joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140016f40
Capabilities:
Query environment variable

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3e0], rcx
mov qword [rbp + 0x3c8], 2
xorps xmm0, xmm0
movups xmmword [rbp + 0x3d0], xmm0
mov rax, qword [rdx]
mov qword [rbp + 0x3c0], rax
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3e8], rax
xor r14d, r14d
xor ebx, ebx
xor r13d, r13d
cmp r8, 0x201
jae 0x140016fe0
jmp 0x140016fcf
jae 0x1400170a6
cmp r8, 0x201
jae 0x140016fe0
mov r15d, 0x200
lea rdi, [rbp - 0x60]
mov r12, r8
jmp 0x140017038
sub r8, r13
sub rbx, r13
cmp rbx, r8
jae 0x14001700f
lea rcx, [rbp + 0x3c8]
mov rdx, r13
call fcn.140029c20
mov rax, qword [rbp + 0x3c8]
mov qword [rbp + 0x3e8], rax
mov r14, qword [rbp + 0x3d0]
mov eax, 0xffffffff
cmp r14, rax
mov r13d, 0xffffffff
cmovb r13, r14
mov qword [rbp + 0x3d8], r13
mov rbx, r14
mov r15, r13
mov rdi, qword [rbp + 0x3e8]
mov r12, r13
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [rbp + 0x3c0]
mov rdx, rdi
mov r8d, r12d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
test eax, eax
jne 0x140017067
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x14001710e
mov r8d, esi
cmp r12, r8
jne 0x140016fc0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140017131
add r12, r12
mov eax, 0xffffffff
cmp r12, rax
cmovae r12, rax
mov r8, r12
cmp r8, 0x201
jb 0x140016fcf
jmp 0x140016fe0
cmp r15, r8
jb 0x14001714b
lea rcx, [rbp + 0x3a0]
mov rdx, rdi
call fcn.140018bc0
movups xmm0, xmmword [rbp + 0x3a0]
movups xmm1, xmmword [rbp + 0x3b0]
mov rsi, qword [rbp + 0x3e0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
test r14, r14
je 0x1400170f7
add r14, r14
mov r8d, 2
mov rcx, qword [rbp + 0x3e8]
mov rdx, r14
call fcn.14000f550
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3e0]
mov qword [rsi], rax
mov byte [rsi + 0x18], 2
test r14, r14
jne 0x1400170df
jmp 0x1400170f7
lea rcx, [0x1407f5b48]
lea r8, str.library_std_src_syswindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov edx, 0x28
call fcn.14002a770
jmp 0x140017160
lea rax, str.library_std_src_syswindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov rcx, r8
mov rdx, r15
mov r8, rax
call fcn.14002ab80
ud2
Function at 0x1400171b0
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3e0], rcx
mov qword [rbp + 0x3c8], 2
xorps xmm0, xmm0
movups xmmword [rbp + 0x3d0], xmm0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3e8], rax
xor edi, edi
xor ebx, ebx
xor r12d, r12d
cmp r8, 0x201
jae 0x140017240
jmp 0x14001722f
jae 0x140017300
cmp r8, 0x201
jae 0x140017240
mov esi, 0x200
lea r13, [rbp - 0x58]
mov r15, r8
jmp 0x140017298
sub r8, r12
sub rbx, r12
cmp rbx, r8
jae 0x14001726f
lea rcx, [rbp + 0x3c8]
mov rdx, r12
call fcn.140029c20
mov rax, qword [rbp + 0x3c8]
mov qword [rbp + 0x3e8], rax
mov rdi, qword [rbp + 0x3d0]
mov eax, 0xffffffff
cmp rdi, rax
mov r12d, 0xffffffff
cmovb r12, rdi
mov qword [rbp + 0x3d8], r12
mov rbx, rdi
mov rsi, r12
mov r13, qword [rbp + 0x3e8]
mov r15, r12
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, r15d
mov rdx, r13
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov r14d, eax
test eax, eax
jne 0x1400172c1
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140017368
mov r8d, r14d
cmp r15, r8
jne 0x140017220
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14001738b
add r15, r15
mov eax, 0xffffffff
cmp r15, rax
