joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002460
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
movzx r8d, word [rcx + 6]
lea rax, [rcx + rax + 0x18]
test r8w, r8w
je 0x1400024ad
lea ecx, [r8 - 1]
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rcx, r8
cmp rdx, r8
jb 0x1400024a4
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x1400024af
add rax, 0x28
cmp rax, r9
jne 0x140002490
xor eax, eax
ret

Function at 0x1400024b0
Capabilities:
Parse pe header

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, rcx
call sym.strlen
cmp rax, 8
ja 0x140002540
mov rdx, qword [0x140004420]
xor ebx, ebx
cmp word [rdx], 0x5a4d
jne 0x14000252e
movsxd rax, dword [rdx + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
jne 0x14000252e
cmp word [rax + 0x18], 0x20b
jne 0x14000252e
movzx edx, word [rax + 0x14]
lea rbx, [rax + rdx + 0x18]
movzx edx, word [rax + 6]
test dx, dx
je 0x140002540
lea eax, [rdx - 1]
lea rax, [rax + rax*4]
lea rdi, [rbx + rax*8 + 0x28]
jmp 0x140002519
add rbx, 0x28
cmp rbx, rdi
je 0x140002540
mov r8d, 8
mov rdx, rsi
mov rcx, rbx
call sym.strncmp
test eax, eax
jne 0x140002510
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
xor ebx, ebx
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret

Function at 0x140002550
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x140004420]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140002570
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140002578
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140002570
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x1400025cd
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x1400025c4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x140002570
add rax, 0x28
cmp rax, r9
jne 0x1400025b0
xor eax, eax
ret

Function at 0x1400025d0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140004420]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x1400025ef
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400025f8
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x1400025ef
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x140002610
Capabilities:
Parse pe header

Disassembly:
mov r8, qword [0x140004420]
xor eax, eax
cmp word [r8], 0x5a4d
jne 0x140002630
movsxd rdx, dword [r8 + 0x3c]
add rdx, r8
cmp dword [rdx], 0x4550
je 0x140002638
ret
cmp word [rdx + 0x18], 0x20b
jne 0x140002630
movzx eax, word [rdx + 0x14]
movzx r8d, word [rdx + 6]
lea rax, [rdx + rax + 0x18]
test r8w, r8w
je 0x140002680
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea rdx, [rax + rdx*8 + 0x28]
nop dword [rax]
test byte [rax + 0x27], 0x20
je 0x140002677
test rcx, rcx
je 0x140002630
sub rcx, 1
add rax, 0x28
cmp rdx, rax
jne 0x140002668
xor eax, eax
ret
Function at 0x140002690
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140004420]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x1400026af
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x1400026b8
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret

Function at 0x1400026d0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x140004420]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x1400026f0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x1400026f8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x1400026f0
sub rcx, rdx
movzx r9d, word [r8 + 6]
movzx edx, word [r8 + 0x14]
lea rdx, [r8 + rdx + 0x18]
test r9w, r9w
je 0x1400026f0
lea eax, [r9 - 1]
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rdx + 0xc]
mov rax, r8
cmp rcx, r8
jb 0x140002744
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x140002750
add rdx, 0x28
cmp rdx, r9
jne 0x140002730
xor eax, eax
ret
mov eax, dword [rdx + 0x24]
not eax
shr eax, 0x1f
ret

Function at 0x140002760
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov r11, qword [0x140004420]
xor r9d, r9d
cmp word [r11], 0x5a4d
jne 0x140002782
movsxd r8, dword [r11 + 0x3c]
add r8, r11
cmp dword [r8], 0x4550
je 0x140002790
mov rax, r9
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140002782
mov eax, dword [r8 + 0x90]
test eax, eax
je 0x140002782
movzx edx, word [r8 + 0x14]
movzx r10d, word [r8 + 6]
lea rdx, [r8 + rdx + 0x18]
test r10w, r10w
je 0x140002782
lea r8d, [r10 - 1]
lea r8, [r8 + r8*4]
lea r10, [rdx + r8*8 + 0x28]
nop word cs:[rax + rax]
mov r9d, dword [rdx + 0xc]
mov r8, r9
cmp rax, r9
jb 0x1400027e5
add r8d, dword [rdx + 8]
cmp rax, r8
jb 0x1400027f8
add rdx, 0x28
cmp r10, rdx
jne 0x1400027d0
xor r9d, r9d
mov rax, r9
ret
add rax, r11
jmp 0x140002807
sub ecx, 1
add rax, 0x14
mov r8d, dword [rax + 4]
test r8d, r8d
jne 0x140002817
mov edx, dword [rax + 0xc]
test edx, edx
je 0x1400027ee
test ecx, ecx
jg 0x140002800
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
ret
Function at 0x140001da0
Capabilities:
Get storage device properties

