joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400491f0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x14036cbc0]
xor rax, rsp
mov qword [rbp - 8], rax
mov edi, r8d
mov rsi, rdx
xor edx, edx
cmp ecx, 0xa5
ja 0x140049233
movsxd rax, ecx
lea rdx, str.NONE
mov rdx, qword [rdx + rax*8]
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
and qword [rbp - 0x18], 0
mov ecx, reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x10], rcx
mov byte [rbp - 0x28], 0
test rdx, rdx
jne 0x140049267
mov qword [rbp - 0x18], 4
mov eax, dword [str.NONE]
mov dword [rbp - 0x28], eax
mov byte [rbp - 0x24], dl
jmp 0x140049274
lea rcx, [rbp - 0x28]
call fcn.14004e080
mov rcx, qword [rbp - 0x10]
cmp edi, 1
jne 0x1400492c2
lea edx, [rdi + 0xc]
cmp rcx, rdx
jb 0x1400492aa
lea rbx, [rbp - 0x28]
cmp rcx, 0xf
cmova rbx, qword [rbp - 0x28]
mov qword [rbp - 0x18], rdx
mov r8d, edx
lea rdx, str.PRESS_THE_KEY
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0xd], 0
jmp 0x1400492be
lea r9, str.PRESS_THE_KEY
mov r8b, byte [rbp - 0x40]
lea rcx, [rbp - 0x28]
call fcn.14002f79c
mov rcx, qword [rbp - 0x10]
lea rdx, [rbp - 0x28]
cmp rcx, 0xf
cmova rdx, qword [rbp - 0x28]
movss xmm0, dword [0x14012adc0]
movss dword [rsp + 0x20], xmm0
xor r9d, r9d
xor r8d, r8d
lea rcx, [rbp - 0x38]
call fcn.140007510
movss xmm2, dword [rbp - 0x34]
addss xmm2, dword [0x14012ad74]
movss xmm0, dword [rbp - 0x38]
addss xmm0, dword [0x14012ad74]
movss dword [rbp - 0x30], xmm0
movss dword [rbp - 0x2c], xmm2
lea rcx, [rbp - 0x28]
cmp qword [rbp - 0x10], 0xf
cmova rcx, qword [rbp - 0x28]
lea rdx, [rbp - 0x30]
call fcn.140032f28
test al, al
je 0x14004934a
test edi, edi
jne 0x14004934a
and qword [rsp + 0x28], 0
and dword [rsp + 0x20], edi
xor r9d, r9d
mov r8, rsi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
nop
mov rdx, qword [rbp - 0x10]
cmp rdx, 0xf
jbe 0x140049388
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140049383
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140049383
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400ba308
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400ba780
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x14004a980
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, ecx
mov edx, 0x1000
xor ecx, ecx
mov r8d, edx
lea r9d, [rcx + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
test rax, rax
je 0x14004a9fc
movups xmm0, xmmword [0x14036db58]
mov ecx, ebx
movups xmmword [rax], xmm0
movsd xmm1, qword [0x14036db68]
movsd qword [rax + 0x10], xmm1
mov eax, dword [0x14036db70]
mov dword [rdi + 0x18], eax
movzx eax, word [0x14036db74]
mov word [rdi + 0x1c], ax
call rdi
xor edx, edx
mov r8d, 0x1000
mov rcx, rdi
mov ebx, eax
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14004aa08
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov ebp, ecx
mov ebx, r8d
xor ecx, ecx
mov rsi, rdx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
test rax, rax
je 0x14004aa90
movups xmm0, xmmword [0x14036db38]
mov r8d, ebx
mov rdx, rsi
mov ecx, ebp
movups xmmword [rax], xmm0
movsd xmm1, qword [0x14036db48]
movsd qword [rax + 0x10], xmm1
mov eax, dword [0x14036db50]
mov dword [rdi + 0x18], eax
movzx eax, word [0x14036db54]
mov word [rdi + 0x1c], ax
call rdi
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test ebx, ebx
setg al
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14004bb84
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x14036cbc0]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x14004bbf3
cmp byte [rcx + 0x71], 0
je 0x14004bbf3
mov rax, qword [rcx]
or edx, 0xffffffff
call qword [rax + Ordinal_26]
cmp eax, 0xffffffff
je 0x14004bc48
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14004bc0d
sub eax, 1
je 0x14004bc11
cmp eax, 2
jne 0x14004bc48
mov byte [rbx + 0x71], 0
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400ba780
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x14004bc3f
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14004bc48
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14004bbf5
xor al, al
jmp 0x14004bbf5

Function at 0x14004be04
Capabilities:
Encode data using add xor sub operations
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
lea r10, [rcx + 0x9c4]
mov r9, rcx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r8, r10
mov edx, eax
add r10, 4
mov r11d, dword [r10]
xor edx, r11d
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x634]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x14004be1b
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
mov eax, r11d
mov r8, r10
mov edx, eax
add r10, 4
mov r11d, dword [r10]
xor edx, r11d
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 - 0xd4c]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x14004be68
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
and dword [r9], ebx
mov rbx, qword [rsp + 8]
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
shr edx, 1
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
ret
Function at 0x14004e0f0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x88
mov rax, qword [0x14036cbc0]
xor rax, rsp
mov qword [rsp + 0x78], rax
movups xmm0, xmmword [0x140130418]
mov al, byte [0x140130448]
xor r8d, r8d
movups xmm1, xmmword [0x140130428]
mov byte [rsp + 0x70], al
lea r9, [rsp + 0x40]
movups xmmword [rsp + 0x40], xmm0
movups xmm0, xmmword [0x140130438]
movups xmmword [rsp + 0x50], xmm1
movups xmmword [rsp + 0x60], xmm0
mov eax, 0x24924925
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x38
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0x31
jl 0x14004e13c
and qword [rsp + 0x30], 0
lea rcx, [rsp + 0x40]
and dword [rsp + 0x28], 0
mov r8d, 3
xor r9d, r9d
mov dword [rsp + 0x20], r8d
mov edx, 0xc0000000
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [0x14036d6a8], rax
test rax, rax
je 0x14004e1a8
cmp rax, 0xffffffffffffffff
setne al
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400ba780
add rsp, 0x88
ret
Function at 0x14004f24c
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x160
mov rax, qword [0x14036cbc0]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rdi, rcx
xor edx, edx
lea rcx, [rsp + 0x24]
mov r8d, Ordinal_301
call sub.VCRUNTIME140.dll_memset
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], pe_nt_image_headers64
mov rcx, rax
mov rbx, rax
call sub.KERNEL32.dll_Process32First
jmp 0x14004f2c3
mov rdx, rdi
lea rcx, [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
mov rcx, rbx
test eax, eax
je 0x14004f2f3
lea rdx, [rsp + 0x20]
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x14004f2a4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1400ba780
mov rbx, qword [rsp + 0x178]
add rsp, 0x160
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x28]
jmp 0x14004f2d2
Function at 0x140052d8c
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x14036cbc0]
xor rax, rsp
mov qword [rbp - 8], rax
or esi, 0xffffffff
mov r14d, edx
mov rdi, rcx
cmp edx, esi
jne 0x140052dc6
xor eax, eax
jmp 0x140052ee5
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
test rax, rax
je 0x140052dff
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::epptr_void_const___ptr64]
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
cmp rax, rbx
jae 0x140052dff
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], r14b
mov eax, r14d
jmp 0x140052ee5
cmp qword [rdi + 0x80], 0
je 0x140052ee3
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::eback_void_const___ptr64]
lea rcx, [rdi + 0x70]
cmp rax, rcx
jne 0x140052e39
mov rdx, qword [rdi + 0x88]
mov rcx, rdi
mov r9, qword [rdi + 0x90]
mov r8, rdx
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::setg_char____ptr64__char____ptr64__char____ptr64____ptr64]
mov rcx, qword [rdi + 0x68]
test rcx, rcx
jne 0x140052e5a
movsx ecx, r14b
mov rdx, qword [rdi + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
cmp eax, esi
jmp 0x140052edf
lea rax, [rbp - 0x38]
mov byte [rbp - 0x40], r14b
mov qword [rsp + 0x38], rax
lea rdx, [rdi + 0x74]
lea rax, [rbp - 8]
mov qword [rsp + 0x30], rax
lea r9, [rbp - 0x3f]
lea rax, [rbp - 0x28]
mov qword [rsp + 0x28], rax
lea r8, [rbp - 0x40]
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140052ea8
sub eax, 1
je 0x140052ea8
cmp eax, 2
jne 0x140052ee3
movsx ecx, byte [rbp - 0x40]
jmp 0x140052e46
mov rbx, qword [rbp - 0x38]
lea rax, [rbp - 0x28]
sub rbx, rax
je 0x140052ed3
mov r9, qword [rdi + 0x80]
lea rcx, [rbp - 0x28]
mov r8, rbx
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rbx, rax
jne 0x140052ee3
lea rax, [rbp - 0x40]
mov byte [rdi + 0x71], 1
cmp qword [rbp - 0x30], rax
cmovne esi, r14d
mov eax, esi
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400ba780
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x1400534e0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x14036cbc0]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov r15, rdx
mov rdi, rcx
mov qword [rsp + 0x30], rcx
and dword [rsp + 0x24], 0
movups xmm0, xmmword [0x1401306b8]
movups xmmword [rsp + 0x38], xmm0
movups xmm1, xmmword [str.ghkm]
movups xmmword [rsp + 0x48], xmm1
movups xmm0, xmmword [0x1401306d8]
movups xmmword [rsp + 0x58], xmm0
mov al, byte [0x1401306e8]
mov byte [rsp + 0x68], al
mov ecx, dword [0x14036ebe0]
mov rax, qword gs:[0x58]
mov rsi, qword [rax + rcx*8]
mov r14d, 0x1398
mov eax, dword [r14 + rsi]
mov r12d, reloc.WS2_32.dll_recv
test al, 1
jne 0x1400535bb
or eax, 1
mov dword [r14 + rsi], eax
mov ebx, r12d
add rbx, rsi
call sub.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_
mov ecx, eax
or dword [rbx + 0x1384], 0xffffffff
mov dword [rbx + 4], eax
mov edx, 1
lea r8, [rbx + 8]
mov r9d, 0x270
mov eax, ecx
shr eax, 0x1e
xor eax, ecx
imul ecx, eax, 0x6c078965
add ecx, edx
mov dword [r8], ecx
inc rdx
lea r8, [r8 + 4]
cmp rdx, r9
jb 0x14005359a
mov dword [rbx], r9d
mov eax, dword [r14 + rsi]
mov ebp, 0x13a0
test al, 2
jne 0x1400535dd
or eax, 2
mov dword [r14 + rsi], eax
and qword [rsi + rbp], 0
mov qword [rsi + rbp + 8], 6
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
and qword [rdi + 0x10], 0
and qword [rdi + 0x10], 0
mov qword [rdi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rdi], 0
mov dword [rsp + 0x24], 1
cmp r15, 0xf
jbe 0x14005361d
mov r8b, byte [rsp + 0x20]
mov rdx, r15
mov rcx, rdi
call fcn.140042ac8
and qword [rdi + 0x10], 0
jmp 0x140053626
test r15, r15
je 0x1400536c2
mov ebx, r12d
add rbx, rsi
dec r15
mov qword [rsp + 0x28], rbx
mov r12, qword [rsi + rbp]
mov rdx, qword [rsi + rbp + 8]
sub rdx, r12
cmp rdx, 0xffffffffffffffff
jne 0x140053664
mov rcx, rbx
call fcn.140047248
mov r14d, eax
shl r14, 0x20
mov rcx, rbx
call fcn.140047248
mov eax, eax
or r14, rax
jmp 0x140053674
inc rdx
lea rcx, [rsp + 0x28]
call fcn.140047134
mov r14, rax
lea rax, [r14 + r12]
mov r9b, byte [rsp + rax + 0x38]
mov rcx, qword [rdi + 0x10]
cmp rcx, qword [rdi + 0x18]
jae 0x1400536a7
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x14005369c
mov rax, qword [rdi]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x1400536b9
mov r8b, byte [rsp + 0x20]
mov edx, 1
mov rcx, rdi
call fcn.140042988
test r15, r15
jne 0x14005362c
mov rax, rdi
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1400ba780
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x140055c94
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rsi, r8
mov r14, rdx
mov rbp, rcx
test r8, r8
jg 0x140055cc2
xor eax, eax
jmp 0x140055da9
cmp qword [rcx + 0x68], 0
je 0x140055cd4
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
jmp 0x140055da9
mov rdi, rsi
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Gnavail_void_const___ptr64]
test rax, rax
je 0x140055d14
cmp rax, rsi
mov rbx, rsi
mov rcx, rbp
cmovb rbx, rax
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gptr_void_const___ptr64]
mov r8, rbx
mov rcx, r14
mov rdx, rax
call fcn.1401252d4
mov edx, ebx
mov rcx, rbp
add r14, rbx
sub rdi, rbx
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int____ptr64]
cmp qword [rbp + 0x80], 0
je 0x140055da3
mov rcx, rbp
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::eback_void_const___ptr64]
lea rcx, [rbp + 0x70]
cmp rax, rcx
jne 0x140055d4e
mov rdx, qword [rbp + 0x88]
mov rcx, rbp
mov r9, qword [rbp + 0x90]
mov r8, rdx
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::setg_char____ptr64__char____ptr64__char____ptr64____ptr64]
mov rcx, rdi
mov ebx, 0xfff
jmp 0x140055d7e
mov r9, qword [rbp + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rdi, rax
add r14, rax
mov rcx, rdi
cmp rax, rbx
jne 0x140055da3
cmp rdi, rbx
ja 0x140055d58
test rcx, rcx
je 0x140055da3
mov r9, qword [rbp + 0x80]
mov r8, rdi
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rdi, rax
sub rsi, rdi
mov rax, rsi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140055dc4
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je 0x140055dee
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x140055e5e
mov rsi, rbx
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov rbp, rax
test rbx, rbx
jle 0x140055e58
test rax, rax
jle 0x140055e38
cmp rbx, rax
mov rcx, rdi
cmovl rbp, rbx
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, rbp
mov rdx, r14
mov rcx, rax
call fcn.1401252d4
mov edx, ebp
mov rcx, rdi
add r14, rbp
sub rbx, rbp
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
test rbx, rbx
jle 0x140055e58
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140055e58
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
sub rsi, rbx
mov rax, rsi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x140059290
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rdi, rdx
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [r8 + 7], sil
je 0x14005931b
movdqa xmm2, xmmword [0x140132aa0]
mov ecx, esi
movdqa xmm0, xmmword [str.uuuuuuuuuuuuuuuu_]
movdqa xmmword [rsp + 0x30], xmm0
movzx edx, word [rsp + 0x30]
nop dword [rax + rax]
movq xmm1, rcx
punpcklqdq xmm1, xmm1
paddq xmm1, xmm2
andps xmm1, xmmword [0x140132ab0]
packuswb xmm1, xmm1
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd xmm0, edx
paddb xmm1, xmm0
movzx eax, word [r8 + rcx]
movd xmm0, eax
xorps xmm1, xmm0
movd eax, xmm1
mov word [r8 + rcx], ax
add rcx, 2
cmp rcx, 6
jb 0x1400592d0
mov byte [r8 + 7], sil
add r8, 6
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.140058bd0
nop
mov r9, qword [rdi + 0x10]
cmp qword [rdi + 0x18], 0xf
jbe 0x140059340
mov rdi, qword [rdi]
mov r8, rdi
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140052ae0
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x1400593ba
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400593b5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400593b5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400ba308
mov rax, rbx
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x140059790
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x70
mov rax, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
cmp byte [r8 + 0xc], 0
je 0x1400597ea
xor byte [r8], 0x75
xor byte [r8 + 1], 0x76
xor byte [r8 + 2], 0x77
xor byte [r8 + 3], 0x78
xor byte [r8 + 4], 0x79
xor byte [r8 + 5], 0x7a
xor byte [r8 + 6], 0x7b
xor byte [r8 + 7], 0x7c
xor byte [r8 + 8], 0x7d
xor byte [r8 + 9], 0x7e
xor byte [r8 + 0xa], 0x7f
mov byte [r8 + 0xc], 0
add r8, 0xb
lea r9, [rsp + 0x20]
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140058bd0
nop
cmp byte [rbx + 0x10], 0
je 0x1400598c3
movdqa xmm2, xmmword [str.uuuuuuuuuuuuuuuu_]
mov eax, dword [0x140132a60]
movzx eax, ax
movd xmm1, eax
paddb xmm1, xmm2
movzx eax, word [rbx]
movd xmm0, eax
xorps xmm1, xmm0
movd eax, xmm1
mov word [rbx], ax
mov eax, dword [0x140132a70]
movzx eax, ax
movd xmm1, eax
paddb xmm1, xmm2
movzx eax, word [rbx + 2]
movd xmm0, eax
xorps xmm1, xmm0
movd eax, xmm1
mov word [rbx + 2], ax
mov eax, dword [0x140132a80]
movzx eax, ax
movd xmm1, eax
paddb xmm1, xmm2
movzx eax, word [rbx + 4]
movd xmm0, eax
xorps xmm1, xmm0
movd eax, xmm1
mov word [rbx + 4], ax
mov eax, dword [0x140132a90]
movzx eax, ax
movd xmm1, eax
paddb xmm1, xmm2
movzx eax, word [rbx + 6]
movd xmm0, eax
xorps xmm1, xmm0
movd eax, xmm1
mov word [rbx + 6], ax
mov ecx, 8
nop word [rax + rax]
lea eax, [rcx + 0x75]
xor byte [rbx + rcx], al
inc rcx
cmp rcx, 0xf
jb 0x1400598b0
mov byte [rbx + 0x10], 0
lea r8, [rbx + 0xf]
lea r9, [rsp + 0x20]
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.140058bd0
nop
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
movzx edx, byte [rsp + 0x20]
mov rcx, rdi
call fcn.140060100
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x140059933
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005992d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005992d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400ba308
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x140059973
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005996e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005996e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400ba308
mov rax, rdi
mov rbx, qword [rsp + 0x98]
add rsp, 0x70
pop rdi
ret