joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001182f
Capabilities:
Parse pe header

Disassembly:
jmp 0x140028a20
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140028a40
xor al, al
jmp 0x140028ac1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140028a53
xor al, al
jmp 0x140028ac1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140028a7d
xor al, al
jmp 0x140028ac1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140028a91
xor al, al
jmp 0x140028ac1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140028aa3
xor al, al
jmp 0x140028ac1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140028abf
xor al, al
jmp 0x140028ac1
mov al, 1
add rsp, 0x38
ret
Function at 0x140011b8b
Capabilities:
Copy file

Disassembly:
jmp 0x14001f960
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rcx, [0x14004619a]
call fcn.140011bcc
xor r8d, r8d
mov rdx, qword [rbp + 0x108]
mov rcx, qword [rbp + 0x100]
call qword [sym.imp.KERNEL32.dll_CopyFileA]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
je 0x14001f9b7
lea rdx, str.___Successfully_transfered_file__n
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011168
cmp dword [rbp + 4], 0
jbe 0x14001f9c9
mov dword [rbp + 0xd4], 1
jmp 0x14001f9d3
mov dword [rbp + 0xd4], 0
mov eax, dword [rbp + 0xd4]
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret
Function at 0x140011bae
Capabilities:
Write file on windows

Disassembly:
jmp 0x14001fe20
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1e8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x3e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x208]
mov rax, qword [0x14003b018]
xor rax, rbp
mov qword [rbp + 0x1a0], rax
lea rcx, [0x140046190]
call fcn.140011bcc
mov rax, qword [rbp + 0x1d0]
cmp qword [rax + 0x68], 0
je 0x14001fe86
mov rax, qword [rbp + 0x1d0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x14001fe8d
mov al, 1
jmp 0x14001ffe7
call fcn.14001133e
mov rcx, qword [rbp + 0x1d0]
mov rcx, qword [rcx]
mov qword [rbp + 0x198], rcx
mov edx, eax
mov rcx, qword [rbp + 0x1d0]
mov rax, qword [rbp + 0x198]
call qword [rax + 0x18]
mov dword [rbp + 0x164], eax
call fcn.14001133e
mov dword [rbp + 0x184], eax
lea rdx, [rbp + 0x164]
lea rcx, [rbp + 0x184]
call fcn.1400119ec
movzx eax, al
test eax, eax
je 0x14001fee8
xor al, al
jmp 0x14001ffe7
mov qword [rbp + 8], 0x20
lea rax, [rbp + 0x48]
mov rcx, qword [rbp + 0x1d0]
add rcx, 0x74
lea rdx, [rbp + 0x68]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rbp + 0x28]
mov rdx, rcx
mov rax, qword [rbp + 0x1d0]
mov rcx, qword [rax + 0x68]
call qword [sym.imp.MSVCP140D.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rbp + 0x194], eax
cmp dword [rbp + 0x194], 0
je 0x14001ff4d
cmp dword [rbp + 0x194], 1
je 0x14001ff58
cmp dword [rbp + 0x194], 3
je 0x14001ffd6
jmp 0x14001ffe5
mov rax, qword [rbp + 0x1d0]
mov byte [rax + 0x71], 0
lea rax, [rbp + 0x28]
mov rcx, qword [rbp + 0x68]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0
jbe 0x14001ffa8
mov rax, qword [rbp + 0x1d0]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x88]
mov edx, 1
lea rcx, [rbp + 0x28]
call qword [sym.imp.ucrtbased.dll_fwrite]
cmp qword [rbp + 0x88], rax
je 0x14001ffa8
xor al, al
jmp 0x14001ffe7
mov rax, qword [rbp + 0x1d0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x14001ffc3
mov dword [rbp + 0x194], 1
jmp 0x14001ffcd
mov dword [rbp + 0x194], 0
movzx eax, byte [rbp + 0x194]
jmp 0x14001ffe7
mov rax, qword [rbp + 0x1d0]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x14001ffe7
xor al, al
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x140033600]
call fcn.1400119c9
mov rax, rdi
mov rcx, qword [rbp + 0x1a0]
xor rcx, rbp
call fcn.1400115c3
lea rsp, [rbp + 0x1b8]
pop rdi
pop rbp
ret
Function at 0x140003370
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x47], 0
je 0x140003393
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x5e]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x46
jb 0x140003380
mov byte [rcx + 0x47], 0
mov rax, rcx
ret

Function at 0x1400033a0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x68], rcx
xor esi, esi
cmp byte [r8 + 6], sil
je 0x1400033d4
mov ecx, esi
lea eax, [rcx + 0x5e]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 5
jb 0x1400033c0
mov byte [r8 + 6], sil
lea rax, [r8 + 5]
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x48], sil
cmp r9, rax
je 0x140003409
mov r8d, 5
mov rdx, r9
lea rcx, [rsp + 0x48]
call fcn.140008080
nop
cmp byte [rbx + 0xa], 0
je 0x140003433
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x5e]
xor byte [rcx + rbx], al
inc rcx
cmp rcx, 9
jb 0x140003420
mov byte [rbx + 0xa], 0
lea rax, [rbx + 9]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], 0
cmp rbx, rax
je 0x140003468
mov r8d, 9
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.140008080
nop
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x28]
mov rcx, rdi
call fcn.14000a340
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x1400034bc
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400034b6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400034b6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c0cec
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x1400034fc
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400034f7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400034f7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c0cec
mov rax, rdi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x140003510
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x48], rcx
xor esi, esi
cmp byte [r8 + 7], sil
je 0x140003544
mov ecx, esi
lea eax, [rcx + 0x5e]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 6
jb 0x140003530
mov byte [r8 + 7], sil
lea rax, [r8 + 6]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], sil
cmp r9, rax
je 0x140003579
mov r8d, 6
mov rdx, r9
lea rcx, [rsp + 0x28]
call fcn.140008080
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140003587
mov rbx, qword [rbx]
mov r8, rbx
lea rcx, [rsp + 0x28]
call fcn.14000b1f0
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x1400035fc
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400035f7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400035f7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c0cec
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x140003610
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x48], rcx
xor esi, esi
cmp byte [r8 + 0xa], sil
je 0x140003644
mov ecx, esi
lea eax, [rcx + 0x5e]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 9
jb 0x140003630
mov byte [r8 + 0xa], sil
lea rax, [r8 + 9]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], sil
cmp r9, rax
je 0x140003679
mov r8d, 9
mov rdx, r9
lea rcx, [rsp + 0x28]
call fcn.140008080
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140003687
mov rbx, qword [rbx]
mov r8, rbx
lea rcx, [rsp + 0x28]
call fcn.14000b1f0
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x1400036fc
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400036f7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400036f7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c0cec
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x140003710
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x136], 0
je 0x140003738
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x5e]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x135
jb 0x140003720
mov byte [rcx + 0x136], 0
mov rax, rcx
ret
Function at 0x140003770
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x48], rcx
xor esi, esi
cmp byte [r8 + 0xc], sil
je 0x1400037a4
mov ecx, esi
lea eax, [rcx + 0x5e]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 0xb
jb 0x140003790
mov byte [r8 + 0xc], sil
lea rax, [r8 + 0xb]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], sil
cmp r9, rax
je 0x1400037d9
mov r8d, listen
mov rdx, r9
lea rcx, [rsp + 0x28]
call fcn.140008080
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x1400037e7
mov rbx, qword [rbx]
mov r8, rbx
lea rcx, [rsp + 0x28]
call fcn.14000b1f0
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x14000385c
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003857
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003857
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c0cec
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x140003de0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x68], rcx
xor esi, esi
cmp byte [r8 + 6], sil
je 0x140003e14
mov ecx, esi
lea eax, [rcx + 0x5e]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 5
jb 0x140003e00
mov byte [r8 + 6], sil
lea rax, [r8 + 5]
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x48], sil
cmp r9, rax
je 0x140003e49
mov r8d, 5
mov rdx, r9
lea rcx, [rsp + 0x48]
call fcn.140008080
nop
cmp byte [rbx + 0xd], 0
je 0x140003e73
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x5e]
xor byte [rcx + rbx], al
inc rcx
cmp rcx, 0xc
jb 0x140003e60
mov byte [rbx + 0xd], 0
lea rax, [rbx + 0xc]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], 0
cmp rbx, rax
je 0x140003ea8
mov r8d, listen
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.140008080
nop
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x28]
mov rcx, rdi
call fcn.14000a340
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x140003efc
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003ef6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003ef6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c0cec
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x140003f3c
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003f37
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003f37
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c0cec
mov rax, rdi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x140004390
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x68], rcx
xor esi, esi
cmp byte [r8 + 0xc], sil
je 0x1400043c4
mov ecx, esi
lea eax, [rcx + 0x5e]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 0xb
jb 0x1400043b0
mov byte [r8 + 0xc], sil
lea rax, [r8 + 0xb]
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x48], sil
cmp r9, rax
je 0x1400043f9
mov r8d, listen
mov rdx, r9
lea rcx, [rsp + 0x48]
call fcn.140008080
nop
cmp byte [rbx + 9], 0
je 0x140004423
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x5e]
xor byte [rcx + rbx], al
inc rcx
cmp rcx, 8
jb 0x140004410
mov byte [rbx + 9], 0
lea rax, [rbx + 8]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], 0
cmp rbx, rax
je 0x140004458
mov r8d, 8
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.140008080
nop
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x28]
mov rcx, rdi
call fcn.14000a340
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x1400044ac
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400044a6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400044a6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c0cec
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x1400044ec
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400044e7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400044e7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c0cec
mov rax, rdi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x140004b80
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x68], rcx
xor esi, esi
cmp byte [r8 + 7], sil
je 0x140004bb4
mov ecx, esi
lea eax, [rcx + 0x5e]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 6
jb 0x140004ba0
mov byte [r8 + 7], sil
lea rax, [r8 + 6]
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x48], sil
cmp r9, rax
je 0x140004be9
mov r8d, 6
mov rdx, r9
lea rcx, [rsp + 0x48]
call fcn.140008080
nop
cmp byte [rbx + 0x14], 0
je 0x140004c13
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x5e]
xor byte [rcx + rbx], al
inc rcx
cmp rcx, 0x13
jb 0x140004c00
mov byte [rbx + 0x14], 0
lea rax, [rbx + 0x13]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], 0
cmp rbx, rax
je 0x140004c48
mov r8d, reloc.WS2_32.dll_send
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.140008080
nop
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x28]
mov rcx, rdi
call fcn.14000a340
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x140004c9c
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004c96
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004c96
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c0cec
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x140004cdc
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004cd7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004cd7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c0cec
mov rax, rdi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x140005200
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x68], rcx
xor esi, esi
cmp byte [r8 + 9], sil
je 0x140005234
mov ecx, esi
lea eax, [rcx + 0x5e]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 8
jb 0x140005220
mov byte [r8 + 9], sil
lea rax, [r8 + 8]
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x48], sil
cmp r9, rax
je 0x140005269
mov r8d, 8
mov rdx, r9
lea rcx, [rsp + 0x48]
call fcn.140008080
nop
cmp byte [rbx + 9], 0
je 0x140005293
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x5e]
xor byte [rcx + rbx], al
inc rcx
cmp rcx, 8
jb 0x140005280
mov byte [rbx + 9], 0
lea rax, [rbx + 8]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], 0
cmp rbx, rax
je 0x1400052c8
mov r8d, 8
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.140008080
nop
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x28]
mov rcx, rdi
call fcn.14000a340
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x14000531c
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005316
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005316
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c0cec
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x14000535c
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005357
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005357
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c0cec
mov rax, rdi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x14001be80
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x1401092c8]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x140109810]
mov esi, edx
mov edi, ecx
cmp byte [rbx + 0x20d5], 0
jne 0x14001bee7
cmp byte [rbx + 0x20d6], 0
jne 0x14001bee7
mov r9d, dword [rbx + 0x3178]
lea r8, str.Tooltip__02d
mov edx, reloc.WS2_32.dll_recv
lea rcx, [rsp + 0x20]
call fcn.140028f00
test sil, 1
je 0x14001c01c
jmp 0x14001bf86
movss xmm1, dword [rbx + 0x16ec]
lea r8, str.Tooltip__02d
movaps xmm0, xmm1
lea rcx, [rsp + 0x20]
mulss xmm0, dword [0x1400c59d4]
xor eax, eax
mov edx, reloc.WS2_32.dll_recv
mulss xmm1, dword [0x1400c59c8]
addss xmm0, dword [rbx + 0x120]
addss xmm1, dword [rbx + 0x124]
or dword [rbx + 0x1dc0], 1
mov qword [rbx + 0x1ddc], rax
movss dword [rbx + 0x1dd4], xmm0
mov dword [rbx + 0x1dc4], 1
movss dword [rbx + 0x1dd8], xmm1
mov byte [rbx + 0x1dfc], 1
movss xmm0, dword [rbx + 0x1748]
mov rax, qword [0x140109810]
mulss xmm0, dword [0x1400c595c]
or dword [rax + 0x1dc0], 0x40
movss dword [rax + 0x1e20], xmm0
mov r9d, dword [rbx + 0x3178]
call fcn.140028f00
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x14001bfd6
lea r11, [0x1400c4d80]
cmp r9b, 0x23
jne 0x14001bfb9
cmp byte [r8], r9b
jne 0x14001bfb9
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x14001bfa6
not ecx
call fcn.140027750
test rax, rax
je 0x14001c01c
cmp byte [rax + 0xcf], 0
je 0x14001c01c
mov byte [rax + 0xd6], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xf0], 1
lea rcx, [rsp + 0x20]
inc dword [rbx + 0x3178]
mov edx, reloc.WS2_32.dll_recv
mov r9d, dword [rbx + 0x3178]
call fcn.140028f00
or edi, 0x22c0347
lea rcx, [rsp + 0x20]
mov r8d, edi
xor edx, edx
call fcn.140018200
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400c12f0
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x1400275b0
Capabilities:
Hash data with crc32

Disassembly:
push rbx
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10d, 0xffffffff
mov rbx, rcx
mov eax, r10d
test r9b, r9b
je 0x140027602
lea r11, [0x1400c4d80]
cmp r9b, 0x23
jne 0x1400275e5
cmp byte [r8], r9b
jne 0x1400275e5
cmp byte [r8 + 1], r9b
cmove eax, r10d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [r11 + rdx*4]
test r9b, r9b
jne 0x1400275d2
mov r11, qword [0x140109810]
mov r10, qword [r11 + 0x3228]
test r10, r10
je 0x140027649
lea r9, [r10 + 4]
test r9, r9
je 0x140027649
not eax
cmp dword [r9], eax
je 0x140027652
movsxd r8, dword [r9 - 4]
movsxd rdx, dword [r11 + 0x3220]
add r8, r9
add rdx, 4
xor r9d, r9d
add rdx, r10
cmp r8, rdx
cmovne r9, r8
test r9, r9
jne 0x140027620
mov rcx, rbx
pop rbx
jmp fcn.14001dc30
mov rax, r9
pop rbx
ret

Function at 0x1400277d0
Capabilities:
Hash data with crc32

Disassembly:
mov rax, rcx
mov r10d, 0xffffffff
mov ecx, r10d
movzx r9d, byte [rax]
lea r8, [rax + 1]
test r9b, r9b
je 0x140027820
lea r11, [0x1400c4d80]
cmp r9b, 0x23
jne 0x140027803
cmp byte [r8], r9b
jne 0x140027803
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x1400277f0
not ecx
jmp fcn.140027750

Function at 0x140028200
Capabilities:
Hash data with crc32

Disassembly:
mov rax, qword [rcx + 0x110]
mov r9, r8
movsxd r8, dword [rcx + 0x108]
mov r10, rdx
xor ecx, ecx
mov rdx, r9
sub rdx, r10
test r9, r9
mov r8d, dword [rax + r8*4 - 4]
cmove rdx, rcx
mov rcx, r10
jmp fcn.140029050

Function at 0x140029050
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x1400290ad
lea rbx, [0x1400c4d80]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x140029094
cmp r10, 2
jb 0x140029094
cmp byte [r9], r8b
jne 0x140029094
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x140029070
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x1400290ef
lea rbx, [0x1400c4d80]
cmp r8b, 0x23
jne 0x1400290d3
cmp byte [r9], r8b
jne 0x1400290d3
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x1400290c0
mov rbx, qword [rsp + 8]
not eax
ret