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
sub rsp, 0xe0
mov rax, qword [0x140023008]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov r9d, ecx
lea r8, str..PhysicalDrive
lea rcx, [rsp + 0x50]
lea rdx, str._s_d
call qword [sym.imp.USER32.dll_wsprintfW]
xor ebp, ebp
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x30], rbp
xor r9d, r9d
mov dword [rsp + 0x28], ebp
xor edx, edx
mov dword [rsp + 0x20], 3
lea r8d, [rbp + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x140001e21
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x140001edb
mov qword [rsp + 0xf8], rbx
mov ecx, 0x1048
mov qword [rsp + 0x100], rdi
mov dword [rsp + 0x40], ebp
call fcn.14000367c
xor edx, edx
mov r8d, 0x103c
mov rbx, rax
lea rcx, [rax + 0xc]
call fcn.140004870
lea rdi, [rbx + 8]
mov qword [rsp + 0x38], rbp
lea rax, [rsp + 0x40]
mov qword [rbx], 0x31
mov qword [rsp + 0x30], rax
mov r9d, 0x1048
mov dword [rsp + 0x28], 0x1048
mov r8, rbx
mov edx, 0x2d1400
mov qword [rsp + 0x20], rbx
mov rcx, rsi
mov dword [rdi], 3
mov dword [rdi + 4], 1
mov qword [rdi + 8], 1
mov dword [rdi + 0x10], 0x28
mov dword [rdi + 0x14], 0x1000
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rbx, qword [rsp + 0xf8]
test eax, eax
jne 0x140001ecd
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x140001ed3
mov eax, dword [rdi + 0x10]
add rax, rdi
mov rdi, qword [rsp + 0x100]
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.140003650
mov rbp, qword [rsp + 0x108]
add rsp, 0xe0
pop rsi
ret
Function at 0x14000bd70
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
mov rdx, rcx
test rcx, rcx
jne 0x14000bd4d
call fcn.140008f20
mov dword [rax], 0x16
call fcn.140008e00
or eax, 0xffffffff
jmp 0x14000bd6a
sub dword [rcx + 0x10], 1
jns 0x14000bd5c
add rsp, 0x28
jmp 0x1400126c8
mov rax, qword [rcx]
movzx ecx, byte [rax]
inc rax
mov qword [rdx], rax
mov eax, ecx
add rsp, 0x28
ret
jmp 0x14000bd2c
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov rdi, rcx
test rcx, rcx
jne 0x1400126fa
call fcn.140008f20
mov dword [rax], 0x16
call fcn.140008e00
jmp 0x140012817
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x140012817
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test al, 1
jne 0x140012817
mov eax, dword [rcx + 0x14]
shr eax, 1
test al, 1
je 0x140012729
lock or dword [rcx + 0x14], 0x10
jmp 0x140012817
lock or dword [rcx + 0x14], 1
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x14001273d
call fcn.140014f4c
mov rbx, qword [rdi + 8]
mov rcx, rdi
mov qword [rdi], rbx
call fcn.14000b534
mov r8d, dword [rdi + 0x20]
mov ecx, eax
mov rdx, rbx
call fcn.1400140cc
mov dword [rdi + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 1
jbe 0x140012805
mov eax, dword [rdi + 0x14]
or esi, 0xffffffff
test al, 6
jne 0x1400127d0
mov rcx, rdi
call fcn.14000b534
cmp eax, esi
je 0x1400127bb
mov rcx, rdi
call fcn.14000b534
cmp eax, 0xfffffffe
je 0x1400127bb
mov rcx, rdi
call fcn.14000b534
movsxd rbx, eax
lea r14, [0x1400245c0]
mov rcx, rdi
sar rbx, 6
call fcn.14000b534
and eax, 0x3f
lea rcx, [rax + rax*8]
mov rax, qword [r14 + rbx*8]
lea rdx, [rax + rcx*8]
jmp 0x1400127c2
lea rdx, [0x140023160]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x1400127d0
lock or dword [rdi + 0x14], 0x20
cmp dword [rdi + 0x20], 0x200
jne 0x1400127f4
mov eax, dword [rdi + 0x14]
shr eax, 6
test al, 1
je 0x1400127f4
mov eax, dword [rdi + 0x14]
shr eax, 8
test al, 1
jne 0x1400127f4
mov dword [rdi + 0x20], 0x1000
add dword [rdi + 0x10], esi
mov rax, qword [rdi]
movzx esi, byte [rax]
inc rax
mov qword [rdi], rax
jmp 0x14001281a
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rdi + 0x14], eax
and dword [rdi + 0x10], 0
or esi, 0xffffffff
mov rbx, qword [rsp + 0x30]
mov eax, esi
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x140030fc0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x140030fcd
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x140030fdd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x140030fc5
lea eax, [rcx + 1]
call r11
adc eax, eax
add ebx, ebx
jne 0x140030ff5
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x140030fe2
sub eax, 3
jb 0x14003100f
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x140031046
movsxd rbp, eax
lea eax, [rcx + 1]
call r11
adc ecx, ecx
call r11
adc ecx, ecx
jne 0x140031036
mov ecx, eax
add eax, 2
call r11
adc ecx, ecx
add ebx, ebx
jne 0x140031034
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x140031023
cmp rbp, 0xfffffffffffff300
adc ecx, eax
call fcn.140030f82
jmp 0x140030fcd
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x1b400
mov dl, 9
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x140031092
cmp rsi, rcx
jae 0x14003109a
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x140031079
cmp al, 0x8f
ja 0x140031079
cmp byte [rsi - 2], 0xf
je 0x14003107f
sub al, 0xe8
cmp al, 1
ja 0x140031063
cmp rsi, rcx
jae 0x14003109a
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x140031069
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x14003109a
lodsb al, byte [rsi]
jmp 0x140031079
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x2e000]
mov eax, dword [rdi]
or eax, eax
je 0x140031103
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x35fb0]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x1400310a7
jns 0x1400310dc
movzx rdx, word [rdi]
add rdi, 2
jmp 0x1400310e6
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x1400310fd
mov qword [rbx], rax
add rbx, 8
jmp 0x1400310c7
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x18f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x14003115b
sub rsp, 0xffffffffffffff80
jmp 0x14001bce0
Function at 0x14007233e
Capabilities:
Terminate process

Disassembly:
jmp 0x1401500d0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x140072415
Capabilities:
Parse pe header

Disassembly:
jmp 0x140151420
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140151440
xor al, al
jmp 0x1401514c1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140151453
xor al, al
jmp 0x1401514c1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14015147d
xor al, al
jmp 0x1401514c1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140151491
xor al, al
jmp 0x1401514c1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x1401514a3
xor al, al
jmp 0x1401514c1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x1401514bf
xor al, al
jmp 0x1401514c1
mov al, 1
add rsp, 0x38
ret
Function at 0x140008d40
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
mov rax, qword [0x1400a8800]
xor rax, rsp
mov qword [rsp + 0x80], rax
cmp edx, 0xffffffff
je 0x140008e6d
mov esi, edx
mov rdi, rcx
mov rax, qword [rcx + 0x40]
cmp qword [rax], 0
je 0x140008d9d
mov rax, qword [rdi + 0x58]
mov ecx, dword [rax]
test ecx, ecx
jle 0x140008d9d
dec ecx
mov dword [rax], ecx
mov rax, qword [rdi + 0x40]
mov rcx, qword [rax]
lea rdx, [rcx + 1]
mov qword [rax], rdx
mov byte [rcx], sil
jmp 0x140008eb2
cmp qword [rdi + 0x80], 0
je 0x140008e71
mov rax, qword [rdi + 0x18]
lea rcx, [rdi + 0x70]
cmp qword [rax], rcx
jne 0x140008dd7
mov ecx, dword [rdi + 0x90]
mov rdx, qword [rdi + 0x88]
mov qword [rax], rdx
mov rax, qword [rdi + 0x38]
mov qword [rax], rdx
sub ecx, edx
mov rax, qword [rdi + 0x50]
mov dword [rax], ecx
mov rcx, qword [rdi + 0x68]
test rcx, rcx
je 0x140008e78
mov byte [rsp + 0x5f], sil
lea rax, [rsp + 0x80]
lea r9, [rsp + 0x60]
lea rdx, [rdi + 0x74]
mov r10, qword [rcx]
lea r8, [rsp + 0x48]
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rax
lea r14, [rsp + 0x60]
mov qword [rsp + 0x28], r14
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea rbx, [rsp + 0x5f]
mov r8, rbx
call qword [r10 + gethostname]
mov ebp, 0xffffffff
cmp eax, 2
jae 0x140008e91
mov r15, qword [rsp + 0x48]
sub r15, r14
je 0x140008e5d
mov r9, qword [rdi + 0x80]
mov edx, 1
mov rcx, r14
mov r8, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp r15, rax
jne 0x140008eb0
mov byte [rdi + 0x71], 1
cmp qword [rsp + 0x50], rbx
mov eax, 0xffffffff
jmp 0x140008eab
xor esi, esi
jmp 0x140008eb2
mov esi, 0xffffffff
jmp 0x140008eb2
mov rdx, qword [rdi + 0x80]
movsx ecx, sil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
cmp eax, 0xffffffff
cmove esi, eax
jmp 0x140008eb2
cmp eax, 3
jne 0x140008eb0
mov rdx, qword [rdi + 0x80]
movsx ecx, byte [rsp + 0x5f]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
cmp eax, 0xffffffff
cmove esi, eax
mov ebp, esi
mov esi, ebp
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140038080
mov eax, esi
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140009320
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
test r8, r8
jle 0x14000935b
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
cmp qword [rcx + 0x68], 0
je 0x140009362
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
xor esi, esi
jmp 0x140009459
mov rax, qword [rbx + 0x38]
mov rdx, qword [rax]
test rdx, rdx
je 0x1400093b5
mov rax, qword [rbx + 0x50]
movsxd r15, dword [rax]
test r15, r15
je 0x1400093b5
cmp r15, rsi
cmovae r15, rsi
mov rcx, rdi
mov r8, r15
call sub.VCRUNTIME140.dll_memcpy
add rdi, r15
mov r14, rsi
sub r14, r15
mov rax, qword [rbx + 0x50]
sub dword [rax], r15d
mov rax, qword [rbx + 0x38]
movsxd rcx, r15d
add qword [rax], rcx
cmp qword [rbx + 0x80], 0
jne 0x1400093c6
jmp 0x140009456
mov r14, rsi
cmp qword [rbx + 0x80], 0
je 0x140009456
mov rax, qword [rbx + 0x18]
lea rcx, [rbx + 0x70]
cmp qword [rax], rcx
jne 0x1400093f2
mov ecx, dword [rbx + 0x90]
mov rdx, qword [rbx + 0x88]
mov qword [rax], rdx
mov rax, qword [rbx + 0x38]
mov qword [rax], rdx
sub ecx, edx
mov rax, qword [rbx + 0x50]
mov dword [rax], ecx
mov r15, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
nop dword [rax]
cmp r14, 0x1000
jb 0x140009431
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rdi
call r15
add rdi, rax
sub r14, rax
cmp rax, 0xfff
je 0x140009400
jmp 0x140009456
test r14, r14
je 0x140009453
mov r9, qword [rbx + 0x80]
mov edx, 1
mov rcx, rdi
mov r8, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub r14, rax
jmp 0x140009456
xor r14d, r14d
sub rsi, r14
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x140009470
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
cmp qword [rcx + 0x68], 0
je 0x1400094a6
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rbx + 0x40]
mov rcx, qword [rax]
test rcx, rcx
je 0x1400094f3
test rsi, rsi
jle 0x1400094f3
mov rax, qword [rbx + 0x58]
mov r15d, dword [rax]
test r15d, r15d
jle 0x1400094f3
cmp r15, rsi
cmovae r15, rsi
mov rdx, rdi
mov r8, r15
call sub.VCRUNTIME140.dll_memcpy
add rdi, r15
mov r14, rsi
sub r14, r15
mov rax, qword [rbx + 0x58]
sub dword [rax], r15d
mov rax, qword [rbx + 0x40]
add qword [rax], r15
test r14, r14
jg 0x1400094fb
jmp 0x14000951b
mov r14, rsi
test r14, r14
jle 0x14000951b
mov r9, qword [rbx + 0x80]
test r9, r9
je 0x14000951b
mov edx, 1
mov rcx, rdi
mov r8, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub r14, rax
sub rsi, r14
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140009910
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rax, qword [0x1400a8800]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov dil, 1
cmp qword [rcx + 0x68], 0
je 0x1400099ba
mov rsi, rcx
cmp byte [rcx + 0x71], 0
je 0x1400099ba
mov rax, qword [rsi]
mov rcx, rsi
mov edx, 0xffffffff
call qword [rax + Ordinal_26]
cmp eax, 0xffffffff
je 0x1400099b8
mov rcx, qword [rsi + 0x68]
lea r9, [rsp + 0x50]
lea rdx, [rsi + 0x74]
mov rax, qword [rcx]
lea r8, [rsp + 0x28]
mov qword [rsp + 0x20], r8
lea rdi, [rsp + 0x30]
mov r8, rdi
call qword [rax + 0x40]
cmp eax, 3
je 0x1400099d1
cmp eax, 1
je 0x140009987
test eax, eax
jne 0x1400099b8
mov byte [rsi + 0x71], 0
mov rbx, qword [rsp + 0x28]
sub rbx, rdi
je 0x1400099ae
mov r9, qword [rsi + 0x80]
mov edx, 1
mov rcx, rdi
mov r8, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rbx, rax
jne 0x1400099b8
cmp byte [rsi + 0x71], 0
sete dil
jmp 0x1400099ba
xor edi, edi
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140038080
mov eax, edi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
mov byte [rsi + 0x71], 0
mov dil, 1
jmp 0x1400099ba
Function at 0x1400271c0
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
mov r10, rcx
mov ecx, r9d
test r8, r8
je 0x1400272a7
sub r10, rdx
cmp r8, 8
jb 0x140027283
mov rax, r8
lea r9, [rdx + 4]
and rax, 0xfffffffffffffff8
xorps xmm3, xmm3
xorps xmm2, xmm2
movd xmm1, dword [r10 + r9 - 4]
add rcx, 8
movd xmm0, dword [r9 - 4]
lea r9, [r9 + 8]
punpcklbw xmm1, xmm1
punpcklwd xmm1, xmm1
punpcklbw xmm0, xmm0
psrad xmm1, 0x18
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
pxor xmm1, xmm0
movd xmm0, dword [r9 - 8]
punpcklbw xmm0, xmm0
por xmm3, xmm1
movd xmm1, dword [r10 + r9 - 8]
punpcklbw xmm1, xmm1
punpcklwd xmm1, xmm1
punpcklwd xmm0, xmm0
psrad xmm1, 0x18
psrad xmm0, 0x18
pxor xmm1, xmm0
por xmm2, xmm1
cmp rcx, rax
jb 0x1400271f0
por xmm2, xmm3
movdqa xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movdqa xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movd r9d, xmm2
cmp rcx, r8
jae 0x1400272a7
lea rax, [rcx + rdx]
sub r8, rcx
nop word [rax + rax]
movsx edx, byte [r10 + rax]
movsx ecx, byte [rax]
lea rax, [rax + 1]
xor edx, ecx
or r9d, edx
sub r8, 1
jne 0x140027290
test r9d, r9d
sete al
ret
Function at 0x140027a70
Capabilities:
Execute command

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x1400a8800]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rsi, rcx
mov qword [rsp + 0x78], rcx
mov r8, rcx
lea rdx, str.start_cmd__C__color_b__title_Error__echo
lea rcx, [rsp + 0x58]
call fcn.14001e930
mov rdi, rax
mov rcx, qword [rax + 0x10]
mov rdx, qword [rax + 0x18]
mov rax, rdx
sub rax, rcx
cmp rax, 0x11
jb 0x140027afa
lea rax, [rcx + 0x11]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x140027adb
mov rax, qword [rdi]
lea rbx, [rax + rcx]
mov r8d, reloc.WS2_32.dll_recvfrom
lea rdx, str.__timeout__t_5_
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x11], 0
jmp 0x140027b1c
mov qword [rsp + 0x20], reloc.WS2_32.dll_recvfrom
lea r9, str.__timeout__t_5_
xor r8d, r8d
lea edx, [r8 + 0x11]
mov rcx, rdi
call fcn.140029740
mov rdi, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
movups xmm0, xmmword [rdi]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rdi + 0x10], 0
mov qword [rdi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rdi], 0
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 0x10
cmovae rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140027ba8
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140027ba3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140027ba3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140037df4
movdqa xmm0, xmmword [0x140087330]
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x30], 0
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x140027bfb
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140027bf6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140027bf6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140037df4
xor ecx, ecx
int 0x29
mov rdx, qword [rsi + 0x18]
cmp rdx, 0x10
jb 0x140027c35
inc rdx
mov rcx, qword [rsi]
cmp rdx, 0x1000
jb 0x140027c30
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140027c6d
mov rcx, r8
call fcn.140037df4
mov qword [rsi + 0x10], 0
mov qword [rsi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rsi], 0
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140038080
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3

Function at 0x140027c80
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x47], 0
je 0x140027ca3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x65]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x46
jb 0x140027c90
mov byte [rcx + 0x47], 0
mov rax, rcx
ret