cmovae r15, rax
mov r8, r15
cmp r8, 0x201
jb 0x14001722f
jmp 0x140017240
cmp rsi, r8
jb 0x1400173a5
lea rcx, [rbp + 0x3a8]
mov rdx, r13
call fcn.140018bc0
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3e0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
test rdi, rdi
je 0x140017351
add rdi, rdi
mov r8d, 2
mov rcx, qword [rbp + 0x3e8]
mov rdx, rdi
call fcn.14000f550
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3e0]
mov qword [rsi], rax
mov byte [rsi + 0x18], 2
test rdi, rdi
jne 0x140017339
jmp 0x140017351
lea rcx, [0x1407f5b48]
lea r8, str.library_std_src_syswindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov edx, 0x28
call fcn.14002a770
jmp 0x1400173ba
lea rax, str.library_std_src_syswindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov rcx, r8
mov rdx, rsi
mov r8, rax
call fcn.14002ab80
ud2
Function at 0x14001b8b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rdx
movzx ebp, byte [rdx + 0x38]
xor ebx, ebx
cmp bpl, 1
setne dl
mov eax, 0
sbb eax, eax
mov rsi, rcx
or al, dl
movzx ecx, al
cmp cl, 0xff
je 0x14001b8e0
test ecx, ecx
jne 0x14001b930
movzx ebx, byte [rdi + 0x3a]
cmp al, 0xff
je 0x14001b8ec
test ecx, ecx
jne 0x14001b930
mov rcx, rdi
call fcn.14001b780
movzx eax, al
test bpl, bpl
jne 0x14001b937
lea rdx, [rdi + 0x10]
xor ecx, ecx
cmp byte [rdi + 0x10], 6
cmove rdx, rcx
je case.0x14001b923.2
movzx r8d, byte [rdx]
mov ecx, 6
lea r9, [0x14001baa8]
movsxd r8, dword [r9 + r8*4]
add r8, r9
jmp r8
mov rcx, qword [rdx + 0x10]
add rcx, 4
jmp case.0x14001b923.2
xor eax, eax
test bpl, bpl
je 0x14001b8fc
xor ecx, ecx
add rax, rcx
movzx r10d, bl
lea rcx, [rax + r10]
mov rdx, qword [rdi + 8]
cmp rdx, rcx
jb 0x14001ba89
mov r11, qword [rdi]
lea r8, [r11 + rcx]
cmp rdx, rcx
jne 0x14001b96a
movzx r9d, byte [rdi + 0x10]
xor r10d, r10d
jmp 0x14001b9e9
movzx r9d, byte [rdi + 0x10]
add rax, r10
sub rax, rdx
inc rax
lea rdi, [rdx + r11]
dec rdi
xor r10d, r10d
cmp r9b, 3
jae 0x14001b9b0
nop dword [rax + rax]
cmp byte [rdi], 0x5c
je 0x14001b9cb
inc rax
dec rdi
cmp rax, 1
jne 0x14001b990
jmp 0x14001b9e9
movzx ebx, byte [rdi]
cmp ebx, 0x2f
je 0x14001b9cb
cmp ebx, 0x5c
je 0x14001b9cb
inc rax
dec rdi
cmp rax, 1
jne 0x14001b9b0
jmp 0x14001b9e9
neg rax
add rcx, rax
inc rcx
cmp rdx, rcx
jb 0x14001ba97
add r11, rcx
mov r10d, 1
mov r8, r11
sub rdx, rcx
je 0x14001ba13
mov al, 9
cmp rdx, 2
je 0x14001ba17
cmp rdx, 1
jne 0x14001ba27
cmp byte [r8], 0x2e
jne 0x14001ba27
xor eax, eax
cmp r9b, 3
setae al
lea eax, [rax + rax*2]
add eax, 7
jmp 0x14001ba27
mov al, 0xa
jmp 0x14001ba27
cmp byte [r8], 0x2e
jne 0x14001ba27
cmp byte [r8 + 1], 0x2e
sete al
xor al, 9
add r10, rdx
mov qword [rsi], r10
mov byte [rsi + 8], al
mov qword [rsi + 0x10], r8
mov qword [rsi + 0x18], rdx
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
mov rcx, qword [rdx + 0x10]
mov rdx, qword [rdx + 0x20]
lea r8, [rdx + 1]
test rdx, rdx
cmove r8, rdx
add rcx, r8
add rcx, 8
jmp case.0x14001b923.2
mov rcx, qword [rdx + 0x10]
mov rdx, qword [rdx + 0x20]
lea r8, [rdx + 1]
test rdx, rdx
cmove r8, rdx
add rcx, r8
add rcx, 2
jmp case.0x14001b923.2
mov ecx, 2
jmp case.0x14001b923.2
lea r8, str.library_std_srcpath.rs
call fcn.14002ab00
ud2
lea r8, str.library_std_srcpath.rs
call fcn.14002ab00
ud2
Function at 0x140027c50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test r8, r8
je 0x140027cca
mov rax, rdx
mov rdx, qword [rsp + 0x70]
mov esi, ecx
shr esi, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov rbx, rax
movzx edi, byte [rax + 1]
add rax, 2
lea r10, [r11 + rdi]
cmp byte [rbx], sil
jne 0x140027cc0
cmp r10, r11
jb 0x140027d62
cmp r10, rdx
ja 0x140027d76
add r11, r9
xor ebx, ebx
nop dword [rax]
cmp rdi, rbx
je 0x140027cc2
lea r14, [rbx + 1]
cmp byte [r11 + rbx], cl
mov rbx, r14
jne 0x140027ca0
jmp 0x140027d36
ja 0x140027cca
mov r11, r10
cmp rax, r8
jne 0x140027c72
mov rax, qword [rsp + 0x80]
test rax, rax
je 0x140027d3a
mov r9, qword [rsp + 0x78]
lea rdx, [r9 + rax]
cmp rax, 1
mov r8, r9
sbb r8, 0xffffffffffffffff
movzx ecx, cx
mov al, 1
movzx r10d, byte [r9]
test r10b, r10b
jns 0x140027d10
cmp r8, rdx
je 0x140027d48
movzx r9d, byte [r8]
inc r8
and r10d, 0x7f
shl r10d, 8
or r10d, r9d
mov r9, r8
sub ecx, r10d
js 0x140027d3c
xor al, 1
xor r8d, r8d
cmp r9, rdx
setne r10b
test r9, r9
je 0x140027d3c
mov r8b, r10b
add r8, r9
cmp r9, rdx
jne 0x140027cf0
jmp 0x140027d3c
xor eax, eax
jmp 0x140027d3c
mov al, 1
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, str.called__Option::unwrap____on_a__None__valuebyte_index__is_not_a_char_boundary__it_is_inside___bytes___of__
lea r8, str.librarycore_srcunicodeprintable.rs
mov edx, 0x2b
call fcn.14002a770
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.14002ac00
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.14002ab80
ud2

Function at 0x1400296b8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140029702
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140029702
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140029702
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140029702
cmp dword [rcx + 0x84], 0xe
jbe 0x140029702
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140029704
xor al, al
add rsp, 0x28
ret
Function at 0x140011442
Capabilities:
Terminate process

Disassembly:
jmp 0x14001b590
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x140011564
Capabilities:
Parse pe header

Disassembly:
jmp 0x14001c8e0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14001c900
xor al, al
jmp 0x14001c981
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14001c913
xor al, al
jmp 0x14001c981
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001c93d
xor al, al
jmp 0x14001c981
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x14001c951
xor al, al
jmp 0x14001c981
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x14001c963
xor al, al
jmp 0x14001c981
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001c97f
xor al, al
jmp 0x14001c981
mov al, 1
add rsp, 0x38
ret
Function at 0x140003480
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
push r12
push r13
mov eax, 0x1070
call fcn.14000eb60
sub rsp, rax
mov rax, qword [0x14001e010]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov rdx, qword [rsp + 0x10b0]
xor ebp, ebp
mov qword [rsp + 0x38], r9
mov r12, r8
mov qword [rsp + 0x30], rdx
mov r13, rcx
test r8, r8
jne 0x1400034cc
mov rdx, rbp
jmp 0x1400035e0
mov r9d, 0x1000
lea rdx, [rsp + 0x40]
call fcn.140001f20
test al, al
je 0x1400034c4
mov qword [rsp + 0x1068], rsi
lea rdx, str.PAGE
mov qword [rsp + 0x1060], rdi
mov rdi, 0xffffffffffffffff
mov qword [rsp + 0x1058], r14
mov qword [rsp + 0x1050], r15
nop
inc rdi
cmp byte [rdx + rdi], bpl
jne 0x140003510
movsxd rax, dword [rsp + 0x7c]
lea rcx, [rsp + 0x40]
add rcx, rax
mov qword [rsp + 0x1098], rbx
