joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401aac20
Capabilities:
Reference sql statements

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
lea rax, str.SELECT_parentnode_FROM__Q._q_parent_WHERE_nodeno_1
movsxd r12, edx
mov qword [rsp + 0x40], rax
mov rbx, rcx
mov rsi, r8
lea rax, str.SELECT_nodeno_FROM__Q._q_rowid_WHERE_rowid_1
cmp qword [rcx + r12*8 + 0x28], 0
mov rbp, r12
mov rdi, r9
mov qword [rsp + 0x48], rax
lea r13, [r12 + 4]
jne 0x1401aac77
mov rdx, qword [rsp + r12*8 + 0x40]
mov r9, qword [rcx + 0x10]
mov r8, qword [rcx + 8]
call fcn.1401ab0b0
mov qword [rbx + r13*8 + 8], rax
cmp dword [rbx + 0x40], 0
jne 0x1401aad30
mov r12, qword [rbx + r12*8 + 0x28]
mov r8, rsi
mov edx, 1
mov rcx, r12
call fcn.1401f6d90
mov rcx, r12
call fcn.1401fc730
cmp eax, 0x65
jne 0x1401aacd3
test ebp, ebp
lea rdx, str.__parent
mov r9, rdi
mov r8, rsi
lea rax, str.__rowid
mov rcx, rbx
cmove rax, rdx
lea rdx, str.Mapping___lld_____lld__missing_from__s_table
mov qword [rsp + 0x20], rax
call fcn.1401aab20
jmp 0x1401aad1f
cmp eax, 0x64
jne 0x1401aad1f
xor edx, edx
mov rcx, r12
call fcn.1401f7c60
mov r9, rax
cmp rax, rdi
je 0x1401aad1f
lea rdx, str.__parent
test ebp, ebp
mov r8, rsi
mov rcx, rbx
lea rax, str.__rowid
mov qword [rsp + 0x30], rdi
cmove rax, rdx
mov qword [rsp + 0x28], rsi
lea rdx, str.Found___lld_____lld__in__s_table__expected___lld_____lld_
mov qword [rsp + 0x20], rax
call fcn.1401aab20
mov rcx, r12
call fcn.1401fb9b0
cmp dword [rbx + 0x40], 0
jne 0x1401aad30
mov dword [rbx + 0x40], eax
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
Function at 0x1401c96f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
mov eax, ecx
mov r8d, edx
cmp ecx, 0x7f
jg 0x1401c970f
lea edx, [rcx - 0x41]
cmp edx, 0x19
ja 0x1401c97b0
add eax, 0x20
jmp 0x1401c97b0
cmp ecx, 0xffff
jg 0x1401c97a2
or rdx, 0xffffffffffffffff
xor r11d, r11d
mov r10d, 0xa2
lea r9, [0x14029af80]
lea ecx, [r10 + r11]
sar ecx, 1
movsxd rbx, ecx
movzx ebx, word [r9 + rbx*4]
cmp eax, ebx
js 0x1401c974a
lea r11d, [rcx + 1]
movsxd rdx, ecx
jmp 0x1401c974e
lea r10d, [rcx - 1]
cmp r11d, r10d
jle 0x1401c972f
movzx ecx, word [r9 + rdx*4]
movzx r10d, byte [r9 + rdx*4 + 3]
add r10d, ecx
cmp eax, r10d
jge 0x1401c978c
mov dl, byte [r9 + rdx*4 + 2]
xor ecx, eax
mov r9d, edx
and r9d, 1
test r9d, ecx
jne 0x1401c978c
shr dl, 1
lea rcx, [0x14029e6c0]
and edx, 0x7f
add ax, word [rcx + rdx*2]
movzx eax, ax
test r8d, r8d
je 0x1401c97b0
xor edx, edx
cmp r8d, 2
mov ecx, eax
sete dl
pop rbx
jmp fcn.1401a5ee0
lea edx, [rcx - 0x10400]
cmp edx, 0x27
ja 0x1401c97b0
add eax, 0x28
pop rbx
ret
Function at 0x1402065e0
Capabilities:
Create thread

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
xor r12d, r12d
xor esi, esi
movzx ebp, byte [rcx + 0x5b]
dec ebp
mov byte [rcx + 0x58], 1
mov rbx, rcx
cmp esi, ebp
jge 0x1402066d8
movzx eax, byte [rbx + 0x5a]
lea eax, [rsi + rax + 1]
cdq
idiv ebp
movsxd rdi, edx
imul rax, rdi, 0x68
cmp dword [rbx + rax + 0x68], 0
lea r12, [rbx + rax + 0x60]
jne 0x140206632
imul rdi, rdi, 0x68
cmp qword [rbx + rdi + 0x60], 0
je 0x140206643
inc esi
jmp 0x1402065fc
mov rcx, r12
call fcn.140206730
test eax, eax
je 0x140206622
jmp 0x1402066fd
lea rdx, [rbx + 0x60]
mov rax, r12
mov rcx, qword [r12 + 0x28]
movups xmm0, xmmword [rbx + 0x38]
sub rax, rdx
movabs rdx, 0x4ec4ec4ec4ec4ec5
sar rax, 3
imul rax, rdx
mov byte [rbx + 0x5a], al
mov rax, qword [rbx + 0x48]
movups xmmword [r12 + 0x20], xmm0
mov qword [r12 + 0x30], rax
mov qword [rbx + 0x38], 0
mov dword [rbx + 0x48], 0
test rcx, rcx
je 0x14020669c
mov qword [rbx + 0x40], rcx
call fcn.1401cfff0
mov dword [rbx + 0x54], eax
jmp 0x1402066b5
cmp qword [rbx + 0x40], 0
je 0x1402066b5
movsxd rcx, dword [rbx + 0x54]
call fcn.1401cfe80
mov qword [rbx + 0x40], rax
test rax, rax
je 0x1402066d1
mov r8, r12
lea rdx, [0x140206710]
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp fcn.1401e2790
mov eax, 7
jmp 0x1402066fd
jne 0x140206643
movsxd rsi, esi
lea rdx, [rbx + 0x38]
imul rsi, rsi, 0x68
lea rcx, [rbx + rsi + 0x60]
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp fcn.1402067b0
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x140211fb0
Capabilities:
Encode data using xor

