joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400582c0
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, qword [rsp + 0x58]
movaps xmm3, xmm0
mov eax, r8d
movabs rsi, 0x7ffffffefffe
cdq
sub eax, edx
sar eax, 1
lea rcx, [rdi + 0xb98]
movd xmm2, eax
mov eax, r9d
cdq
sub eax, edx
sar eax, 1
cvtdq2pd xmm2, xmm2
movd xmm0, eax
lea rax, [rcx - 0x10001]
subsd xmm3, xmm2
cvtdq2pd xmm0, xmm0
subsd xmm1, xmm0
cmp rax, rsi
ja 0x140058382
mov dword [reloc.WS2_32.dll_closesocket], 2
lea rdx, [0x14049c640]
mov qword [0x14049c650], rcx
xor r9d, r9d
mov rcx, qword [0x14049e1c8]
mov r8d, 0x520
movsd qword [0x14049c658], xmm3
movsd qword [0x14049c660], xmm1
mov qword [0x14049c648], 0x10
call qword [sym.imp.WS2_32.dll_send]
mov rcx, qword [0x14049e1c8]
lea rdx, [0x14049c640]
xor r9d, r9d
mov r8d, 0x520
call qword [sym.imp.WS2_32.dll_recv]
mov rcx, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x60]
add rcx, 0x678
lea rax, [rcx - 0x10001]
cmp rax, rsi
ja 0x1400583fc
mov dword [reloc.WS2_32.dll_closesocket], 2
lea rdx, [0x14049c640]
mov qword [0x14049c650], rcx
xor r9d, r9d
mov rcx, qword [0x14049e1c8]
mov r8d, 0x520
mov qword [0x14049c658], rbx
mov qword [0x14049c648], 8
call qword [sym.imp.WS2_32.dll_send]
mov rcx, qword [0x14049e1c8]
lea rdx, [0x14049c640]
xor r9d, r9d
mov r8d, 0x520
call qword [sym.imp.WS2_32.dll_recv]
lea rcx, [rdi + 0xc08]
lea rax, [rcx - 0x10001]
cmp rax, rsi
ja 0x14005846c
mov dword [reloc.WS2_32.dll_closesocket], 2
lea rdx, [0x14049c640]
mov qword [0x14049c650], rcx
xor r9d, r9d
mov rcx, qword [0x14049e1c8]
mov r8d, 0x520
mov qword [0x14049c658], rbx
mov qword [0x14049c648], 8
call qword [sym.imp.WS2_32.dll_send]
mov rcx, qword [0x14049e1c8]
lea rdx, [0x14049c640]
xor r9d, r9d
mov r8d, 0x520
call qword [sym.imp.WS2_32.dll_recv]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140058ab0
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
sub rsp, 0x28
mov rcx, qword [0x14049e1c8]
lea rdx, [0x14049c640]
xor r9d, r9d
mov dword [reloc.WS2_32.dll_closesocket], 0
mov r8d, 0x520
call qword [sym.imp.WS2_32.dll_send]
mov rcx, qword [0x14049e1c8]
lea rdx, [0x14049c640]
xor r9d, r9d
mov r8d, 0x520
call qword [sym.imp.WS2_32.dll_recv]
mov rax, qword [0x14049c658]
add rsp, 0x28
ret
Function at 0x140058b10
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get system information on windows

Disassembly:
push rbx
sub rsp, 0x50
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x60], 0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [rsp + 0x24]
xor ecx, ecx
lea r9d, [rcx + 0x40]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
mov qword [rsp + 0x68], rax
test rax, rax
je 0x140058bbc
movabs rax, 0xc3c3c3c3c3c3c3c3
mov byte [rbx], al
mov edx, dword [rsp + 0x24]
lea r9, [rsp + 0x60]
mov r8d, 0x140
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x140058bbc
call rbx
nop
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, 1
add rsp, 0x50
pop rbx
ret
xor eax, eax
add rsp, 0x50
pop rbx
ret
Function at 0x140058bd0
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x60
mov rsi, rcx
xor ebx, ebx
lea rcx, [rdx + 0xae8]
call fcn.140051ea0
lea rdx, [rax - 0x10001]
movabs r12, 0x7ffffffefffe
xorps xmm0, xmm0
cmp rdx, r12
ja 0x140058d03
lea rcx, [rax + 8]
movups xmmword [rsp + 0x28], xmm0
lea rax, [rcx - 0x10001]
cmp rax, r12
ja 0x140058c84
mov qword [0x14049c650], rcx
mov qword [0x14049c648], 0x10
mov dword [reloc.WS2_32.dll_closesocket], 1
xor r9d, r9d
mov r8d, 0x520
lea rdx, [0x14049c640]
mov rcx, qword [0x14049e1c8]
call qword [sym.imp.WS2_32.dll_send]
xor r9d, r9d
mov r8d, 0x520
lea rdx, [0x14049c640]
mov rcx, qword [0x14049e1c8]
call qword [sym.imp.WS2_32.dll_recv]
movups xmm0, xmmword [0x14049c658]
movups xmmword [rsp + 0x28], xmm0
mov edx, dword [rsp + 0x30]
mov dword [rsp + 0xb0], edx
mov dword [rsp + 0xb8], reloc.WLDAP32.dll_Ordinal_50
mov dword [rsp + 0xa8], ebx
mov eax, edx
shr eax, 0x1f
lea rcx, [rsp + 0xa8]
lea r8, [rsp + 0xb0]
test al, al
cmove rcx, r8
lea rax, [rsp + 0xb8]
cmp edx, 0x32
cmovle rax, rcx
movsxd r15, dword [rax]
mov rdi, r15
mov eax, 2
mul r15
mov rbp, 0xffffffffffffffff
cmovo rax, rbp
mov rcx, rax
call fcn.14006a450
mov r14, rax
mov rax, qword [rsp + 0x28]
lea rcx, [rax - 0x10001]
cmp rcx, r12
jbe 0x140058d19
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], rbx
mov qword [rsi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rsi], bl
jmp 0x140058e17
add rdi, rdi
mov rdx, rdi
mov rcx, rax
call fcn.14005d250
mov r8, rdi
lea rdx, [0x14049c658]
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
lea eax, [r15 - 1]
mov rcx, r14
movsx edx, al
and edx, 3
lea eax, [r15 - 1]
mov r8d, ebx
test r15d, r15d
cmovne r8d, eax
cmp ebx, r8d
jge 0x140058d6e
add edx, 3
inc ebx
movzx eax, dx
and ax, 7
add word [rcx], ax
add rcx, 2
jmp 0x140058d54
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x48], xmm1
nop
inc rbp
cmp word [r14 + rbp*2], 0
jne 0x140058d80
mov r8, rbp
mov rdx, r14
lea rcx, [rsp + 0x38]
call fcn.140047ed0
nop
lea rdx, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae rdx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x48]
lea r8, [rdx + rax*2]
lea rdx, [rsp + 0x38]
cmovae rdx, qword [rsp + 0x38]
lea r9, [rsp + 0xa8]
mov rcx, rsi
call fcn.1400471d0
nop
mov rdx, qword [rsp + 0x50]
cmp rdx, 8
jb 0x140058e17
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140058e12
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140058e12
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140069d4c
mov rax, rsi
add rsp, 0x60
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14005d250
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
sub rsp, 0x28
mov qword [0x14049c650], rcx
xor r9d, r9d
mov rcx, qword [0x14049e1c8]
mov r8d, 0x520
mov qword [0x14049c648], rdx
lea rdx, [0x14049c640]
mov dword [reloc.WS2_32.dll_closesocket], 1
call qword [sym.imp.WS2_32.dll_send]
mov rcx, qword [0x14049e1c8]
lea rdx, [0x14049c640]
xor r9d, r9d
mov r8d, 0x520
call qword [sym.imp.WS2_32.dll_recv]
mov rax, qword [0x14049c658]
add rsp, 0x28
ret

Function at 0x14005d930
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x50
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x14005d9f9
cmp byte [rcx + 0x71], 0
je 0x14005d9f9
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x68], rdi
call qword [rax + Ordinal_26]
cmp eax, 0xffffffff
je 0x14005d9ec
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x60]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14005d9a8
sub eax, 1
je 0x14005d9ac
cmp eax, 2
jne 0x14005d9ec
mov rdi, qword [rsp + 0x68]
mov al, 1
mov byte [rbx + 0x71], 0
add rsp, 0x50
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x60]
lea rax, [rsp + 0x30]
sub rdi, rax
je 0x14005d9da
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x30]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14005d9ec
cmp byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x68]
sete al
add rsp, 0x50
pop rbx
ret
mov rdi, qword [rsp + 0x68]
xor al, al
add rsp, 0x50
pop rbx
ret
mov al, 1
add rsp, 0x50
pop rbx
ret

Function at 0x14005f690
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
sub rsp, 0x38
xor eax, eax
add rcx, 0x368
mov qword [rsp + 0x20], rax
movabs rdx, 0x7ffffffefffe
mov dword [rsp + 0x28], eax
lea rax, [rcx - 0x10001]
cmp rax, rdx
ja 0x14005f72a
mov qword [0x14049c650], rcx
lea rdx, [0x14049c640]
mov rcx, qword [0x14049e1c8]
xor r9d, r9d
mov qword [0x14049c648], 0xc
mov r8d, 0x520
mov dword [reloc.WS2_32.dll_closesocket], 1
call qword [sym.imp.WS2_32.dll_send]
mov rcx, qword [0x14049e1c8]
lea rdx, [0x14049c640]
xor r9d, r9d
mov r8d, 0x520
call qword [sym.imp.WS2_32.dll_recv]
movsd xmm0, qword [0x14049c658]
mov eax, dword [0x14049c660]
movsd qword [rsp + 0x20], xmm0
mov dword [rsp + 0x28], eax
movss xmm0, dword [rsp + 0x28]
addss xmm0, dword [0x1400dcb34]
comiss xmm0, dword [rsp + 0x20]
setae al
add rsp, 0x38
ret

Function at 0x14005f7e0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1a], 0
je 0x14005f803
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x42]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x19
jb 0x14005f7f0
mov byte [rcx + 0x1a], 0
mov rax, rcx
ret
Function at 0x14005f810
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
cmp qword [rcx + 0x80], 0
mov rbx, rcx
je 0x14005f916
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::eback_void_const___ptr64]
lea rdx, [rbx + 0x70]
cmp rax, rdx
jne 0x14005f85e
mov rdx, qword [rbx + 0x88]
mov rcx, rbx
mov r9, qword [rbx + 0x90]
mov r8, rdx
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::setg_char____ptr64__char____ptr64__char____ptr64____ptr64]
cmp qword [rbx + 0x68], 0
lea rdi, [rbx + 0x71]
je 0x14005f8b8
cmp byte [rdi], 0
je 0x14005f8b8
mov rax, qword [rbx]
mov edx, 0xffffffff
mov rcx, rbx
call qword [rax + Ordinal_26]
cmp eax, 0xffffffff
jne 0x14005f885
xor al, al
jmp 0x14005f8ba
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x60]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14005f8d9
sub eax, 1
je 0x14005f8dc
cmp eax, 2
jne 0x14005f881
mov byte [rdi], 0
mov al, 1
mov rcx, qword [rbx + 0x80]
xor esi, esi
test al, al
mov ebp, esi
cmovne rbp, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test eax, eax
cmovne rbp, rsi
jmp 0x14005f91e
mov byte [rdi], 0
mov rsi, qword [rsp + 0x60]
lea rax, [rsp + 0x30]
sub rsi, rax
je 0x14005f90e
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x30]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x14005f881
cmp byte [rdi], 0
sete al
jmp 0x14005f8ba
xor esi, esi
lea rdi, [rcx + 0x71]
mov ebp, esi
mov rcx, rbx
mov byte [rbx + 0x7c], 0
mov byte [rdi], 0
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Init_void____ptr64]
mov qword [rbx + 0x80], rsi
mov rax, rbp
mov rcx, qword [0x14049e678]
mov rbp, qword [rsp + 0x70]
mov qword [rbx + 0x68], rsi
mov rsi, qword [rsp + 0x78]
mov qword [rbx + 0x74], rcx
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x1400627c0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x70
mov esi, edx
mov rdi, rcx
cmp edx, 0xffffffff
jne 0x1400627e4
xor eax, eax
mov rsi, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
mov qword [rsp + 0x80], rbx
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
test rax, rax
je 0x140062824
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::epptr_void_const___ptr64]
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
cmp rax, rbx
jae 0x140062824
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], sil
mov eax, esi
jmp 0x140062951
cmp qword [rdi + 0x80], 0
je 0x14006294c
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::eback_void_const___ptr64]
lea rcx, [rdi + 0x70]
cmp rax, rcx
jne 0x14006285e
mov rdx, qword [rdi + 0x88]
mov rcx, rdi
mov r9, qword [rdi + 0x90]
mov r8, rdx
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::setg_char____ptr64__char____ptr64__char____ptr64____ptr64]
mov rcx, qword [rdi + 0x68]
test rcx, rcx
jne 0x140062889
mov rdx, qword [rdi + 0x80]
movsx ecx, sil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, esi
mov eax, ecx
jmp 0x140062951
lea rax, [rsp + 0x90]
mov byte [rsp + 0x40], sil
mov qword [rsp + 0x38], rax
lea rdx, [rdi + 0x74]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x41]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x40]
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400628fe
sub eax, 1
je 0x1400628fe
cmp eax, 2
jne 0x14006294c
movsx ecx, byte [rsp + 0x40]
mov rdx, qword [rdi + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, esi
mov eax, ecx
jmp 0x140062951
mov rbx, qword [rsp + 0x90]
lea rax, [rsp + 0x48]
sub rbx, rax
je 0x14006292f
mov r9, qword [rdi + 0x80]
lea rcx, [rsp + 0x48]
mov r8, rbx
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rbx, rax
jne 0x14006294c
lea rax, [rsp + 0x40]
mov byte [rdi + 0x71], 1
cmp qword [rsp + 0x98], rax
mov ecx, 0xffffffff
cmovne ecx, esi
mov eax, ecx
jmp 0x140062951
mov eax, 0xffffffff
mov rbx, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
Function at 0x140066ae0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov rsi, r8
mov r14, rdx
mov rbp, rcx
test r8, r8
jg 0x140066b11
xor eax, eax
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rcx + 0x68], 0
je 0x140066b2f
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov qword [rsp + 0x30], rbx
mov rbx, rsi
mov qword [rsp + 0x38], rdi
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Gnavail_void_const___ptr64]
test rax, rax
je 0x140066b79
cmp rax, rsi
mov rdi, rsi
mov rcx, rbp
cmovb rdi, rax
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gptr_void_const___ptr64]
mov r8, rdi
mov rcx, r14
mov rdx, rax
call sub.VCRUNTIME140.dll_memcpy
mov edx, edi
mov rcx, rbp
add r14, rdi
sub rbx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int____ptr64]
cmp qword [rbp + 0x80], 0
mov rdi, rbx
je 0x140066bf1
mov rcx, rbp
call fcn.14005e630
cmp rbx, 0xfff
jbe 0x140066bd1
nop word [rax + rax]
mov r9, qword [rbp + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
add r14, rax
mov rdi, rbx
cmp rax, 0xfff
jne 0x140066c12
cmp rbx, rax
ja 0x140066ba0
test rdi, rdi
je 0x140066bf1
mov r9, qword [rbp + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rdi, rax
sub rsi, rdi
mov rbx, qword [rsp + 0x30]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
sub rsi, rbx
jmp 0x140066bf4
Function at 0x140066c20
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je 0x140066c48
add rsp, 0x20
pop r14
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov rbp, rax
test rbx, rbx
jle 0x140066cbc
test rax, rax
jle 0x140066c9c
cmp rbx, rax
mov rcx, rdi
cmovl rbp, rbx
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, rbp
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov edx, ebp
mov rcx, rdi
add r14, rbp
sub rbx, rbp
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
test rbx, rbx
jle 0x140066cbc
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140066cbc
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov rbp, qword [rsp + 0x40]
sub rsi, rbx
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rbx
ret
Function at 0x14006a8b0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14006a8fa
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14006a8fa
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14006a8fa
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14006a8fa
cmp dword [rcx + 0x84], 0xe
jbe 0x14006a8fa
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14006a8fc
xor al, al
add rsp, 0x28
ret

Function at 0x14006ab50
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, rdx
lea r8, [rsp + 0x60]
mov ebx, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov r8d, ebx
mov ecx, 0x1300
neg eax
sbb r9d, r9d
and qword [rsp + 0x30], 0
and r9d, dword [rsp + 0x60]
xor edx, edx
and dword [rsp + 0x28], 0
mov dword [rsp + 0x60], r9d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x14006abd4
mov r8, qword [rdi]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, reloc.WS2_32.dll_accept
cmp byte [rcx + rax], 0
je 0x14006abd4
dec r8
sub rdx, 1
jne 0x14006abba
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x14006b5c0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 7], sil
je 0x14006b5f4
mov eax, esi
lea ecx, [rax - 0x2d]
xor byte [r8 + rax], cl
inc rax
cmp rax, 6
jb 0x14006b5e0
mov byte [r8 + 7], sil
add r8, 6
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.1400470e0
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x14006b619
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140061820
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x14006b693
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006b68e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14006b68e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140069d4c
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x14006b6a0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 9], sil
je 0x14006b6d4
mov eax, esi
lea ecx, [rax - 0x2d]
xor byte [r8 + rax], cl
inc rax
cmp rax, 8
jb 0x14006b6c0
mov byte [r8 + 9], sil
add r8, 8
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.1400470e0
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x14006b6f9
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140061820
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x14006b773
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006b76e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14006b76e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140069d4c
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x14006b780
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 0xa], sil
je 0x14006b7b4
mov eax, esi
lea ecx, [rax - 0x2d]
xor byte [r8 + rax], cl
inc rax
cmp rax, 9
jb 0x14006b7a0
mov byte [r8 + 0xa], sil
add r8, 9
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.1400470e0
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x14006b7d9
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140061820
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x14006b853
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006b84e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14006b84e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140069d4c
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret