joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002d680
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x50
mov rsi, qword [rdx + 0x10]
xor r14d, r14d
mov rbx, rdx
shr rsi, 1
mov rdi, rcx
mov dword [rsp + 0x20], r14d
jne 0x14002d6cf
mov qword [rcx + 0x18], 0xf
mov qword [rcx + 0x10], r14
lea rdx, [0x14007a42e]
xor r8d, r8d
mov byte [rcx], r14b
call fcn.140002390
jmp 0x14002d84e
mov rcx, rsi
mov qword [rsp + 0x60], rbp
call fcn.14004f218
mov r11, r14
mov rbp, rax
test rsi, rsi
je 0x14002d79c
mov r9, r14
nop
mov r8, qword [rbx + 0x10]
cmp r8, r9
jbe 0x14002d874
mov r10, qword [rbx + 0x18]
cmp r10, 0x10
jb 0x14002d70c
mov rax, qword [rbx]
jmp 0x14002d70f
mov rax, rbx
movzx edx, byte [rax + r9]
xor cl, cl
lea eax, [rdx - 0x30]
cmp al, 9
ja 0x14002d722
lea ecx, [rdx - 0x30]
jmp 0x14002d738
lea eax, [rdx - 0x61]
cmp al, 5
ja 0x14002d72e
lea ecx, [rdx - 0x57]
jmp 0x14002d738
lea eax, [rdx - 0x41]
cmp al, 5
ja 0x14002d738
lea ecx, [rdx - 0x37]
lea rdx, [r9 + 1]
cmp r8, rdx
jbe 0x14002d867
cmp r10, 0x10
jb 0x14002d750
mov rax, qword [rbx]
jmp 0x14002d753
mov rax, rbx
movzx r8d, byte [rax + rdx]
xor dl, dl
lea eax, [r8 - 0x30]
cmp al, 9
ja 0x14002d768
lea edx, [r8 - 0x30]
jmp 0x14002d782
lea eax, [r8 - 0x61]
cmp al, 5
ja 0x14002d776
lea edx, [r8 - 0x57]
jmp 0x14002d782
lea eax, [r8 - 0x41]
cmp al, 5
ja 0x14002d782
lea edx, [r8 - 0x37]
shl cl, 4
inc r11
add r9, 2
or cl, dl
mov byte [r11 + rbp - 1], cl
cmp r11, rsi
jb 0x14002d6f0
mov dl, 0x65
test rsi, rsi
je 0x14002d7c3
mov rcx, rbp
mov r8, rsi
nop dword [rax]
mov al, 0xb
lea rcx, [rcx + 1]
imul dl
xor byte [rcx - 1], al
movzx edx, al
dec r8
jne 0x14002d7b0
movzx r8d, byte [rbp]
lea rax, [rsi - 1]
lea rdx, [rbp + 1]
cmp r8, rax
lea rcx, [rsp + 0x28]
mov qword [rsp + 0x40], 0xf
cmova r8, rax
mov qword [rsp + 0x38], r14
mov byte [rsp + 0x28], r14b
call fcn.140002390
mov rcx, rbp
call fcn.14004dea4
mov qword [rdi + 0x18], 0xf
mov qword [rdi + 0x10], r14
mov byte [rdi], r14b
mov rcx, qword [rsp + 0x40]
cmp rcx, 0x10
jae 0x14002d834
mov r8, qword [rsp + 0x38]
inc r8
je 0x14002d83c
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.14004cdd0
mov rcx, qword [rsp + 0x40]
jmp 0x14002d83c
mov rax, qword [rsp + 0x28]
mov qword [rdi], rax
mov rax, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x60]
mov qword [rdi + 0x18], rcx
mov qword [rdi + 0x10], rax
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rax, rdi
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r14
ret
lea rcx, str.invalid_string_position
call fcn.14004c060
int3
lea rcx, str.invalid_string_position
call fcn.14004c060
int3
Function at 0x14003d560
Capabilities:
Set current directory

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
add rsp, 0x28
ret

Function at 0x14003d580
Capabilities:
Get common file path

Disassembly:
sub rsp, 0x28
mov eax, edx
mov rdx, rcx
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
add rsp, 0x28
ret

Function at 0x14003d5b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rdi
sub rsp, 0x20
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x14003d5cc
xor eax, eax
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x30], rbx
test al, 0x10
mov ebx, 0
setne bl
mov edx, 4
mov rcx, rdi
inc ebx
call fcn.1400540dc
test eax, eax
je 0x14003d5f1
or ebx, 0x10
mov edx, 2
mov rcx, rdi
call fcn.1400540dc
test eax, eax
je 0x14003d605
or ebx, 0x20
lea rdx, [rsp + 0x38]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetBinaryTypeA]
test eax, eax
je 0x14003d61a
or ebx, 0x40
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140045280
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rdi, rcx
cmp qword [rcx + 0x78], 0
je 0x140045478
cmp byte [rcx + 0x81], 0
je 0x140045478
mov rax, qword [rcx]
or edx, 0xffffffff
call qword [rax + 0x18]
cmp eax, 0xffffffff
jne 0x1400452ce
xor al, al
jmp 0x14004547a
mov edx, 0xf
mov qword [rbp - 0x10], rdx
mov byte [rbp - 0x28], 0
xor ecx, ecx
mov qword [rbp - 0x28], rcx
mov qword [rbp - 0x18], 8
lea rax, [rbp - 0x28]
cmp rdx, 0x10
cmovae rax, rcx
mov byte [rax + 8], cl
xor r14d, r14d
mov r9, qword [rbp - 0x10]
nop
lea rdx, [rbp - 0x28]
cmp r9, 0x10
cmovae rdx, qword [rbp - 0x28]
lea r8, [rbp - 0x28]
cmovae r8, qword [rbp - 0x28]
mov rcx, qword [rdi + 0x78]
mov r10, qword [rcx]
mov r9, qword [rbp - 0x18]
add r9, rdx
lea rax, [rbp + 0x20]
mov qword [rsp + 0x20], rax
lea rdx, [rdi + 0x84]
call qword [r10 + 0x40]
test eax, eax
je 0x140045346
dec eax
jne 0x14004543b
jmp 0x14004534d
mov byte [rdi + 0x81], r14b
lea rax, [rbp - 0x28]
mov r10, qword [rbp - 0x28]
mov r9, qword [rbp - 0x10]
cmp r9, 0x10
cmovae rax, r10
mov rbx, qword [rbp + 0x20]
sub rbx, rax
je 0x140045397
lea rcx, [rbp - 0x28]
cmp r9, 0x10
cmovae rcx, r10
mov r9, qword [rdi + 0x90]
mov r8, rbx
mov edx, 1
call fcn.140054854
mov r9, qword [rbp - 0x10]
cmp rbx, rax
jne 0x140045444
cmp byte [rdi + 0x81], r14b
je 0x140045462
test rbx, rbx
jne 0x140045300
or rax, 0xffffffffffffffff
mov r8, qword [rbp - 0x18]
sub rax, r8
cmp rax, 8
jbe 0x140045455
lea rbx, [r8 + 8]
cmp rbx, 0xfffffffffffffffe
ja 0x140045448
cmp r9, rbx
jae 0x1400453e3
mov rdx, rbx
lea rcx, [rbp - 0x28]
call fcn.140001b80
mov r9, qword [rbp - 0x10]
jmp 0x140045401
test rbx, rbx
jne 0x14004540a
mov qword [rbp - 0x18], r14
lea rax, [rbp - 0x28]
cmp r9, 0x10
cmovae rax, qword [rbp - 0x28]
mov byte [rax], r14b
jmp 0x1400452fb
test rbx, rbx
je 0x140045300
lea rcx, [rbp - 0x28]
cmp r9, 0x10
cmovae rcx, qword [rbp - 0x28]
mov rax, qword [rbp - 0x18]
xor edx, edx
mov qword [rax + rcx], rdx
mov qword [rbp - 0x18], rbx
lea rax, [rbp - 0x28]
cmp qword [rbp - 0x10], 0x10
cmovae rax, qword [rbp - 0x28]
mov byte [rbx + rax], dl
jmp 0x1400452fb
mov r9, qword [rbp - 0x10]
sub eax, 2
je 0x140045462
xor bl, bl
jmp 0x140045464
lea rcx, str.string_too_long
call fcn.14004c028
int3
lea rcx, str.string_too_long
call fcn.14004c028
int3
mov bl, 1
cmp r9, 0x10
jb 0x140045473
mov rcx, qword [rbp - 0x28]
call fcn.14004cc48
movzx eax, bl
jmp 0x14004547a
mov al, 1
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x14005198c
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.1400517f4
Function at 0x14006220c
Capabilities:
Create directory

Disassembly:
sub rsp, 0x28
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x140062224
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140062226
xor eax, eax
test eax, eax
je 0x140062236
mov ecx, eax
call fcn.14004dde4
or eax, 0xffffffff
jmp 0x140062238
xor eax, eax
add rsp, 0x28
ret

Function at 0x14006be28
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x14006be3e
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x14006be40
xor eax, eax
test eax, eax
je 0x14006be50
mov ecx, eax
call fcn.14004dde4
or eax, 0xffffffff
jmp 0x14006be52
xor eax, eax
add rsp, 0x28
ret
Function at 0x1400030b0
Capabilities:
Delete file
Encode data using xor

Disassembly:
sub rsp, 0x68
cmp byte [0x1400acdfb], 0
movups xmm0, xmmword [0x1400acde0]
mov eax, dword [0x1400acdf8]
mov dword [rsp + 0x48], eax
movups xmmword [rsp + 0x30], xmm0
movsd xmm0, qword [0x1400acdf0]
movsd qword [rsp + 0x40], xmm0
je 0x14000327f
xor ecx, ecx
cmp dword [reloc.WS2_32.dll_accept], 2
jl 0x140003241
movdqa xmm0, xmmword [0x1400ae290]
lea rdx, [rsp + 0x34]
movdqa xmm5, xmmword [0x1400ae1f0]
movdqa xmm4, xmmword [0x1400ae2f0]
movdqa xmmword [rsp + 0x20], xmm0
mov r8d, dword [rsp + 0x20]
movaps xmmword [rsp + 0x50], xmm6
movdqa xmm6, xmmword [0x1400ae210]
nop dword [rax]
movd xmm2, ecx
