joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400223b0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x5db8], 0
lea rbx, [rcx + 0x5dc0]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x140022457
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x14002240a
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.140030e40
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.140030770
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x5db8]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x5dc8]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x14011efd0]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x14002245f
mov rcx, rbx
call fcn.140030770
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x14002ae30
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [0x14011efc8]
mov rbx, rcx
xor ecx, ecx
mov dword [rax + 0x5d14], ecx
test rbx, rbx
je 0x14002ae9f
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x38], rdi
call fcn.14002aeb0
lea rdx, [0x1400c0df4]
mov rcx, rbx
mov rdi, rax
call fcn.140020050
mov rbx, rax
test rax, rax
je 0x14002ae9a
mov r8, qword [rsp + 0x30]
mov r9, rax
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret

Function at 0x14002f240
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push r14
sub rsp, 0x20
mov rbx, qword [0x14011efc8]
cmp byte [rbx + 0x5d11], 0
jne 0x14002f39c
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x14002f395
lea rdx, [0x1400c0df0]
mov qword [rsp + 0x40], rdi
call fcn.140020050
mov rdi, rax
test rax, rax
je 0x14002f390
mov qword [rsp + 0x30], rbp
mov rcx, rax
mov qword [rsp + 0x38], rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebp, eax
cmp eax, 0xffffffff
je 0x14002f37d
xor edx, edx
mov r8d, 2
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x14002f37d
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rsi, eax
cmp esi, 0xffffffff
je 0x14002f37d
xor r8d, r8d
mov edx, ebp
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x14002f37d
cmp rsi, 0xffffffffffffffff
je 0x14002f37d
mov rdx, qword [0x14011efd8]
mov rcx, rsi
call qword [0x14011d960]
mov rbp, rax
mov rax, qword [0x14011efc8]
test rax, rax
je 0x14002f31a
inc dword [rax + 0xf0]
test rbp, rbp
je 0x14002f37d
mov r9, rdi
mov r8, rsi
mov edx, 1
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rdi
cmp rax, rsi
je 0x14002f343
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
jmp 0x14002f359
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rsi, rsi
je 0x14002f359
mov rdx, rsi
mov rcx, rbp
call fcn.140021ef0
mov rax, qword [0x14011efc8]
test rax, rax
je 0x14002f36b
dec dword [rax + 0xf0]
mov rdx, qword [0x14011efd8]
mov rcx, rbp
call qword [0x14011d968]
jmp 0x14002f386
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rsi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x40]
mov byte [rbx + 0x5d11], 1
movss xmm0, dword [rbx + 0x5d14]
xorps xmm1, xmm1
comiss xmm0, xmm1
jbe 0x14002f3df
subss xmm0, dword [rbx + 0x18]
comiss xmm1, xmm0
movss dword [rbx + 0x5d14], xmm0
jb 0x14002f3df
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x14002f3ce
call fcn.14002ae30
jmp 0x14002f3d5
mov byte [rbx + 0xd6], 1
mov dword [rbx + 0x5d14], 0
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140047290
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
push rbx
sub rsp, 0x20
call fcn.14001f140
test rax, rax
je 0x1400472ae
call fcn.14001f530
mov rbx, qword [rax + 0x88]
jmp 0x1400472b0
xor ebx, ebx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
shr rax, 0x10
mov r9d, 4
movzx ecx, ax
lea r8, [rbx + 0x2c]
mov edx, 0x20001004
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x1400472db
mov dword [rbx + 0x2c], eax
add rsp, 0x20
pop rbx
ret

Function at 0x140047ea0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x38
mov rax, qword [0x14011efc8]
mov rcx, qword [rax + 0x4bd8]
mov r10, qword [rax + 0x3f08]
movsxd rax, dword [rcx + 0x74]
movups xmm0, xmmword [rcx + 0x168]
movss xmm4, dword [rcx + 0x168]
movss xmm3, dword [rcx + 0x16c]
movss xmm2, dword [rcx + 0x170]
movss xmm1, dword [rcx + 0x174]
movss dword [rsp + 0x20], xmm4
movss dword [rsp + 0x24], xmm3
movss dword [rsp + 0x28], xmm2
movss dword [rsp + 0x2c], xmm1
imul r9, rax, 0x70
mov rax, qword [r10 + 0x2a0]
add r9, qword [rcx + 0x18]
movups xmmword [r10 + 0x240], xmm0
movss dword [rax + 0x88], xmm4
movss dword [rax + 0x8c], xmm3
movss dword [rax + 0x90], xmm2
movss dword [rax + 0x94], xmm1
mov rax, qword [r10 + 0x2a0]
movups xmm0, xmmword [rsp + 0x20]
movsxd r8, dword [rax + 0x58]
mov rdx, qword [rax + 0x60]
add r8, r8
movups xmmword [rdx + r8*8 - 0x10], xmm0
movzx r8d, word [r9 + 0x5c]
mov rdx, qword [r10 + 0x2a0]
mov rcx, qword [rcx + 0x198]
add rsp, 0x38
jmp 0x14003cdd0

Function at 0x140047f70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x38
mov rax, qword [0x14011efc8]
mov rcx, qword [rax + 0x4bd8]
mov r9, qword [rax + 0x3f08]
movups xmm0, xmmword [r9 + 0x240]
movups xmmword [rcx + 0x168], xmm0
mov rax, qword [r9 + 0x2a0]
movups xmm0, xmmword [rcx + 0x148]
movss xmm4, dword [rcx + 0x148]
movss xmm3, dword [rcx + 0x14c]
movss xmm2, dword [rcx + 0x150]
movss xmm1, dword [rcx + 0x154]
movups xmmword [r9 + 0x240], xmm0
movss dword [rsp + 0x20], xmm4
movss dword [rsp + 0x24], xmm3
movss dword [rsp + 0x28], xmm2
movss dword [rsp + 0x2c], xmm1
movss dword [rax + 0x88], xmm4
movss dword [rax + 0x8c], xmm3
movss dword [rax + 0x90], xmm2
movss dword [rax + 0x94], xmm1
mov rax, qword [r9 + 0x2a0]
movups xmm0, xmmword [rsp + 0x20]
movsxd r8, dword [rax + 0x58]
mov rdx, qword [rax + 0x60]
add r8, r8
movups xmmword [rdx + r8*8 - 0x10], xmm0
movzx r8d, word [rcx + 0x226]
mov rcx, qword [rcx + 0x198]
mov rdx, qword [r9 + 0x2a0]
add rsp, 0x38
jmp 0x14003cdd0
Function at 0x140055e90
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x140056041
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x40], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.14000d080
lea rax, [rdi - 1]
mov qword [rsi + 0x38], rdi
mov qword [rsi + 0x30], rax
mov rax, qword [rsi + 8]
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x140056006
mov qword [rsp + 0x38], rbp
movabs rdi, 0x100000001b3
movabs rbp, 0xcbf29ce484222325
nop dword [rax]
nop dword [rax + rax]
movzx edx, byte [rax + 0x11]
movzx r9d, byte [rax + 0x10]
mov r11, qword [rsi + 0x30]
xor r9, rbp
mov rcx, qword [rcx]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x12]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x13]
imul r9, rdi
xor r9, rdx
imul r9, rdi
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rbx
jne 0x140055f80
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x140055ff5
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x140055fbd
mov r10, qword [rdx]
cmp r10, rax
je 0x140055fb7
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x140055ff5
cmp r9, rdx
je 0x140055fd1
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x14005601b
cmp r9, rdx
jne 0x140055fc2
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
jne 0x140055f30
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov r14, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x140055ff5
lea rcx, str.invalid_hash_bucket_count
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_
int3
Function at 0x140056740
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 7], sil
je 0x140056774
mov eax, esi
lea ecx, [rax + 0x50]
xor byte [r8 + rax], cl
inc rax
cmp rax, 6
jb 0x140056760
mov byte [r8 + 7], sil
add r8, 6
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.140056350
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140056799
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140062a30
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140056813
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005680e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005680e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b7ebc
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x140056820
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 9], sil
je 0x140056854
mov eax, esi
lea ecx, [rax + 0x50]
xor byte [r8 + rax], cl
inc rax
cmp rax, 8
jb 0x140056840
mov byte [r8 + 9], sil
add r8, 8
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.140056350
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140056879
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140062a30
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x1400568f3
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400568ee
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400568ee
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b7ebc
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x140056900
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 0xa], sil
je 0x140056934
mov eax, esi
lea ecx, [rax + 0x50]
xor byte [r8 + rax], cl
inc rax
cmp rax, 9
jb 0x140056920
mov byte [r8 + 0xa], sil
add r8, 9
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.140056350
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140056959
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140062a30
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x1400569d3
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400569ce
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400569ce
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b7ebc
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x1400569e0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 0xc], sil
je 0x140056a14
mov eax, esi
lea ecx, [rax + 0x50]
xor byte [r8 + rax], cl
inc rax
cmp rax, 0xb
jb 0x140056a00
mov byte [r8 + 0xc], sil
add r8, 0xb
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.140056350
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140056a39
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140062a30
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140056ab3
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140056aae
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140056aae
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b7ebc
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x14005d480
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 9], al
je 0x14005d4a3
lea edx, [rax + 0x50]
xor byte [rax + rcx], dl
inc rax
cmp rax, 8
jb 0x14005d490
mov byte [rcx + 9], 0
lea r8, [rcx + 8]
mov rdx, rcx
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.140056350
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x14005d4c0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 0x10], al
je 0x14005d4e3
lea edx, [rax + 0x50]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xf
jb 0x14005d4d0
mov byte [rcx + 0x10], 0
lea r8, [rcx + 0xf]
mov rdx, rcx
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.140056350
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x14005e7a0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 5], 0
je 0x14005e7c3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x50]
xor byte [rax + rcx], dl
inc rax
cmp rax, 4
jb 0x14005e7b0
mov byte [rcx + 5], 0
mov rax, rcx
ret

Function at 0x14005e7d0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x136], 0
je 0x14005e7f8
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x50]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x135
jb 0x14005e7e0
mov byte [rcx + 0x136], 0
mov rax, rcx
ret

Function at 0x14005e800
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x44], 0
je 0x14005e823
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x50]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x43
jb 0x14005e810
mov byte [rcx + 0x44], 0
mov rax, rcx
ret

Function at 0x14005e830
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x47], 0
je 0x14005e853
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x50]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x46
jb 0x14005e840
mov byte [rcx + 0x47], 0
mov rax, rcx
ret

Function at 0x14005e870
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0xa8
xor eax, eax
cmp byte [0x14011f0f0], al
jne 0x14005e921
movdqa xmm0, xmmword [str._t_s:033x_5._0]
movdqa xmm1, xmmword [0x1400c6cf0]
movdqa xmmword [rsp + 0x40], xmm0
movdqa xmm0, xmmword [0x1400c6ec0]
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmm0, xmmword [0x1400c7020]
movdqa xmmword [rsp + 0x50], xmm1
movdqa xmm1, xmmword [0x1400c7060]
movdqa xmmword [rsp + 0x80], xmm0
movdqa xmmword [rsp + 0x70], xmm1
mov dword [rsp + 0x90], 0x100d2ce
nop dword [rax]
lea ecx, [rax + 0x50]
xor byte [rsp + rax + 0x40], cl
inc rax
cmp rax, 0x52
jb 0x14005e8e0
lea r9, [rsp + 0xb0]
mov byte [rsp + 0x93], 0
lea r8, [rsp + 0x92]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.140056350
lea rcx, [rsp + 0x20]
call fcn.1400604c0
add rsp, 0xa8
ret
Function at 0x14005f080
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
mov r10, rcx
mov ecx, r9d
test r8, r8
je 0x14005f167
sub r10, rdx
cmp r8, 8
jb 0x14005f13c
mov rax, r8
lea r9, [rdx + 4]
and rax, 0xfffffffffffffff8
xorps xmm3, xmm3
xorps xmm2, xmm2
movd xmm1, dword [r10 + r9 - 4]
add rcx, 8
movd xmm0, dword [r9 - 4]
lea r9, [r9 + 8]
punpcklbw xmm1, xmm1
punpcklwd xmm1, xmm1
punpcklbw xmm0, xmm0
psrad xmm1, 0x18
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
movd xmm0, dword [r9 - 8]
punpcklbw xmm0, xmm0
orps xmm3, xmm1
movd xmm1, dword [r10 + r9 - 8]
punpcklbw xmm1, xmm1
punpcklwd xmm1, xmm1
punpcklwd xmm0, xmm0
psrad xmm1, 0x18
psrad xmm0, 0x18
xorps xmm1, xmm0
orps xmm2, xmm1
cmp rcx, rax
jb 0x14005f0b0
orps xmm2, xmm3
movdqa xmm0, xmm2
psrldq xmm0, 8
orps xmm2, xmm0
movdqa xmm0, xmm2
psrldq xmm0, 4
orps xmm2, xmm0
movd r9d, xmm2
cmp rcx, r8
jae 0x14005f167
lea rax, [rcx + rdx]
sub r8, rcx
nop dword [rax]
nop word [rax + rax]
movsx edx, byte [r10 + rax]
movsx ecx, byte [rax]
lea rax, [rax + 1]
xor edx, ecx
or r9d, edx
sub r8, 1
jne 0x14005f150
test r9d, r9d
sete al
ret
Function at 0x1400604c0
Capabilities:
Encode data using xor
Execute command

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xc0
mov rax, qword [0x14011df80]
xor rax, rsp
mov qword [rbp + 0x4f], rax
mov rbx, rcx
mov qword [rbp + 0x27], rcx
movdqa xmm0, xmmword [0x1400c6f00]
movdqu xmmword [rbp - 0x49], xmm0
mov word [rbp - 0x39], 0x100
xor ecx, ecx
nop dword [rax]
lea eax, [rcx + 0x50]
xor byte [rbp + rcx - 0x49], al
inc rcx
cmp rcx, 0x10
jb 0x140060500
mov byte [rbp - 0x38], 0
movdqa xmm0, xmmword [0x1400c6e40]
movdqu xmmword [rbp - 0x31], xmm0
movdqa xmm1, xmmword [0x1400c6dc0]
movdqu xmmword [rbp - 0x21], xmm1
mov dword [rbp - 0x11], 0x53001e02
mov dword [rbp - 0xd], 0x12565352
mov dword [rbp - 9], 0x5b15111b
mov word [rbp - 5], 0x100
xor ecx, ecx
nop dword [rax + rax]
lea eax, [rcx + 0x50]
xor byte [rbp + rcx - 0x31], al
inc rcx
cmp rcx, 0x2c
jb 0x140060550
mov byte [rbp - 4], 0
mov r8, rbx
lea rdx, [rbp - 0x31]
lea rcx, [rbp + 7]
call fcn.1400565e0
nop
lea rcx, [rbp - 0x49]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rcx + r8], 0
jne 0x140060580
lea rdx, [rbp - 0x49]
mov rcx, rax
call fcn.14005e5f0
xorps xmm0, xmm0
movups xmmword [rbp + 0x2f], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x3f], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x2f], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x3f], xmm1
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rbp + 0x1f]
cmp rdx, 0x10
jb 0x140060605
inc rdx
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140060600
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140060600
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b7ebc
lea rcx, [rbp + 0x2f]
cmp qword [rbp + 0x47], 0x10
cmovae rcx, qword [rbp + 0x2f]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor ecx, ecx
int 0x29
mov rdx, qword [rbp + 0x47]
cmp rdx, 0x10
jb 0x14006065b
inc rdx
mov rcx, qword [rbp + 0x2f]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140060656
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140060656
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b7ebc
movdqa xmm0, xmmword [0x1400bf2d0]
movdqu xmmword [rbp + 0x3f], xmm0
mov byte [rbp + 0x2f], 0
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x1400606a2
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x14006069d
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400606d2
mov rcx, r8
call fcn.1400b7ebc
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.1400b8220
mov rbx, qword [rsp + 0xd8]
add rsp, 0xc0
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x1400642f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x14011df80]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, rdx
mov rsi, rcx
mov qword [rbp - 0x18], rdx
xor edi, edi
mov dword [rbp - 0x50], 0x30312423
mov dword [rbp - 0x4c], 0x252631
mov byte [rbp - 0x48], 1
mov ecx, edi
nop dword [rax]
lea eax, [rcx + 0x50]
xor byte [rbp + rcx - 0x50], al
inc rcx
cmp rcx, 7
jb 0x140064330
mov byte [rbp - 0x48], 0
lea r9, [rbp - 0x40]
lea r8, [rbp - 0x49]
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x38]
call fcn.140056350
nop
cmp byte [rbx], 0
jne 0x14006436b
mov byte [rbx], 1
call fcn.140058400
mov qword [rbx + 8], rax
cmp byte [rbx], 1
jne 0x140064382
lea rdx, [rbp - 0x38]
mov rcx, qword [rbx + 8]
call fcn.14005d390
mov rcx, rax
jmp 0x140064386
mov rcx, qword [rbp - 0x18]
lea rax, [rcx + 8]
cmp byte [rcx], 4
cmovne rax, rdi
movzx eax, byte [rax]
mov byte [rsi + 0x210], al
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x1400643d8
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400643d3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400643d3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b7ebc
mov dword [rbp - 0x50], 0x2021343d
mov dword [rbp - 0x4c], 0x333235
mov byte [rbp - 0x48], 1
mov rcx, rdi
nop dword [rax]
lea eax, [rcx + 0x50]
xor byte [rbp + rcx - 0x50], al
inc rcx
cmp rcx, 7
jb 0x1400643f0
mov byte [rbp - 0x48], 0
lea r9, [rbp - 0x40]
lea r8, [rbp - 0x49]
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x38]
call fcn.140056350
nop
cmp byte [rbx], 0
jne 0x14006442b
mov byte [rbx], 1
call fcn.140058400
mov qword [rbx + 8], rax
cmp byte [rbx], 1
jne 0x14006443f
lea rdx, [rbp - 0x38]
mov rcx, qword [rbx + 8]
call fcn.14005d390
jmp 0x140064443
mov rax, qword [rbp - 0x18]
cmp byte [rax], 3
jne 0x14006444c
mov rdi, qword [rax + 8]
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x140064459
mov rdx, qword [rdi]
lea rcx, [rsi + 0x218]
mov r8, qword [rdi + 0x10]
call fcn.14000d880
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x1400644a9
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400644a3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400644a3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b7ebc
nop
lea rcx, [rbx + 8]
movzx edx, byte [rbx]
call fcn.14005f900
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400b8220
mov rbx, qword [rsp + 0xa0]
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret
Function at 0x14006db70
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__read]
cdqe
add rsp, 0x28
ret