joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000b420
Capabilities:
Hash data with crc32

Disassembly:
mov rax, qword [rcx + 0x1e8]
mov r10, r8
movsxd r9, dword [rcx + 0x1e0]
mov r11, rdx
mov rcx, r11
mov r8d, dword [rax + r9*4 - 4]
mov eax, r10d
sub eax, edx
xor edx, edx
test r10, r10
cmovne edx, eax
jmp fcn.14000beb0

Function at 0x14000bac0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push r14
sub rsp, 0x20
movsxd rbp, r9d
mov r14, r8
test r8, r8
je 0x14000badb
mov qword [r8], 0
call fcn.14000bc10
mov rbx, rax
test rax, rax
jne 0x14000baf1
add rsp, 0x20
pop r14
pop rbp
pop rbx
ret
xor edx, edx
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rdi
mov rcx, rbx
mov qword [rsp + 0x50], r15
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x14000bbde
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x14000bbde
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x14000bbde
mov rax, qword [0x140074fe0]
mov rsi, rdi
test rax, rax
je 0x14000bb57
inc dword [rax + 0x3c8]
mov rdx, qword [0x140074ff0]
lea rcx, [rdi + rbp]
call qword [section..data]
mov rdi, rax
test rax, rax
je 0x14000bbde
mov r9, rbx
mov r8, rsi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp rax, rsi
je 0x14000bbb6
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x140074fe0]
test rax, rax
je 0x14000bba4
dec dword [rax + 0x3c8]
mov rdx, qword [0x140074ff0]
mov rcx, rdi
call qword [0x140073008]
jmp 0x14000bbe7
test ebp, ebp
jle 0x14000bbc8
lea rcx, [rdi + rsi]
mov r8, rbp
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test r14, r14
je 0x14000bbd9
mov qword [r14], rsi
mov rax, rdi
jmp 0x14000bbe9
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov r15, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rbp
pop rbx
ret
Function at 0x14000beb0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rdi
cmp dword [0x140075014], 0
lea rdi, [0x140075010]
mov r11d, r8d
mov r9d, edx
mov r10, rcx
jne 0x14000bf88
mov qword [rsp + 0x10], rbx
xor edx, edx
mov rbx, rdi
nop dword [rax]
mov r8d, edx
lea rbx, [rbx + 4]
and r8d, 1
mov eax, edx
shr eax, 1
neg r8d
and r8d, 0xedb88320
inc edx
xor r8d, eax
mov eax, r8d
shr r8d, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, r8d
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov dword [rbx - 4], eax
cmp edx, 0x100
jb 0x14000bee0
mov rbx, qword [rsp + 0x10]
not r11d
mov eax, r11d
test r9d, r9d
jle 0x14000bfbe
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [r10]
lea r10, [r10 + 1]
movzx edx, al
xor rdx, rcx
shr eax, 8
xor eax, dword [rdi + rdx*4]
sub r9d, 1
jne 0x14000bfa0
not eax
pop rdi
ret
movzx r9d, byte [r10]
lea r8, [r10 + 1]
test r9b, r9b
je 0x14000bfff
nop dword [rax + rax]
cmp r9b, 0x23
jne 0x14000bfe3
cmp byte [r8], r9b
jne 0x14000bfe3
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rdi + rdx*4]
test r9b, r9b
jne 0x14000bfd0
not eax
pop rdi
ret
Function at 0x140014050
Capabilities:
Write file on windows

Disassembly:
push rdi
push r15
sub rsp, 0x28
mov rax, qword [0x140074fe0]
xor edi, edi
mov r15, rcx
mov dword [rax + 0x2d9c], edi
test rcx, rcx
je 0x14001417f
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x50], rsi
mov rsi, qword [0x140074fe0]
lea rbx, [rsi + 0x2da0]
mov dword [rsi + 0x2d9c], edi
mov ecx, dword [rbx + 4]
test ecx, ecx
jns 0x1400140b5
mov eax, ecx
cdq
sub eax, edx
mov edx, edi
sar eax, 1
add eax, ecx
mov rcx, rbx
test eax, eax
cmovg edx, eax
call fcn.140017160
mov dword [rbx], edi
cmp dword [rbx + 4], edi
jne 0x1400140c9
mov edx, 8
mov rcx, rbx
call fcn.140017160
movsxd rcx, dword [rbx]
mov ebp, edi
mov rax, qword [rbx + 8]
mov byte [rcx + rax], dil
inc dword [rbx]
cmp dword [rsi + 0x2db0], edi
jle 0x14001411a