lea eax, [rcx + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add ecx, 8
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x1400ae250]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 0xc]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rdx - 0xc], xmm2
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, r8d
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1400ae250]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx - 8]
xorps xmm2, xmm0
movd dword [rdx - 8], xmm2
cmp ecx, 0x18
jl 0x140003130
movaps xmm6, xmmword [rsp + 0x50]
cmp ecx, 0x1c
jge 0x14000327f
movsxd rax, ecx
lea r8, [rsp + 0x30]
add r8, rax
nop dword [rax]
mov eax, 0xa0a0a0a1
lea r8, [r8 + 1]
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x33
movzx eax, cl
inc ecx
sub al, dl
add al, 0x35
xor byte [r8 - 1], al
cmp ecx, 0x1c
jl 0x140003250
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
add rsp, 0x68
ret
Function at 0x140012460
Capabilities:
Access peb ldr_data
Encode data using xor
Get process filename
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1400bd648]
test rax, rax
jne 0x14001264c
mov rax, qword gs:[0x60]
xor r11d, r11d
mov qword [rsp + 0x48], rbp
mov r9d, 0x705fe90d
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x30], rdi
mov rcx, qword [rax + 0x18]
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x20], r15
mov rax, qword [rcx + 0x10]
mov rbp, qword [rax]
mov rdi, rbp
nop dword [rax]
nop word [rax + rax]
movups xmm0, xmmword [rdi + 0x58]
movd eax, xmm0
sub ax, 8
test r11d, r11d
je 0x14001250d
psrldq xmm0, 8
mov edx, 0x86105569
movq rcx, xmm0
movzx eax, ax
shr rax, 1
lea r8, [rcx + rax*2]
cmp rcx, r8
je 0x140012504
nop
movsx eax, byte [rcx]
add rcx, 2
xor eax, edx
imul edx, eax, 0x1000193
cmp rcx, r8
jne 0x1400124f0
cmp edx, r11d
jne 0x14001260f
mov r10, qword [rdi + 0x30]
movsxd rax, dword [r10 + 0x3c]
mov rcx, qword [rax + r10 + 0x88]
mov r15, rcx
mov ebx, ecx
shr r15, 0x20
add rbx, r10
cmp rbx, r10
je 0x14001260f
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x14001260f
mov r14d, dword [rbx + 0x20]
nop dword [rax]
nop word [rax + rax]
dec r8d
mov edx, 0x86105569
lea rax, [r14 + r8*4]
mov ecx, dword [rax + r10]
add rcx, r10
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x140012587
nop dword [rax]
movsx eax, al
lea rcx, [rcx + 1]
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx - 1]
test al, al
jne 0x140012570
cmp edx, r9d
je 0x140012593
test r8d, r8d
jne 0x140012550
jmp 0x14001260f
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
cmp rax, rbx
jbe 0x140012627
lea rcx, [r15 + rbx]
cmp rax, rcx
jae 0x140012627
movzx ecx, byte [rax]
mov r11d, 0x86105569
mov r9d, r11d
cmp cl, 0x2e
je 0x1400125e8
nop dword [rax]
movsx ecx, cl
inc rax
xor ecx, r11d
imul r11d, ecx, 0x1000193
movzx ecx, byte [rax]
cmp cl, 0x2e
jne 0x1400125d0
movzx ecx, byte [rax + 1]
inc rax
test cl, cl
je 0x14001260b
movsx ecx, cl
lea rax, [rax + 1]
xor ecx, r9d
imul r9d, ecx, 0x1000193
movzx ecx, byte [rax]
test cl, cl
jne 0x1400125f3
mov rdi, qword [rbp]
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rbp
je 0x140012625
cmp qword [rax + 0x30], 0
jne 0x1400124c0
xor eax, eax
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov qword [0x1400bd648], rax
add rsp, 0x38
jmp rax
Function at 0x140015eb0
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1400bc0c0]
xor rax, rsp
mov qword [rbp - 8], rax
cmp byte [0x1400ac961], 0
movsd xmm0, qword [str._BSTU]
movzx eax, word [0x1400ac960]
movsd qword [rbp - 0x30], xmm0
mov word [rbp - 0x28], ax
je 0x140015f10
xor byte [rbp - 0x2f], 0x36
xor byte [rbp - 0x2e], 0x37
xor byte [rbp - 0x2d], 0x38
xor byte [rbp - 0x2c], 0x39
xor byte [rbp - 0x2b], 0x3a
xor byte [rbp - 0x2a], 0x3b
xor byte [rbp - 0x29], 0x3c
xor byte [rbp - 0x28], 0x3d
xor byte [rbp - 0x27], 0x3e
mov byte [rbp - 0x30], WSAGetLastError
lea rcx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r9, rax
test rax, rax
je 0x1400160e6
cmp byte [0x1400acc45], 0
mov ecx, dword [0x1400acc40]
movsd xmm0, qword [str.qTPzK_ZWmQV.5B]
mov dword [rbp - 0x18], ecx
movzx ecx, word [0x1400acc44]
mov word [rbp - 0x14], cx
mov qword [rsp + 0x60], rbx
movsd qword [rbp - 0x20], xmm0
je 0x1400160af
xor ecx, ecx
cmp dword [reloc.WS2_32.dll_accept], 2
jl 0x140016068
movdqa xmm2, xmmword [0x1400ae1f0]
mov ecx, 8
movdqa xmm3, xmmword [0x1400ae200]
movdqa xmm1, xmm2
movdqa xmm4, xmmword [0x1400ae2f0]
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1400ae210]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, dword [str.qTPzK_ZWmQV.5B]
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x1400ae250]
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1400ae290]
xorps xmm2, xmm0
punpckldq xmm1, xmm3
movd dword [rbp - 0x20], xmm2
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1400ae210]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, dword [rbp - 0x1c]
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1400ae250]
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1400ae290]
xorps xmm2, xmm0
movd dword [rbp - 0x1c], xmm2
movsxd rax, ecx
lea r8, [rbp - 0x20]
add r8, rax
nop dword [rax]
nop word [rax + rax]
mov eax, 0xa0a0a0a1
lea r8, [r8 + 1]
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x33
movzx eax, cl
inc ecx
sub al, dl
add al, 0x35
xor byte [r8 - 1], al
cmp ecx, 0xe
jl 0x140016080
lea rdx, [rbp - 0x20]
mov rcx, r9
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x1400160e1
mov edx, 1
lea r9, [rbp - 0x10]
mov rcx, rax
lea r8d, [rdx + 0x3f]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1400160e1
mov byte [rbx], 0xc3
mov rbx, qword [rsp + 0x60]
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140097db0
add rsp, 0x50
pop rbp
ret
Function at 0x140016780
Capabilities:
Check for software breakpoints
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x90
mov rax, qword [0x1400bc0c0]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rbx, qword [rsp + 0x98]
cmp byte [rbx], 0xcc
jne 0x1400169f2
mov edx, 1
lea r9, [rsp + 0x70]
mov rcx, rbx
lea r8d, [rdx + 0x3f]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1400169f2
mov r8d, dword [rsp + 0x70]
lea r9, [rsp + 0x70]
mov edx, 1
mov byte [rbx], 0x90
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
movups xmm0, xmmword [str.fBRH]
mov eax, dword [0x1400acbb8]
xor r9d, r9d
cmp byte [0x1400acbbb], r9b
movups xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x30], eax
je 0x1400169af
cmp dword [reloc.WS2_32.dll_accept], 2
mov ecx, r9d
jl 0x140016974
movdqa xmm0, xmmword [0x1400ae290]
lea rdx, [rsp + 0x24]
movdqa xmm5, xmmword [0x1400ae1f0]
movdqa xmm4, xmmword [0x1400ae2f0]
movdqa xmmword [rsp + 0x40], xmm0
mov r8d, dword [rsp + 0x40]
movaps xmmword [rsp + 0x80], xmm6
movdqa xmm6, xmmword [0x1400ae210]
nop dword [rax]
nop word [rax + rax]
movd xmm2, ecx
lea eax, [rcx + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add ecx, 8
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x1400ae250]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 0xc]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rdx - 0xc], xmm2
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, r8d
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1400ae250]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx - 8]
xorps xmm2, xmm0
movd dword [rdx - 8], xmm2
cmp ecx, 0x10
jl 0x140016860
movaps xmm6, xmmword [rsp + 0x80]
cmp ecx, 0x14
jge 0x1400169af
movsxd rax, ecx
lea r8, [rsp + 0x20]
add r8, rax
nop
mov eax, 0xa0a0a0a1
lea r8, [r8 + 1]
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x33
movzx eax, cl
inc ecx
sub al, dl
add al, 0x35
xor byte [r8 - 1], al
cmp ecx, 0x14
jl 0x140016980
xorps xmm0, xmm0
mov qword [rsp + 0x60], r9
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x68], r9
lea rax, [rsp + 0x20]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], r9b
jne 0x1400169d0
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x50]
call fcn.140022cf0
lea rcx, [rsp + 0x50]
call fcn.14000e770
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140097db0
add rsp, 0x90
pop rbx
ret
Function at 0x140016dc0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x78
call fcn.140035a40
test eax, eax
je 0x140016fdc
movups xmm0, xmmword [0x1400adc28]
xor r9d, r9d
movups xmmword [rsp + 0x20], xmm0
psrldq xmm0, 0xf
movd eax, xmm0
test al, al
je 0x140016f8f
cmp dword [reloc.WS2_32.dll_accept], 2
jl 0x140016f4e
movdqa xmm0, xmmword [0x1400ae290]
lea rcx, [rsp + 0x24]
movdqa xmm5, xmmword [0x1400ae1f0]
mov edx, r9d
movdqa xmm4, xmmword [0x1400ae2f0]
movdqa xmmword [rsp + 0x30], xmm0
mov r8d, dword [rsp + 0x30]
movaps xmmword [rsp + 0x60], xmm6
movdqa xmm6, xmmword [0x1400ae210]
nop word [rax + rax]
movd xmm2, edx
lea eax, [rdx + 4]
pshufd xmm2, xmm2, 0
lea rcx, [rcx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add edx, 8
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x1400ae250]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rcx - 0xc]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rcx - 0xc], xmm2
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, r8d
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1400ae250]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rcx - 8]
xorps xmm2, xmm0
movd dword [rcx - 8], xmm2
cmp edx, 0x10
jl 0x140016e40
movaps xmm6, xmmword [rsp + 0x60]
jmp 0x140016f8f
lea r8, [rsp + 0x20]
mov ecx, r9d
nop word [rax + rax]
mov eax, 0xa0a0a0a1
lea r8, [r8 + 1]
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x33
movzx eax, cl
inc ecx
sub al, dl
add al, 0x35
xor byte [r8 - 1], al
cmp ecx, 0x10
jl 0x140016f60
xorps xmm0, xmm0
mov qword [rsp + 0x50], r9
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x58], r9
lea rax, [rsp + 0x20]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], r9b
jne 0x140016fb0
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.140022cf0
lea rcx, [rsp + 0x40]
call fcn.14000e770
mov eax, 0x1000
add rsp, 0x78
ret
xor eax, eax
add rsp, 0x78
ret
Function at 0x14001d520
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x14001d548
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x14001d56e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x14001d570
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x14001d5c9
test ecx, ecx
jle 0x14001d5a9
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x14001d5c9
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x14001d5c9
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret

Function at 0x14001d5f0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x14001d612
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x14001d628
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x14001d644
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14001d646
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14001d682
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x14001d71e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x14001d6bd
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x14001d6fe
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x14001d71e
cmp rbx, rax
ja 0x14001d6d0
test rbx, rbx
je 0x14001d71e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret