joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140052950
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140187080]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14005297d
xor eax, eax
jmp 0x140052ae9
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x1400529b7
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x1400529b7
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x140052ae9
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x140052adc
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x1400529fa
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140052a25
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140052ae1
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140052a94
sub eax, 1
je 0x140052a94
cmp eax, 2
jne 0x140052adc
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140052ae1
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x140052ac2
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x140052adc
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x140052ae1
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400c91e0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x140054290
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140187080]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140054363
cmp byte [rcx + 0x71], 0
je 0x140054363
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + Ordinal_26]
cmp eax, 0xffffffff
je 0x14005435f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140054324
sub eax, 1
je 0x140054328
cmp eax, 2
jne 0x14005435f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400c91e0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140054356
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14005435f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14005430c
xor al, al
jmp 0x14005430c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400c91e0
add rsp, 0x60
pop rbx
ret
Function at 0x140063bf0
Capabilities:
Hash data using fnv
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
movaps xmmword [rsp + 0x30], xmm6
movaps xmm6, xmm3
movzx r14d, r8b
mov r8d, 0xffffffff
mov ebx, r8d
movzx r9d, byte [rcx]
lea rdx, [rcx + 1]
test r9b, r9b
je 0x140063c60
lea r10, [0x140165260]
nop
cmp r9b, 0x23
jne 0x140063c43
cmp byte [rdx], r9b
jne 0x140063c43
cmp byte [rdx + 1], r9b
cmove ebx, r8d
movzx ecx, bl
movzx eax, r9b
xor rcx, rax
shr ebx, 8
xor ebx, dword [r10 + rcx*4]
movzx r9d, byte [rdx]
inc rdx
test r9b, r9b
jne 0x140063c30
not ebx
mov dword [rsp + 0x80], ebx
mov edi, ebx
shr edi, 0x18
mov esi, ebx
shr esi, 0x10
mov ebp, ebx
shr ebp, 8
mov edx, 4
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x1405ca008], eax
jle 0x140063ce6
lea rcx, [0x1405ca008]
call fcn.1400c92a8
cmp dword [0x1405ca008], 0xffffffff
jne 0x140063ce6
xorps xmm0, xmm0
movups xmmword [0x1405ca010], xmm0
movups xmmword [0x1405ca020], xmm0
movups xmmword [0x1405ca030], xmm0
movups xmmword [0x1405ca040], xmm0
call fcn.1400340c0
lea rcx, [0x140137ed0]
call fcn.1400c97e8
nop
lea rcx, [0x1405ca008]
call fcn.1400c923c
movzx edx, bl
movabs r12, 0xcbf29ce484222325
xor rdx, r12
movabs r15, 0x100000001b3
imul rdx, r15
movzx eax, bpl
xor rdx, rax
imul rdx, r15
movzx eax, sil
xor rdx, rax
imul rdx, r15
mov eax, edi
xor rdx, rax
imul rdx, r15
and rdx, qword [0x1405ca040]
add rdx, rdx
mov rax, qword [0x1405ca028]
mov rcx, qword [rax + rdx*8 + 8]
xor edi, edi
mov r8, qword [0x1405ca018]
cmp rcx, r8
je 0x140063d60
mov rax, qword [rax + rdx*8]
cmp ebx, dword [rcx + 0x10]
je 0x140063d63
cmp rcx, rax
je 0x140063d60
mov rcx, qword [rcx + 8]
cmp ebx, dword [rcx + 0x10]
jne 0x140063d50
jmp 0x140063d63
mov rcx, rdi
mov rax, r8
test rcx, rcx
cmovne rax, rcx
cmp rax, r8
jne 0x140063e09
mov dword [rsp + 0x70], ebx
movss dword [rsp + 0x74], xmm6
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x20]
call fcn.140034370
movzx edx, bl
xor rdx, r12
imul rdx, r15
movzx eax, byte [rsp + 0x81]
xor rdx, rax
imul rdx, r15
movzx eax, byte [rsp + 0x82]
xor rdx, rax
imul rdx, r15
movzx eax, byte [rsp + 0x83]
xor rdx, rax
imul rdx, r15
and rdx, qword [0x1405ca040]
add rdx, rdx
mov r8, qword [0x1405ca028]
mov rcx, qword [r8 + rdx*8 + 8]
mov rax, qword [0x1405ca018]
cmp rcx, rax
je 0x140063e02
mov r8, qword [r8 + rdx*8]
cmp ebx, dword [rcx + 0x10]
je 0x140063dff
cmp rcx, r8
je 0x140063e02
mov rcx, qword [rcx + 8]
cmp ebx, dword [rcx + 0x10]
jne 0x140063df1
mov rdi, rcx
test rdi, rdi
cmovne rax, rdi
movss xmm1, dword [0x14016c5dc]
mov rcx, qword [0x1405c99b0]
subss xmm1, dword [rcx + 0x18]
mulss xmm1, dword [rsp + 0x98]
test r14b, r14b
je 0x140063e34
movss xmm6, dword [rsp + 0x90]
subss xmm6, dword [rax + 0x14]
mulss xmm6, xmm1
addss xmm6, dword [rax + 0x14]
movss dword [rax + 0x14], xmm6
movaps xmm0, xmm6
mov rbx, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x88]
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x140067210
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rdi, rdx
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [r8 + 7], sil
je 0x14006729b
movdqa xmm2, xmmword [0x14013a350]
mov ecx, esi
movdqa xmm0, xmmword [0x14013a380]
movdqa xmmword [rsp + 0x30], xmm0
movzx edx, word [rsp + 0x30]
nop dword [rax + rax]
movq xmm1, rcx
punpcklqdq xmm1, xmm1
paddq xmm1, xmm2
andps xmm1, xmmword [0x14013a360]
packuswb xmm1, xmm1
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd xmm0, edx
psubb xmm1, xmm0
movzx eax, word [r8 + rcx]
movd xmm0, eax
xorps xmm1, xmm0
movd eax, xmm1
mov word [r8 + rcx], ax
add rcx, 2
cmp rcx, 6
jb 0x140067250
mov byte [r8 + 7], sil
add r8, 6
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.14005b350
nop
mov r9, qword [rdi + 0x10]
cmp qword [rdi + 0x18], 0xf
jbe 0x1400672c0
mov rdi, qword [rdi]
mov r8, rdi
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140059520
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x14006733a
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140067335
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140067335
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c9800
mov rax, rbx
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x140067a60
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r10, r8
mov rdi, rdx
mov rsi, rcx
mov qword [rsp + 0x28], rcx
mov ebx, 8
cmp byte [r8 + 0xb], 0
je 0x140067b45
movdqa xmm2, xmmword [0x14013a380]
mov eax, dword [0x14013a310]
movzx eax, ax
movd xmm1, eax
psubb xmm1, xmm2
movzx eax, word [r8]
movd xmm0, eax
xorps xmm1, xmm0
movd eax, xmm1
mov word [r8], ax
mov eax, dword [0x14013a320]
movzx eax, ax
movd xmm1, eax
psubb xmm1, xmm2
movzx eax, word [r8 + 2]
movd xmm0, eax
xorps xmm1, xmm0
movd eax, xmm1
mov word [r8 + 2], ax
mov eax, dword [0x14013a330]
movzx eax, ax
movd xmm1, eax
psubb xmm1, xmm2
movzx eax, word [r8 + 4]
movd xmm0, eax
xorps xmm1, xmm0
movd eax, xmm1
mov word [r8 + 4], ax
mov eax, dword [0x14013a340]
movzx eax, ax
movd xmm1, eax
psubb xmm1, xmm2
movzx eax, word [r8 + 6]
movd xmm0, eax
xorps xmm1, xmm0
movd eax, xmm1
mov word [r8 + 6], ax
mov ecx, ebx
nop word [rax + rax]
lea eax, [rcx - 0x74]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 0xa
jb 0x140067b30
mov byte [r8 + 0xb], 0
add r8, 0xa
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x50]
call fcn.14005b350
nop
cmp byte [rdi + 0xb], 0
je 0x140067c33
mov eax, dword [0x14013a310]
movzx eax, ax
movd xmm2, eax
mov ecx, dword [0x14013a380]
movzx eax, cx
movd xmm0, eax
psubb xmm2, xmm0
movzx eax, word [rdi]
movd xmm0, eax
xorps xmm2, xmm0
movd eax, xmm2
mov word [rdi], ax
mov eax, dword [0x14013a320]
movzx eax, ax
movd xmm1, eax
movzx eax, cx
movd xmm0, eax
psubb xmm1, xmm0
movzx eax, word [rdi + 2]
movd xmm0, eax
xorps xmm1, xmm0
movd eax, xmm1
mov word [rdi + 2], ax
mov eax, dword [0x14013a330]
movzx eax, ax
movd xmm1, eax
movzx eax, cx
movd xmm0, eax
psubb xmm1, xmm0
movzx eax, word [rdi + 4]
movd xmm0, eax
xorps xmm1, xmm0
movd eax, xmm1
mov word [rdi + 4], ax
mov eax, dword [0x14013a340]
movzx eax, ax
movd xmm1, eax
movzx eax, cx
movd xmm0, eax
psubb xmm1, xmm0
movzx eax, word [rdi + 6]
movd xmm0, eax
xorps xmm1, xmm0
movd eax, xmm1
mov word [rdi + 6], ax
nop word [rax + rax]
lea eax, [rbx - 0x74]
xor byte [rdi + rbx], al
inc rbx
cmp rbx, 0xa
jb 0x140067c20
mov byte [rdi + 0xb], 0
lea r8, [rdi + 0xa]
lea r9, [rsp + 0x20]
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.14005b350
nop
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
movzx edx, byte [rsp + 0x20]
mov rcx, rsi
call fcn.140058b00
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x140067ca3
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140067c9d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140067c9d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c9800
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x140067ce3
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140067cde
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140067cde
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c9800
mov rax, rsi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x140067e00
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r10, r8
mov rdi, rdx
mov rsi, rcx
mov qword [rsp + 0x28], rcx
mov ebx, 8
cmp byte [r8 + 0xb], 0
je 0x140067ee5
movdqa xmm2, xmmword [0x14013a380]
mov eax, dword [0x14013a310]
movzx eax, ax
movd xmm1, eax
psubb xmm1, xmm2
movzx eax, word [r8]
movd xmm0, eax
xorps xmm1, xmm0
movd eax, xmm1
mov word [r8], ax
mov eax, dword [0x14013a320]
movzx eax, ax
movd xmm1, eax
psubb xmm1, xmm2
movzx eax, word [r8 + 2]
movd xmm0, eax
xorps xmm1, xmm0
movd eax, xmm1
mov word [r8 + 2], ax
mov eax, dword [0x14013a330]
movzx eax, ax
movd xmm1, eax
psubb xmm1, xmm2
movzx eax, word [r8 + 4]
movd xmm0, eax
xorps xmm1, xmm0
movd eax, xmm1
mov word [r8 + 4], ax
mov eax, dword [0x14013a340]
movzx eax, ax
movd xmm1, eax
psubb xmm1, xmm2
movzx eax, word [r8 + 6]
movd xmm0, eax
xorps xmm1, xmm0
movd eax, xmm1
mov word [r8 + 6], ax
mov ecx, ebx
nop word [rax + rax]
lea eax, [rcx - 0x74]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 0xa
jb 0x140067ed0
mov byte [r8 + 0xb], 0
add r8, 0xa
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x50]
call fcn.14005b350
nop
cmp byte [rdi + 0xe], 0
je 0x140067fd3
mov eax, dword [0x14013a310]
movzx eax, ax
movd xmm2, eax
mov ecx, dword [0x14013a380]
movzx eax, cx
movd xmm0, eax
psubb xmm2, xmm0
movzx eax, word [rdi]
movd xmm0, eax
xorps xmm2, xmm0
movd eax, xmm2
mov word [rdi], ax
mov eax, dword [0x14013a320]
movzx eax, ax
movd xmm1, eax
movzx eax, cx
movd xmm0, eax
psubb xmm1, xmm0
movzx eax, word [rdi + 2]
movd xmm0, eax
xorps xmm1, xmm0
movd eax, xmm1
mov word [rdi + 2], ax
mov eax, dword [0x14013a330]
movzx eax, ax
movd xmm1, eax
movzx eax, cx
movd xmm0, eax
psubb xmm1, xmm0
movzx eax, word [rdi + 4]
movd xmm0, eax
xorps xmm1, xmm0
movd eax, xmm1
mov word [rdi + 4], ax
mov eax, dword [0x14013a340]
movzx eax, ax
movd xmm1, eax
movzx eax, cx
movd xmm0, eax
psubb xmm1, xmm0
movzx eax, word [rdi + 6]
movd xmm0, eax
xorps xmm1, xmm0
movd eax, xmm1
mov word [rdi + 6], ax
nop word [rax + rax]
lea eax, [rbx - 0x74]
xor byte [rdi + rbx], al
inc rbx
cmp rbx, 0xd
jb 0x140067fc0
mov byte [rdi + 0xe], 0
lea r8, [rdi + 0xd]
lea r9, [rsp + 0x20]
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.14005b350
nop
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
movzx edx, byte [rsp + 0x20]
mov rcx, rsi
call fcn.140058b00
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x140068043
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006803d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14006803d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c9800
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x140068083
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006807e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14006807e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c9800
mov rax, rsi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x140069aa0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x140187080]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbx, rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.1400c9834
mov rdi, rax
lea rax, [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rdi
cmp byte [rbx + 0xb], 0
je 0x140069ba3
movdqa xmm2, xmmword [0x14013a380]
mov eax, dword [0x14013a310]
movzx eax, ax
movd xmm1, eax
psubb xmm1, xmm2
movzx eax, word [rbx]
movd xmm0, eax
xorps xmm1, xmm0
movd eax, xmm1
mov word [rbx], ax
mov eax, dword [0x14013a320]
movzx eax, ax
movd xmm1, eax
psubb xmm1, xmm2
movzx eax, word [rbx + 2]
movd xmm0, eax
xorps xmm1, xmm0
movd eax, xmm1
mov word [rbx + 2], ax
mov eax, dword [0x14013a330]
movzx eax, ax
movd xmm1, eax
psubb xmm1, xmm2
movzx eax, word [rbx + 4]
movd xmm0, eax
xorps xmm1, xmm0
movd eax, xmm1
mov word [rbx + 4], ax
mov eax, dword [0x14013a340]
movzx eax, ax
movd xmm1, eax
psubb xmm1, xmm2
movzx eax, word [rbx + 6]
movd xmm0, eax
xorps xmm1, xmm0
movd eax, xmm1
mov word [rbx + 6], ax
mov eax, 8
nop word [rax + rax]
lea ecx, [rax - 0x74]
xor byte [rbx + rax], cl
inc rax
cmp rax, 0xa
jb 0x140069b90
mov byte [rbx + 0xb], 0
lea r8, [rbx + 0xa]
lea r9, [rsp + 0x20]
mov rdx, rbx
mov rcx, rdi
call fcn.14005b350
nop
mov rax, rdi
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400c91e0
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x1400701b0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
sub rsp, 0x18
cmp byte [rcx + 0x19], 0
je 0x14007031e
movdqa xmm0, xmmword [0x14013a380]
lea r10, [rcx + 4]
movdqa xmm2, xmmword [0x14013a350]
mov r8, 0xfffffffffffffffe
mov r9d, 2
movdqa xmmword [rsp], xmm0
movzx r11d, word [rsp]
sub r8, rcx
sub r9, rcx
mov rdx, 0xfffffffffffffffc
sub rdx, rcx
nop dword [rax]
lea rax, [rdx + r10]
movd xmm0, r11d
movq xmm1, rax
movzx eax, word [r10 - 4]
punpcklqdq xmm1, xmm1
paddq xmm1, xmm2
andps xmm1, xmmword [0x14013a360]
packuswb xmm1, xmm1
packuswb xmm1, xmm1
packuswb xmm1, xmm1
psubb xmm1, xmm0
movd xmm0, eax
xorps xmm1, xmm0
movd xmm0, r11d
movd eax, xmm1
mov word [r10 - 4], ax
lea rax, [r8 + r10]
movq xmm1, rax
movzx eax, word [r10 - 2]
punpcklqdq xmm1, xmm1
paddq xmm1, xmm2
andps xmm1, xmmword [0x14013a360]
packuswb xmm1, xmm1
packuswb xmm1, xmm1
packuswb xmm1, xmm1
psubb xmm1, xmm0
movd xmm0, eax
xorps xmm1, xmm0
movd xmm0, r11d
movd eax, xmm1
mov word [r10 - 2], ax
mov rax, r10
sub rax, rcx
movq xmm1, rax
movzx eax, word [r10]
punpcklqdq xmm1, xmm1
paddq xmm1, xmm2
andps xmm1, xmmword [0x14013a360]
packuswb xmm1, xmm1
packuswb xmm1, xmm1
packuswb xmm1, xmm1
psubb xmm1, xmm0
movd xmm0, eax
xorps xmm1, xmm0
movd xmm0, r11d
movd eax, xmm1
mov word [r10], ax
lea rax, [r9 + r10]
movq xmm1, rax
movzx eax, word [r10 + 2]
punpcklqdq xmm1, xmm1
paddq xmm1, xmm2
andps xmm1, xmmword [0x14013a360]
packuswb xmm1, xmm1
packuswb xmm1, xmm1
packuswb xmm1, xmm1
psubb xmm1, xmm0
movd xmm0, eax
xorps xmm1, xmm0
movd eax, xmm1
mov word [r10 + 2], ax
add r10, 8
lea rax, [rdx + r10]
cmp rax, 0x18
jb 0x140070200
mov byte [rcx + 0x19], 0
mov rax, rcx
add rsp, 0x18
ret
Function at 0x140070330
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x18
cmp byte [rcx + 0x44], 0
mov rdx, rcx
je 0x1400704b3
movdqa xmm0, xmmword [0x14013a380]
lea r10, [rcx + 4]
movdqa xmm2, xmmword [0x14013a350]
mov r8, 0xfffffffffffffffe
movdqa xmmword [rsp], xmm0
sub r8, rcx
movzx r11d, word [rsp]
xor eax, eax
mov r9d, 2
sub r9, rcx
nop dword [rax]
nop dword [rax + rax]
movzx ecx, word [r10 - 4]
movq xmm1, rax
punpcklqdq xmm1, xmm1
add rax, 8
paddq xmm1, xmm2
movd xmm0, r11d
andps xmm1, xmmword [0x14013a360]
packuswb xmm1, xmm1
packuswb xmm1, xmm1
packuswb xmm1, xmm1
psubb xmm1, xmm0
movd xmm0, ecx
xorps xmm1, xmm0
movd xmm0, r11d
movd ecx, xmm1
mov word [r10 - 4], cx
lea rcx, [r8 + r10]
movq xmm1, rcx
movzx ecx, word [r10 - 2]
punpcklqdq xmm1, xmm1
paddq xmm1, xmm2
andps xmm1, xmmword [0x14013a360]
packuswb xmm1, xmm1
packuswb xmm1, xmm1
packuswb xmm1, xmm1
psubb xmm1, xmm0
movd xmm0, ecx
xorps xmm1, xmm0
movd xmm0, r11d
movd ecx, xmm1
mov word [r10 - 2], cx
mov rcx, r10
sub rcx, rdx
movq xmm1, rcx
movzx ecx, word [r10]
punpcklqdq xmm1, xmm1
paddq xmm1, xmm2
andps xmm1, xmmword [0x14013a360]
packuswb xmm1, xmm1
packuswb xmm1, xmm1
packuswb xmm1, xmm1
psubb xmm1, xmm0
movd xmm0, ecx
xorps xmm1, xmm0
movd xmm0, r11d
movd ecx, xmm1
mov word [r10], cx
lea rcx, [r9 + r10]
movq xmm1, rcx
movzx ecx, word [r10 + 2]
punpcklqdq xmm1, xmm1
paddq xmm1, xmm2
andps xmm1, xmmword [0x14013a360]
packuswb xmm1, xmm1
packuswb xmm1, xmm1
packuswb xmm1, xmm1
psubb xmm1, xmm0
movd xmm0, ecx
xorps xmm1, xmm0
movd ecx, xmm1
mov word [r10 + 2], cx
add r10, 8
cmp rax, 0x40
jb 0x140070380
cmp rax, 0x43
jae 0x1400704af
nop dword [rax]
lea ecx, [rax - 0x74]
xor byte [rdx + rax], cl
inc rax
cmp rax, 0x43
jb 0x1400704a0
mov byte [rdx + 0x44], 0
mov rax, rdx
add rsp, 0x18
ret
Function at 0x140071530
Capabilities:
Execute command

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x140187080]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rsi, rcx
mov qword [rsp + 0x78], rcx
mov r8, rcx
lea rdx, [0x14013a278]
lea rcx, [rsp + 0x58]
call fcn.140055840
mov rdi, rax
mov rcx, qword [rax + 0x10]
mov rdx, qword [rax + 0x18]
mov rax, rdx
sub rax, rcx
cmp rax, 0x11
jb 0x1400715ba
lea rax, [rcx + 0x11]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0xf
jbe 0x14007159b
mov rax, qword [rdi]
lea rbx, [rax + rcx]
mov r8d, reloc.WS2_32.dll_recvfrom
lea rdx, [0x14013a260]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x11], 0
jmp 0x1400715dd
mov qword [rsp + 0x20], reloc.WS2_32.dll_recvfrom
lea r9, [0x14013a260]
xor r8d, r8d
mov edx, reloc.WS2_32.dll_recvfrom
mov rcx, rdi
call fcn.140057710
mov rdi, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
movups xmm0, xmmword [rdi]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rdi + 0x10], 0
mov qword [rdi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rdi], 0
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 0xf
cmova rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x140071669
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140071664
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140071664
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c9800
movdqa xmm0, xmmword [0x14016c720]
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x30], 0
mov rdx, qword [rsp + 0x70]
cmp rdx, 0xf
jbe 0x1400716bc
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400716b7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400716b7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c9800
xor ecx, ecx
int 0x29
mov rdx, qword [rsi + 0x18]
cmp rdx, 0xf
jbe 0x1400716f6
inc rdx
mov rcx, qword [rsi]
cmp rdx, 0x1000
jb 0x1400716f1
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14007172e
mov rcx, r8
call fcn.1400c9800
mov qword [rsi + 0x10], 0
mov qword [rsi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rsi], 0
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400c91e0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x14007ed60
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__read]
cdqe
add rsp, 0x28
ret