joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400397e4
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x110
mov rax, qword [0x1401cd300]
xor rax, rsp
mov qword [rsp + 0x100], rax
mov edi, 0x20
lea rdx, [0x1401ce130]
mov ecx, edi
call sub.d3d9.dll_Direct3DCreate9Ex
test eax, eax
jns 0x140039829
lea ecx, [rdi - 0x1d]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov eax, dword [0x1401ce210]
lea rdx, [0x1401ce670]
mov rcx, qword [0x1401ce130]
mov ebx, 1
mov r9, qword [0x1401ce668]
mov r8d, ebx
and qword [0x1401ce0fc], 0
and dword [0x1401ce10c], 0
and qword [0x1401ce124], 0
and dword [0x1401ce12c], 0
and dword [0x1401ce104], 0
mov qword [rsp + 0x30], rdx
lea rdx, [0x1401ce0f0]
mov dword [0x1401ce0f0], eax
mov eax, dword [0x1401ce214]
mov qword [rsp + 0x28], rdx
xor edx, edx
mov dword [0x1401ce0f4], eax
mov dword [0x1401ce0f8], 0x15
mov dword [0x1401ce120], 0x50
mov dword [0x1401ce108], ebx
mov dword [0x1401ce11c], ebx
mov qword [0x1401ce110], r9
mov dword [0x1401ce118], ebx
mov rax, qword [rcx]
mov dword [rsp + 0x20], edi
call qword [rax + 0x80]
mov edx, 0x1548
mov qword [rsp + 0x28], reloc.WS2_32.dll_sendto
lea r9d, [rbx + 7]
mov qword [rsp + 0x20], reloc.WS2_32.dll_recv
mov r8d, 0x3a0
lea rcx, str.1.67_WIP
call fcn.140007358
xor ecx, ecx
call fcn.140006fbc
call fcn.140008f74
mov rcx, qword [0x1401ce668]
mov rsi, rax
call fcn.14001fa64
mov rcx, qword [0x1401ce670]
call fcn.14001f130
xor ecx, ecx
call fcn.14001809c
call fcn.140009408
lea rcx, [rsp + 0x70]
call fcn.1400125a8
lea rdx, str.C:WindowsFontsBahnschrift.ttf
mov byte [rsp + 0xb8], bl
lea rcx, [rsp + 0x40]
mov byte [rsp + 0x90], bl
mov dword [rsp + 0x88], 3
mov dword [rsp + 0x8c], 3
call fcn.14002dfac
mov rdi, qword [rsi + 0x98]
mov rcx, rdi
call fcn.1400159a8
lea rcx, [rsp + 0x40]
mov rbx, rax
call fcn.140036d08
movss xmm2, dword [0x1400e97d0]
xor r9d, r9d
mov rdx, rax
mov qword [rsp + 0x20], rbx
mov rcx, rdi
call fcn.140012fc4
movss xmm3, dword [0x1400e43a8]
lea rdi, [0x1400e928c]
mov qword [0x1401ce1b0], rax
lea rdx, [0x140135760]
mov rcx, qword [rsi + 0x98]
lea rax, [rsp + 0x70]
mov ebx, 0x5e74c
mov qword [rsp + 0x28], rdi
mov r8d, ebx
mov qword [rsp + 0x20], rax
call fcn.140013660
and qword [rsp + 0x28], 0
mov r8d, 0x1b44c
and qword [rsp + 0x20], 0
movss xmm3, dword [0x1400e97d8]
mov rcx, qword [rsi + 0x98]
lea rdx, [0x14011a310]
call fcn.140013660
movss xmm3, dword [0x1400e43a8]
lea rdx, [0x140135760]
mov qword [0x1401ce1b8], rax
mov r8d, ebx
mov rcx, qword [rsi + 0x98]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
call fcn.140013660
mov rcx, qword [0x1401ce130]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.1400df3e0
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x140039d1c
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rsi, r8
mov r14, rdx
mov rbp, rcx
test r8, r8
jg 0x140039d4a
xor eax, eax
jmp 0x140039e31
cmp qword [rcx + 0x68], 0
je 0x140039d5c
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
jmp 0x140039e31
mov rdi, rsi
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Gnavail_void_const___ptr64]
test rax, rax
je 0x140039d9c
cmp rax, rsi
mov rbx, rsi
mov rcx, rbp
cmovb rbx, rax
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gptr_void_const___ptr64]
mov r8, rbx
mov rcx, r14
mov rdx, rax
call fcn.1400e0af0
mov edx, ebx
mov rcx, rbp
add r14, rbx
sub rdi, rbx
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int____ptr64]
cmp qword [rbp + 0x80], 0
je 0x140039e2b
mov rcx, rbp
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::eback_void_const___ptr64]
lea rcx, [rbp + 0x70]
cmp rax, rcx
jne 0x140039dd6
mov rdx, qword [rbp + 0x88]
mov rcx, rbp
mov r9, qword [rbp + 0x90]
mov r8, rdx
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::setg_char____ptr64__char____ptr64__char____ptr64____ptr64]
mov rcx, rdi
mov ebx, 0xfff
jmp 0x140039e06
mov r9, qword [rbp + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rdi, rax
add r14, rax
mov rcx, rdi
cmp rax, rbx
jne 0x140039e2b
cmp rdi, rbx
ja 0x140039de0
test rcx, rcx
je 0x140039e2b
mov r9, qword [rbp + 0x80]
mov r8, rdi
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rdi, rax
sub rsi, rdi
mov rax, rsi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140039e4c
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je 0x140039e76
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x140039ee6
mov rsi, rbx
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov rbp, rax
test rbx, rbx
jle 0x140039ee0
test rax, rax
jle 0x140039ec0
cmp rbx, rax
mov rcx, rdi
cmovl rbp, rbx
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, rbp
mov rdx, r14
mov rcx, rax
call fcn.1400e0af0
mov edx, ebp
mov rcx, rdi
add r14, rbp
sub rbx, rbp
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
test rbx, rbx
jle 0x140039ee0
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140039ee0
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
sub rsi, rbx
mov rax, rsi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x14003b770
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 7], sil
je 0x14003b7a4
mov eax, esi
lea ecx, [rax - 0x6a]
xor byte [r8 + rax], cl
inc rax
cmp rax, 6
jb 0x14003b790
mov byte [r8 + 7], sil
add r8, 6
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.14003ac90
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x14003b7c9
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.14004fac0
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x14003b843
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003b83e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003b83e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400defec
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x14003b850
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 0xa], sil
je 0x14003b884
mov eax, esi
lea ecx, [rax - 0x6a]
xor byte [r8 + rax], cl
inc rax
cmp rax, 9
jb 0x14003b870
mov byte [r8 + 0xa], sil
add r8, 9
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.14003ac90
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x14003b8a9
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.14004fac0
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x14003b923
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003b91e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003b91e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400defec
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x14003b930
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 0x31], sil
je 0x14003b964
mov eax, esi
lea ecx, [rax - 0x6a]
xor byte [r8 + rax], cl
inc rax
cmp rax, 0x30
jb 0x14003b950
mov byte [r8 + 0x31], sil
add r8, 0x30
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.14003ac90
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x14003b989
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.14004fac0
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x14003ba03
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003b9fe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003b9fe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400defec
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x14003ba10
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 0xc], sil
je 0x14003ba44
mov eax, esi
lea ecx, [rax - 0x6a]
xor byte [r8 + rax], cl
inc rax
cmp rax, 0xb
jb 0x14003ba30
mov byte [r8 + 0xc], sil
add r8, 0xb
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.14003ac90
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x14003ba69
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.14004fac0
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x14003bae3
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003bade
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003bade
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400defec
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x140043990
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 8], al
je 0x1400439b3
lea edx, [rax - 0x6a]
xor byte [rax + rcx], dl
inc rax
cmp rax, 7
jb 0x1400439a0
mov byte [rcx + 8], 0
lea r8, [rcx + 7]
mov rdx, rcx
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.14003ac90
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x1400439d0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 9], al
je 0x1400439f3
lea edx, [rax - 0x6a]
xor byte [rax + rcx], dl
inc rax
cmp rax, 8
jb 0x1400439e0
mov byte [rcx + 9], 0
lea r8, [rcx + 8]
mov rdx, rcx
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.14003ac90
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x140043a10
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 0xa], al
je 0x140043a33
lea edx, [rax - 0x6a]
xor byte [rax + rcx], dl
inc rax
cmp rax, 9
jb 0x140043a20
mov byte [rcx + 0xa], 0
lea r8, [rcx + 9]
mov rdx, rcx
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.14003ac90
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x140043a50
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 0x10], al
je 0x140043a73
lea edx, [rax - 0x6a]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xf
jb 0x140043a60
mov byte [rcx + 0x10], 0
lea r8, [rcx + 0xf]
mov rdx, rcx
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.14003ac90
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x140043a90
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 0xb], al
je 0x140043ab3
lea edx, [rax - 0x6a]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xa
jb 0x140043aa0
mov byte [rcx + 0xb], 0
lea r8, [rcx + 0xa]
mov rdx, rcx
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.14003ac90
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x140044d90
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r10, qword [rcx]
mov r9d, 0x270
mov ecx, dword [r10]
cmp ecx, r9d
jne 0x140044df1
lea r8, [r10 + 8]
nop dword [rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x140044db0
mov ecx, dword [r10]
jmp 0x140044eda
cmp ecx, 0x4e0
jb 0x140044eda
lea r11, [r10 + 0x9c4]
mov qword [rsp], rbx
mov eax, dword [r11]
mov ebx, 0xe3
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x140044e10
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x140044e60
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
xor ecx, ecx
mov dword [r10], ecx
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret

Function at 0x140045be0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 5], 0
je 0x140045c03
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x6a]
xor byte [rax + rcx], dl
inc rax
cmp rax, 4
jb 0x140045bf0
mov byte [rcx + 5], 0
mov rax, rcx
ret
Function at 0x140046210
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0xa8
xor eax, eax
cmp byte [0x1401ce6c8], al
jne 0x1400462c1
movdqa xmm0, xmmword [0x1400eb800]
movdqa xmm1, xmmword [0x1400eba40]
movdqa xmmword [rsp + 0x40], xmm0
movdqa xmm0, xmmword [0x1400eba80]
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmm0, xmmword [0x1400eb850]
movdqa xmmword [rsp + 0x50], xmm1
movdqa xmm1, xmmword [0x1400eb8d0]
movdqa xmmword [rsp + 0x80], xmm0
movdqa xmmword [rsp + 0x70], xmm1
mov dword [rsp + 0x90], 0x1009488
nop dword [rax]
lea ecx, [rax - 0x6a]
xor byte [rsp + rax + 0x40], cl
inc rax
cmp rax, 0x52
jb 0x140046280
lea r9, [rsp + 0xb0]
mov byte [rsp + 0x93], 0
lea r8, [rsp + 0x92]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.14003ac90
lea rcx, [rsp + 0x20]
call fcn.14004b420
add rsp, 0xa8
ret
Function at 0x14004c260
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x1310]
mov eax, 0x1410
call fcn.1400df410
sub rsp, rax
mov rax, qword [0x1401cd300]
xor rax, rsp
mov qword [rbp + 0x1308], rax
mov rdi, rcx
mov qword [rsp + 0x50], rcx
xor ebx, ebx
mov dword [rsp + 0x24], ebx
call sub.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_
mov edx, eax
mov dword [rbp + 0x12e4], 0xffffffff
mov dword [rsp + 0x64], eax
mov r14d, 1
mov ecx, r14d
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, ecx
mov dword [rsp + rcx*4 + 0x64], edx
inc rcx
cmp rcx, 0x270
jb 0x14004c2c0
mov dword [rsp + 0x60], 0x270
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x28]
call fcn.140044d90
mov ecx, eax
lea rax, [rcx + rcx*2]
add rax, rax
cmp eax, 3
ja 0x14004c328
nop dword [rax]
lea rcx, [rsp + 0x28]
call fcn.140044d90
mov ecx, eax
lea rax, [rcx + rcx*2]
add rax, rax
cmp eax, 4
jb 0x14004c310
shr rax, 0x20
lea esi, [rax + 5]
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rbx
mov qword [rdi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rdi], bl
mov dword [rsp + 0x24], r14d
test esi, esi
je 0x14004c49d
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
nop word [rax + rax]
lea rcx, [rsp + 0x28]
call fcn.140044d90
mov ecx, eax
lea rcx, [rcx + rcx*4]
add rcx, rcx
cmp ecx, 5
ja 0x14004c398
nop dword [rax + rax]
lea rcx, [rsp + 0x28]
call fcn.140044d90
mov ecx, eax
lea rcx, [rcx + rcx*4]
add rcx, rcx
cmp ecx, 6
jb 0x14004c380
shr rcx, 0x20
lea r10, [rbp + 0x1305]
test ecx, ecx
jns 0x14004c3f0
neg ecx
nop dword [rax]
dec r10
mov eax, 0xcccccccd
mul ecx
shr edx, 3
movzx eax, dl
shl al, 2
lea r8d, [rax + rdx]
add r8b, r8b
sub cl, r8b
add cl, 0x30
mov byte [r10], cl
mov ecx, edx
test edx, edx
jne 0x14004c3b0
dec r10
mov byte [r10], 0x2d
jmp 0x14004c419
dec r10
mov eax, 0xcccccccd
mul ecx
shr edx, 3
movzx eax, dl
shl al, 2
lea r8d, [rax + rdx]
add r8b, r8b
sub cl, r8b
add cl, 0x30
mov byte [r10], cl
mov ecx, edx
test edx, edx
jne 0x14004c3f0
lea r9, [rsp + 0x20]
lea r8, [rbp + 0x1305]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.14003ac90
or r14d, 6
mov dword [rsp + 0x24], r14d
lea rdx, [rsp + 0x30]
cmp qword [rsp + 0x48], 0x10
cmovae rdx, qword [rsp + 0x30]
mov r8, qword [rsp + 0x40]
mov rcx, rdi
call fcn.140036a84
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x14004c493
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004c48e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004c4c7
call fcn.1400defec
inc ebx
cmp ebx, esi
jl 0x14004c360
mov rax, rdi
mov rcx, qword [rbp + 0x1308]
xor rcx, rsp
call fcn.1400df3e0
lea r11, [rsp + 0x1410]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x14004c550
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x60
mov rdi, rcx
mov qword [rsp + 0x58], rcx
xor ebx, ebx
mov dword [rsp + 0x30], ebx
lea rcx, str.ALLUSERSPROFILE
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x14004c5b0
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rbx
mov qword [rdi + 0x18], rbx
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], bl
jne 0x14004c597
mov rdx, rax
mov rcx, rdi
call fcn.14002c914
jmp 0x14004c690
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
movdqa xmm1, xmmword [0x1400e9830]
movdqu xmmword [rsp + 0x48], xmm1
mov word [rsp + 0x38], bx
mov dword [rsp + 0x30], 2
lea rcx, [rsp + 0x38]
call fcn.1400448a0
test eax, eax
jne 0x14004c6b0
lea rbp, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
call fcn.1400e0300
mov r14d, eax
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rbx
mov qword [rdi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rdi], 0
mov dword [rsp + 0x30], 0x22
test rsi, rsi
je 0x14004c686
cmp rsi, 0x7fffffff
ja 0x14004c6bf
mov dword [rsp + 0x20], ebx
xor r9d, r9d
mov r8d, esi
mov rdx, rbp
mov ecx, eax
call fcn.1400e0370
mov rbx, rax
shr rax, 0x20
test eax, eax
jne 0x14004c6ca
movsxd rdx, ebx
xor r8d, r8d
mov rcx, rdi
call fcn.140054ce0
mov r9, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x14004c66c
mov r9, qword [rdi]
mov dword [rsp + 0x20], ebx
mov r8d, esi
mov rdx, rbp
mov ecx, r14d
call fcn.1400e0370
shr rax, 0x20
test eax, eax
jne 0x14004c6a8
lea rcx, [rsp + 0x38]
call fcn.1400367e0
mov rax, rdi
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
mov ecx, eax
call fcn.1400365f0
nop
mov edx, eax
lea rcx, str.current_path__
call fcn.140045520
nop
mov ecx, socket
call fcn.1400365b4
int3
mov ecx, eax
call fcn.1400365f0
int3
Function at 0x14005d370
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
call sub.api_ms_win_crt_stdio_l1_1_0.dll__read
cdqe
add rsp, 0x28
ret
Function at 0x140064c90
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x140064d72
call fcn.140087020
test al, al
jne 0x140064d72
mov qword [rsp + 0x30], rsi
xor esi, esi
mov qword [rsp + 0x38], rdi
mov rdi, 0xffffffffffffffff
inc rdi
cmp byte [rbx + rdi], sil
jne 0x140064cc2
mov r8, rdi
mov edx, 0x2e
mov rcx, rbx
call fcn.140090f30
test rax, rax
je 0x140064d07
sub rax, rbx
mov edx, 0x2e
mov r8, rax
mov rcx, rbx
call fcn.140090f30
mov rsi, rax
test rax, rax
je 0x140064d07
inc rsi
mov rcx, rbx
sub rcx, rsi
add rdi, rcx
test rsi, rsi
cmovne rbx, rsi
lea rsi, [rbx + rdi]
mov edi, 0x1505
cmp rbx, rsi
jae 0x140064d3b
nop dword [rax]
movzx ecx, byte [rbx]
call fcn.14007a370
imul rdi, rdi, 0x21
movsx rcx, al
inc rbx
xor rdi, rcx
cmp rbx, rsi
jb 0x140064d20
mov rsi, qword [rsp + 0x30]
mov rcx, rdi
movabs rax, 0x410410410410411
mul rdi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 5
imul rcx, rcx, 0x3f
sub rdi, rcx
mov rax, rdi
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
xor eax, eax
add rsp, 0x20
pop rbx
ret