Disassembly:
push rbx
xor r11d, r11d
movsxd rax, dword [rcx + 0xc]
mov r9, rdx
xor edx, edx
lea r10d, [rax + 1]
add rax, qword [rcx]
mov bl, byte [r9 + rdx]
xor byte [rax], bl
movsxd rax, r10d
cmp dword [rcx + 8], r10d
cmovle rax, r11
inc rdx
cmp r8d, edx
jg 0x140211fbd
add dword [rcx + 0x10], r8d
mov dword [rcx + 0xc], eax
pop rbx
ret
Function at 0x140003560
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x1400bb0c0]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov r15d, ecx
lea rcx, [rdx + 0x20]
call fcn.140003510
mov r14, rax
lea rdx, [rax + 0x18]
call fcn.1400283b0
mov rdx, qword [0x1400bc9f0]
mov rdi, rax
lea rcx, [rax + 0x16]
mov r8, qword [rdx + 0x30]
shr rcx, 7
movzx edx, al
and ecx, 7
add rdx, 0x16
lea rbx, [r8 + 0x7bbf72]
and edx, 0x7f
add r8, 0x391d900
lea rbp, [rbx + 8]
add rcx, r8
lea rdx, [rcx + rdx*8]
call fcn.1400283b0
movabs rcx, 0xca9752806442c016
mov rsi, rax
add rcx, rdi
xor rsi, rcx
xor rsi, rbx
cmp rbx, rbp
jae 0x14000360a
mov rdx, rbx
call fcn.1400283b0
xor rsi, rax
add rbx, 8
cmp rbx, rbp
jb 0x1400035f6
xor esi, ebp
lea rcx, [r14 + 0x10]
xor esi, r15d
lea rax, [rcx - 0x10000]
xor esi, 0x9bbd3fe9
movabs rdx, 0x7ffffffeffff
mov dword [rsp + 0x40], esi
cmp rax, rdx
ja 0x140003686
lea rax, [rsp + 0x40]
mov qword [rsp + 0x50], rcx
mov rcx, qword [0x1400bca20]
lea r8, [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov r9d, Ordinal_41
xor eax, eax
mov qword [rsp + 0x60], 4
mov qword [rsp + 0x38], rax
mov edx, 0x221a60
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x48]
mov dword [rsp + Ordinal_41], 0x28
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140099e60
mov rbx, qword [rsp + 0xc0]
add rsp, 0x80
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14002b4c0
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x20
lea rcx, str.Started__n
call fcn.140001c10
xor r8d, r8d
lea rcx, [0x140007b60]
xor edx, edx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthread]
mov ecx, reloc.WLDAP32.dll_Ordinal_50
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r8d, r8d
lea rcx, [0x140007b80]
xor edx, edx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthread]
xor r8d, r8d
lea rcx, [0x140009a40]
xor edx, edx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthread]
xor r8d, r8d
lea rcx, [0x140009c70]
xor edx, edx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthread]
xor r8d, r8d
lea rcx, [0x14001f220]
xor edx, edx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthread]
movabs rbx, 0x12a153440
lea rcx, [rsp + 0x30]
call fcn.140001e30
mov rcx, qword [rax]
sub rcx, qword [0x1400bca08]
cmp rcx, rbx
jl 0x14002b578
lea rcx, str.entity_scan_thread_n
call fcn.140001c10
xor r8d, r8d
lea rcx, [0x140007b60]
xor edx, edx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthread]
lea rcx, [rsp + 0x38]
call fcn.140001e30
mov rcx, qword [rax]
sub rcx, qword [0x1400bca28]
cmp rcx, rbx
jl 0x14002b5af
lea rcx, str.entity_thread_n
call fcn.140001c10
xor r8d, r8d
lea rcx, [0x140007b80]
xor edx, edx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthread]
lea rcx, [rsp + 0x40]
call fcn.140001e30
mov rcx, qword [rax]
sub rcx, qword [0x1400bc9d0]
cmp rcx, rbx
jl 0x14002b5e6
lea rcx, str.aimbot_thread_n
call fcn.140001c10
xor r8d, r8d
lea rcx, [0x140009c70]
xor edx, edx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthread]
lea rcx, [rsp + 0x48]
call fcn.140001e30
mov rcx, qword [rax]
sub rcx, qword [0x1400bc9d8]
cmp rcx, rbx
jl 0x14002b61d
lea rcx, str.viewmatrix_thread_n
call fcn.140001c10
xor r8d, r8d
lea rcx, [0x140009a40]
xor edx, edx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthread]
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14002b541
Function at 0x14002eab0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 7], sil
je 0x14002eae4
mov eax, esi
lea ecx, [rax - 0x6a]
xor byte [r8 + rax], cl
inc rax
cmp rax, 6
jb 0x14002ead0
mov byte [r8 + 7], sil
add r8, 6
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.14002deb0
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x14002eb09
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140042c60
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x14002eb83
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002eb7e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002eb7e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140099e80
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x14002eb90
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 9], sil
je 0x14002ebc4
mov eax, esi
lea ecx, [rax - 0x6a]
xor byte [r8 + rax], cl
inc rax
cmp rax, 8
jb 0x14002ebb0
mov byte [r8 + 9], sil
add r8, 8
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.14002deb0
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x14002ebe9
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140042c60
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x14002ec63
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002ec5e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002ec5e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140099e80
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x14002ec70
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 0xa], sil
je 0x14002eca4
mov eax, esi
lea ecx, [rax - 0x6a]
xor byte [r8 + rax], cl
inc rax
cmp rax, 9
jb 0x14002ec90
mov byte [r8 + 0xa], sil
add r8, 9
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.14002deb0
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x14002ecc9
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140042c60
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x14002ed43
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002ed3e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002ed3e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140099e80
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x14002ed50
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 0x31], sil
je 0x14002ed84
mov eax, esi
lea ecx, [rax - 0x6a]
xor byte [r8 + rax], cl
inc rax
cmp rax, 0x30
jb 0x14002ed70
mov byte [r8 + 0x31], sil
add r8, 0x30
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.14002deb0
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x14002eda9
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140042c60
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x14002ee23
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002ee1e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002ee1e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140099e80
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x14002ee30
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 0xc], sil
je 0x14002ee64
mov eax, esi
lea ecx, [rax - 0x6a]
xor byte [r8 + rax], cl
inc rax
cmp rax, 0xb
jb 0x14002ee50
mov byte [r8 + 0xc], sil
add r8, 0xb
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.14002deb0
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x14002ee89
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140042c60
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x14002ef03
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002eefe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002eefe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140099e80
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x140038870
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
mov rdx, rcx
cmp byte [rcx + 8], al
je 0x1400388a3
nop dword [rax]
nop word [rax + rax]
lea ecx, [rax - 0x6a]
xor byte [rdx + rax], cl
inc rax
cmp rax, 7
jb 0x140038890
mov byte [rdx + 8], 0
lea r8, [rdx + 7]
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.14002deb0
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x1400388c0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
mov rdx, rcx
cmp byte [rcx + 9], al
je 0x1400388f3
nop dword [rax]
nop word [rax + rax]
lea ecx, [rax - 0x6a]
xor byte [rdx + rax], cl
inc rax
cmp rax, 8
jb 0x1400388e0
mov byte [rdx + 9], 0
lea r8, [rdx + 8]
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.14002deb0
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x140038910
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
mov rdx, rcx
cmp byte [rcx + 0x10], al
je 0x140038943
nop dword [rax]
nop word [rax + rax]
lea ecx, [rax - 0x6a]
xor byte [rdx + rax], cl
inc rax
cmp rax, 0xf
jb 0x140038930
mov byte [rdx + 0x10], 0
lea r8, [rdx + 0xf]
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.14002deb0
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x140039590
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1400bb0c0]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140039663
cmp byte [rcx + 0x71], 0
je 0x140039663
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + Ordinal_26]
cmp eax, 0xffffffff
je 0x14003965f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140039624
sub eax, 1
je 0x140039628
cmp eax, 2
jne 0x14003965f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140099e60
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140039656
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14003965f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14003960c
xor al, al
jmp 0x14003960c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140099e60
add rsp, 0x60
pop rbx
ret

Function at 0x14003a9d0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 5], 0
je 0x14003a9f3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x6a]
xor byte [rcx + rax], dl
inc rax
cmp rax, 4
jb 0x14003a9e0
mov byte [rcx + 5], 0
mov rax, rcx
ret

Function at 0x14003aa00
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 8], 0
je 0x14003aa23
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x6a]
xor byte [rcx + rax], dl
inc rax
cmp rax, 7
jb 0x14003aa10
mov byte [rcx + 8], 0
mov rax, rcx
ret

Function at 0x14003aa30
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x136], 0
je 0x14003aa58
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x6a]
xor byte [rcx + rax], dl
inc rax
cmp rax, 0x135
jb 0x14003aa40
mov byte [rcx + 0x136], 0
mov rax, rcx
ret

Function at 0x14003aa60
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x32], 0
je 0x14003aa83
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x6a]
xor byte [rcx + rax], dl
inc rax
cmp rax, 0x31
jb 0x14003aa70
mov byte [rcx + 0x32], 0
mov rax, rcx
ret

Function at 0x14003aa90
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x44], 0
je 0x14003aab3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x6a]
xor byte [rcx + rax], dl
inc rax
cmp rax, 0x43
jb 0x14003aaa0
mov byte [rcx + 0x44], 0
mov rax, rcx
ret

Function at 0x14003aac0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x47], 0
je 0x14003aae3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x6a]
xor byte [rcx + rax], dl
inc rax
cmp rax, 0x46
jb 0x14003aad0
mov byte [rcx + 0x47], 0
mov rax, rcx
ret
Function at 0x14003faa0
Capabilities:
Execute command

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0xa0
mov rax, qword [0x1400bb0c0]
xor rax, rsp
mov qword [rsp + 0x98], rax
mov rdi, rcx
mov qword [rsp + 0x90], rcx
mov rcx, qword [rcx + 0x10]
movabs rax, 0x7fffffffffffffff
sub rax, rcx
cmp rax, 0x2d
jb 0x14003fceb
mov rax, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x14003faf2
mov rax, qword [rdi]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], reloc.WLDAP32.dll_Ordinal_45
lea r9, str.start_cmd__C__color_b__title_Error__echo
mov r8, rdi
movzx edx, byte [rsp + 0x40]
lea rcx, [rsp + 0x68]
call fcn.1400369f0
nop
mov rcx, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x80]
mov rax, rdx
sub rax, rcx
cmp rax, 0x11
jb 0x14003fb73
lea rax, [rcx + 0x11]
mov qword [rsp + 0x78], rax
lea rbx, [rsp + 0x68]
cmp rdx, 0xf
cmova rbx, qword [rsp + 0x68]
add rbx, rcx
mov r8d, reloc.WS2_32.dll_recvfrom
lea rdx, str.__timeout__t_5_
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x11], 0
lea rax, [rsp + 0x68]
jmp 0x14003fb94
mov qword [rsp + 0x20], reloc.WS2_32.dll_recvfrom
lea r9, str.__timeout__t_5_
xor r8d, r8d
lea edx, [r8 + 0x11]
lea rcx, [rsp + 0x68]
call fcn.1400312a0
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x58], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x58], xmm1
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rcx, [rsp + 0x48]
cmp qword [rsp + 0x60], 0xf
cmova rcx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rsp + 0x60]
cmp rdx, 0xf
jbe 0x14003fc20
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003fc1b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003fc1b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140099e80
movdqa xmm0, xmmword [0x1400adc50]
movdqu xmmword [rsp + 0x58], xmm0
mov byte [rsp + 0x48], 0
mov rdx, qword [rsp + 0x80]
cmp rdx, 0xf
jbe 0x14003fc76
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003fc71
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003fc71
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140099e80
xor ecx, ecx
int 0x29
mov rdx, qword [rdi + 0x18]
cmp rdx, 0xf
jbe 0x14003fcb0
inc rdx
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x14003fcab
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14003fce4
mov rcx, r8
call fcn.140099e80
mov qword [rdi + 0x10], 0
mov qword [rdi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rdi], 0
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.140099e60
mov rbx, qword [rsp + 0xb8]
add rsp, 0xa0
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.140001e10
nop
int3
Function at 0x1400407a0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x60
mov rbx, rcx
mov qword [rsp + 0x38], rcx
xor edi, edi
mov dword [rsp + 0x30], edi
lea rcx, str.ALLUSERSPROFILE
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x140040800
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], dil
jne 0x1400407e7
mov rdx, rax
mov rcx, rbx
call fcn.140029870
jmp 0x1400408b4
lea rcx, [rsp + 0x40]
call fcn.14003b6b0
nop
mov rsi, rax
cmp qword [rax + 0x18], 7
jbe 0x140040818
mov rsi, qword [rax]
mov rbp, qword [rax + 0x10]
call fcn.140099788
mov r14d, eax
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov dword [rsp + 0x30], reloc.WS2_32.dll_recv
test rbp, rbp
je 0x1400408aa
cmp rbp, 0x7fffffff
ja 0x1400408d6
mov dword [rsp + 0x20], edi
xor r9d, r9d
mov r8d, ebp
mov rdx, rsi
mov ecx, eax
call fcn.1400997f8
mov rdi, rax
shr rax, 0x20
test eax, eax
jne 0x1400408e1
movsxd rdx, edi
xor r8d, r8d
mov rcx, rbx
call fcn.140046980
mov r9, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x14004088d
mov r9, qword [rbx]
mov dword [rsp + 0x20], edi
mov r8d, ebp
mov rdx, rsi
mov ecx, r14d
call fcn.1400997f8
mov rcx, rax
shr rax, 0x20
test eax, eax
jne 0x1400408cc
lea rcx, [rsp + 0x40]
call fcn.14003a6f0
mov rax, rbx
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
shr rcx, 0x20
call fcn.14003a590
int3
mov ecx, reloc.WLDAP32.dll_Ordinal_22
call fcn.14003a550
int3
shr rdi, 0x20
mov ecx, edi
call fcn.14003a590
int3