joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800c7a40
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
lea ebp, [r8 + 0xd]
mov r12, r9
mov ebx, r8d
mov r15, rdx
mov r13, rcx
cmp r8d, ebp
jae case.0x1800c7aac.107
mov r14, qword [rsp + 0x90]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x30]
lea eax, [rbx - 0x69]
lea rdx, [0x180000000]
cmp eax, 0x27
ja case.0x1800c7aac.116
movzx eax, byte [rdx + rax + 0xc7cb8]
mov ecx, dword [rdx + rax*4 + 0xc7c88]
add rcx, rdx
jmp rcx
mov dword [r14 + 0x38], 2
mov dword [rsp + 0x30], 0xffffffff
jmp case.0x1800c7aac.116
mov rax, qword [rsi + 0x20]
mov qword [rsp + 0x30], rax
jmp case.0x1800c7aac.116
mov edx, dword [r15]
mov ecx, dword [r12]
mov r8d, dword [rsi + 0x28]
lea eax, [rcx + rdx]
cmp r8d, eax
jae 0x1800c7b0e
sub ecx, r8d
mov r9, r14
add ecx, edx
lea r8, [rsp + 0x80]
mov dword [rsp + 0x80], ecx
mov edx, 0xad
xor ecx, ecx
call fcn.18006e220
mov ecx, dword [r12]
mov edx, dword [r15]
mov r8d, ecx
mov ecx, edx
mov rdx, r13
add rcx, qword [rsi + 0x20]
call sub.VCRUNTIME140.dll_memcpy
jmp case.0x1800c7aac.116
test rdi, rdi
je case.0x1800c7aac.116
nop dword [rax]
mov r8, rdi
mov rax, r14
sub r8, r14
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x1800c7b53
inc rax
test ecx, ecx
jne 0x1800c7b40
test edx, edx
jne 0x1800c7b30
mov ecx, 0x123
nop dword [rax]
mov eax, ecx
sub eax, 0x122
je case.0x1800c7aac.110
cmp eax, 1
jne 0x1800c7b71
mov rsi, rdi
dec ecx
cmp ecx, 0x121
ja 0x1800c7b60
jmp 0x1800c7b30
mov ebx, 0x78
jmp case.0x1800c7aac.116
test rsi, rsi
jne case.0x1800c7aac.116
xor r8d, r8d
lea rdx, [0x1800d9468]
lea rcx, str.L_z__._01_2
call fcn.1800d0700
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov eax, dword [r14 + 0x14]
cmp dword [r15], eax
ja case.0x1800c7aac.116
mov dword [rsp + 0x30], 0
mov rax, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x88]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov rax, qword [r14]
test rax, rax
je 0x1800c7bfd
mov eax, dword [rax]
sub eax, 0x7f2bb708
cmp eax, 2
jbe 0x1800c7c22
mov ecx, 0xc4
mov eax, ecx
sub eax, 0xc3
je case.0x1800c7aac.107
cmp eax, 1
jne 0x1800c7c18
mov dword [rsp + 0x30], 0x7f2bb70a
dec ecx
cmp ecx, 0xc2
ja 0x1800c7c02
mov dword [rsp + 0x30], 0
jmp case.0x1800c7aac.116
mov eax, 0x2f
cmp eax, 0x2f
je 0x1800c7c56
add eax, 3
cmp eax, 0x32
jb 0x1800c7c31
mov rdi, qword [0x1800fba18]
xor esi, esi
inc ebx
cmp ebx, ebp
jae case.0x1800c7aac.107
jmp 0x1800c7a87
mov rax, qword [r14]
lea r9, [rsp + 0x30]
mov dword [rsp + 0x28], 0x2c
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x30], rax
xor ecx, ecx
mov qword [rsp + 0x20], 0
call fcn.1800ad990
jmp 0x1800c7bc9
Function at 0x140001e60
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001eaa
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001eaa
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001eaa
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001eaa
cmp dword [rcx + 0x84], 0xe
jbe 0x140001eaa
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001eac
xor al, al
add rsp, 0x28
ret
Function at 0x140006940
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xc], 0
mov r8, rcx
je 0x140006a91
xor eax, eax
cmp dword [0x140095118], 5
jl 0x140006a63
movzx eax, word [rcx]
movdqa xmm5, xmmword [0x140087ba0]
movdqa xmm4, xmmword [0x1400879d0]
movdqa xmm3, xmmword [0x140087980]
movdqa xmm2, xmmword [0x140087990]
movdqa xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm5, xmm0
pshufb xmm1, xmm4
movd xmm0, eax
xorps xmm1, xmm0
psllq xmm3, 3
movd eax, xmm1
movdqa xmm0, xmm2
psllq xmm0, 3
vpsrlvq xmm1, xmm5, xmm0
mov word [rcx], ax
movzx eax, word [rcx + 2]
pshufb xmm1, xmm4
movd xmm0, eax
xorps xmm1, xmm0
psllq xmm2, 3
movdqa xmm0, xmmword [0x1400879a0]
movd eax, xmm1
psllq xmm0, 3
vpsrlvq xmm1, xmm5, xmm0
mov word [rcx + 2], ax
movzx eax, word [rcx + 4]
pshufb xmm1, xmm4
movd xmm0, eax
xorps xmm1, xmm0
movdqa xmm0, xmmword [0x1400879b0]
movd eax, xmm1
psllq xmm0, 3
vpsrlvq xmm1, xmm5, xmm0
mov word [rcx + 4], ax
movzx eax, word [rcx + 6]
pshufb xmm1, xmm4
movd xmm0, eax
xorps xmm1, xmm0
movd eax, xmm1
vpsrlvq xmm1, xmm5, xmm3
pshufb xmm1, xmm4
mov word [rcx + 6], ax
movzx eax, word [rcx + 8]
movd xmm0, eax
xorps xmm1, xmm0
movd eax, xmm1
vpsrlvq xmm1, xmm5, xmm2
pshufb xmm1, xmm4
mov word [rcx + 8], ax
movzx eax, word [rcx + 0xa]
movd xmm0, eax
xorps xmm1, xmm0
movd eax, xmm1
mov word [rcx + 0xa], ax
mov byte [rcx + 0xc], 0
ret
movabs r9, 0x7b95f1a3c1a5f1ed
nop dword [rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r8 + rax], dl
inc rax
cmp rax, 0xc
jb 0x140006a70
mov byte [r8 + 0xc], 0
ret

Function at 0x140006da0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1b], 0
mov r8, rcx
je 0x140006f11
xor eax, eax
cmp dword [0x140095118], 5
jl 0x140006edf
movdqa xmm2, xmmword [0x140087980]
lea rdx, [rcx + 4]
movdqa xmm3, xmmword [0x1400879c0]
mov r9, 0xfffffffffffffffe
movdqa xmm4, xmmword [0x140087a20]
sub r9, rcx
movdqa xmm5, xmmword [0x1400879d0]
mov r10d, 2
sub r10, rcx
movzx ecx, word [rdx - 4]
movq xmm0, rax
punpcklqdq xmm0, xmm0
add rax, 8
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 4], cx
lea rcx, [r9 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx - 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 2], cx
mov rcx, rdx
sub rcx, r8
movq xmm0, rcx
movzx ecx, word [rdx]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx], cx
lea rcx, [r10 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx + 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx + 2], cx
add rdx, 8
cmp rax, 0x18
jb 0x140006df3
cmp rax, 0x1b
jae 0x140006f0c
movabs r9, 0x1bd25c3ffdb193b
nop dword [rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r8 + rax], dl
inc rax
cmp rax, 0x1b
jb 0x140006ef0
mov byte [r8 + 0x1b], 0
ret
Function at 0x140009680
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 7], sil
je 0x1400096b4
mov eax, esi
lea ecx, [rax - 0x69]
xor byte [r8 + rax], cl
inc rax
cmp rax, 6
jb 0x1400096a0
mov byte [r8 + 7], sil
add r8, 6
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.140008dc0
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x1400096d9
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.14001c250
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x140009753
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000974e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000974e
call fcn.1401fc255
call fcn.14007311c
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x140009760
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 9], sil
je 0x140009794
mov eax, esi
lea ecx, [rax - 0x69]
xor byte [r8 + rax], cl
inc rax
cmp rax, 8
jb 0x140009780
mov byte [r8 + 9], sil
add r8, 8
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.140008dc0
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x1400097b9
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.14001c250
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x140009833
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000982e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000982e
push rbx
call fcn.1401f19ac
int3
call fcn.14007311c
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x140009840
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 0xa], sil
je 0x140009874
mov eax, esi
lea ecx, [rax - 0x69]
xor byte [r8 + rax], cl
inc rax
cmp rax, 9
jb 0x140009860
mov byte [r8 + 0xa], sil
add r8, 9
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.140008dc0
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x140009899
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.14001c250
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x140009913
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000990e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000990e
push rax
call fcn.14016c28b
int3
call fcn.14007311c
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x140009920
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 0xc], sil
je 0x140009954
mov eax, esi
lea ecx, [rax - 0x69]
xor byte [r8 + rax], cl
inc rax
cmp rax, 0xb
jb 0x140009940
mov byte [r8 + 0xc], sil
add r8, 0xb
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.140008dc0
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x140009979
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.14001c250
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x1400099f3
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400099ee
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400099ee
call fcn.1400b5009
call fcn.14007311c
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x140012750
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 9], al
je 0x140012773
lea edx, [rax - 0x69]
xor byte [rax + rcx], dl
inc rax
cmp rax, 8
jb 0x140012760
mov byte [rcx + 9], 0
lea r8, [rcx + 8]
mov rdx, rcx
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.140008dc0
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x140012790
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 0x10], al
je 0x1400127b3
lea edx, [rax - 0x69]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xf
jb 0x1400127a0
mov byte [rcx + 0x10], 0
lea r8, [rcx + 0xf]
mov rdx, rcx
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.140008dc0
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x140014600
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x47], 0
je 0x140014623
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x69]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x46
jb 0x140014610
mov byte [rcx + 0x47], 0
mov rax, rcx
ret
Function at 0x14001ad50
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x4d0]
sub rsp, 0x5d0
mov rax, qword [0x1400950c0]
xor rax, rsp
mov qword [rbp + 0x4c0], rax
mov r14, rcx
xor r13d, r13d
mov dword [rsp + 0x50], r13d
mov rbx, qword [0x1400775a0]
movdqa xmm0, xmmword [0x14007a0a0]
movdqu xmmword [rsp + 0x58], xmm0
mov dword [rsp + 0x68], 0xc5c588de
mov dword [rsp + 0x6c], 0xc0c3c5cc
mov dword [rsp + 0x70], 0x90d4ca
mov byte [rsp + 0x74], 1
mov ecx, r13d
nop dword [rax + rax]
lea eax, [rcx - 0x69]
xor byte [rsp + rcx + 0x58], al
inc rcx
cmp rcx, 0x1b
jb 0x14001add0
mov byte [rsp + 0x74], r13b
lea rdx, [rsp + 0x58]
mov rcx, rbx
call fcn.1400074c0
lea rdx, [0x1400076a0]
mov rcx, rbx
push rax
call fcn.1401fbedd
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], r13d
xor r9d, r9d
lea r8, [0x14001df40]
xor edx, edx
xor ecx, ecx
push rax
call fcn.1400b0e7f
cmp qword [r14 + 0x30], 0xa
jne 0x14001c1da
cmp qword [r14 + 0x50], 0x40
jne 0x14001c1da
xorps xmm0, xmm0
movups xmmword [rbp + 0x388], xmm0
xorps xmm1, xmm1
movups xmmword [rbp + 0x2f0], xmm1
mov qword [rbp + 0x300], r13
mov qword [rbp + 0x308], 0xf
mov byte [rbp + 0x2f0], r13b
lea rcx, [rbp + 0x388]
call fcn.1401ab410
movdqa xmm0, xmmword [0x140079fd0]
movdqu xmmword [rbp - 0x10], xmm0
movdqa xmm1, xmmword [0x14007a000]
movdqu xmmword [rbp], xmm1
movdqa xmm0, xmmword [0x14007a040]
movdqu xmmword [rbp + 0x10], xmm0
movdqa xmm1, xmmword [0x14007a050]
movdqu xmmword [rbp + 0x20], xmm1
mov dword [rbp + 0x30], 0xb9f7b6be
mov dword [rbp + 0x34], 0x100acab
lea rcx, [rbp - 0x10]
call fcn.140014600
mov rdx, rax
mov r9d, 0x10
xor r8d, r8d
xor ecx, ecx
push rsi
call fcn.14015166d
xor ecx, ecx
push rax
call fcn.14017a6d0
nop
call fcn.140001c00
nop
int3
Function at 0x14001d770
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1400950c0]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rdi, rdx
mov rsi, rcx
mov qword [rbp - 0x18], rdx
xor ebx, ebx
mov dword [rbp - 0x50], 0xf9faede4
mov dword [rbp - 0x4c], 0xeeeffe
mov byte [rbp - 0x48], 1
mov ecx, ebx
nop dword [rax]
lea eax, [rcx - 0x69]
xor byte [rbp + rcx - 0x50], al
inc rcx
cmp rcx, 7
jb 0x14001d7b0
mov byte [rbp - 0x48], 0
lea r9, [rbp - 0x40]
lea r8, [rbp - 0x49]
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x38]
call fcn.140008dc0
nop
cmp byte [rdi], 0
jne 0x14001d7eb
mov byte [rdi], 1
call fcn.14000c3c0
mov qword [rdi + 8], rax
cmp byte [rdi], 1
jne 0x14001d802
lea rdx, [rbp - 0x38]
mov rcx, qword [rdi + 8]
call fcn.140012660
mov rcx, rax
jmp 0x14001d806
mov rcx, qword [rbp - 0x18]
lea rax, [rcx + 8]
cmp byte [rcx], 4
cmovne rax, rbx
movzx eax, byte [rax]
mov byte [rsi + 0x210], al
mov rdx, qword [rbp - 0x20]
cmp rdx, 0xf
jbe 0x14001d858
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001d853
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001d853
push rbp
call fcn.1401937c5
int3
call fcn.14007311c
mov dword [rbp - 0x50], 0xe9eafdfa
mov dword [rbp - 0x4c], 0xf8fbfa
mov byte [rbp - 0x48], 1
nop word [rax + rax]
lea eax, [rbx - 0x69]
xor byte [rbp + rbx - 0x50], al
inc rbx
cmp rbx, 7
jb 0x14001d870
mov byte [rbp - 0x48], 0
lea r9, [rbp - 0x40]
lea r8, [rbp - 0x49]
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x38]
call fcn.140008dc0
nop
cmp byte [rdi], 0
jne 0x14001d8ab
mov byte [rdi], 1
call fcn.14000c3c0
mov qword [rdi + 8], rax
cmp byte [rdi], 1
jne 0x14001d8bf
lea rdx, [rbp - 0x38]
mov rcx, qword [rdi + 8]
call fcn.140012660
jmp 0x14001d8c3
mov rax, qword [rbp - 0x18]
lea rcx, [rsi + 0x218]
mov rdx, rax
call fcn.1400092e0
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 0xf
jbe 0x14001d912
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001d90c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001d90c
push rdx
call fcn.140183de5
int3
call fcn.14007311c
nop
lea rcx, [rdi + 8]
movzx edx, byte [rdi]
call fcn.140017500
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140072e80
mov rbx, qword [rsp + 0xa0]
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret
Function at 0x14003d7f0
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov r8d, dword [rcx + 0x28]
mov rdi, rdx
mov rbx, rcx
cmp r8d, 0x40
jae 0x14003d9a8
lea ecx, [r8*8]
mov qword [rsp + 0x30], rsi
add qword [rbx], rcx
mov byte [r8 + rbx + 0x2c], pe_nt_image_headers64
mov eax, dword [rbx + 0x28]
inc eax
mov dword [rbx + 0x28], eax
cmp eax, 0x38
jbe 0x14003d868
cmp eax, 0x40
jae 0x14003d852
nop word [rax + rax]
mov byte [rax + rbx + 0x2c], 0
mov eax, dword [rbx + 0x28]
inc eax
mov dword [rbx + 0x28], eax
cmp eax, 0x40
jb 0x14003d840
lea rsi, [rbx + 0x2c]
mov rcx, rbx
mov rdx, rsi
call fcn.14003dad0
xor eax, eax
mov dword [rbx + 0x28], eax
jmp 0x14003d870
lea rsi, [rbx + 0x2c]
jae 0x14003d882
nop
mov byte [rax + rbx + 0x2c], 0
mov eax, dword [rbx + 0x28]
inc eax
mov dword [rbx + 0x28], eax
cmp eax, 0x38
jb 0x14003d870
movzx eax, byte [rbx + 7]
mov rdx, rsi
mov byte [rbx + 0x64], al
mov rcx, rbx
movzx eax, byte [rbx + 6]
mov byte [rbx + 0x65], al
movzx eax, byte [rbx + 5]
mov byte [rbx + 0x66], al
movzx eax, byte [rbx + 4]
mov byte [rbx + 0x67], al
movzx eax, byte [rbx + 3]
mov byte [rbx + 0x68], al
movzx eax, byte [rbx + 2]
mov byte [rbx + 0x69], al
movzx eax, byte [rbx + 1]
mov byte [rbx + 0x6a], al
movzx eax, byte [rbx]
mov byte [rbx + 0x6b], al
call fcn.14003dad0
movzx eax, byte [rbx + 0xb]
mov byte [rdi], al
movzx eax, byte [rbx + 0xa]
mov byte [rdi + 1], al
movzx eax, byte [rbx + 9]
mov byte [rdi + 2], al
movzx eax, byte [rbx + 8]
mov byte [rdi + 3], al
movzx eax, byte [rbx + 0xf]
mov byte [rdi + 4], al
movzx eax, byte [rbx + 0xe]
mov byte [rdi + 5], al
movzx eax, byte [rbx + 0xd]
mov byte [rdi + 6], al
movzx eax, byte [rbx + 0xc]
mov byte [rdi + 7], al
movzx eax, byte [rbx + 0x13]
mov byte [rdi + 8], al
movzx eax, byte [rbx + 0x12]
mov byte [rdi + 9], al
movzx eax, byte [rbx + 0x11]
mov byte [rdi + 0xa], al
movzx eax, byte [rbx + 0x10]
mov byte [rdi + 0xb], al
movzx eax, byte [rbx + 0x17]
mov byte [rdi + 0xc], al
movzx eax, byte [rbx + 0x16]
mov byte [rdi + 0xd], al
movzx eax, byte [rbx + 0x15]
mov byte [rdi + 0xe], al
movzx eax, byte [rbx + 0x14]
mov byte [rdi + 0xf], al
movzx eax, byte [rbx + 0x1b]
mov byte [rdi + 0x10], al
movzx eax, byte [rbx + 0x1a]
mov byte [rdi + 0x11], al
movzx eax, byte [rbx + 0x19]
mov byte [rdi + 0x12], al
movzx eax, byte [rbx + 0x18]
mov byte [rdi + 0x13], al
movzx eax, byte [rbx + 0x1f]
mov byte [rdi + 0x14], al
movzx eax, byte [rbx + 0x1e]
mov byte [rdi + 0x15], al
movzx eax, byte [rbx + 0x1d]
mov byte [rdi + 0x16], al
movzx eax, byte [rbx + 0x1c]
mov byte [rdi + 0x17], al
movzx eax, byte [rbx + 0x23]
mov byte [rdi + 0x18], al
movzx eax, byte [rbx + 0x22]
mov byte [rdi + 0x19], al
movzx eax, byte [rbx + 0x21]
mov byte [rdi + 0x1a], al
movzx eax, byte [rbx + 0x20]
mov byte [rdi + 0x1b], al
movzx eax, byte [rbx + 0x27]
mov byte [rdi + 0x1c], al
movzx eax, byte [rbx + 0x26]
mov byte [rdi + 0x1d], al
movzx eax, byte [rbx + 0x25]
mov byte [rdi + 0x1e], al
movzx eax, byte [rbx + 0x24]
mov rsi, qword [rsp + 0x30]
mov byte [rdi + 0x1f], al
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14003d9c0
Capabilities:
Hash data using sha256

Disassembly:
xor eax, eax
mov qword [rcx + 0x24], 0x5be0cd19
mov qword [rcx], rax
mov dword [rcx + 8], 0x6a09e667
mov dword [rcx + 0xc], 0xbb67ae85
mov dword [rcx + 0x10], 0x3c6ef372
mov dword [rcx + 0x14], 0xa54ff53a
mov dword [rcx + 0x18], 0x510e527f
mov dword [rcx + 0x1c], 0x9b05688c
mov dword [rcx + 0x20], 0x1f83d9ab
ret
Function at 0x140057b00
Capabilities:
Check http status code

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x30
xor ebx, ebx
lea eax, [rdx - 0xc8]
mov rdi, rcx
mov rcx, qword [rcx]
mov esi, r8d
cmp eax, 0x64
jb 0x140057b35
lea rdx, str.Couldnt_set_desired_mode
call fcn.140039c50
lea eax, [rbx + 0x11]
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
cmp edx, 0xc8
je 0x140057b4c
mov r8d, edx
lea rdx, str.Got_a__03d_response_code_instead_of_the_assumed_200_n
call fcn.140039dd0
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], r14
cmp esi, 0x13
jne 0x140057b68
mov rcx, rdi
call fcn.140057a40
jmp 0x140057c9f
cmp esi, 0x14
jne 0x140057c81
mov rsi, qword [rdi]
mov rbp, rbx
cmp dword [rsi + 0xba0], 2
jne 0x140057be9
mov rax, qword [rsi + 0x1e0]
mov rdx, qword [rax]
test rdx, rdx
je 0x140057be9
mov byte [rsp + 0x28], 1
lea r9, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov rcx, rsi
mov qword [rsp + 0x50], rbx
call fcn.1400228d0
test eax, eax
jne 0x140057c9f
mov rcx, qword [rsp + 0x50]
lea edx, [rax + 0x2f]
call fcn.140074272
test rax, rax
je 0x140057bde
mov rbp, qword [rsp + 0x50]
mov ecx, 1
sub rax, rbp
cmovne rcx, rax
mov byte [rcx + rbp], bl
jmp 0x140057be9
mov rcx, qword [rsp + 0x50]
call qword [fcn.14007429c]
mov rdx, qword [rsi + 0xc08]
test rdx, rdx
jne 0x140057c0d
cmp byte [rsi + 0xf0d], bl
lea rax, str.NLST
lea rdx, str.LIST
cmovne rdx, rax
lea r8, [0x140077fd5]
test rbp, rbp
mov r9, r8
lea rax, [0x140087508]
cmovne r9, rbp
lea rcx, [0x14007d1f4]
cmovne r8, rax
call fcn.140027b20
mov rcx, rbp
mov r14, rax
call qword [fcn.14007429c]
test r14, r14
jne 0x140057c4c
lea ebx, [r14 + 0x1b]
jmp 0x140057ca1
lea rcx, [rdi + 0xa00]
mov r8, r14
lea rdx, [0x140081a00]
call fcn.14006dc60
mov rcx, r14
mov esi, eax
call qword [fcn.14007429c]
test esi, esi
je 0x140057c75
mov ebx, esi
jmp 0x140057ca1
mov dword [rdi + 0xab8], 0x1f
jmp 0x140057ca1
cmp esi, 0x15
jne 0x140057c8c
lea r8d, [rsi - 8]
jmp 0x140057c95
cmp esi, 0x16
jne 0x140057ca1
lea r8d, [rsi - 8]
mov dl, 1
mov rcx, rdi
call fcn.140057570
mov ebx, eax
mov r14, qword [rsp + 0x60]
mov eax, ebx
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret