joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400cd5b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push r14
sub rsp, 0x250
mov rax, qword [0x140193088]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov eax, dword [rcx + 0x58]
lea rbx, [rsp + 0x30]
mov dword [rsp + 0x40], eax
mov ebp, r9d
mov eax, dword [rcx + 0x5c]
mov rsi, rcx
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x290]
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x38], edx
mov dword [rsp + 0x3c], r8d
mov dword [rsp + 0x30], r9d
mov qword [rsp + 0x278], rdi
nop dword [rax]
mov r10d, dword [rbx + 0x14]
mov eax, r10d
mov r14d, dword [rbx + 4]
cmp r10d, r14d
mov r9d, dword [rbx + 0xc]
cmovg eax, r14d
cmp r9d, eax
jl 0x1400cd74c
cmp r10d, r14d
mov eax, r14d
cmovg eax, r10d
cmp r9d, eax
jg 0x1400cd74c
cmp r10d, r14d
jne 0x1400cd650
sub rbx, 0x10
jmp 0x1400cd794
mov edx, dword [rsi + 0x88]
xor r9d, r9d
cmp r10d, r14d
setge r9b
inc r9d
cmp edx, r9d
je 0x1400cd6c2
mov eax, dword [rsi + 4]
mov ecx, eax
mov r8d, dword [rsi + 8]
neg ecx
cmp r10d, r14d
jge 0x1400cd684
dec eax
add eax, r10d
and eax, ecx
sub eax, r10d
jmp 0x1400cd68c
and ecx, r10d
mov eax, r10d
sub eax, ecx
cmp eax, r8d
setge r11b
test edx, edx
je 0x1400cd6ab
movzx edx, r11b
mov rcx, rsi
call fcn.1400ce760
test al, al
jne 0x1400cd7a5
movzx r8d, r11b
mov edx, r9d
mov rcx, rsi
call fcn.1400cedd0
test al, al
jne 0x1400cd7a5
mov edx, dword [rsi + 0x64]
lea r9, [0x1400cf130]
mov ecx, dword [rsi + 0x60]
mov r8, rbx
cmp r10d, r14d
jge 0x1400cd6ee
mov dword [rsp + 0x28], edx
mov edx, 2
mov dword [rsp + 0x20], ecx
mov rcx, rsi
call fcn.1400cd430
jmp 0x1400cd742
mov eax, dword [rbx + 4]
neg ecx
movzx edi, byte [rsi + 0x6a]
neg eax
mov dword [rbx + 4], eax
neg edx
mov eax, dword [rbx + 0xc]
neg eax
mov dword [rsp + 0x28], ecx
mov dword [rbx + 0xc], eax
mov rcx, rsi
mov eax, dword [rbx + 0x14]
neg eax
mov dword [rsp + 0x20], edx
mov edx, 2
mov dword [rbx + 0x14], eax
call fcn.1400cd430
test dil, dil
je 0x1400cd73a
cmp byte [rsi + 0x6a], 0
jne 0x1400cd73a
mov rdx, qword [rsi + 0x70]
mov ecx, dword [rdx + 0x20]
neg ecx
mov dword [rdx + 0x20], ecx
mov ecx, dword [rbx + 4]
neg ecx
mov dword [rbx + 4], ecx
test al, al
jne 0x1400cd7a5
sub rbx, 0x10
jmp 0x1400cd794
mov eax, dword [rbx + 8]
mov ecx, dword [rbx + 0x10]
mov dword [rbx + 0x20], ecx
add ecx, eax
mov dword [rbx + 0x24], r10d
lea edx, [rax + rbp]
mov eax, ecx
sar eax, 1
mov dword [rbx + 0x18], eax
lea eax, [rcx + rdx]
sar eax, 2
lea ecx, [r10 + r9]
mov dword [rbx + 0x10], eax
mov eax, ecx
sar edx, 1
sar eax, 1
mov dword [rbx + 8], edx
lea edx, [r14 + r9]
mov dword [rbx + 0x1c], eax
lea eax, [rcx + rdx]
sar eax, 2
sar edx, 1
mov dword [rbx + 0x14], eax
mov dword [rbx + 0xc], edx
add rbx, 0x10
lea rax, [rsp + 0x30]
cmp rbx, rax
jb 0x1400cd7a9
mov ebp, dword [rbx]
jmp 0x1400cd610
mov al, 1
jmp 0x1400cd7b2
mov dword [rsi + 0x58], ebp
xor al, al
mov dword [rsi + 0x5c], r14d
mov rdi, qword [rsp + 0x278]
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140139460
mov rbx, qword [rsp + 0x280]
add rsp, 0x250
pop r14
pop rsi
pop rbp
ret
Function at 0x1400d3b00
Capabilities:
Get file size
Read file on windows
Read file via mapping

Disassembly:
push rbx
push rbp
sub rsp, 0x48
mov rbp, rdx
mov rbx, rcx
test rcx, rcx
jne 0x1400d3b1c
lea eax, [rcx + 0x28]
add rsp, 0x48
pop rbp
pop rbx
ret
mov qword [rsp + 0x68], rsi
xor r9d, r9d
mov qword [rsp + 0x40], r14
mov edx, 0x80000000
xor r14d, r14d
mov rcx, rbp
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
lea r8d, [r14 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x1400d3b70
mov r14, qword [rsp + 0x40]
lea eax, [rsi + 2]
mov rsi, qword [rsp + 0x68]
add rsp, 0x48
pop rbp
pop rbx
ret
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x78], rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1400d3c95
mov rax, qword [rsp + 0x70]
cmp rax, 0x7fffffff
jg 0x1400d3c95
test rax, rax
je 0x1400d3c95
xor r9d, r9d
mov qword [rsp + 0x28], r14
xor edx, edx
mov dword [rsp + 0x20], r14d
mov rcx, rsi
lea r8d, [r9 + 2]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov rdi, rax
test rax, rax
je 0x1400d3c95
mov ecx, dword [rsp + 0x70]
xor r9d, r9d
mov dword [rbx + 8], ecx
xor r8d, r8d
mov rcx, rax
mov dword [rbx + 0xc], r14d
mov qword [rsp + 0x20], r14
lea edx, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rcx, rdi
mov qword [rbx], rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rbx], r14
je 0x1400d3c0a
lea rax, [0x1400d3cf0]
jmp 0x1400d3c63
mov rcx, qword [rbx + 0x30]
xor edx, edx
movsxd r8, dword [rbx + 8]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbx], rax
test rax, rax
je 0x1400d3c95
mov edi, r14d
nop dword [rax + rax]
mov r8d, dword [rbx + 8]
lea r9, [rsp + 0x60]
mov edx, edi
sub r8d, edi
add rdx, qword [rbx]
mov rcx, rsi
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400d3c83
add edi, dword [rsp + 0x60]
cmp edi, dword [rbx + 8]
jne 0x1400d3c30
lea rax, [0x1400d3cc0]
mov rcx, rsi
mov qword [rbx + 0x28], rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rbx]
mov qword [rbx + 0x10], rax
xor eax, eax
mov qword [rbx + 0x18], rbp
mov qword [rbx + 0x20], r14
jmp 0x1400d3caa
mov rcx, qword [rbx + 0x30]
xor edx, edx
mov r8, qword [rbx]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x51
mov qword [rbx], r14
mov qword [rbx + 8], r14
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x68]
mov r14, qword [rsp + 0x40]
add rsp, 0x48
pop rbp
pop rbx
ret
Function at 0x1400d5280
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov r9, rdx
test rdx, rdx
jne 0x1400d528b
xor eax, eax
ret
lea r11, [0x140159930]
not ecx
cmp r8d, 8
jb 0x1400d5361
mov r10d, r8d
shr r10, 3
nop word [rax + rax]
movzx edx, byte [r9]
mov eax, ecx
xor rdx, rax
shr ecx, 8
movzx eax, dl
add r8d, 0xfffffff8
movzx edx, byte [r9 + 1]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 2]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 3]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 4]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 5]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 6]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 7]
add r9, 8
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
xor ecx, dword [r11 + rax*4]
sub r10, 1
jne 0x1400d52b0
test r8d, r8d
je 0x1400d538d
nop word [rax + rax]
movzx edx, byte [r9]
lea r9, [r9 + 1]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
xor ecx, dword [r11 + rax*4]
add r8d, 0xffffffff
jne 0x1400d5370
not ecx
mov eax, ecx
ret
Function at 0x1400d9300
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x50
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor r9d, r9d
cmp byte [r8 + 6], r9b
je 0x1400d9334
mov ecx, r9d
nop word [rax + rax]
lea eax, [rcx - 0x75]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 5
jb 0x1400d9320
mov byte [r8 + 6], r9b
mov qword [rsp + 0x20], r9
lea rax, [r8 + 5]
cmp r8, rax
jne 0x1400d9357
mov qword [rsp + 0x30], r9
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x20], 0
jmp 0x1400d9380
mov qword [rsp + 0x30], 5
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
mov eax, dword [r8]
mov dword [rsp + 0x20], eax
movzx eax, byte [r8 + 4]
mov byte [rsp + 0x24], al
mov byte [rsp + 0x25], r9b
nop
lea r8, [rsp + 0x20]
mov rcx, rbx
call fcn.1400d9290
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x1400d93ce
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400d93c9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400d93c9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140138e04
mov rax, rbx
add rsp, 0x50
pop rbx
ret

Function at 0x1400d93e0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x50
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor r9d, r9d
cmp byte [r8 + 7], r9b
je 0x1400d9414
mov ecx, r9d
nop word [rax + rax]
lea eax, [rcx - 0x75]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 6
jb 0x1400d9400
mov byte [r8 + 7], r9b
mov qword [rsp + 0x20], r9
lea rax, [r8 + 6]
cmp r8, rax
jne 0x1400d9437
mov qword [rsp + 0x30], r9
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x20], 0
jmp 0x1400d9460
mov qword [rsp + 0x30], 6
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
mov eax, dword [r8]
mov dword [rsp + 0x20], eax
movzx eax, word [r8 + 4]
mov word [rsp + 0x24], ax
mov byte [rsp + 0x26], r9b
nop
lea r8, [rsp + 0x20]
mov rcx, rbx
call fcn.1400d9290
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x1400d94ae
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400d94a9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400d94a9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140138e04
mov rax, rbx
add rsp, 0x50
pop rbx
ret
Function at 0x1400d94c0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x50
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor r9d, r9d
cmp byte [r8 + 9], r9b
je 0x1400d94f4
mov ecx, r9d
nop word [rax + rax]
lea eax, [rcx - 0x75]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 8
jb 0x1400d94e0
mov byte [r8 + 9], r9b
mov qword [rsp + 0x20], r9
lea rax, [r8 + 8]
cmp r8, rax
jne 0x1400d9517
mov qword [rsp + 0x30], r9
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x20], 0
jmp 0x1400d9540
mov qword [rsp + 0x30], 8
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
mov rax, qword [r8]
mov qword [rsp + 0x20], rax
mov byte [rsp + 0x28], r9b
nop word [rax + rax]
lea r8, [rsp + 0x20]
mov rcx, rbx
call fcn.1400d9290
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x1400d958e
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400d9589
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400d9589
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140138e04
mov rax, rbx
add rsp, 0x50
pop rbx
ret
Function at 0x1400d95a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rbx, rcx
mov qword [rbp - 0x10], rcx
xor r9d, r9d
cmp byte [r8 + 6], r9b
je 0x1400d95e4
mov ecx, r9d
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x75]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 5
jb 0x1400d95d0
mov byte [r8 + 6], r9b
mov qword [rbp - 0x38], r9
lea rax, [r8 + 5]
cmp r8, rax
jne 0x1400d9603
mov qword [rbp - 0x28], r9
mov qword [rbp - 0x20], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x38], 0
jmp 0x1400d9625
mov qword [rbp - 0x28], 5
mov qword [rbp - 0x20], reloc.WS2_32.dll_ntohs
mov eax, dword [r8]
mov dword [rbp - 0x38], eax
movzx eax, byte [r8 + 4]
mov byte [rbp - 0x34], al
mov byte [rbp - 0x33], r9b
cmp byte [rdx + 0xa], 0
je 0x1400d9643
mov rcx, r9
nop
lea eax, [rcx - 0x75]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 9
jb 0x1400d9630
mov byte [rdx + 0xa], 0
mov qword [rbp - 0x58], r9
lea rax, [rdx + 9]
cmp rdx, rax
jne 0x1400d9662
mov qword [rbp - 0x48], r9
mov qword [rbp - 0x40], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x58], 0
jmp 0x1400d9690
mov qword [rbp - 0x48], 9
mov qword [rbp - 0x40], reloc.WS2_32.dll_ntohs
movsd xmm0, qword [rdx]
movsd qword [rbp - 0x58], xmm0
movzx eax, byte [rdx + 8]
mov byte [rbp - 0x50], al
mov byte [rbp - 0x4f], 0
nop word [rax + rax]
lea r9, [rbp - 0x38]
lea r8, [rbp - 0x58]
movzx edx, byte [rbp - 0x60]
mov rcx, rbx
call fcn.1400df0c0
nop
mov rdx, qword [rbp - 0x40]
cmp rdx, 0x10
jb 0x1400d96e4
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400d96de
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400d96de
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140138e04
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x1400d9722
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400d971d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400d971d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140138e04
mov rax, rbx
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rbp
ret
Function at 0x1400d9740
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x50
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor r9d, r9d
cmp byte [r8 + 0xa], r9b
je 0x1400d9774
mov ecx, r9d
nop word [rax + rax]
lea eax, [rcx - 0x75]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 9
jb 0x1400d9760
mov byte [r8 + 0xa], r9b
mov qword [rsp + 0x20], r9
lea rax, [r8 + 9]
cmp r8, rax
jne 0x1400d9797
mov qword [rsp + 0x30], r9
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x20], 0
jmp 0x1400d97c2
mov qword [rsp + 0x30], 9
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
movsd xmm0, qword [r8]
movsd qword [rsp + 0x20], xmm0
movzx eax, byte [r8 + 8]
mov byte [rsp + 0x28], al
mov byte [rsp + 0x29], r9b
lea r8, [rsp + 0x20]
mov rcx, rbx
call fcn.1400d9290
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x1400d9810
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400d980b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400d980b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140138e04
mov rax, rbx
add rsp, 0x50
pop rbx
ret
Function at 0x1400d9820
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rbx, rcx
mov qword [rbp - 0x10], rcx
xor r9d, r9d
cmp byte [r8 + 0xb], r9b
je 0x1400d9864
mov ecx, r9d
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x75]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 0xa
jb 0x1400d9850
mov byte [r8 + 0xb], r9b
mov qword [rbp - 0x38], r9
lea rax, [r8 + 0xa]
cmp r8, rax
jne 0x1400d9883
mov qword [rbp - 0x28], r9
mov qword [rbp - 0x20], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x38], 0
jmp 0x1400d98b0
mov qword [rbp - 0x28], 0xa
mov qword [rbp - 0x20], reloc.WS2_32.dll_ntohs
movsd xmm0, qword [r8]
movsd qword [rbp - 0x38], xmm0
movzx eax, word [r8 + 8]
mov word [rbp - 0x30], ax
mov byte [rbp - 0x2e], r9b
nop word [rax + rax]
cmp byte [rdx + 0xb], 0
je 0x1400d98d3
mov rcx, r9
nop dword [rax]
lea eax, [rcx - 0x75]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xa
jb 0x1400d98c0
mov byte [rdx + 0xb], 0
mov qword [rbp - 0x58], r9
lea rax, [rdx + 0xa]
cmp rdx, rax
jne 0x1400d98f2
mov qword [rbp - 0x48], r9
mov qword [rbp - 0x40], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x58], 0
jmp 0x1400d9920
mov qword [rbp - 0x48], 0xa
mov qword [rbp - 0x40], reloc.WS2_32.dll_ntohs
movsd xmm0, qword [rdx]
movsd qword [rbp - 0x58], xmm0
movzx eax, word [rdx + 8]
mov word [rbp - 0x50], ax
mov byte [rbp - 0x4e], 0
nop word [rax + rax]
lea r9, [rbp - 0x38]
lea r8, [rbp - 0x58]
movzx edx, byte [rbp - 0x60]
mov rcx, rbx
call fcn.1400df0c0
nop
mov rdx, qword [rbp - 0x40]
cmp rdx, 0x10
jb 0x1400d9974
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400d996e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400d996e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140138e04
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x1400d99b2
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400d99ad
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400d99ad
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140138e04
mov rax, rbx
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rbp
ret
Function at 0x1400d99d0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x50
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor r9d, r9d
cmp byte [r8 + 0xc], r9b
je 0x1400d9a04
mov ecx, r9d
nop word [rax + rax]
lea eax, [rcx - 0x75]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 0xb
jb 0x1400d99f0
mov byte [r8 + 0xc], r9b
mov qword [rsp + 0x20], r9
lea rax, [r8 + 0xb]
cmp r8, rax
jne 0x1400d9a27
mov qword [rsp + 0x30], r9
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x20], 0
jmp 0x1400d9a60
mov qword [rsp + 0x30], recvfrom
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
movsd xmm0, qword [r8]
movsd qword [rsp + 0x20], xmm0
movzx eax, word [r8 + 8]
mov word [rsp + 0x28], ax
movzx eax, byte [r8 + 0xa]
mov byte [rsp + 0x2a], al
mov byte [rsp + 0x2b], r9b
nop dword [rax]
lea r8, [rsp + 0x20]
mov rcx, rbx
call fcn.1400d9290
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x1400d9aae
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400d9aa9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400d9aa9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140138e04
mov rax, rbx
add rsp, 0x50
pop rbx
ret
Function at 0x1400d9ac0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rbx, rcx
mov qword [rbp - 0x10], rcx
xor r9d, r9d
cmp byte [r8 + 0xb], r9b
je 0x1400d9b04
mov ecx, r9d
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x75]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 0xa
jb 0x1400d9af0
mov byte [r8 + 0xb], r9b
mov qword [rbp - 0x38], r9
lea rax, [r8 + 0xa]
cmp r8, rax
jne 0x1400d9b23
mov qword [rbp - 0x28], r9
mov qword [rbp - 0x20], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x38], 0
jmp 0x1400d9b50
mov qword [rbp - 0x28], 0xa
mov qword [rbp - 0x20], reloc.WS2_32.dll_ntohs
movsd xmm0, qword [r8]
movsd qword [rbp - 0x38], xmm0
movzx eax, word [r8 + 8]
mov word [rbp - 0x30], ax
mov byte [rbp - 0x2e], r9b
nop word [rax + rax]
cmp byte [rdx + 0xe], 0
je 0x1400d9b73
mov rcx, r9
nop dword [rax]
lea eax, [rcx - 0x75]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xd
jb 0x1400d9b60
mov byte [rdx + 0xe], 0
mov qword [rbp - 0x58], r9
lea rax, [rdx + 0xd]
cmp rdx, rax
jne 0x1400d9b92
mov qword [rbp - 0x48], r9
mov qword [rbp - 0x40], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x58], 0
jmp 0x1400d9bc0
mov qword [rbp - 0x48], reloc.WS2_32.dll_listen
mov qword [rbp - 0x40], reloc.WS2_32.dll_ntohs
movsd xmm0, qword [rdx]
movsd qword [rbp - 0x58], xmm0
mov eax, dword [rdx + 8]
mov dword [rbp - 0x50], eax
movzx eax, byte [rdx + 0xc]
mov byte [rbp - 0x4c], al
mov byte [rbp - 0x4b], 0
nop dword [rax]
lea r9, [rbp - 0x38]
lea r8, [rbp - 0x58]
movzx edx, byte [rbp - 0x60]
mov rcx, rbx
call fcn.1400df0c0
nop
mov rdx, qword [rbp - 0x40]
cmp rdx, 0x10
jb 0x1400d9c14
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400d9c0e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400d9c0e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140138e04
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x1400d9c52
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400d9c4d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400d9c4d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140138e04
mov rax, rbx
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rbp
ret

Function at 0x1400e11f0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x44], 0
je 0x1400e1213
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x75]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x43
jb 0x1400e1200
mov byte [rcx + 0x44], 0
mov rax, rcx
ret

Function at 0x1400e1220
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x47], 0
je 0x1400e1243
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x75]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x46
jb 0x1400e1230
mov byte [rcx + 0x47], 0
mov rax, rcx
ret
Function at 0x1400ffbd0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx + 0x718], 0
mov rsi, r9
mov rbp, r8
movsxd rbx, edx
mov rdi, rcx
je 0x1400ffc2e
mov dl, 1
call fcn.1400f0620
mov rax, qword [rdi + 0x670]
mov r9, rsi
mov r8, rbp
mov qword [rsp + 0x20], rax
mov edx, ebx
mov rcx, rdi
call qword [rdi + 0x718]
xor edx, edx
mov rcx, rdi
mov ebx, eax
call fcn.1400f0620
mov eax, ebx
jmp 0x1400ffc72
cmp ebx, 2
ja 0x1400ffc70
mov r9, qword [rdi + 0x668]
lea rdx, [0x14015e568]
lea rcx, [rbx + rbx*2]
add rcx, rdx
mov edx, 2
lea r8d, [rdx - 1]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r9, qword [rdi + 0x668]
mov r8d, 1
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x1400ffc90
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rdi
sub rsp, 0x160
mov rax, qword [0x140193088]
xor rax, rsp
mov qword [rsp + 0x140], rax
cmp byte [rcx + 0xf1e], 0
mov rdi, rcx
jne 0x1400ffcd3
cmp qword [rcx + 0x678], 0
je 0x1400ffdb0
mov r8, rdx
mov qword [rsp + 0x158], rbx
mov edx, 0x100
lea r9, [rsp + 0x180]
lea rcx, [rsp + 0x30]
call fcn.1400ee720
lea rax, [rsp + 0x30]
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x1400ffd01
mov rcx, qword [rdi + 0x678]
test rcx, rcx
je 0x1400ffd48
cmp byte [rdi + 0x1597], 0
jne 0x1400ffd48
lea rdx, [rsp + 0x30]
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rdx]
lea rdx, [rdx + 1]
mov byte [rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x1400ffd30
mov byte [rdi + 0x1597], 1
cmp byte [rdi + 0xf1e], 0
je 0x1400ffda8
mov byte [rsp + rbx + 0x30], 0xa
inc rbx
cmp rbx, 0x102
jae 0x1400ffe03
cmp qword [rdi + 0x718], 0
mov byte [rsp + rbx + 0x30], 0
je 0x1400ffdc9
mov dl, 1
mov rcx, rdi
call fcn.1400f0620
mov rax, qword [rdi + 0x670]
lea r8, [rsp + 0x30]
mov r9, rbx
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, rdi
call qword [rdi + 0x718]
xor edx, edx
mov rcx, rdi
call fcn.1400f0620
mov rbx, qword [rsp + 0x158]
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.140139460
add rsp, 0x160
pop rdi
ret
mov r9, qword [rdi + 0x668]
lea rcx, [0x14015e568]
mov edx, 2
lea r8d, [rdx - 1]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r9, qword [rdi + 0x668]
lea rcx, [rsp + 0x30]
mov r8d, 1
mov rdx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
jmp 0x1400ffda8
call fcn.140139240
int3