joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400375b0
Capabilities:
Log keystrokes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rcx, qword [0x140100b38]
movzx ebx, dl
mov byte [0x140100ade], dl
mov edx, 0xffffffec
call qword [sym.imp.USER32.dll_GetWindowLongW]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, eax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [0x140100a5c], eax
test bl, bl
je 0x140037656
mov r8d, 1
mov edx, esi
mov ecx, eax
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov rcx, qword [0x140100b38]
btr edi, 0x13
mov r8d, edi
mov edx, 0xffffffec
call qword [sym.imp.USER32.dll_SetWindowLongW]
mov rcx, qword [0x140100b38]
call qword [sym.imp.USER32.dll_SetForegroundWindow]
mov ecx, dword [0x140100a5c]
xor r8d, r8d
mov edx, esi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.USER32.dll_AttachThreadInput]
mov rcx, qword [0x140100b38]
bts edi, 0x13
mov r8d, edi
mov edx, 0xffffffec
call qword [sym.imp.USER32.dll_SetWindowLongW]
lea rdx, str.Rust
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
mov rcx, rax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.USER32.dll_SetForegroundWindow]

Function at 0x1400376a0
Capabilities:
Log keystrokes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rcx, qword [0x140100b38]
movzx ebx, dl
mov edx, 0xffffffec
call qword [sym.imp.USER32.dll_GetWindowLongW]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, eax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [0x140100a5c], eax
test bl, bl
je 0x140037740
mov r8d, 1
mov edx, esi
mov ecx, eax
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov rcx, qword [0x140100b38]
btr edi, 0x13
mov r8d, edi
mov edx, 0xffffffec
call qword [sym.imp.USER32.dll_SetWindowLongW]
mov rcx, qword [0x140100b38]
call qword [sym.imp.USER32.dll_SetForegroundWindow]
mov ecx, dword [0x140100a5c]
xor r8d, r8d
mov edx, esi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.USER32.dll_AttachThreadInput]
mov rcx, qword [0x140100b38]
bts edi, 0x13
mov r8d, edi
mov edx, 0xffffffec
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.USER32.dll_SetWindowLongW]

Function at 0x140037770
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
nop word [rax + rax]
mov ecx, reloc.WLDAP32.dll_Ordinal_45
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x1400377a4
cmp byte [0x140100ade], 0
sete dl
mov byte [0x140100ade], dl
call fcn.1400375b0
mov rbx, qword [0x140100a60]
mov ecx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jae 0x1400377c1
mov al, 1
jmp 0x1400377ca
mov byte [rbx + 0x42a], 1
xor al, al
mov ecx, 1
mov byte [rbx + 0x130], al
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140037780
Function at 0x14003b3b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, qword [0x140100a70]
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x14003b3e4
imul rcx, rax, 0x64
jmp 0x14003b405
cqo
idiv rbx
mov r8, rax
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
mov rcx, rax
imul rax, r8, 0x3b9aca00
add rcx, rax
sub rcx, qword [rdi + 8]
movabs rax, 0x431bde82d7b634db
movss xmm0, dword [rdi + 0x88]
imul rcx
addss xmm0, xmm0
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cvttss2si rax, xmm0
cmp rdx, rax
jle 0x14003b44a
mov rax, qword [rdi + 0x30]
test byte [rax + 1], 1
jne 0x14003b44a
mov dword [rdi], 0
lea rbx, [rdi + 0x68]
lea rsi, [rdi + 0xb8]
cmp rsi, rbx
je 0x14003b473
cmp qword [rbx + 0x18], 0x10
mov rdx, rbx
jb 0x14003b467
mov rdx, qword [rbx]
mov r8, qword [rbx + 0x10]
mov rcx, rsi
call fcn.140035f10
mov eax, dword [rbx + 0x20]
mov dword [rsi + 0x20], eax
mov eax, dword [rbx + 0x24]
mov dword [rsi + 0x24], eax
mov eax, dword [rbx + 0x28]
mov dword [rsi + 0x28], eax
mov rax, qword [rbx + 0x30]
mov qword [rsi + 0x30], rax
mov eax, dword [rbx + 0x38]
mov dword [rsi + 0x38], eax
movzx eax, byte [rbx + 0x3c]
mov byte [rsi + 0x3c], al
movzx eax, byte [rbx + 0x3d]
mov byte [rsi + 0x3d], al
mov eax, dword [rbx + 0x40]
mov dword [rsi + 0x40], eax
mov eax, dword [rbx + 0x44]
mov dword [rsi + 0x44], eax
mov eax, dword [rbx + 0x48]
lea rbx, [rdi + 0x108]
mov dword [rsi + 0x48], eax
lea rsi, [rdi + 0x140]
cmp rsi, rbx
je 0x14003b4df
cmp qword [rbx + 0x18], 0x10
mov rdx, rbx
jb 0x14003b4d3
mov rdx, qword [rbx]
mov r8, qword [rbx + 0x10]
mov rcx, rsi
call fcn.140035f10
mov eax, dword [rbx + 0x20]
mov dword [rsi + 0x20], eax
mov eax, dword [rbx + 0x24]
mov dword [rsi + 0x24], eax
mov eax, dword [rbx + 0x28]
mov dword [rsi + 0x28], eax
mov eax, dword [rbx + 0x2c]
mov dword [rsi + 0x2c], eax
movzx eax, byte [rbx + 0x30]
lea rbx, [rdi + 0x178]
add rdi, 0x1a8
mov byte [rsi + 0x30], al
cmp rdi, rbx
je 0x14003b52a
cmp qword [rbx + 0x18], 0x10
mov rdx, rbx
jb 0x14003b51e
mov rdx, qword [rbx]
mov r8, qword [rbx + 0x10]
mov rcx, rdi
call fcn.140035f10
mov eax, dword [rbx + 0x20]
mov rsi, qword [rsp + 0x38]
mov dword [rdi + 0x20], eax
mov eax, dword [rbx + 0x24]
mov dword [rdi + 0x24], eax
mov eax, dword [rbx + 0x28]
mov dword [rdi + 0x28], eax
mov eax, dword [rbx + 0x2c]
mov rbx, qword [rsp + 0x30]
mov dword [rdi + 0x2c], eax
add rsp, 0x20
pop rdi
ret
Function at 0x14003c920
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x50
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor edi, edi
cmp byte [r8 + 7], dil
je 0x14003c954
mov ecx, edi
nop dword [rax]
lea eax, [rcx + 0x7d]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 6
jb 0x14003c940
mov byte [r8 + 7], dil
lea rax, [r8 + 6]
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x14003c981
mov qword [rsp + 0x30], rdi
mov byte [rsp + 0x20], dil
jmp 0x14003c9a0
mov qword [rsp + 0x30], 6
mov eax, dword [r8]
mov dword [rsp + 0x20], eax
movzx eax, word [r8 + 4]
mov word [rsp + 0x24], ax
mov byte [rsp + 0x26], dil
mov r9, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x14003c9ae
mov rdx, qword [rdx]
mov r8, rdx
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.1400492f0
mov qword [rbx], rdi
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x14003ca25
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003ca20
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003ca20
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14009d530
mov rax, rbx
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x14003ca40
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x50
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor edi, edi
cmp byte [r8 + 9], dil
je 0x14003ca74
mov ecx, edi
nop dword [rax]
lea eax, [rcx + 0x7d]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 8
jb 0x14003ca60
mov byte [r8 + 9], dil
lea rax, [r8 + 8]
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x14003caa1
mov qword [rsp + 0x30], rdi
mov byte [rsp + 0x20], dil
jmp 0x14003cab7
mov qword [rsp + 0x30], 8
mov rax, qword [r8]
mov qword [rsp + 0x20], rax
mov byte [rsp + 0x28], dil
mov r9, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x14003cac5
mov rdx, qword [rdx]
mov r8, rdx
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.1400492f0
mov qword [rbx], rdi
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x14003cb3c
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003cb37
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003cb37
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14009d530
mov rax, rbx
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x14003cb50
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rbx, rcx
mov qword [rbp - 0x10], rcx
xor r9d, r9d
cmp byte [r8 + 6], r9b
je 0x14003cb94
mov ecx, r9d
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x7d]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 5
jb 0x14003cb80
mov byte [r8 + 6], r9b
lea rax, [r8 + 5]
mov qword [rbp - 0x38], r9
mov qword [rbp - 0x28], r9
mov qword [rbp - 0x20], r9
mov qword [rbp - 0x20], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x14003cbbb
mov qword [rbp - 0x28], r9
mov byte [rbp - 0x38], r9b
jmp 0x14003cbd5
mov qword [rbp - 0x28], 5
mov eax, dword [r8]
mov dword [rbp - 0x38], eax
movzx eax, byte [r8 + 4]
mov byte [rbp - 0x34], al
mov byte [rbp - 0x33], r9b
cmp byte [rdx + 0xa], 0
je 0x14003cbf3
mov rcx, r9
nop
lea eax, [rcx + 0x7d]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 9
jb 0x14003cbe0
mov byte [rdx + 0xa], 0
lea rax, [rdx + 9]
mov qword [rbp - 0x58], r9
mov qword [rbp - 0x48], r9
mov qword [rbp - 0x40], r9
mov qword [rbp - 0x40], reloc.WS2_32.dll_ntohs
cmp rdx, rax
jne 0x14003cc1a
mov qword [rbp - 0x48], r9
mov byte [rbp - 0x58], 0
jmp 0x14003cc36
mov qword [rbp - 0x48], 9
movsd xmm0, qword [rdx]
movsd qword [rbp - 0x58], xmm0
movzx eax, byte [rdx + 8]
mov byte [rbp - 0x50], al
mov byte [rbp - 0x4f], 0
lea r9, [rbp - 0x38]
lea r8, [rbp - 0x58]
movzx edx, byte [rbp - 0x60]
mov rcx, rbx
call fcn.1400431a0
nop
mov rdx, qword [rbp - 0x40]
cmp rdx, 0x10
jb 0x14003cc8a
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003cc84
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003cc84
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14009d530
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x14003ccc8
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003ccc3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003ccc3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14009d530
mov rax, rbx
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rbp
ret
Function at 0x14003cce0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x50
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor edi, edi
cmp byte [r8 + 0xa], dil
je 0x14003cd14
mov ecx, edi
nop dword [rax]
lea eax, [rcx + 0x7d]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 9
jb 0x14003cd00
mov byte [r8 + 0xa], dil
lea rax, [r8 + 9]
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x14003cd41
mov qword [rsp + 0x30], rdi
mov byte [rsp + 0x20], dil
jmp 0x14003cd63
mov qword [rsp + 0x30], 9
movsd xmm0, qword [r8]
movsd qword [rsp + 0x20], xmm0
movzx eax, byte [r8 + 8]
mov byte [rsp + 0x28], al
mov byte [rsp + 0x29], dil
mov r9, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x14003cd71
mov rdx, qword [rdx]
mov r8, rdx
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.1400492f0
mov qword [rbx], rdi
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x14003cde8
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003cde3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003cde3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14009d530
mov rax, rbx
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x14003ce00
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rbx, rcx
mov qword [rbp - 0x10], rcx
xor r9d, r9d
cmp byte [r8 + 0xb], r9b
je 0x14003ce44
mov ecx, r9d
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x7d]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 0xa
jb 0x14003ce30
mov byte [r8 + 0xb], r9b
lea rax, [r8 + 0xa]
mov qword [rbp - 0x38], r9
mov qword [rbp - 0x28], r9
mov qword [rbp - 0x20], r9
mov qword [rbp - 0x20], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x14003ce6b
mov qword [rbp - 0x28], r9
mov byte [rbp - 0x38], r9b
jmp 0x14003ce8a
mov qword [rbp - 0x28], 0xa
movsd xmm0, qword [r8]
movsd qword [rbp - 0x38], xmm0
movzx eax, word [r8 + 8]
mov word [rbp - 0x30], ax
mov byte [rbp - 0x2e], r9b
cmp byte [rdx + 0xb], 0
je 0x14003ceb3
mov rcx, r9
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x7d]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xa
jb 0x14003cea0
mov byte [rdx + 0xb], 0
lea rax, [rdx + 0xa]
mov qword [rbp - 0x58], r9
mov qword [rbp - 0x48], r9
mov qword [rbp - 0x40], r9
mov qword [rbp - 0x40], reloc.WS2_32.dll_ntohs
cmp rdx, rax
jne 0x14003ceda
mov qword [rbp - 0x48], r9
mov byte [rbp - 0x58], 0
jmp 0x14003cef7
mov qword [rbp - 0x48], 0xa
movsd xmm0, qword [rdx]
movsd qword [rbp - 0x58], xmm0
movzx eax, word [rdx + 8]
mov word [rbp - 0x50], ax
mov byte [rbp - 0x4e], 0
lea r9, [rbp - 0x38]
lea r8, [rbp - 0x58]
movzx edx, byte [rbp - 0x60]
mov rcx, rbx
call fcn.1400431a0
nop
mov rdx, qword [rbp - 0x40]
cmp rdx, 0x10
jb 0x14003cf4b
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003cf45
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003cf45
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14009d530
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x14003cf89
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003cf84
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003cf84
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14009d530
mov rax, rbx
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rbp
ret
Function at 0x14003cfa0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rbx, rcx
mov qword [rbp - 0x10], rcx
xor r9d, r9d
cmp byte [r8 + 0xc], r9b
je 0x14003cfe4
mov ecx, r9d
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x7d]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 0xb
jb 0x14003cfd0
mov byte [r8 + 0xc], r9b
lea rax, [r8 + 0xb]
mov qword [rbp - 0x58], r9
mov qword [rbp - 0x48], r9
mov qword [rbp - 0x40], r9
mov qword [rbp - 0x40], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x14003d00b
mov qword [rbp - 0x48], r9
mov byte [rbp - 0x58], r9b
jmp 0x14003d032
mov qword [rbp - 0x48], recvfrom
movsd xmm0, qword [r8]
movsd qword [rbp - 0x58], xmm0
movzx eax, word [r8 + 8]
mov word [rbp - 0x50], ax
movzx eax, byte [r8 + 0xa]
mov byte [rbp - 0x4e], al
mov byte [rbp - 0x4d], r9b
cmp byte [rdx + 0xb], 0
je 0x14003d053
mov rcx, r9
nop dword [rax + rax]
lea eax, [rcx + 0x7d]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xa
jb 0x14003d040
mov byte [rdx + 0xb], 0
lea rax, [rdx + 0xa]
mov qword [rbp - 0x38], r9
mov qword [rbp - 0x28], r9
mov qword [rbp - 0x20], r9
mov qword [rbp - 0x20], reloc.WS2_32.dll_ntohs
cmp rdx, rax
jne 0x14003d07a
mov qword [rbp - 0x28], r9
mov byte [rbp - 0x38], 0
jmp 0x14003d097
mov qword [rbp - 0x28], 0xa
movsd xmm0, qword [rdx]
movsd qword [rbp - 0x38], xmm0
movzx eax, word [rdx + 8]
mov word [rbp - 0x30], ax
mov byte [rbp - 0x2e], 0
lea r9, [rbp - 0x58]
lea r8, [rbp - 0x38]
movzx edx, byte [rbp - 0x60]
mov rcx, rbx
call fcn.1400431a0
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x14003d0eb
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003d0e5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003d0e5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14009d530
nop
mov rdx, qword [rbp - 0x40]
cmp rdx, 0x10
jb 0x14003d129
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003d124
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003d124
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14009d530
mov rax, rbx
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rbp
ret
Function at 0x14003d140
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x50
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor edi, edi
cmp byte [r8 + 0xc], dil
je 0x14003d174
mov ecx, edi
nop dword [rax]
lea eax, [rcx + 0x7d]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 0xb
jb 0x14003d160
mov byte [r8 + 0xc], dil
lea rax, [r8 + 0xb]
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x14003d1a1
mov qword [rsp + 0x30], rdi
mov byte [rsp + 0x20], dil
jmp 0x14003d1cd
mov qword [rsp + 0x30], recvfrom
movsd xmm0, qword [r8]
movsd qword [rsp + 0x20], xmm0
movzx eax, word [r8 + 8]
mov word [rsp + 0x28], ax
movzx eax, byte [r8 + 0xa]
mov byte [rsp + 0x2a], al
mov byte [rsp + 0x2b], dil
mov r9, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x14003d1db
mov rdx, qword [rdx]
mov r8, rdx
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.1400492f0
mov qword [rbx], rdi
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x14003d252
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003d24d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003d24d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14009d530
mov rax, rbx
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret

Function at 0x140045380
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x136], 0
je 0x1400453a8
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x7d]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x135
jb 0x140045390
mov byte [rcx + 0x136], 0
mov rax, rcx
ret

Function at 0x1400453b0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x44], 0
je 0x1400453d3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x7d]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x43
jb 0x1400453c0
mov byte [rcx + 0x44], 0
mov rax, rcx
ret

Function at 0x1400453e0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x47], 0
je 0x140045403
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x7d]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x46
jb 0x1400453f0
mov byte [rcx + 0x47], 0
mov rax, rcx
ret
Function at 0x1400647c0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx + 0x718], 0
mov rsi, r9
mov rbp, r8
movsxd rbx, edx
mov rdi, rcx
je 0x14006481e
mov dl, 1
call fcn.140055210
mov rax, qword [rdi + 0x670]
mov r9, rsi
mov r8, rbp
mov qword [rsp + 0x20], rax
mov edx, ebx
mov rcx, rdi
call qword [rdi + 0x718]
xor edx, edx
mov rcx, rdi
mov ebx, eax
call fcn.140055210
mov eax, ebx
jmp 0x140064862
cmp ebx, 2
ja 0x140064860
mov r9, qword [rdi + 0x668]
lea rdx, [0x1400a6338]
lea rcx, [rbx + rbx*2]
add rcx, rdx
mov edx, 2
lea r8d, [rdx - 1]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r9, qword [rdi + 0x668]
mov r8d, 1
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x140064880
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rdi
sub rsp, 0x160
mov rax, qword [0x1400ff080]
xor rax, rsp
mov qword [rsp + 0x140], rax
cmp byte [rcx + 0xf1e], 0
mov rdi, rcx
jne 0x1400648c3
cmp qword [rcx + 0x678], 0
je 0x1400649a0
mov r8, rdx
mov qword [rsp + 0x158], rbx
mov edx, 0x100
lea r9, [rsp + 0x180]
lea rcx, [rsp + 0x30]
call fcn.1400532b0
lea rax, [rsp + 0x30]
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x1400648f1
mov rcx, qword [rdi + 0x678]
test rcx, rcx
je 0x140064938
cmp byte [rdi + 0x1597], 0
jne 0x140064938
lea rdx, [rsp + 0x30]
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rdx]
lea rdx, [rdx + 1]
mov byte [rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x140064920
mov byte [rdi + 0x1597], 1
cmp byte [rdi + 0xf1e], 0
je 0x140064998
mov byte [rsp + rbx + 0x30], 0xa
inc rbx
cmp rbx, 0x102
jae 0x1400649f3
cmp qword [rdi + 0x718], 0
mov byte [rsp + rbx + 0x30], 0
je 0x1400649b9
mov dl, 1
mov rcx, rdi
call fcn.140055210
mov rax, qword [rdi + 0x670]
lea r8, [rsp + 0x30]
mov r9, rbx
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, rdi
call qword [rdi + 0x718]
xor edx, edx
mov rcx, rdi
call fcn.140055210
mov rbx, qword [rsp + 0x158]
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14009d440
add rsp, 0x160
pop rdi
ret
mov r9, qword [rdi + 0x668]
lea rcx, [0x1400a6338]
mov edx, 2
lea r8d, [rdx - 1]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r9, qword [rdi + 0x668]
lea rcx, [rsp + 0x30]
mov r8d, 1
mov rdx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
jmp 0x140064998
call fcn.14009e038
int3