mov esi, ebp
movzx eax, word [rcx + 0x14]
lea r15, [rcx + 0x18]
movzx r14d, word [rcx + 6]
add r15, rax
test r14d, r14d
je 0x1400035b5
nop word [rax + rax]
mov eax, esi
mov r8, rdi
lea rcx, [rax + rax*4]
lea rbx, [r15 + rcx*8]
mov rcx, rbx
call fcn.14000ebb4
test eax, eax
jne 0x14000357e
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rbx + rax], bpl
jne 0x140003570
cmp rdi, rax
je 0x14000358e
inc esi
cmp esi, r14d
jae 0x1400035b5
lea rdx, str.PAGE
jmp 0x140003550
mov eax, dword [rbx + 0xc]
test eax, eax
je 0x1400035b5
mov ecx, dword [rbx + 8]
lea rdx, [rsp + 0x40]
add rdx, rax
je 0x1400035b5
test ecx, ecx
je 0x1400035b5
lea rax, [rsp + 0x40]
mov ebp, ecx
sub rdx, rax
add rdx, r12
jmp 0x1400035b8
mov rdx, rbp
mov rbx, qword [rsp + 0x1098]
mov rdi, qword [rsp + 0x1060]
mov rsi, qword [rsp + 0x1068]
mov r14, qword [rsp + 0x1058]
mov r15, qword [rsp + 0x1050]
mov rax, qword [rsp + 0x30]
mov rcx, r13
mov r9, qword [rsp + 0x38]
mov r8d, ebp
mov qword [rsp + 0x20], rax
call fcn.140003370
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.14000d940
add rsp, 0x1070
pop r13
pop r12
pop rbp
ret
Function at 0x14000b150
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x14001e010]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rsi, rdx
mov rdi, rcx
mov qword [rsp + 0x40], rcx
xor r8d, r8d
mov eax, 0x5a4d
cmp word [rdx], ax
jne 0x14000b262
movsxd rax, dword [rdx + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x14000b262
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x48], xmm1
mov qword [rsp + 0x58], r8
mov ecx, dword [rax + rdx + 0xb0]
test ecx, ecx
jne 0x14000b1c9
mov qword [rdi], r8
mov qword [rdi + 8], r8
mov qword [rdi + 0x10], r8
jmp 0x14000b26d
lea rbx, [rdx + rcx]
mov ebp, dword [rax + rdx + 0xb4]
add rbp, rbx
mov rcx, qword [rsp + 0x50]
cmp rbx, rbp
jae 0x14000b250
mov edx, dword [rbx + 4]
test edx, edx
je 0x14000b250
mov eax, dword [rbx]
add rax, rsi
mov qword [rsp + 0x28], rax
lea rax, [rbx + 8]
mov qword [rsp + 0x30], rax
lea rax, [rdx - 8]
shr rax, 1
mov dword [rsp + 0x38], eax
cmp rcx, r8
je 0x14000b229
movups xmm0, xmmword [rsp + 0x28]
movups xmmword [rcx], xmm0
movsd xmm1, qword [rsp + 0x38]
movsd qword [rcx + 0x10], xmm1
add rcx, 0x18
mov qword [rsp + 0x50], rcx
jmp 0x14000b245
lea r8, [rsp + 0x28]
mov rdx, rcx
lea rcx, [rsp + 0x48]
call fcn.14000bb00
mov r8, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
mov eax, dword [rbx + 4]
add rbx, rax
cmp rbx, rbp
jb 0x14000b1e1
mov rax, qword [rsp + 0x48]
mov qword [rdi], rax
mov qword [rdi + 8], rcx
mov qword [rdi + 0x10], r8
jmp 0x14000b26d
mov qword [rcx], r8
mov qword [rcx + 8], r8
mov qword [rcx + 0x10], r8
mov rax, rdi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14000d940
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x14000e75c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [0x1400100d8]
test rax, rax
je 0x14000e7a6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000e7a6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000e7a6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000e7a6
cmp dword [rcx + 0x84], 0xe
jbe 0x14000e7a6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000e7a8
xor al, al
add rsp, 0x28
ret
Function at 0x1400f3c30
Capabilities:
Execute command

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x140184540]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rsi, rcx
mov qword [rsp + 0x78], rcx
mov r8, rcx
lea rdx, str.start_cmd__C__color_b__title_Error__echo
lea rcx, [rsp + 0x58]
call fcn.14001b470
mov rdi, rax
mov rcx, qword [rax + 0x10]
mov rdx, qword [rax + 0x18]
mov rax, rdx
sub rax, rcx
cmp rax, 0x11
jb 0x1400f3cba
lea rax, [rcx + 0x11]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x1400f3c9b
mov rax, qword [rdi]
lea rbx, [rax + rcx]
mov r8d, reloc.WS2_32.dll_recvfrom
lea rdx, str.__timeout__t_5_
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x11], 0
jmp 0x1400f3cdc
mov qword [rsp + 0x20], reloc.WS2_32.dll_recvfrom
lea r9, str.__timeout__t_5_
xor r8d, r8d
lea edx, [r8 + 0x11]
mov rcx, rdi
call fcn.1400f52f0
mov rdi, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
movups xmm0, xmmword [rdi]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rdi + 0x10], 0
mov qword [rdi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rdi], 0
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 0x10
cmovae rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x1400f3d68
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400f3d63
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400f3d63
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400fea14
movdqa xmm0, xmmword [0x1401563b0]
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x30], 0
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x1400f3dbb
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400f3db6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400f3db6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400fea14
xor ecx, ecx
int 0x29
mov rdx, qword [rsi + 0x18]
cmp rdx, 0x10
jb 0x1400f3df5
inc rdx
mov rcx, qword [rsi]
cmp rdx, 0x1000
jb 0x1400f3df0
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400f3e2d
mov rcx, r8
call fcn.1400fea14
mov qword [rsi + 0x10], 0
mov qword [rsi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rsi], 0
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400feac0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3

Function at 0x1400f3e40
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x47], 0
je 0x1400f3e63
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x58]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x46
jb 0x1400f3e50
mov byte [rcx + 0x47], 0
mov rax, rcx
ret
Function at 0x1400f3e70
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rbx, rcx
mov qword [rbp - 0x10], rcx
xor r9d, r9d
cmp byte [r8 + 6], r9b
je 0x1400f3eb4
mov ecx, r9d
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x58]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 5
jb 0x1400f3ea0
mov byte [r8 + 6], r9b
lea rax, [r8 + 5]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
mov qword [rbp - 0x28], r9
mov qword [rbp - 0x20], r9
mov qword [rbp - 0x20], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x1400f3ede
mov qword [rbp - 0x28], r9
mov byte [rbp - 0x38], r9b
jmp 0x1400f3ef4
mov qword [rbp - 0x28], 5
mov eax, dword [r8]
mov dword [rbp - 0x38], eax
movzx eax, byte [r8 + 4]
mov byte [rbp - 0x34], al
cmp byte [rdx + 0xa], 0
je 0x1400f3f13
mov rcx, r9
nop dword [rax]
lea eax, [rcx + 0x58]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 9
jb 0x1400f3f00
mov byte [rdx + 0xa], 0
lea rax, [rdx + 9]
xorps xmm0, xmm0
movups xmmword [rbp - 0x58], xmm0
mov qword [rbp - 0x48], r9
mov qword [rbp - 0x40], r9
mov qword [rbp - 0x40], reloc.WS2_32.dll_ntohs
cmp rdx, rax
jne 0x1400f3f3d
mov qword [rbp - 0x48], r9
mov byte [rbp - 0x58], 0
jmp 0x1400f3f55
mov qword [rbp - 0x48], 9
movsd xmm0, qword [rdx]
movsd qword [rbp - 0x58], xmm0
movzx eax, byte [rdx + 8]
mov byte [rbp - 0x50], al
lea r9, [rbp - 0x38]
lea r8, [rbp - 0x58]
movzx edx, byte [rbp - 0x60]
mov rcx, rbx
call fcn.1400ec950
nop
mov rdx, qword [rbp - 0x40]
cmp rdx, 0x10
jb 0x1400f3fa9
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400f3fa3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400f3fa3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400fea14
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x1400f3fe7
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400f3fe2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400f3fe2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400fea14
mov rax, rbx
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rbp
ret
Function at 0x1400f4000
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x50
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor edi, edi
cmp byte [r8 + 7], dil
je 0x1400f4034
mov eax, edi
nop dword [rax]
lea ecx, [rax + 0x58]
xor byte [r8 + rax], cl
inc rax
cmp rax, 6
jb 0x1400f4020
mov byte [r8 + 7], dil
lea rax, [r8 + 6]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x1400f4064
mov qword [rsp + 0x30], rdi
mov byte [rsp + 0x20], dil
jmp 0x1400f407e
mov qword [rsp + 0x30], 6
mov eax, dword [r8]
mov dword [rsp + 0x20], eax
movzx eax, word [r8 + 4]
mov word [rsp + 0x24], ax
mov r9, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x1400f408c
mov rdx, qword [rdx]
mov r8, rdx
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.1400ecb90
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x1400f4106
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400f4101
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400f4101
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400fea14
mov rax, rbx
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret

Function at 0x1400f4120
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 9], al
je 0x1400f4143
lea edx, [rax + 0x58]
xor byte [rax + rcx], dl
inc rax
cmp rax, 8
jb 0x1400f4130
mov byte [rcx + 9], 0
lea r8, [rcx + 8]
mov rdx, rcx
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.14004cd60
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x1400f4160
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x50
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor edi, edi
cmp byte [r8 + 9], dil
je 0x1400f4194
mov eax, edi
nop dword [rax]
lea ecx, [rax + 0x58]
xor byte [r8 + rax], cl
inc rax
cmp rax, 8
jb 0x1400f4180
mov byte [r8 + 9], dil
lea rax, [r8 + 8]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x1400f41c4
mov qword [rsp + 0x30], rdi
mov byte [rsp + 0x20], dil
jmp 0x1400f41d5
mov qword [rsp + 0x30], 8
mov rax, qword [r8]
mov qword [rsp + 0x20], rax
mov r9, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x1400f41e3
mov rdx, qword [rdx]
mov r8, rdx
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.1400ecb90
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x1400f425d
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400f4258
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400f4258
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400fea14
mov rax, rbx
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret