joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000b6e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov rax, rdx
mov rsi, qword [rbp + 0x70]
mov rdi, qword [rbp + 0x68]
mov rdx, qword [rbp + 0x60]
mov ebx, ecx
shr ebx, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov r15, rax
movzx r14d, byte [rax + 1]
add rax, 2
lea r10, [r11 + r14]
cmp byte [r15], bl
jne 0x14000b760
cmp r11, r10
ja 0x14000b7d7
cmp r10, rdx
ja 0x14000b7e9
add r11, r9
xor r15d, r15d
nop dword [rax + rax]
cmp r14, r15
je 0x14000b762
lea r12, [r15 + 1]
cmp byte [r11 + r15], cl
mov r15, r12
jne 0x14000b740
jmp 0x14000b7c4
ja 0x14000b76a
mov r11, r10
cmp rax, r8
jne 0x14000b70e
add rsi, rdi
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r8, [rdi + 1]
movzx edx, byte [rdi]
test dl, dl
js 0x14000b7a0
mov rdi, r8
sub ecx, edx
jns 0x14000b7bb
jmp 0x14000b7c6
cmp r8, rsi
je 0x14000b7f8
movzx r8d, byte [rdi + 1]
add rdi, 2
and edx, 0x7f
shl edx, 8
or edx, r8d
sub ecx, edx
js 0x14000b7c6
xor al, 1
cmp rdi, rsi
jne 0x14000b780
jmp 0x14000b7c6
xor eax, eax
and al, 1
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.14002f490
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.14002f160
lea rcx, str.librarycore_srcunicodeprintable.rs
call fcn.14002f500
int3

Function at 0x14000d226
Capabilities:
Encode data using xor
Encrypt data using aes

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rsi, rdx
mov rbx, rcx
mov byte [rdx + 0xf0], 0xa
call fcn.14000d319
mov edi, eax
mov dword [rsi], eax
lea rcx, [rbx + 4]
call fcn.14000d319
mov dword [rsi + 4], eax
lea rcx, [rbx + 8]
call fcn.14000d319
mov dword [rsi + 8], eax
add rbx, 0xc
mov rcx, rbx
call fcn.14000d319
mov dword [rsi + 0xc], eax
xor ecx, ecx
lea rdx, [0x1400351a8]
mov r8d, 0xff
lea r9, [0x1400355a8]
lea r10, [0x1400359a8]
lea r11, [0x140035da8]
lea rbx, [0x1400361a8]
mov r14d, eax
shr r14d, 0xe
and r14d, 0x3fc
movzx ebp, byte [r14 + rdx + 3]
shl ebp, 0x18
xor ebp, edi
mov edi, eax
shr edi, 8
and edi, r8d
movzx edi, byte [r9 + rdi*4 + 2]
shl edi, 0x10
mov r14d, eax
and r14d, r8d
movzx r14d, byte [r10 + r14*4 + 1]
shl r14d, 8
xor r14d, edi
xor r14d, ebp
mov edi, eax
shr edi, 0x18
movzx edi, byte [r11 + rdi*4]
xor edi, r14d
xor edi, dword [rcx + rbx]
mov dword [rsi + rcx*4 + 0x10], edi
mov ebp, dword [rsi + rcx*4 + 4]
xor ebp, edi
mov dword [rsi + rcx*4 + 0x14], ebp
xor ebp, dword [rsi + rcx*4 + 8]
mov dword [rsi + rcx*4 + 0x18], ebp
xor eax, ebp
mov dword [rsi + rcx*4 + 0x1c], eax
add rcx, 4
cmp rcx, 0x28
jne 0x14000d298
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x140016780
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
mov rax, rdx
sub rdx, rcx
cmp rdx, 0x20
jae 0x1400167a5
cmp rax, rcx
je 0x1400167ab
cmp rdx, 4
jae 0x1400167b2
xor eax, eax
xor r8d, r8d
jmp 0x140016850
pop rbp
jmp fcn.140008d60
xor eax, eax
jmp 0x140016867
mov r8d, edx
and r8d, 0x1c
pxor xmm0, xmm0
xor eax, eax
movdqa xmm2, xmmword [0x140032530]
movdqa xmm3, xmmword [0x140032540]
pxor xmm1, xmm1
nop word cs:[rax + rax]
movzx r9d, word [rcx + rax]
movd xmm4, r9d
movzx r9d, word [rcx + rax + 2]
movd xmm5, r9d
pcmpgtb xmm4, xmm2
punpcklbw xmm4, xmm4
pshuflw xmm4, xmm4, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm0, xmm4
pcmpgtb xmm5, xmm2
punpcklbw xmm5, xmm5
pshuflw xmm4, xmm5, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm1, xmm4
add rax, 4
cmp r8, rax
jne 0x1400167e0
paddq xmm1, xmm0
pshufd xmm0, xmm1, 0xee
paddq xmm0, xmm1
movq rax, xmm0
cmp r8, rdx
je 0x140016867
nop dword [rax]
xor r9d, r9d
cmp byte [rcx + r8], 0xc0
setge r9b
add rax, r9
inc r8
cmp rdx, r8
jne 0x140016850
pop rbp
ret
Function at 0x140023450
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
mov r9, rcx
mov ecx, 0xfffffff4
pop rbp
jmp fcn.14001a380

Function at 0x1400261f4
Capabilities:
Accept command line arguments

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov qword [rbp], 0xfffffffffffffffe
mov rax, rdx
mov rsi, rcx
lea rdx, [rbp - 4]
mov rcx, rax
call qword [sym.imp.shell32.dll_CommandLineToArgvW]
test rax, rax
je 0x14002629a
mov rdi, rax
lea rbx, [rbp - 0x20]
and qword [rbx], 0
mov qword [rbx + 8], 8
and qword [rbx + 0x10], 0
movsxd rax, dword [rbp - 4]
lea r12, [rdi + rax*8]
lea r14, [rbp - 0x40]
mov r13, rdi
cmp r13, r12
je 0x140026280
mov r15, qword [r13]
mov rcx, r15
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
mov rcx, r14
mov rdx, r15
mov r8, rax
call fcn.14001d270
mov rcx, rbx
mov rdx, r14
call fcn.140026632
add r13, 8
jmp 0x140026250
mov rcx, rdi
call qword [sym.imp.kernel32.dll_LocalFree]
mov rax, qword [rbp - 0x10]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rbp - 0x20]
movups xmmword [rsi], xmm0
jmp 0x1400262ab
and qword [rsi], 0
mov qword [rsi + 8], 8
and qword [rsi + 0x10], 0
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x14002bb6d
Capabilities:
Check os version

Disassembly:
push rsi
push rdi
sub rsp, 0x148
mov rax, qword [rcx]
mov rdi, qword [rax]
and qword [rax], 0
test rdi, rdi
je 0x14002bbd9
lea rsi, [rsp + 0x30]
mov r8d, 0x118
mov rcx, rsi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov dword [rsi - 4], 0x11c
lea rcx, [rsp + 0x2c]
call qword [sym.imp.ntdll.dll_RtlGetVersion]
test eax, eax
js 0x14002bbc7
mov ecx, dword [rsp + 0x30]
mov al, 1
cmp ecx, 6
ja 0x14002bbcd
jne 0x14002bbcb
cmp dword [rsp + 0x34], 3
setae al
jmp 0x14002bbcd
mov al, 1
jmp 0x14002bbcd
xor eax, eax
mov byte [rdi], al
add rsp, 0x148
pop rdi
pop rsi
ret
lea rcx, str._rustc_3f5fd8dd41153bc5fdca9427e9e05be2c767ba23library_std_src_synconce.rs
call fcn.14002f500
int3

Function at 0x14002e714
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.kernel32.dll_GetModuleHandleW]
test rax, rax
je 0x14002e75e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14002e75e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14002e75e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14002e75e
cmp dword [rcx + 0x84], 0xe
jbe 0x14002e75e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14002e760
xor al, al
add rsp, 0x28
ret
Function at 0x140002060
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x140002088
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x1400020ae
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x1400020b0
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140002109
test ecx, ecx
jle 0x1400020e9
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140002109
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140002109
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret

Function at 0x140002130
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140002152
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x140002168
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140002184
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140002186
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x1400021c2
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x14000225e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x1400021fd
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x14000223e
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x14000225e
cmp rbx, rax
ja 0x140002210
test rbx, rbx
je 0x14000225e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
Function at 0x1400026d0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x14008a080]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x1400026fd
xor eax, eax
jmp 0x140002869
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x140002737
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x140002737
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x140002869
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x14000285c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14000277a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x1400027a5
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140002861
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140002814
sub eax, 1
je 0x140002814
cmp eax, 2
jne 0x14000285c
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140002861
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x140002842
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x14000285c
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x140002861
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14006d160
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x140002ae0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x14008a080]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140002bb3
cmp byte [rcx + 0x71], 0
je 0x140002bb3
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + Ordinal_26]
cmp eax, 0xffffffff
je 0x140002baf
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140002b74
sub eax, 1
je 0x140002b78
cmp eax, 2
jne 0x140002baf
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14006d160
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140002ba6
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x140002baf
cmp byte [rbx + 0x71], 0
sete al
jmp 0x140002b5c
xor al, al
jmp 0x140002b5c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14006d160
add rsp, 0x60
pop rbx
ret

Function at 0x140003e90
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x160
mov rax, qword [0x14008a080]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rdi, rcx
xor edx, edx
mov ecx, 2
xor esi, esi
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140003f1a
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x140003f1a
nop dword [rax]
mov rdx, rdi
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x140003f16
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140003ef0
jmp 0x140003f1a
mov esi, dword [rsp + 0x28]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.14006d160
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140003f50
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x160
mov rax, qword [0x14008a080]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rdi, rcx
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140003fab
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
jne 0x140003fb0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x140003fda
lea rdx, [rsp + 0x4c]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
mov rcx, rbx
test eax, eax
je 0x140003fd2
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_Process32Next]
jmp 0x140003f9e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.14006d160
mov rbx, qword [rsp + 0x178]
add rsp, 0x160
pop rdi
ret
Function at 0x14000b520
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 7], sil
je 0x14000b554
mov eax, esi
lea ecx, [rax - 0x35]
xor byte [r8 + rax], cl
inc rax
cmp rax, 6
jb 0x14000b540
mov byte [r8 + 7], sil
add r8, 6
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.140003570
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x14000b579
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140017850
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x14000b5f3
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b5ee
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000b5ee
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006d404
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x14000b600
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 9], sil
je 0x14000b634
mov eax, esi
lea ecx, [rax - 0x35]
xor byte [r8 + rax], cl
inc rax
cmp rax, 8
jb 0x14000b620
mov byte [r8 + 9], sil
add r8, 8
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.140003570
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x14000b659
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140017850
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x14000b6d3
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b6ce
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000b6ce
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006d404
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x14000b6e0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 0xa], sil
je 0x14000b714
mov eax, esi
lea ecx, [rax - 0x35]
xor byte [r8 + rax], cl
inc rax
cmp rax, 9
jb 0x14000b700
mov byte [r8 + 0xa], sil
add r8, 9
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.140003570
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x14000b739
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140017850
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x14000b7b3
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b7ae
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000b7ae
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006d404
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x14000b7c0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 0xc], sil
je 0x14000b7f4
mov eax, esi
lea ecx, [rax - 0x35]
xor byte [r8 + rax], cl
inc rax
cmp rax, 0xb
jb 0x14000b7e0
mov byte [r8 + 0xc], sil
add r8, 0xb
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.140003570
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x14000b819
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140017850
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x14000b893
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b88e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000b88e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006d404
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x140012480
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 9], al
je 0x1400124a3
lea edx, [rax - 0x35]
xor byte [rax + rcx], dl
inc rax
cmp rax, 8
jb 0x140012490
mov byte [rcx + 9], 0
lea r8, [rcx + 8]
mov rdx, rcx
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.140003570
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x1400124c0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 0x10], al
je 0x1400124e3
lea edx, [rax - 0x35]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xf
jb 0x1400124d0
mov byte [rcx + 0x10], 0
lea r8, [rcx + 0xf]
mov rdx, rcx
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.140003570
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x1400136a0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 5], 0
je 0x1400136c3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x35]
xor byte [rax + rcx], dl
inc rax
cmp rax, 4
jb 0x1400136b0
mov byte [rcx + 5], 0
mov rax, rcx
ret

Function at 0x1400136d0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x136], 0
je 0x1400136f8
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x35]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x135
jb 0x1400136e0
mov byte [rcx + 0x136], 0
mov rax, rcx
ret

Function at 0x140013700
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x44], 0
je 0x140013723
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x35]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x43
jb 0x140013710
mov byte [rcx + 0x44], 0
mov rax, rcx
ret

Function at 0x140013730
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x47], 0
je 0x140013753
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x35]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x46
jb 0x140013740
mov byte [rcx + 0x47], 0
mov rax, rcx
ret

Function at 0x140013760
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
sub rsp, 0xa8
cmp byte [0x14008a6d8], 0
jne 0x140013827
movdqa xmm0, xmmword [0x140072100]
xor edx, edx
movdqa xmm1, xmmword [0x140071ea0]
movdqa xmmword [rax - 0x68], xmm0
movdqa xmm0, xmmword [0x140072070]
movdqa xmmword [rax - 0x58], xmm1
movdqa xmm1, xmmword [0x140071e70]
movdqa xmmword [rax - 0x48], xmm0
movdqa xmm0, xmmword [0x140071e50]
movdqa xmmword [rax - 0x38], xmm1
movdqa xmmword [rax - 0x28], xmm0
mov dword [rax - 0x18], 0x1006f75
mov eax, edx
nop dword [rax]
nop word [rax + rax]
lea ecx, [rax - 0x35]
xor byte [rsp + rax + 0x40], cl
inc rax
cmp rax, 0x52
jb 0x1400137d0
xorps xmm0, xmm0
mov byte [rsp + 0x93], dl
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rdx
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rdx
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], dl
jne 0x140013805
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.140001690
lea rcx, [rsp + 0x20]
call fcn.1400152f0
add rsp, 0xa8
ret