
call fcn.140054840
mov eax, eax
imul rcx, rax, 0x7bd
cmp ecx, 0x330
jb 0x140057900
mov rdx, qword [0x14016ff20]
shr rcx, 0x20
cmp rdx, qword [0x14016ff28]
movss dword [rsp + 0x28], xmm7
movd xmm0, ecx
cvtdq2ps xmm0, xmm0
movss dword [rsp + 0x24], xmm0
je 0x140057956
movsd xmm0, qword [rsp + 0x24]
movsd qword [rdx], xmm0
add qword [0x14016ff20], 8
jmp 0x140057967
lea r8, [rsp + 0x24]
lea rcx, [0x14016ff18]
call fcn.1400529b0
lea rcx, [rsp + 0x48]
call fcn.140054840
mov eax, eax
lea rcx, [rsp + 0x50]
add rax, rax
shr rax, 0x20
lea eax, [rax*2 - 1]
movd xmm6, eax
cvtdq2ps xmm6, xmm6
call fcn.140054840
mov rdx, qword [0x14016ff38]
mov ecx, eax
mov eax, 1
add rcx, rcx
movss dword [rsp + 0x30], xmm6
shr rcx, 0x20
test ecx, ecx
cmove eax, esi
cmp rdx, qword [0x14016ff40]
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [rsp + 0x2c], xmm0
je 0x1400579dc
movsd xmm0, qword [rsp + 0x2c]
movsd qword [rdx], xmm0
add qword [0x14016ff38], 8
jmp 0x1400579ed
lea r8, [rsp + 0x2c]
lea rcx, [0x14016ff30]
call fcn.1400529b0
mov rdx, qword [0x14016ffb0]
cmp rdx, qword [0x14016ffb8]
je 0x140057a0d
mov dword [rdx], 3
add qword [0x14016ffb0], 4
jmp 0x140057a1e
lea r8, [rsp + 0x20]
lea rcx, [0x14016ffa8]
call fcn.140052800
lea rdi, [rbx - 1]
test rdi, rdi
jne 0x140057891
mov rcx, qword [rbp + 0x12f0]
xor rcx, rsp
call fcn.1400c1350
lea r11, [rsp + 0x1420]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x140059800
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 6], sil
je 0x140059834
mov eax, esi
lea ecx, [rax - 0x79]
xor byte [r8 + rax], cl
inc rax
cmp rax, 5
jb 0x140059820
mov byte [r8 + 6], sil
add r8, 5
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.1400590a0
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140059859
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140069610
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x1400598d3
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400598ce
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400598ce
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c0d7c
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x1400598e0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 7], sil
je 0x140059914
mov eax, esi
lea ecx, [rax - 0x79]
xor byte [r8 + rax], cl
inc rax
cmp rax, 6
jb 0x140059900
mov byte [r8 + 7], sil
add r8, 6
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.1400590a0
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140059939
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140069610
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x1400599b3
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400599ae
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400599ae
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c0d7c
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400599c0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 8], sil
je 0x1400599f4
mov eax, esi
lea ecx, [rax - 0x79]
xor byte [r8 + rax], cl
inc rax
cmp rax, 7
jb 0x1400599e0
mov byte [r8 + 8], sil
add r8, 7
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.1400590a0
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140059a19
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140069610
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140059a93
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140059a8e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140059a8e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c0d7c
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x140059aa0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 9], sil
je 0x140059ad4
mov eax, esi
lea ecx, [rax - 0x79]
xor byte [r8 + rax], cl
inc rax
cmp rax, 8
jb 0x140059ac0
mov byte [r8 + 9], sil
add r8, 8
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.1400590a0
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140059af9
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140069610
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140059b73
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140059b6e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140059b6e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c0d7c
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x140059b80
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 0xa], sil
je 0x140059bb4
mov eax, esi
lea ecx, [rax - 0x79]
xor byte [r8 + rax], cl
inc rax
cmp rax, 9
jb 0x140059ba0
mov byte [r8 + 0xa], sil
add r8, 9
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.1400590a0
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140059bd9
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140069610
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140059c53
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140059c4e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140059c4e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c0d7c
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x140059c60
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r10, r8
mov rdi, rdx
mov rsi, rcx
mov qword [rsp + 0x28], rcx
xor ebx, ebx
cmp byte [r8 + 0xb], bl
je 0x140059c94
mov ecx, ebx
lea eax, [rcx - 0x79]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 0xa
jb 0x140059c80
mov byte [r8 + 0xb], bl
add r8, 0xa
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x50]
call fcn.1400590a0
nop
cmp byte [rdi + 0xb], 0
je 0x140059cc4
lea eax, [rbx - 0x79]
xor byte [rbx + rdi], al
inc rbx
cmp rbx, 0xa
jb 0x140059cb1
mov byte [rdi + 0xb], 0
lea r8, [rdi + 0xa]
lea r9, [rsp + 0x20]
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.1400590a0
nop
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
movzx edx, byte [rsp + 0x20]
mov rcx, rsi
call fcn.140060040
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140059d34
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140059d2e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140059d2e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c0d7c
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x140059d74
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140059d6f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140059d6f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c0d7c
mov rax, rsi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x140059d80
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 0xc], sil
je 0x140059db4
mov eax, esi
lea ecx, [rax - 0x79]
xor byte [r8 + rax], cl
inc rax
cmp rax, 0xb
jb 0x140059da0
mov byte [r8 + 0xc], sil
add r8, 0xb
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.1400590a0
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140059dd9
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140069610
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140059e53
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140059e4e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140059e4e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c0d7c
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x140061480
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 9], al
je 0x1400614a3
lea edx, [rax - 0x79]
xor byte [rax + rcx], dl
inc rax
cmp rax, 8
jb 0x140061490
mov byte [rcx + 9], 0
lea r8, [rcx + 8]
mov rdx, rcx
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.1400590a0
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x1400614c0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 0x10], al
je 0x1400614e3
lea edx, [rax - 0x79]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xf
jb 0x1400614d0
mov byte [rcx + 0x10], 0
lea r8, [rcx + 0xf]
mov rdx, rcx
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.1400590a0
mov rax, rbx
add rsp, 0x30
pop rbx
ret