mov qword [rsp + 0x20], r14
mov r14, rdi
nop dword [rax + rax]
mov r9, qword [rsi + 0x2db8]
mov r8, rbx
add r9, r14
mov rcx, rsi
mov rdx, r9
call qword [r9 + 0x20]
inc ebp
add r14, 0x30
cmp ebp, dword [rsi + 0x2db0]
jl 0x1400140f0
mov r14, qword [rsp + 0x20]
cmp qword [rbx + 8], rdi
je 0x140014124
mov edi, dword [rbx]
dec edi
mov rax, qword [rsi + 0x2da8]
lea rdx, [0x1400489bc]
test rax, rax
movsxd rbp, edi
lea rdi, [0x140074fe8]
mov rcx, r15
cmovne rdi, rax
call fcn.14000bc10
mov rsi, qword [rsp + 0x50]
mov rbx, rax
test rax, rax
je 0x140014175
mov r9, rax
mov r8, rbp
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x28
pop r15
pop rdi
ret
Function at 0x14001a250
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test r9d, 0xff000000
je 0x14001a407
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
movss xmm3, dword [rsp + 0x70]
xorps xmm0, xmm0
comiss xmm3, xmm0
mov esi, r9d
mov rdi, r8
mov rbp, rdx
mov rbx, rcx
jbe 0x14001a2e6
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x20], eax
call fcn.14001d230
mov r8d, dword [rbx + 0x80]
mov r9d, esi
mov rdx, qword [rbx + 0x88]
mov rcx, rbx
call fcn.140017aa0
mov ecx, dword [rbx + 0x84]
test ecx, ecx
jns 0x14001a2d7
mov eax, ecx
cdq
sub eax, edx
xor edx, edx
sar eax, 1
add eax, ecx
lea rcx, [rbx + 0x80]
test eax, eax
cmovg edx, eax
call fcn.1400172a0
mov dword [rbx + 0x80], 0
jmp 0x14001a3f3
mov edx, 6
movaps xmmword [rsp + 0x30], xmm6
lea r8d, [rdx - 2]
call fcn.14001d710
movzx edx, word [rbx + 0x48]
mov rax, qword [rbx + 0x38]
movss xmm1, dword [rdi]
movss xmm2, dword [rbp + 4]
movss xmm3, dword [rbp]
lea ecx, [rdx + 1]
movss xmm6, dword [rax + 4]
movss xmm5, dword [rax]
movss xmm4, dword [rdi + 4]
mov rax, qword [rbx + 0x58]
mov word [rax], dx
mov rax, qword [rbx + 0x58]
mov word [rax + 2], cx
lea ecx, [rdx + 2]
mov rax, qword [rbx + 0x58]
mov word [rax + 4], cx
mov rax, qword [rbx + 0x58]
mov word [rax + 6], dx
add dx, 3
mov rax, qword [rbx + 0x58]
mov word [rax + 8], cx
mov rax, qword [rbx + 0x58]
mov word [rax + 0xa], dx
movsd xmm0, qword [rbp]
mov rax, qword [rbx + 0x50]
movsd qword [rax], xmm0
mov rax, qword [rbx + 0x50]
movss dword [rax + 8], xmm5
movss dword [rax + 0xc], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x10], esi
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x14], xmm1
movss dword [rax + 0x18], xmm2
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x1c], xmm5
movss dword [rax + 0x20], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x24], esi
movsd xmm0, qword [rdi]
mov rax, qword [rbx + 0x50]
movsd qword [rax + 0x28], xmm0
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x30], xmm5
movss dword [rax + 0x34], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x38], esi
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x3c], xmm3
movss dword [rax + 0x40], xmm4
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x44], xmm5
movss dword [rax + 0x48], xmm6
mov rax, qword [rbx + 0x50]
movaps xmm6, xmmword [rsp + 0x30]
mov dword [rax + 0x4c], esi
add qword [rbx + 0x50], 0x50
add dword [rbx + 0x48], 4
add qword [rbx + 0x58], 0xc
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x1400274f0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x140074ef8]
xor rax, rsp
mov qword [rsp + 0x48], rax
call fcn.14000b450
mov rcx, qword [0x140075468]
lea rdx, [rsp + 0x38]
mov rdi, rax
call qword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [rsp + 0x40]
sub ecx, dword [rsp + 0x38]
movd xmm1, ecx
mov ecx, dword [rsp + 0x44]
sub ecx, dword [rsp + 0x3c]
cvtdq2ps xmm1, xmm1
movd xmm0, ecx
lea rcx, [rsp + 0x30]
cvtdq2ps xmm0, xmm0
movss dword [rdi + 8], xmm1
movss dword [rdi + 0xc], xmm0
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x30]
xorps xmm1, xmm1
sub rax, qword [0x140075470]
xorps xmm0, xmm0
cvtsi2ss xmm0, qword [0x140075478]
mov ecx, 0x11
cvtsi2ss xmm1, rax
divss xmm1, xmm0
movss dword [rdi + 0x10], xmm1
mov rax, qword [rsp + 0x30]
mov qword [0x140075470], rax
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov ecx, 0x10
and al, 1
mov byte [rdi + 0x128], al
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov ecx, 0x12
and al, 1
mov byte [rdi + 0x129], al
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, 1
mov byte [rdi + 0x12b], 0
mov byte [rdi + 0x12a], al
call fcn.14000b450
cmp byte [rax + 0x3a7], 0
lea rbx, [rax + 0x110]
je 0x14002761d
cvttss2si ecx, dword [rbx]
lea rdx, [rsp + 0x20]
cvttss2si eax, dword [rax + 0x114]
mov dword [rsp + 0x20], ecx
mov rcx, qword [0x140075468]
mov dword [rsp + 0x24], eax
call qword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [rsp + 0x24]
mov ecx, dword [rsp + 0x20]
call qword [sym.imp.USER32.dll_SetCursorPos]
mov dword [rbx], 0xff7fffff
mov dword [rbx + 4], 0xff7fffff
call qword [sym.imp.USER32.dll_GetActiveWindow]
cmp rax, qword [0x140075468]
jne 0x140027679
lea rcx, [rsp + 0x28]
call qword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x140027679
mov rcx, qword [0x140075468]
lea rdx, [rsp + 0x28]
call qword [sym.imp.USER32.dll_ScreenToClient]
test eax, eax
je 0x140027679
movd xmm0, dword [rsp + 0x28]
movd xmm1, dword [rsp + 0x2c]
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm1, xmm1
movss dword [rbx], xmm0
movss dword [rbx + 4], xmm1
cmp byte [rdi + 0xc8], 0
je 0x140027689
mov eax, 0xffffffff
jmp 0x14002768e
call fcn.14000b460
cmp dword [0x140073138], eax
je 0x1400276a1
mov dword [0x140073138], eax
call fcn.1400276d0
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140046190
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x14004689c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400468e6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400468e6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400468e6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400468e6
cmp dword [rcx + 0x84], 0xe
jbe 0x1400468e6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400468e8
xor al, al
add rsp, 0x28
ret
Function at 0x14000b330
Capabilities:
Access peb ldr_data
Encode data using xor
Get kernel32 base address
Get process filename
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x38
mov rax, qword [0x14016f7f0]
test rax, rax
jne 0x14000b534
mov rax, qword gs:[0x60]
xor r8d, r8d
mov qword [rsp + 0x48], rbx
mov ebx, 0x694a8c81
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x58], rsi
mov rcx, qword [rax + 0x18]
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r15
mov rax, qword [rcx + 0x10]
mov rbp, qword [rax]
mov rdi, rbp
mov eax, dword [rdi + 0x58]
sub ax, 8
test r8d, r8d
je 0x14000b3cd
mov rcx, qword [rdi + 0x60]
mov edx, 0x811c9dc5
movzx eax, ax
shr rax, 1
lea r9, [rcx + rax*2]
cmp rcx, r9
je 0x14000b3c4
nop word [rax + rax]
movsx eax, byte [rcx]
add rcx, 2
xor eax, edx
imul edx, eax, 0x1000193
cmp rcx, r9
jne 0x14000b3b0
cmp edx, r8d
jne 0x14000b4f7
mov r10, qword [rdi + 0x30]
movsxd rax, dword [r10 + 0x3c]
mov rcx, qword [rax + r10 + 0x88]
mov r15, rcx
mov r11d, ecx
shr r15, 0x20
add r11, r10
cmp r11, r10
je 0x14000b4f7
mov r9d, dword [r11 + 0x18]
test r9d, r9d
je 0x14000b4f7
mov r14d, dword [r11 + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov edx, 0x811c9dc5
lea rax, [r14 + r9*4]
mov ecx, dword [rax + r10]
add rcx, r10
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x14000b447
nop dword [rax]
movsx eax, al
lea rcx, [rcx + 1]
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx - 1]
test al, al
jne 0x14000b430
cmp edx, ebx
je 0x14000b455
test r9d, r9d
jne 0x14000b410
jmp 0x14000b4f7
mov ecx, dword [r11 + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [r11 + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
cmp rax, r11
jbe 0x14000b50f
lea rcx, [r15 + r11]
cmp rax, rcx
jae 0x14000b50f
movzx ecx, byte [rax]
mov r8d, 0x811c9dc5
mov dword [rsp + 0x40], r8d
mov edx, r8d
mov dword [rsp + 0x44], edx
cmp cl, 0x2e
je 0x14000b4bd
nop
movsx ecx, cl
inc rax
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rax]
cmp cl, 0x2e
jne 0x14000b4a0
mov dword [rsp + 0x40], r8d
movzx ecx, byte [rax + 1]
inc rax
test cl, cl
je 0x14000b4ea
nop dword [rax + rax]
movsx ecx, cl
lea rax, [rax + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax]
test cl, cl
jne 0x14000b4d0
mov dword [rsp + 0x44], edx
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rbp]
shr rbx, 0x20
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rbp
je 0x14000b50d
cmp qword [rax + 0x30], 0
jne 0x14000b381
xor eax, eax
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x48]
mov qword [0x14016f7f0], rax
add rsp, 0x38
jmp rax
Function at 0x14000bb50
Capabilities:
Access peb ldr_data
Encode data using xor
Get kernel32 base address
Get process filename
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x38
mov rcx, qword [0x14016f838]
test rcx, rcx
jne 0x14000bd53
mov rax, qword gs:[0x60]
xor r8d, r8d
mov qword [rsp + 0x48], rbx
mov ebx, 0x9bc5a608
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x30], rdi
mov rcx, qword [rax + 0x18]
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r15
mov qword [rsp + 0x50], rbp
mov rax, qword [rcx + 0x10]
mov r15, qword [rax]
mov rdi, r15
mov eax, dword [rdi + 0x58]
sub ax, 8
test r8d, r8d
je 0x14000bbed
mov rcx, qword [rdi + 0x60]
mov edx, 0x811c9dc5
movzx eax, ax
shr rax, 1
lea r9, [rcx + rax*2]
cmp rcx, r9
je 0x14000bbe4
nop word [rax + rax]
movsx eax, byte [rcx]
add rcx, 2
xor eax, edx
imul edx, eax, 0x1000193
cmp rcx, r9
jne 0x14000bbd0
cmp edx, r8d
jne 0x14000bd16
mov r10, qword [rdi + 0x30]
movsxd rax, dword [r10 + 0x3c]
mov rcx, qword [rax + r10 + 0x88]
mov rbp, rcx
mov r11d, ecx
shr rbp, 0x20
add r11, r10
cmp r11, r10
je 0x14000bd16
mov r9d, dword [r11 + 0x18]
test r9d, r9d
je 0x14000bd16
mov r14d, dword [r11 + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov edx, 0x811c9dc5
lea rax, [r14 + r9*4]
mov ecx, dword [rax + r10]
add rcx, r10
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x14000bc67
nop dword [rax]
movsx eax, al
lea rcx, [rcx + 1]
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx - 1]
test al, al
jne 0x14000bc50
cmp edx, ebx
je 0x14000bc75
test r9d, r9d
jne 0x14000bc30
jmp 0x14000bd16
mov ecx, dword [r11 + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [r11 + 0x1c]
add rcx, r10
mov ecx, dword [rcx + rdx*4]
add rcx, r10
cmp rcx, r11
jbe 0x14000bd2e
lea rax, [r11 + rbp]
cmp rcx, rax
jae 0x14000bd2e
movzx eax, byte [rcx]
mov r8d, 0x811c9dc5
mov dword [rsp + 0x40], r8d
mov edx, r8d
mov dword [rsp + 0x44], edx
cmp al, 0x2e
je 0x14000bcdc
nop dword [rax]
movsx eax, al
inc rcx
xor eax, r8d
imul r8d, eax, 0x1000193
movzx eax, byte [rcx]
cmp al, 0x2e
jne 0x14000bcc0
mov dword [rsp + 0x40], r8d
movzx eax, byte [rcx + 1]
inc rcx
test al, al
je 0x14000bd0a
nop word [rax + rax]
movsx eax, al
lea rcx, [rcx + 1]
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx]
test al, al
jne 0x14000bcf0
mov dword [rsp + 0x44], edx
mov rbx, qword [rsp + 0x40]
mov rdi, qword [r15]
shr rbx, 0x20
mov rax, qword [rdi]
mov rdi, rax
cmp rax, r15
je 0x14000bd2c
cmp qword [rax + 0x30], 0
jne 0x14000bba1
xor ecx, ecx
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x48]
mov qword [0x14016f838], rcx
call fcn.14000a260
call fcn.14000aa60
test eax, eax
je 0x14000bd6d
mov qword [0], 1
call fcn.14000af20
test eax, eax
je 0x14000bd82
mov qword [0], 1
call fcn.14000b330
test eax, eax
je 0x14000bd97
mov qword [0], 1
call fcn.14000b540
test al, al
je 0x14000bdac
mov qword [0], 1
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], reloc.WS2_32.dll_sendto
call fcn.14002a2f0
add rsp, 0x38
ret
Function at 0x1400268a0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
xor r8d, r8d
mov rdx, rcx
mov qword [rsp + 0x28], rbx
cmp byte [rcx + 9], r8b
je 0x1400268d3
mov eax, r8d
nop dword [rax]
lea ecx, [rax - 0x61]
xor byte [rax + rdx], cl
inc rax
cmp rax, 8
jb 0x1400268c0
mov byte [rdx + 9], r8b
xorps xmm0, xmm0
lea rcx, [rdx + 8]
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], r8
cmp rdx, rcx
jne 0x140026902
mov qword [rbx + 0x10], r8
mov rax, rbx
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
add rsp, 0x30
pop rbx
ret
mov r8d, 8
mov rcx, rbx
call fcn.1400054a0
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x140026dc0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je case.default.0x140026de1
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x140026e0e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140026e10
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140026e69
test ecx, ecx
jle 0x140026e49
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140026e69
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140026e69
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret
push rdx
add byte [rax], ah
add byte [rax + rax + 0x45], cl
add byte [rbx], dl
and byte [rax], al
add byte [rdi], r9b
add byte [r13], r9b
add byte [r15], al
add byte [r11], r10b
add byte cs:[rsi], dl
outsd dx, dword [rsi]
add byte [rbp], dh
jae 0x14015889a
and byte [rax], al
jo 0x14015889e
outsd dx, dword [rsi]
add byte [rbp], dh
jbe 0x1401588a4
add byte gs:[rdx], bh
and byte [rax], al
outsd dx, dword [rsi]
add byte [rdx], ah
je 0x1401588b0
add byte gs:[rsi], ch
imul eax, dword [rax], 0x200072
add byte fs:[rbp], ah
and byte [rax], al
push rbx
add byte [rcx], bh
jae 0x1401588c6
imul eax, dword [rax], 0x74006e
add byte gs:[rdx], dh
outsb dx, byte [rsi]
add byte [rcx], ah
insb byte [rdi], dx
add byte [rbx], dh
and byte [rax], al
add byte gs:[rax + rax + 0x20], dh
add byte [rax + rax + 0x65], ah
add byte [rax], ah
add byte [rbx], dh
add byte gs:[rbx], dh
and byte [rax], al
add byte [rdi], ch
jne 0x1401588f4
jb 0x1401588f6
outsb dx, byte [rsi]
add byte [rcx], ch
jae 0x1401588fc
jae 0x1401588fe
add byte gs:[rbp], dh
jb 0x140158904
jae 0x140158906
and byte [rax], al
jne 0x14015890a
outsb dx, byte [rsi]
add byte [rbp], ah
and byte [rax], al
imul eax, dword [rax], 0x64006e
add byte gs:[rbp], ch
outsb dx, byte [rsi]
add byte [rcx], ch
jae 0x140158920
invalid
Function at 0x140026e90
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140026eb2
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je case.default.0x140026ec1
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140026ee4
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140026ee6
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140026f22
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x140026fbe
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x140026f5d
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x140026f9e
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x140026fbe
cmp rbx, rax
ja 0x140026f70
test rbx, rbx
je 0x140026fbe
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
leave
add byte [rdx], dl
retf 0x5400
push rsp