joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140071200
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], r8
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov r14, r8
mov rbp, rdx
xor dil, dil
mov byte [rax + 8], dil
mov rbx, qword [r8]
mov rsi, qword [r8 + 8]
cmp rbx, rsi
je 0x1400712f7
movabs rdi, 0x100000001b3
movabs r15, 0xcbf29ce484222325
nop dword [rax + rax]
mov r9, rbx
mov r8, rbp
lea rdx, [rsp + 0x30]
call fcn.1400700e0
nop
lea rdx, [rsp + 0x30]
cmp qword [rsp + 0x48], 0xf
cmova rdx, qword [rsp + 0x30]
mov r9, r15
xor eax, eax
mov r8, qword [rsp + 0x40]
test r8, r8
je 0x140071294
movzx ecx, byte [rax + rdx]
xor r9, rcx
imul r9, rdi
inc rax
cmp rax, r8
jb 0x140071281
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x20]
lea rcx, [0x140156e00]
call fcn.1400a9000
mov rax, qword [rax + 8]
test rax, rax
je 0x1400712d8
cmp rax, qword [0x140156e08]
je 0x1400712d8
mov rax, qword [rax + 0x30]
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x1400712d8
lea rdx, [rsp + 0x80]
call qword [sym.imp.fmod.dll_public:_enum_FMOD_RESULT___cdecl_FMOD::ChannelControl::isPlaying_bool____ptr64____ptr64]
nop
lea rcx, [rsp + 0x30]
call fcn.1400672b0
add rbx, 0x20
cmp rbx, rsi
jne 0x140071250
movzx edi, byte [rsp + 0x80]
mov rcx, r14
call fcn.14009f3a0
movzx eax, dil
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret

Function at 0x1400758a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x80
movaps xmmword [rsp + 0x70], xmm6
movaps xmm6, xmm1
mov rdi, rcx
lea rdx, [rcx + 0x1a8]
lea rcx, [rsp + 0x30]
call fcn.14009dbb0
mov r14, rax
mov qword [rsp + 0xa0], rax
mov rbx, qword [rax]
mov rsi, qword [rax + 8]
cmp rbx, rsi
je 0x1400759ab
movabs rbp, 0x100000001b3
movabs r15, 0xcbf29ce484222325
nop word [rax + rax]
mov r9, rbx
lea r8, [rdi + 0x28]
lea rdx, [rsp + 0x48]
call fcn.1400700e0
nop
lea rdx, [rsp + 0x48]
cmp qword [rsp + 0x60], 0xf
cmova rdx, qword [rsp + 0x48]
mov r9, r15
xor ecx, ecx
mov r8, qword [rsp + 0x58]
test r8, r8
je 0x140075955
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, rbp
inc rcx
cmp rcx, r8
jb 0x140075942
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x20]
lea rcx, [0x140156e00]
call fcn.1400a9000
mov rax, qword [rax + 8]
test rax, rax
je 0x140075994
cmp rax, qword [0x140156e08]
je 0x140075994
mov rax, qword [rax + 0x30]
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x140075994
movaps xmm1, xmm6
call qword [sym.imp.fmod.dll_public:_enum_FMOD_RESULT___cdecl_FMOD::ChannelControl::setPitch_float____ptr64]
nop
lea rcx, [rsp + 0x48]
call fcn.1400672b0
add rbx, 0x20
cmp rbx, rsi
jne 0x140075910
mov rcx, r14
call fcn.14009f3a0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
movaps xmm6, xmmword [rsp + 0x70]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x1400777c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x80
movaps xmmword [rsp + 0x70], xmm6
movaps xmm6, xmm1
mov rdi, rcx
lea rdx, [rcx + 0x1a8]
lea rcx, [rsp + 0x30]
call fcn.14009dbb0
mov r14, rax
mov qword [rsp + 0xa0], rax
mov rbx, qword [rax]
mov rsi, qword [rax + 8]
cmp rbx, rsi
je 0x1400778d9
movabs rbp, 0x100000001b3
movabs r15, 0xcbf29ce484222325
nop word [rax + rax]
mov r9, rbx
lea r8, [rdi + 0x28]
lea rdx, [rsp + 0x48]
call fcn.1400700e0
nop
lea rdx, [rsp + 0x48]
cmp qword [rsp + 0x60], 0xf
cmova rdx, qword [rsp + 0x48]
mov r9, r15
xor ecx, ecx
mov r8, qword [rsp + 0x58]
test r8, r8
je 0x140077875
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, rbp
inc rcx
cmp rcx, r8
jb 0x140077862
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x20]
lea rcx, [0x140156e00]
call fcn.1400a9000
mov rax, qword [rax + 8]
test rax, rax
je 0x1400778c2
cmp rax, qword [0x140156e08]
je 0x1400778c2
mov rax, qword [rax + 0x30]
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x1400778c2
cvttss2si rax, xmm6
imul edx, eax, 0x3e8
mov r8d, 1
call qword [sym.imp.fmod.dll_public:_enum_FMOD_RESULT___cdecl_FMOD::Channel::setPosition_unsigned_int__unsigned_int____ptr64]
nop
lea rcx, [rsp + 0x48]
call fcn.1400672b0
add rbx, 0x20
cmp rbx, rsi
jne 0x140077830
mov rcx, r14
call fcn.14009f3a0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
movaps xmm6, xmmword [rsp + 0x70]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x14007f650
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push rbx
mov eax, 0x13d0
call fcn.14010afb0
sub rsp, rax
movaps xmmword [rsp + 0x13c0], xmm6
movaps xmm6, xmm1
movaps xmmword [rsp + 0x13b0], xmm7
movaps xmm7, xmm0
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov dword [rsp + 0x13a4], 0xffffffff
mov edx, 1
mov dword [rsp + 0x24], eax
nop
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [rsp + rdx*4 + 0x24], eax
inc rdx
cmp rdx, 0x270
jb 0x14007f690
movsd xmm3, qword [0x140133ad8]
xorps xmm1, xmm1
mov edx, 0x270
xorps xmm4, xmm4
cvtss2sd xmm1, xmm6
mov dword [rsp + 0x20], edx
mov r10d, 2
movsd xmm6, qword [0x140133c38]
xorps xmm5, xmm5
cvtss2sd xmm4, xmm7
xorps xmm2, xmm2
cmp edx, 0x270
jne 0x14007f742
lea r8, [rsp + 0x28]
mov r9d, edx
nop dword [rax]
nop word [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x14007f700
mov edx, dword [rsp + 0x20]
jmp 0x14007f83b
cmp edx, 0x4e0
jb 0x14007f83b
xor r8d, r8d
lea r9, [rsp + 0x9e4]
lea r11, [rsp + 0x1018]
lea rbx, [rsp + 0x24]
nop word [rax + rax]
mov edx, dword [r9 + r8*4]
xor edx, dword [rsp + r8*4 + 0x9e8]
btr edx, 0x1f
xor edx, dword [r9 + r8*4]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + r8*4]
xor ecx, edx
mov dword [rbx + r8*4], ecx
inc r8
cmp r8, 0xe3
jb 0x14007f770
mov r8d, 0xe3
lea r9, [rsp + 0x9e8]
lea r11, [rsp + 0x24]
nop dword [rax]
mov eax, dword [rsp + r8*4 + 0x9e4]
mov edx, eax
xor edx, dword [r9 + r8*4]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [rsp + r8*4 - 0x368]
xor ecx, edx
mov dword [r11 + r8*4], ecx
inc r8
cmp r8, 0x26f
jb 0x14007f7c0
mov edx, dword [rsp + 0x13a0]
mov eax, dword [rsp + 0x24]
and edx, 0x80000000
btr eax, 0x1f
or edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, edx
xor ecx, dword [rsp + 0x654]
xor edx, edx
mov dword [rsp + 0x9e0], ecx
mov dword [rsp + 0x20], edx
mov eax, edx
xorps xmm0, xmm0
inc edx
mov ecx, dword [rsp + rax*4 + 0x24]
mov eax, ecx
shr eax, 0xb
and eax, dword [rsp + 0x13a4]
xor ecx, eax
mov dword [rsp + 0x20], edx
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
cvtsi2sd xmm0, rax
subsd xmm0, xmm5
mulsd xmm0, xmm3
mulsd xmm3, xmm6
addsd xmm2, xmm0
sub r10, 1
jne 0x14007f6e2
movaps xmm6, xmmword [rsp + 0x13c0]
subsd xmm1, xmm4
movaps xmm7, xmmword [rsp + 0x13b0]
xorps xmm0, xmm0
divsd xmm2, xmm3
mulsd xmm1, xmm2
addsd xmm1, xmm4
cvtsd2ss xmm0, xmm1
add rsp, 0x13d0
pop rbx
ret
Function at 0x14008c900
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
sub rsp, 0x28
cmp dword [0x1401562e0], 0
jne 0x1400017f0
xor edx, edx
mov ecx, 0x10001
call fcn.140004d20
xor eax, eax
add rsp, 0x28
ret
add rsp, 0x28
jmp 0x140003b90
sub rsp, 0x28
mov rcx, qword [0x1401578c8]
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x140003bbd
lea rdx, str.Win32:_Failed_to_open_clipboard
mov ecx, 0x10008
call fcn.140004d20
xor eax, eax
add rsp, 0x28
ret
mov ecx, recv
mov qword [rsp + 0x20], rbx
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rbx, rax
test rax, rax
jne 0x140003bf8
call qword [sym.imp.USER32.dll_CloseClipboard]
lea rdx, str.Win32:_Failed_to_convert_clipboard_to_string
mov ecx, 0x10009
call fcn.140004d20
mov rbx, qword [rsp + 0x20]
xor eax, eax
add rsp, 0x28
ret
mov rcx, qword [0x1401578d8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rcx, rax
call fcn.140009c70
mov rcx, rbx
mov qword [0x1401578d8], rax
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rax, qword [0x1401578d8]
test rax, rax
jne 0x140003c4b
lea rdx, str.Win32:_Failed_to_convert_wide_string_to_UTF_8
mov ecx, 0x10008
call fcn.140004d20
xor eax, eax
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
mov rcx, qword [0x140156be0]
jmp 0x1400017d0
Function at 0x14009d580
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rdx + 0x18], 0xf
mov rsi, rcx
mov r9, rdx
jbe 0x14009d59f
mov r9, qword [rdx]
mov r10, qword [rdx + 0x10]
xor r8d, r8d
movabs rdi, 0xcbf29ce484222325
test r10, r10
je 0x14009d5d4
movabs rcx, 0x100000001b3
nop
movzx eax, byte [r8 + r9]
inc r8
xor rdi, rax
imul rdi, rcx
cmp r8, r10
jb 0x14009d5c0
mov r8, rdx
mov r9, rdi
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.1400a9000
mov rbx, qword [rax + 8]
test rbx, rbx
je 0x14009d674
mov rdx, qword [rsi + 0x30]
and rdx, rdi
shl rdx, 4
add rdx, qword [rsi + 0x18]
mov rax, qword [rdx]
cmp qword [rdx + 8], rbx
jne 0x14009d628
cmp rax, rbx
jne 0x14009d61e
mov rax, qword [rsi + 8]
mov qword [rdx], rax
mov qword [rdx + 8], rax
jmp 0x14009d633
mov rax, qword [rbx + 8]
mov qword [rdx + 8], rax
jmp 0x14009d633
cmp rax, rbx
jne 0x14009d633
mov rax, qword [rbx]
mov qword [rdx], rax
mov rdx, qword [rbx]
lea rcx, [rbx + 0x10]
dec qword [rsi + 0x10]
mov rax, qword [rbx + 8]
mov qword [rax], rdx
mov rax, qword [rbx + 8]
mov qword [rdx + 8], rax
call fcn.1400672b0
mov edx, 0x38
mov rcx, rbx
call fcn.14010a7a8
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x40]
xor eax, eax
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x1400a14f0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x30
mov rbx, rcx
mov ecx, 1
call fcn.14010ab80
mov qword [rsp + 0x48], rax
lea rdi, [rbx + 8]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x1400ae240]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbx], rax
test rax, rax
je 0x1400a154c
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov dword [rdi], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3

Function at 0x1400a1760
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x30
mov rbx, rcx
mov ecx, 1
call fcn.14010ab80
mov qword [rsp + 0x48], rax
lea rdi, [rbx + 8]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x1400ae2e0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbx], rax
test rax, rax
je 0x1400a17bc
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov dword [rdi], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3

Function at 0x1400a17d0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x30
mov rbx, rcx
mov ecx, 1
call fcn.14010ab80
mov qword [rsp + 0x48], rax
lea rdi, [rbx + 8]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x1400ae360]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbx], rax
test rax, rax
je 0x1400a182c
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov dword [rdi], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3

Function at 0x1400a18b0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x30
mov rbx, rcx
mov ecx, 1
call fcn.14010ab80
mov qword [rsp + 0x48], rax
lea rdi, [rbx + 8]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x1400ae390]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbx], rax
test rax, rax
je 0x1400a190c
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov dword [rdi], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x1400a1920
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rbx, rdx
mov rdi, rcx
xor esi, esi
lea ecx, [rsi + 0x40]
call fcn.14010ab80
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rsi
movups xmm0, xmmword [rbx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rax + 0x10], xmm1
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
xorps xmm0, xmm0
movups xmmword [rax + 0x20], xmm0
mov qword [rax + 0x30], rsi
mov qword [rax + 0x38], rsi
movups xmm0, xmmword [rbx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rbx + 0x30]
movups xmmword [rax + 0x30], xmm1
mov qword [rbx + 0x30], rsi
mov qword [rbx + 0x38], reloc.WS2_32.dll_ntohs
mov byte [rbx + 0x20], sil
mov qword [rsp + 0x40], rax
lea rbx, [rdi + 8]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], esi
mov r9, rax
lea r8, [0x1400ae450]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rdi], rax
test rax, rax
je 0x1400a19da
mov rax, rdi
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov dword [rbx], esi
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3

Function at 0x1400a19f0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x30
mov rbx, rcx
mov ecx, 1
call fcn.14010ab80
mov qword [rsp + 0x48], rax
lea rdi, [rbx + 8]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x1400ae490]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbx], rax
test rax, rax
je 0x1400a1a4c
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov dword [rdi], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3

Function at 0x1400a1a60
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rbx, rdx
mov rdi, rcx
xor esi, esi
lea ecx, [rsi + 0x20]
call fcn.14010ab80
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rsi
movups xmm0, xmmword [rbx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rax + 0x10], xmm1
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
mov qword [rsp + 0x40], rax
lea rbx, [rdi + 8]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], esi
mov r9, rax
lea r8, [0x1400ae510]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rdi], rax
test rax, rax
je 0x1400a1aeb
mov rax, rdi
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov dword [rbx], esi
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x1400b67b0
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x50
mov rbx, rcx
movss dword [rcx + 8], xmm1
movss dword [rcx + 0xc], xmm1
xorps xmm0, xmm0
ucomiss xmm1, xmm0
jp 0x1400b67cd
je 0x1400b67d4
divss xmm1, xmm1
movaps xmm0, xmm1
movss dword [rcx + 4], xmm0
cmp byte [rcx], 0
jne 0x1400b6844
mov byte [rcx], 1
mov ecx, 8
call fcn.14010ab80
mov qword [rax], rbx
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x1400b68b0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1400b6856
cmp dword [rsp + 0x38], 0
je 0x1400b684a
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x1400b684a
add rsp, 0x50
pop rbx
ret
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x38], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x1400b6ea0
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r14, rdx
mov rbx, rcx
xor ebp, ebp
mov dword [rsp + 0x20], ebp
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], rbp
mov qword [rcx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rcx], bpl
mov dword [rsp + 0x20], 1
lea r15d, [rbp - 6]
mov r13d, ebp
cmp qword [rdx + 0x10], r13
jbe 0x1400b7003
mov r12d, ebp
nop dword [rax + rax]
mov rax, r14
cmp qword [r14 + 0x18], 0xf
