joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002a7c0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x2b0
mov rax, qword [0x1400c6088]
xor rax, rsp
mov qword [rsp + 0x2a8], rax
mov qword [rsp + 0x38], rsp
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x14002a955
lea rdx, [0x1400b5a20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x14002a955
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov qword [rsp + 0x48], rax
cmp rax, 0xffffffffffffffff
je 0x14002a955
mov dword [rsp + 0x60], 0x238
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14002a955
mov byte [rsp + 0x30], 0
xor esi, esi
mov qword [rsp + 0x40], rsi
mov dword [rsp + 0x2a0], esi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x34], eax
mov r8d, dword [rsp + 0x68]
cmp eax, r8d
jne 0x14002a890
lea rdx, [0x14002a91a]
mov rcx, qword [rsp + 0x38]
call sub.VCRUNTIME140.dll__local_unwind
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
mov qword [rsp + 0x40], rax
test rax, rax
jne 0x14002a8bb
lea rdx, [0x14002a91a]
mov rcx, qword [rsp + 0x38]
call sub.VCRUNTIME140.dll__local_unwind
mov qword [rsp + 0x20], rsi
mov r9d, 4
lea r8, [rsp + 0x2a0]
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
jne 0x14002a8ef
lea rdx, [0x14002a91a]
mov rcx, qword [rsp + 0x38]
call sub.VCRUNTIME140.dll__local_unwind
mov eax, dword [rbx]
cmp dword [rsp + 0x2a0], eax
je 0x14002a911
mov byte [rsp + 0x30], 1
lea rdx, [0x14002a93e]
mov rcx, qword [rsp + 0x38]
call sub.VCRUNTIME140.dll__local_unwind
nop
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x14002a93e
xor esi, esi
mov rbx, qword [rsp + 0x50]
mov eax, dword [rsp + 0x34]
jmp 0x14002a875
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14002a94e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, byte [rsp + 0x30]
jmp 0x14002a957
xor al, al
mov rcx, qword [rsp + 0x2a8]
xor rcx, rsp
call fcn.1400a2f90
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x14002acc0
Capabilities:
Check for debugger via api
Check for time delay via gettickcount
Check for time delay via queryperformancecounter

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x1400c6088]
xor rax, rsp
mov qword [rsp + 0x30], rax
call fcn.1400115e0
call fcn.140013210
call fcn.14002a720
call fcn.1400115e0
call fcn.140013210
call fcn.140025950
call fcn.140021ba0
call fcn.140013210
call fcn.1400134d0
call fcn.1400137b0
call fcn.140013aa0
call fcn.140013ca0
call fcn.140011950
lea rbx, [0x1400c7920]
lea rdi, [0x1400c7ab0]
nop dword [rax + rax]
mov rcx, qword [rbx]
xor edx, edx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
jne 0x14002ae67
add rbx, 8
cmp rbx, rdi
jne 0x14002ad30
lea rbx, [0x1400c7ab0]
lea rdi, [0x1400c7ab8]
nop dword [rax + rax]
mov r8, qword [rbx]
xor edx, edx
lea ecx, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_OpenFileMappingW]
test rax, rax
jne 0x14002ae67
add rbx, 8
cmp rbx, rdi
jne 0x14002ad60
call fcn.1400115e0
call fcn.140021190
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x14002ae67
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
cmp dword [rsp + 0x20], 0
jne 0x14002ae7d
call fcn.140012ef0
call fcn.1400124c0
call fcn.140011b50
call fcn.140021ba0
call fcn.140013210
call fcn.140011890
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x20]
sub rax, qword [rsp + 0x28]
cmp rax, 0x1e
jg 0x14002ae51
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, ebx
cmp eax, 0x1e
ja 0x14002ae67
call fcn.140011840
call fcn.1400134b0
call fcn.140011870
call fcn.140009490
call fcn.14000ccf0
call fcn.14000f180
mov byte [0x1400c734e], 1
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400a2f90
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
cmp byte [0x1400c734d], 0
jne 0x14002ae61
mov byte [0x1400c734d], 1
call fcn.140011940
int3
cmp byte [0x1400c734d], 0
jne 0x14002ae77
mov byte [0x1400c734d], 1
call fcn.140011940
int3
call fcn.140011940
int3
Function at 0x140030f10
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor edx, edx
lea rcx, [0x14000fc80]
call qword [sym.imp.USER32.dll_EnumWindows]
lea rcx, [0x1400c7610]
call fcn.140047380
cmp qword [0x1400c7840], 0x10
lea rcx, [0x1400c7828]
mov r8, qword [0x1400c7838]
cmovae rcx, qword [0x1400c7828]
cmp r8, 6
jne 0x140030f69
lea rdx, str.Swabra
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140030fe6
call fcn.14002cea0
test al, al
jne 0x140030fe6
movzx eax, byte [0x1400c7341]
test al, al
jne 0x140030fe6
cmp byte [0x1400c7348], al
je 0x140030fe6
call fcn.140029ea0
test eax, eax
jne 0x140030fe6
call fcn.140029ea0
test eax, eax
jne 0x140030fe6
call fcn.1400216f0
test al, al
jne 0x140030fe6
mov rbx, qword [0x1400c78e8]
mov rdi, qword [0x1400c78f0]
cmp rbx, rdi
je 0x140030fd6
cmp qword [rbx + 0x18], 0x10
mov rcx, rbx
jb 0x140030fc0
mov rcx, qword [rbx]
xor edx, edx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x140030fe6
add rbx, 0x20
cmp rbx, rdi
jne 0x140030fb3
mov eax, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x14003edf0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x1400c6088]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rdx
mov rdi, rcx
mov ecx, 8
call fcn.1400a2fb0
mov qword [rax], rbx
mov qword [rsp + 0x30], rax
lea rbx, [rdi + 8]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x14003f590]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rdi], rax
test rax, rax
je 0x14003ee66
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400a2f90
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov dword [rbx], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3

Function at 0x14003ee80
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x1400c6088]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rcx
mov ecx, 8
call fcn.1400a2fb0
lea rcx, [0x140011390]
mov qword [rax], rcx
mov qword [rsp + 0x30], rax
lea rdi, [rbx + 8]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x14003f590]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbx], rax
test rax, rax
je 0x14003eefa
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400a2f90
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov dword [rdi], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3

Function at 0x14003fee0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 7], sil
je 0x14003ff14
mov eax, esi
lea ecx, [rax - 0x12]
xor byte [r8 + rax], cl
inc rax
cmp rax, 6
jb 0x14003ff00
mov byte [r8 + 7], sil
add r8, 6
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.14003eaa0
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x14003ff39
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.14003e540
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x14003ffb3
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003ffae
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003ffae
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400a330c
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x14003ffc0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 9], sil
je 0x14003fff4
mov eax, esi
lea ecx, [rax - 0x12]
xor byte [r8 + rax], cl
inc rax
cmp rax, 8
jb 0x14003ffe0
mov byte [r8 + 9], sil
add r8, 8
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.14003eaa0
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140040019
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.14003e540
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140040093
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004008e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004008e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400a330c
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x1400400a0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 0xa], sil
je 0x1400400d4
mov eax, esi
lea ecx, [rax - 0x12]
xor byte [r8 + rax], cl
inc rax
cmp rax, 9
jb 0x1400400c0
mov byte [r8 + 0xa], sil
add r8, 9
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.14003eaa0
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x1400400f9
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.14003e540
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140040173
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004016e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004016e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400a330c
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x140040180
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 0xc], sil
je 0x1400401b4
mov eax, esi
lea ecx, [rax - 0x12]
xor byte [r8 + rax], cl
inc rax
cmp rax, 0xb
jb 0x1400401a0
mov byte [r8 + 0xc], sil
add r8, 0xb
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.14003eaa0
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x1400401d9
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.14003e540
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140040253
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004024e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004024e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400a330c
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x1400464d0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 9], al
je 0x1400464f3
lea edx, [rax - 0x12]
xor byte [rax + rcx], dl
inc rax
cmp rax, 8
jb 0x1400464e0
mov byte [rcx + 9], 0
lea r8, [rcx + 8]
mov rdx, rcx
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.14003eaa0
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x140046510
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 0x10], al
je 0x140046533
lea edx, [rax - 0x12]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xf
jb 0x140046520
mov byte [rcx + 0x10], 0
lea r8, [rcx + 0xf]
mov rdx, rcx
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.14003eaa0
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x1400472c0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 5], 0
je 0x1400472e3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x12]
xor byte [rax + rcx], dl
inc rax
cmp rax, 4
jb 0x1400472d0
mov byte [rcx + 5], 0
mov rax, rcx
ret

Function at 0x1400472f0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x136], 0
je 0x140047318
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x12]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x135
jb 0x140047300
mov byte [rcx + 0x136], 0
mov rax, rcx
ret

Function at 0x140047320
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x44], 0
je 0x140047343
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x12]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x43
jb 0x140047330
mov byte [rcx + 0x44], 0
mov rax, rcx
ret
Function at 0x140047350
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x47], 0
je 0x140047373
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x12]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x46
jb 0x140047360
mov byte [rcx + 0x47], 0
mov rax, rcx
ret
Function at 0x140047dc0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0xa8
xor eax, eax
cmp byte [0x1400c6a58], al
jne 0x140047e71
movdqa xmm0, xmmword [0x1400a8440]
movdqa xmm1, xmmword [0x1400a8230]
movdqa xmmword [rsp + 0x40], xmm0
movdqa xmm0, xmmword [0x1400a8160]
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmm0, xmmword [0x1400a81e0]
movdqa xmmword [rsp + 0x50], xmm1
movdqa xmm1, xmmword [0x1400a8210]
movdqa xmmword [rsp + 0x80], xmm0
movdqa xmmword [rsp + 0x70], xmm1
mov dword [rsp + 0x90], 0x1004c50
nop dword [rax]
lea ecx, [rax - 0x12]
xor byte [rsp + rax + 0x40], cl
inc rax
cmp rax, 0x52
jb 0x140047e30
lea r9, [rsp + 0xb0]
mov byte [rsp + 0x93], 0
lea r8, [rsp + 0x92]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.14003eaa0
lea rcx, [rsp + 0x20]
call fcn.14004b060
add rsp, 0xa8
ret
Function at 0x1400491e0
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
mov r10, rcx
mov ecx, r9d
test r8, r8
je 0x1400492c7
sub r10, rdx
cmp r8, 8
jb 0x14004929c
mov rax, r8
lea r9, [rdx + 4]
and rax, 0xfffffffffffffff8
xorps xmm3, xmm3
xorps xmm2, xmm2
movd xmm1, dword [r10 + r9 - 4]
add rcx, 8
movd xmm0, dword [r9 - 4]
lea r9, [r9 + 8]
punpcklbw xmm1, xmm1
punpcklwd xmm1, xmm1
punpcklbw xmm0, xmm0
psrad xmm1, 0x18
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
movd xmm0, dword [r9 - 8]
punpcklbw xmm0, xmm0
orps xmm3, xmm1
movd xmm1, dword [r10 + r9 - 8]
punpcklbw xmm1, xmm1
punpcklwd xmm1, xmm1
punpcklwd xmm0, xmm0
psrad xmm1, 0x18
psrad xmm0, 0x18
xorps xmm1, xmm0
orps xmm2, xmm1
cmp rcx, rax
jb 0x140049210
orps xmm2, xmm3
movdqa xmm0, xmm2
psrldq xmm0, 8
orps xmm2, xmm0
movdqa xmm0, xmm2
psrldq xmm0, 4
orps xmm2, xmm0
movd r9d, xmm2
cmp rcx, r8
jae 0x1400492c7
lea rax, [rcx + rdx]
sub r8, rcx
nop dword [rax]
nop word [rax + rax]
movsx edx, byte [r10 + rax]
movsx ecx, byte [rax]
lea rax, [rax + 1]
xor edx, ecx
or r9d, edx
sub r8, 1
jne 0x1400492b0
test r9d, r9d
sete al
ret
Function at 0x14004b060
Capabilities:
Encode data using xor
Execute command

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xc0
mov rax, qword [0x1400c6088]
xor rax, rsp
mov qword [rbp + 0x4f], rax
mov rbx, rcx
mov qword [rbp + 0x27], rcx
movdqa xmm0, xmmword [0x1400a8400]
movdqu xmmword [rbp - 0x49], xmm0
mov word [rbp - 0x39], 0x100
xor ecx, ecx
nop dword [rax]
lea eax, [rcx - 0x12]
xor byte [rbp + rcx - 0x49], al
inc rcx
cmp rcx, 0x10
jb 0x14004b0a0
mov byte [rbp - 0x38], 0
movdqa xmm0, xmmword [0x1400a8360]
movdqu xmmword [rbp - 0x31], xmm0
movdqa xmm1, xmmword [0x1400a8310]
movdqu xmmword [rbp - 0x21], xmm1
mov dword [rbp - 0x11], 0x3162607c
mov dword [rbp - 0xd], 0x70343534
mov dword [rbp - 9], 0x39777f75
mov word [rbp - 5], 0x100
xor ecx, ecx
nop dword [rax + rax]
lea eax, [rcx - 0x12]
xor byte [rbp + rcx - 0x31], al
inc rcx
cmp rcx, 0x2c
jb 0x14004b0f0
mov byte [rbp - 4], 0
mov r8, rbx
lea rdx, [rbp - 0x31]
lea rcx, [rbp + 7]
call fcn.14003fd80
nop
lea rcx, [rbp - 0x49]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rcx + r8], 0
jne 0x14004b120
lea rdx, [rbp - 0x49]
mov rcx, rax
call fcn.14003d130
xorps xmm0, xmm0
movups xmmword [rbp + 0x2f], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x3f], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x2f], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x3f], xmm1
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rbp + 0x1f]
cmp rdx, 0x10
jb 0x14004b1a5
inc rdx
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004b1a0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004b1a0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400a330c
lea rcx, [rbp + 0x2f]
cmp qword [rbp + 0x47], 0x10
cmovae rcx, qword [rbp + 0x2f]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor ecx, ecx
int 0x29
mov rdx, qword [rbp + 0x47]
cmp rdx, 0x10
jb 0x14004b1fb
inc rdx
mov rcx, qword [rbp + 0x2f]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004b1f6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004b1f6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400a330c
movdqa xmm0, xmmword [0x1400b8670]
movdqu xmmword [rbp + 0x3f], xmm0
mov byte [rbp + 0x2f], 0
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x14004b242
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x14004b23d
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14004b272
mov rcx, r8
call fcn.1400a330c
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.1400a2f90
mov rbx, qword [rsp + 0xd8]
add rsp, 0xc0
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x14004efb0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1400c6088]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, rdx
mov rsi, rcx
mov qword [rbp - 0x18], rdx
xor edi, edi
mov dword [rbp - 0x50], 0x92939a9d
mov dword [rbp - 0x4c], 0x878097
mov byte [rbp - 0x48], 1
mov ecx, edi
nop dword [rax]
lea eax, [rcx - 0x12]
xor byte [rbp + rcx - 0x50], al
inc rcx
cmp rcx, 7
jb 0x14004eff0
mov byte [rbp - 0x48], 0
lea r9, [rbp - 0x40]
lea r8, [rbp - 0x49]
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x38]
call fcn.14003eaa0
nop
cmp byte [rbx], 0
jne 0x14004f02b
mov byte [rbx], 1
call fcn.1400417a0
mov qword [rbx + 8], rax
cmp byte [rbx], 1
jne 0x14004f042
lea rdx, [rbp - 0x38]
mov rcx, qword [rbx + 8]
call fcn.1400463e0
mov rcx, rax
jmp 0x14004f046
mov rcx, qword [rbp - 0x18]
lea rax, [rcx + 8]
cmp byte [rcx], 4
cmovne rax, rdi
movzx eax, byte [rax]
mov byte [rsi + 0x210], al
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x14004f098
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004f093
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004f093
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400a330c
mov dword [rbp - 0x50], 0x82838a83
mov dword [rbp - 0x4c], 0x919493
mov byte [rbp - 0x48], 1
mov rcx, rdi
nop dword [rax]
lea eax, [rcx - 0x12]
xor byte [rbp + rcx - 0x50], al
inc rcx
cmp rcx, 7
jb 0x14004f0b0
mov byte [rbp - 0x48], 0
lea r9, [rbp - 0x40]
lea r8, [rbp - 0x49]
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x38]
call fcn.14003eaa0
nop
cmp byte [rbx], 0
jne 0x14004f0eb
mov byte [rbx], 1
call fcn.1400417a0
mov qword [rbx + 8], rax
cmp byte [rbx], 1
jne 0x14004f0ff
lea rdx, [rbp - 0x38]
mov rcx, qword [rbx + 8]
call fcn.1400463e0
jmp 0x14004f103
mov rax, qword [rbp - 0x18]
cmp byte [rax], 3
jne 0x14004f10c
mov rdi, qword [rax + 8]
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x14004f119
mov rdx, qword [rdi]
lea rcx, [rsi + 0x218]
mov r8, qword [rdi + 0x10]
call fcn.14003d210
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x14004f169
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004f163
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004f163
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400a330c
nop
lea rcx, [rbx + 8]
movzx edx, byte [rbx]
call fcn.1400499c0
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400a2f90
mov rbx, qword [rsp + 0xa0]
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret
Function at 0x140058740
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__read]
cdqe
add rsp, 0x28
ret