joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140043f40
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x260
xor edx, edx
mov ecx, 2
xor edi, edi
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140043fae
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140043fae
nop
lea rdx, str.FiveM_b2699_GTAProcess.exe
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140043faa
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140043f80
jmp 0x140043fae
mov edi, dword [rsp + 0x28]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x270]
mov eax, edi
add rsp, 0x260
pop rdi
ret

Function at 0x140043fd0
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x460
mov edx, ecx
xor edi, edi
mov ecx, Ordinal_26
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14004403f
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x438
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x14004403f
nop
lea rdx, str.FiveM_b2699_GTAProcess.exe
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x14004403a
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x140044010
jmp 0x14004403f
mov rdi, qword [rsp + 0x38]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x470]
mov rax, rdi
add rsp, 0x460
pop rdi
ret
Function at 0x1400443c0
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xe0
mov r14, r8
mov r15, rcx
xor ebx, ebx
mov dword [rbp - 0x69], ebx
mov qword [rcx], rbx
mov qword [rcx + 8], rbx
mov qword [rcx + 0x10], rbx
mov dword [rbp - 0x69], 1
lea rcx, [rbp + 7]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov qword [rbp + 0x7f], rbx
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x59], xmm0
mov esi, ebx
mov qword [rbp - 0x49], rbx
mov rdi, qword [rbp - 0x51]
cmp qword [rbp + 0x17], rbx
jbe 0x1400444d4
nop dword [rax]
mov r9d, Ordinal_50
lea r8, [rbp - 0x29]
mov rdx, rbx
mov rcx, qword [rbp + 0x6f]
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
test rax, rax
je 0x1400444d4
cmp dword [rbp - 9], 0x1000
jne 0x1400444c2
cmp dword [rbp - 5], 1
je 0x1400444c2
mov rax, qword [rbp - 0x11]
mov qword [rbp - 0x39], rax
mov qword [rbp - 0x61], r15
lea rax, [rbp - 0x61]
lea r9, [rbp + 0x6f]
lea r8, [0x140044240]
mov rdx, rdi
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r14
lea rax, [rbp - 0x39]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x7f]
mov qword [rsp + 0x20], rax
cmp rdi, rsi
je 0x1400444ad
call fcn.14004a0f0
add rdi, 0x10
mov qword [rbp - 0x51], rdi
jmp 0x1400444be
lea rcx, [rbp - 0x59]
call fcn.140049790
mov rsi, qword [rbp - 0x49]
mov rdi, qword [rbp - 0x51]
mov rbx, qword [rbp + 0x7f]
add rbx, qword [rbp - 0x11]
mov qword [rbp + 0x7f], rbx
cmp rbx, qword [rbp + 0x17]
jb 0x140044430
mov r14, qword [rbp - 0x59]
mov rbx, r14
cmp r14, rdi
je 0x14004451b
cmp dword [rbx + 8], 0
je 0x140044512
call qword [sym.imp.MSVCP140.dll__Thrd_id]
cmp dword [rbx + 8], eax
je 0x140044572
movups xmm0, xmmword [rbx]
movaps xmmword [rbp - 0x39], xmm0
xor edx, edx
lea rcx, [rbp - 0x39]
call qword [sym.imp.MSVCP140.dll__Thrd_join]
test eax, eax
jne 0x140044566
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
add rbx, 0x10
cmp rbx, rdi
jne 0x1400444e0
test r14, r14
je 0x140044590
mov rax, r14
cmp r14, rdi
je 0x140044537
cmp dword [rax + 8], 0
jne 0x14004457e
add rax, 0x10
cmp rax, rdi
jne 0x140044528
sub rsi, r14
and rsi, 0xfffffffffffffff0
mov rax, r14
cmp rsi, 0x1000
jb 0x140044585
add rsi, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140044585
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov ecx, 2
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov ecx, 5
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
mov rdx, rsi
mov rcx, r14
call fcn.1400ac5a0
mov rax, r15
mov rbx, qword [rsp + 0x120]
add rsp, 0xe0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140044930
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xc8
mov rbx, r9
mov rdi, rcx
xor r14d, r14d
mov dword [rbp - 0x79], r14d
mov qword [rcx], r14
mov qword [rcx + 8], r14
mov qword [rcx + 0x10], r14
mov dword [rbp - 0x79], 1
lea rcx, [rbp - 0x21]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r15, qword [rbp - 0x19]
mov rsi, qword [rbp - 0x11]
mov qword [rbp + 0x77], rsi
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x71], xmm0
mov r13d, r14d
mov qword [rbp - 0x61], r14
mov r14, qword [rbp - 0x71]
cmp r15, rsi
jae 0x140044ad8
mov r12, qword [rbp - 0x69]
nop dword [rax]
nop word [rax + rax]
mov r9d, Ordinal_50
lea r8, [rbp - 0x51]
mov rdx, r15
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
cmp rax, 0x30
jne 0x140044ac9
cmp dword [rbp - 0x31], 0x1000
jne 0x140044ac3
test byte [rbp - 0x2d], 0x44
je 0x140044ac3
mov rsi, qword [rbp - 0x39]
mov rcx, r12
sub rcx, r14
cmp rsi, rcx
jae 0x140044a0c
lea r12, [rsi + r14]
jmp 0x140044a4d
jbe 0x140044a51
mov rax, r13
sub rax, r14
cmp rsi, rax
jbe 0x140044a33
mov rdx, rsi
lea rcx, [rbp - 0x71]
call fcn.140049ba0
mov r13, qword [rbp - 0x61]
mov r12, qword [rbp - 0x69]
mov r14, qword [rbp - 0x71]
jmp 0x140044a51
mov rbx, rsi
sub rbx, rcx
mov r8, rbx
xor edx, edx
mov rcx, r12
call sub.VCRUNTIME140.dll_memset
add r12, rbx
mov rbx, qword [rbp + 0x7f]
mov qword [rbp - 0x69], r12
lea rax, [rbp - 0x59]
mov qword [rsp + 0x20], rax
mov r9, rsi
mov r8, r14
mov rdx, qword [rbp - 0x51]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x140044abf
xor ebx, ebx
mov rax, qword [r14 + rbx]
cmp rax, qword [0x14013f520]
jne 0x140044aab
mov rcx, qword [rbp - 0x51]
add rcx, rbx
mov qword [rbp + 0x6f], rcx
mov rdx, qword [rdi + 8]
cmp rdx, qword [rdi + 0x10]
je 0x140044a9f
mov qword [rdx], rcx
add qword [rdi + 8], 8
jmp 0x140044aab
lea r8, [rbp + 0x6f]
mov rcx, rdi
call fcn.140049a00
inc rbx
mov rax, qword [rbp - 0x59]
add rax, 0xfffffffffffffff8
cmp rbx, rax
jbe 0x140044a73
mov rbx, qword [rbp + 0x7f]
mov rsi, qword [rbp + 0x77]
add r15, qword [rbp - 0x39]
jmp 0x140044acf
mov eax, dword [rbp - 0x1d]
add r15, rax
cmp r15, rsi
jb 0x1400449c0
test r14, r14
je 0x140044b13
sub r13, r14
mov rax, r14
cmp r13, 0x1000
jb 0x140044b08
add r13, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140044b08
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rdx, r13
mov rcx, r14
call fcn.1400ac5a0
mov rax, rdi
add rsp, 0xc8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x14004a0f0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r12, r9
mov r13, r8
mov rbp, rdx
xor edi, edi
mov ecx, 0x40
call fcn.1400ac324
mov rsi, rax
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x98]
mov r10, qword [rcx]
mov qword [rax], r10
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], rdi
mov r15, qword [rsp + 0x90]
mov rdx, qword [r15 + 8]
sub rdx, qword [r15]
je 0x14004a185
lea rcx, [rax + 8]
call fcn.1400495a0
mov rdi, qword [rsi + 8]
mov rbx, qword [r15 + 8]
mov rdx, qword [r15]
sub rbx, rdx
mov r8, rbx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
lea rax, [rdi + rbx]
mov qword [rsi + 0x10], rax
xor edi, edi
mov rax, qword [rsp + 0x88]
mov rcx, qword [rax]
mov qword [rsi + 0x20], rcx
mov rax, qword [rsp + 0x80]
mov rcx, qword [rax]
mov qword [rsi + 0x28], rcx
mov rax, qword [r12]
mov qword [rsi + 0x30], rax
mov qword [rsi + 0x38], r13
mov qword [rsp + 0x60], rsi
lea rbx, [rbp + 8]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], edi
mov r9, rsi
lea r8, [0x14004a5f0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp], rax
test rax, rax
je 0x14004a1fb
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov dword [rbx], edi
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x14004a3e0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x14004a441
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x14004a400
mov ecx, dword [r9]
jmp 0x14004a52b
cmp ecx, 0x4e0
jb 0x14004a52b
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
add r10, 4
mov edx, r11d
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x634]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x14004a460
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
mov edx, eax
xor edx, r11d
add r10, 4
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 - 0xd4c]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x14004a4b0
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x14004ae80
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 7], sil
je 0x14004aeb4
mov eax, esi
lea ecx, [rax - 0x65]
xor byte [r8 + rax], cl
inc rax
cmp rax, 6
jb 0x14004aea0
mov byte [r8 + 7], sil
add r8, 6
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.140049650
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x14004aed9
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.1400574e0
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x14004af53
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004af4e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004af4e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400ac5a0
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x14004af60
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 9], sil
je 0x14004af94
mov eax, esi
lea ecx, [rax - 0x65]
xor byte [r8 + rax], cl
inc rax
cmp rax, 8
jb 0x14004af80
mov byte [r8 + 9], sil
add r8, 8
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.140049650
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x14004afb9
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.1400574e0
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x14004b033
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004b02e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004b02e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400ac5a0
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x14004b040
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 0xa], sil
je 0x14004b074
mov eax, esi
lea ecx, [rax - 0x65]
xor byte [r8 + rax], cl
inc rax
cmp rax, 9
jb 0x14004b060
mov byte [r8 + 0xa], sil
add r8, 9
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.140049650
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x14004b099
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.1400574e0
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x14004b113
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004b10e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004b10e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400ac5a0
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x14004b120
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 0xc], sil
je 0x14004b154
mov eax, esi
lea ecx, [rax - 0x65]
xor byte [r8 + rax], cl
inc rax
cmp rax, 0xb
jb 0x14004b140
mov byte [r8 + 0xc], sil
add r8, 0xb
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.140049650
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x14004b179
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.1400574e0
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x14004b1f3
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004b1ee
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004b1ee
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400ac5a0
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x1400521e0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 9], al
je 0x140052203
lea edx, [rax - 0x65]
xor byte [rax + rcx], dl
inc rax
cmp rax, 8
jb 0x1400521f0
mov byte [rcx + 9], 0
lea r8, [rcx + 8]
mov rdx, rcx
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.140049650
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x140052220
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 0x10], al
je 0x140052243
lea edx, [rax - 0x65]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xf
jb 0x140052230
mov byte [rcx + 0x10], 0
lea r8, [rcx + 0xf]
mov rdx, rcx
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.140049650
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x140053500
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 5], 0
je 0x140053523
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x65]
xor byte [rax + rcx], dl
inc rax
cmp rax, 4
jb 0x140053510
mov byte [rcx + 5], 0
mov rax, rcx
ret

Function at 0x140053530
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x136], 0
je 0x140053558
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x65]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x135
jb 0x140053540
mov byte [rcx + 0x136], 0
mov rax, rcx
ret

Function at 0x140053560
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x44], 0
je 0x140053583
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x65]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x43
jb 0x140053570
mov byte [rcx + 0x44], 0
mov rax, rcx
ret

Function at 0x140053590
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x47], 0
je 0x1400535b3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x65]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x46
jb 0x1400535a0
mov byte [rcx + 0x47], 0
mov rax, rcx
ret
Function at 0x140053cc0
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
mov r10, rcx
mov ecx, r9d
test r8, r8
je 0x140053da7
sub r10, rdx
cmp r8, 8
jb 0x140053d83
mov rax, r8
lea r9, [rdx + 4]
and rax, 0xfffffffffffffff8
xorps xmm3, xmm3
xorps xmm2, xmm2
movd xmm1, dword [r10 + r9 - 4]
add rcx, 8
movd xmm0, dword [r9 - 4]
lea r9, [r9 + 8]
punpcklbw xmm1, xmm1
punpcklwd xmm1, xmm1
punpcklbw xmm0, xmm0
psrad xmm1, 0x18
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
pxor xmm1, xmm0
movd xmm0, dword [r9 - 8]
punpcklbw xmm0, xmm0
por xmm3, xmm1
movd xmm1, dword [r10 + r9 - 8]
punpcklbw xmm1, xmm1
punpcklwd xmm1, xmm1
punpcklwd xmm0, xmm0
psrad xmm1, 0x18
psrad xmm0, 0x18
pxor xmm1, xmm0
por xmm2, xmm1
cmp rcx, rax
jb 0x140053cf0
por xmm2, xmm3
movdqa xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movdqa xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movd r9d, xmm2
cmp rcx, r8
jae 0x140053da7
lea rax, [rcx + rdx]
sub r8, rcx
nop word [rax + rax]
movsx edx, byte [r10 + rax]
movsx ecx, byte [rax]
lea rax, [rax + 1]
xor edx, ecx
or r9d, edx
sub r8, 1
jne 0x140053d90
test r9d, r9d
sete al
ret
Function at 0x140055030
Capabilities:
Execute command

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x1400dd080]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rsi, rcx
mov qword [rsp + 0x78], rcx
mov r8, rcx
lea rdx, str.start_cmd__C__color_b__title_Error__echo
lea rcx, [rsp + 0x58]
call fcn.14004ad20
mov rdi, rax
mov rcx, qword [rax + 0x10]
mov rdx, qword [rax + 0x18]
mov rax, rdx
sub rax, rcx
cmp rax, 0x11
jb 0x1400550ba
lea rax, [rcx + 0x11]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x14005509b
mov rax, qword [rdi]
lea rbx, [rax + rcx]
mov r8d, reloc.WS2_32.dll_recvfrom
lea rdx, str.__timeout__t_5_
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x11], 0
jmp 0x1400550dc
mov qword [rsp + 0x20], reloc.WS2_32.dll_recvfrom
lea r9, str.__timeout__t_5_
xor r8d, r8d
lea edx, [r8 + 0x11]
mov rcx, rdi
call fcn.14004c800
mov rdi, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
movups xmm0, xmmword [rdi]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rdi + 0x10], 0
mov qword [rdi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rdi], 0
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 0x10
cmovae rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140055168
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140055163
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140055163
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400ac5a0
movdqa xmm0, xmmword [0x1400cd270]
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x30], 0
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x1400551bb
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400551b6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400551b6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400ac5a0
xor ecx, ecx
int 0x29
mov rdx, qword [rsi + 0x18]
cmp rdx, 0x10
jb 0x1400551f5
inc rdx
mov rcx, qword [rsi]
cmp rdx, 0x1000
jb 0x1400551f0
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14005522d
mov rcx, r8
call fcn.1400ac5a0
mov qword [rsi + 0x10], 0
mov qword [rsi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rsi], 0
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400ac950
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x1400620d0
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__read]
cdqe
add rsp, 0x28
ret