jbe 0x1400b6f0d
mov rax, qword [r14]
movsx eax, byte [r12 + rax]
shl ebp, 8
add eax, ebp
movsxd rbp, eax
add r15d, 8
js 0x1400b6f9a
mov r8, rbp
movsxd rdi, r15d
lea ecx, [r15 + 6]
mov eax, 0xaaaaaaab
mul ecx
shr edx, 2
mov esi, edx
imul eax, edx, 0xfffffffa
add r15d, eax
lea r14, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
mov rax, r8
mov rcx, rdi
sar rax, cl
and eax, 0x3f
movzx r9d, byte [rax + r14]
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x1400b6f80
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0xf
jbe 0x1400b6f75
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x1400b6f8b
mov rcx, rbx
call fcn.1400a3e80
mov r8, rbp
sub rdi, 6
sub rsi, 1
jne 0x1400b6f43
mov r14, qword [rsp + 0x78]
inc r13d
inc r12
movsxd rax, r13d
cmp rax, qword [r14 + 0x10]
jb 0x1400b6f00
cmp r15d, 0xfffffffa
jle 0x1400b7003
lea ecx, [r15 + 8]
shl ebp, 8
movsxd rax, ebp
sar rax, cl
and eax, 0x3f
lea r9, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
movzx r9d, byte [rax + r9]
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x1400b6ffb
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0xf
jbe 0x1400b6ff0
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x1400b7003
mov rcx, rbx
call fcn.1400a3e80
mov rax, qword [rbx + 0x10]
test al, 3
je 0x1400b7048
nop dword [rax + rax]
mov rdx, qword [rbx + 0x18]
cmp rax, rdx
jae 0x1400b7035
lea rcx, [rax + 1]
mov qword [rbx + 0x10], rcx
mov rcx, rbx
cmp rdx, 0xf
jbe 0x1400b702d
mov rcx, qword [rbx]
mov word [rcx + rax], 0x3d
jmp 0x1400b7040
mov r9b, 0x3d
mov rcx, rbx
call fcn.1400a3e80
mov rax, qword [rbx + 0x10]
test al, 3
jne 0x1400b7010
mov rax, rbx
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400b8460
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x80
mov rbx, rcx
xor edi, edi
cmp qword [rcx + 0x18], 0xf
jbe 0x1400b847c
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1400b8639
mov rcx, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x1400b8498
mov rcx, qword [rbx]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x1400b8579
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1400b8579
mov rcx, qword [rbx + 0x10]
movabs rax, 0x7fffffffffffffff
sub rax, rcx
cmp rax, 0xc
jb 0x1400b8656
cmp qword [rbx + 0x18], 0xf
jbe 0x1400b84de
mov rbx, qword [rbx]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], recv
lea r9, str.Folder_path
lea rcx, [rsp + 0x60]
call fcn.1400a5810
nop
mov r8d, 0x23
lea rdx, str._not_found_and_couldnt_be_created.
lea rcx, [rsp + 0x60]
call fcn.1400a0230
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rdi
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rdx, [rsp + 0x40]
mov ecx, recv
call fcn.1400c9320
nop
lea rcx, [rsp + 0x60]
call fcn.1400672b0
xor al, al
mov rbx, qword [rsp + 0x98]
add rsp, 0x80
pop rdi
ret
mov rcx, qword [rbx + 0x10]
movabs rax, 0x7fffffffffffffff
sub rax, rcx
cmp rax, 0xc
jb 0x1400b8650
cmp qword [rbx + 0x18], 0xf
jbe 0x1400b859e
mov rbx, qword [rbx]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], recv
lea r9, str.Folder_path
lea rcx, [rsp + 0x60]
call fcn.1400a5810
nop
mov r8d, reloc.WS2_32.dll_select
lea rdx, str._found_or_created.
lea rcx, [rsp + 0x60]
call fcn.1400a0230
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rdi
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rdx, [rsp + 0x40]
mov ecx, recv
call fcn.1400c9320
nop
lea rcx, [rsp + 0x60]
call fcn.1400672b0
mov al, 1
mov rbx, qword [rsp + 0x98]
add rsp, 0x80
pop rdi
ret
test al, 0x10
je 0x1400b863f
mov al, 1
mov rbx, qword [rsp + 0x98]
add rsp, 0x80
pop rdi
ret
call fcn.1400668e0
int3
call fcn.1400668e0
int3