joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400f1f50
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je case.default.0x1400f1f71
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x1400f1f9e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x1400f1fa0
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x1400f1ff9
test ecx, ecx
jle 0x1400f1fd9
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x1400f1ff9
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x1400f1ff9
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret
invalid
Function at 0x1400f2020
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x1400f2051
xor eax, eax
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rcx + 0x68], 0
je case.default.0x1400f2068
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x30], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x1400f208b
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x1400f208d
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x1400f20c9
mov qword [rsp + 0x38], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x38]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x1400f215e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x1400f2104
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x1400f213e
nop dword [rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x1400f215e
cmp rbx, rax
ja 0x1400f2110
test rbx, rbx
je 0x1400f215e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
mov rsi, qword [rsp + 0x48]
sub rbp, rbx
mov rbx, qword [rsp + 0x30]
mov rax, rbp
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
sbb bh, byte [rsi]
jge 0x14026ad9a
and al, 0x43
mov bl, byte [rdi + 0x58]
and eax, 0xaa17f398
adc dword [rsp + riz*4 - 0x55], 0x383f5b23
and ebx, dword [rbx + 0x3f]
cmp byte [rax], ch
xchg esp, eax
push rsp
pavgb mm3, qword [rcx + 0x3185f38b]
test esp, ebx
Function at 0x1400f2580
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140152040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x1400f25ad
xor eax, eax
jmp 0x1400f2719
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x1400f25e7
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x1400f25e7
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x1400f2719
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x1400f270c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x1400f262a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x1400f2655
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1400f2711
lea rax, [rsp + 0x48]
mov byte [rsp + 0x40], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x41]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x40]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400f26c4
sub eax, 1
je 0x1400f26c4
cmp eax, 2
jne 0x1400f270c
movsx ecx, byte [rsp + 0x40]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1400f2711
mov rsi, qword [rsp + 0x48]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x1400f26f2
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x1400f270c
lea rax, [rsp + 0x40]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x50], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x1400f2711
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14010fe20
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x1400f4ee0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140152040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x1400f4fb3
cmp byte [rcx + 0x71], 0
je 0x1400f4fb3
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x1400f4faf
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400f4f74
sub eax, 1
je 0x1400f4f78
cmp eax, 2
jne 0x1400f4faf
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14010fe20
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x1400f4fa6
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x1400f4faf
cmp byte [rbx + 0x71], 0
sete al
jmp 0x1400f4f5c
xor al, al
jmp 0x1400f4f5c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14010fe20
add rsp, 0x60
pop rbx
ret
Function at 0x1400f9fa0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x30
mov rbx, r9
mov rdi, r8
mov rsi, rcx
mov ecx, 0x18
call fcn.140110588
mov rdx, qword [rbx]
mov qword [rax], rdx
mov rdx, qword [rdi]
mov qword [rax + 8], rdx
mov qword [rsp + 0x48], rax
lea rbx, [rsi + 8]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x140106fa0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsi], rax
test rax, rax
je 0x1400fa019
mov rax, rsi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov dword [rbx], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x1400ffe00
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x88
mov rax, qword [0x140152040]
xor rax, rsp
mov qword [rsp + 0x70], rax
xor r8d, r8d
mov dword [rsp + 0x20], r8d
lea eax, [rcx - 0x30]
cmp al, 9
ja 0x1400ffe42
movsx eax, cl
sub eax, 0x30
cdqe
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14010fe20
add rsp, 0x88
ret
lea rdx, [rsp + 0x40]
call fcn.140100020
mov r10, rax
cmp byte [rax + 0xd], r8b
je 0x1400fffdf
cmp dword [0x140152090], 2
jl 0x1400fffa9
movdqa xmm5, xmmword [0x140138ff0]
movdqa xmm2, xmmword [0x140138f00]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm5
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm5
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [str.7777]
psubd xmm2, xmm0
movdqa xmm4, xmmword [0x140138fb0]
andps xmm2, xmm4
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x140139010]
movd xmm0, dword [rax]
xorps xmm2, xmm0
movd dword [rax], xmm2
movdqa xmm3, xmmword [0x140138f30]
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm5
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm5
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [str.7777]
psubd xmm3, xmm0
andps xmm3, xmm4
packuswb xmm3, xmm3
packuswb xmm3, xmm3
paddb xmm3, xmmword [0x140139010]
movd xmm0, dword [rax + 4]
xorps xmm3, xmm0
movd dword [rax + 4], xmm3
movdqa xmm2, xmmword [0x140138f60]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm5
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm5
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [str.7777]
psubd xmm2, xmm0
andps xmm2, xmm4
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x140139010]
movd xmm0, dword [rax + 8]
xorps xmm2, xmm0
movd dword [rax + 8], xmm2
mov r8d, recv
mov r9d, r8d
add r9, r10
nop
mov eax, 0x94f2095
imul r8d
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x37
movzx eax, r8b
sub al, cl
add al, 0x35
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0xe
jl 0x1400fffb0
mov rdx, r10
lea rcx, [rsp + 0x50]
call fcn.140079ed0
nop
mov dword [rsp + 0x20], 1
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.140078450
lea rdx, [0x14014e018]
lea rcx, [rsp + 0x28]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x140100050
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
sub rsp, 0xa8
movaps xmmword [rax - 0x18], xmm6
movaps xmmword [rax - 0x28], xmm7
mov rax, qword [0x140152040]
xor rax, rsp
mov qword [rsp + 0x78], rax
xor r8d, r8d
mov dword [rsp + 0x20], r8d
lea eax, [rcx - 0x30]
cmp al, 9
ja 0x140100089
movzx eax, cl
sub rax, 0x30
jmp 0x1401000a7
lea eax, [rcx - 0x41]
cmp al, 5
ja 0x140100099
movzx eax, cl
sub rax, 0x37
jmp 0x1401000a7
lea eax, [rcx - 0x61]
cmp al, 5
ja 0x1401000cc
movzx eax, cl
sub rax, 0x57
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14010fe20
movaps xmm6, xmmword [rsp + 0x90]
movaps xmm7, xmmword [rsp + 0x80]
add rsp, 0xa8
ret
lea rdx, [rsp + 0x40]
call fcn.140100300
mov r10, rax
cmp byte [rax + 0x11], r8b
je 0x1401002bf
cmp dword [0x140152090], 2
jl 0x140100288
movdqa xmm5, xmmword [0x140138ff0]
movdqa xmm6, xmmword [str.7777]
movdqa xmm7, xmmword [0x140139010]
movdqa xmm2, xmmword [0x140138f00]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm5
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm5
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
movdqa xmm4, xmmword [0x140138fb0]
andps xmm2, xmm4
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm7
movd xmm0, dword [rax]
xorps xmm2, xmm0
movd dword [rax], xmm2
movdqa xmm3, xmmword [0x140138f30]
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm5
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm5
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
andps xmm3, xmm4
packuswb xmm3, xmm3
packuswb xmm3, xmm3
paddb xmm3, xmm7
movd xmm0, dword [rax + 4]
xorps xmm3, xmm0
movd dword [rax + 4], xmm3
movdqa xmm2, xmmword [0x140138f60]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm5
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm5
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
andps xmm2, xmm4
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm7
movd xmm0, dword [rax + 8]
xorps xmm2, xmm0
movd dword [rax + 8], xmm2
movdqa xmm3, xmmword [0x140138f70]
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm5
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm5
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
andps xmm3, xmm4
packuswb xmm3, xmm3
packuswb xmm3, xmm3
paddb xmm3, xmm7
movd xmm0, dword [rax + 0xc]
xorps xmm3, xmm0
movd dword [rax + 0xc], xmm3
mov r8d, reloc.WS2_32.dll_recv
mov r9d, r8d
add r9, r10
nop
mov eax, 0x94f2095
imul r8d
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x37
movzx eax, r8b
sub al, cl
add al, 0x35
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0x12
jl 0x140100290
mov rdx, r10
lea rcx, [rsp + 0x58]
call fcn.140079ed0
nop
mov dword [rsp + 0x20], 1
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.140078450
lea rdx, [0x14014e018]
lea rcx, [rsp + 0x28]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x140106b30
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x88
mov rax, qword [0x140152040]
xor rax, rsp
mov qword [rsp + 0x70], rax
xor r8d, r8d
mov dword [rsp + 0x20], r8d
lea eax, [rcx - 0x30]
cmp al, 9
ja 0x140106b71
movzx eax, cl
sub ax, 0x30
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14010fe20
add rsp, 0x88
ret
lea rdx, [rsp + 0x40]
call fcn.140100020
mov r10, rax
cmp byte [rax + 0xd], r8b
je 0x140106d0f
cmp dword [0x140152090], 2
jl 0x140106cd8
movdqa xmm5, xmmword [0x140138ff0]
movdqa xmm2, xmmword [0x140138f00]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm5
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm5
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [str.7777]
psubd xmm2, xmm0
movdqa xmm4, xmmword [0x140138fb0]
andps xmm2, xmm4
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x140139010]
movd xmm0, dword [rax]
xorps xmm2, xmm0
movd dword [rax], xmm2
movdqa xmm3, xmmword [0x140138f30]
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm5
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm5
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [str.7777]
psubd xmm3, xmm0
andps xmm3, xmm4
packuswb xmm3, xmm3
packuswb xmm3, xmm3
paddb xmm3, xmmword [0x140139010]
movd xmm0, dword [rax + 4]
xorps xmm3, xmm0
movd dword [rax + 4], xmm3
movdqa xmm2, xmmword [0x140138f60]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm5
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm5
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [str.7777]
psubd xmm2, xmm0
andps xmm2, xmm4
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x140139010]
movd xmm0, dword [rax + 8]
xorps xmm2, xmm0
movd dword [rax + 8], xmm2
mov r8d, recv
mov r9d, r8d
add r9, r10
nop
mov eax, 0x94f2095
imul r8d
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x37
movzx eax, r8b
sub al, cl
add al, 0x35
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0xe
jl 0x140106ce0
mov rdx, r10
lea rcx, [rsp + 0x50]
call fcn.140079ed0
nop
mov dword [rsp + 0x20], 1
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.140078450
lea rdx, [0x14014e018]
lea rcx, [rsp + 0x28]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x1401095a0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
cmp byte [0x1401f4c89], 0
je 0x1401096ea
movabs rsi, 0x7ffffffffff0bdbf
movabs rbp, 0x7fffffffffffffff
mov r14d, 0xff
nop dword [rax]
lea rcx, [0x140250e50]
call qword [sym.imp.MSVCP140.dll__Mtx_lock]
test eax, eax
jne 0x140109715
cmp dword [0x140250e9c], 0x7fffffff
je 0x1401096ff
lea rcx, [0x1402554c0]
call fcn.1400967e0
cmp dword [0x140255238], 3
jne 0x14010968e
mov rbx, qword [0x140256d98]
mov rdi, qword [0x140256da0]
cmp rbx, rdi
je 0x14010966b
nop dword [rax]
mov rcx, qword [rbx]
test rcx, rcx
je 0x140109662
cmp byte [rcx + 0xa], 0
je 0x140109656
cmp byte [0x140255046], 0
jne 0x140109656
cmp byte [rcx + 8], 0
je 0x140109662
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
cmp byte [rcx + 8], 0
je 0x140109662
mov rax, qword [rcx]
call qword [rax + ioctlsocket]
add rbx, 8
cmp rbx, rdi
jne 0x140109630
call fcn.14009be70
lea rcx, [0x140250e50]
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
lea rcx, [rsp + 0x48]
call fcn.1400634a0
mov rax, qword [rsp + 0x48]
jmp 0x1401096af
lea rcx, [0x140250e50]
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
lea rcx, [rsp + 0x48]
call fcn.1400634a0
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
cmp rax, rsi
je 0x1401096ce
mov ecx, 1
cmovl ecx, r14d
test cl, cl
jns 0x1401096ce
add rax, 0xf4240
mov qword [rsp + 0x50], rax
jmp 0x1401096d3
mov qword [rsp + 0x50], rbp
lea rcx, [rsp + 0x50]
call fcn.1401004e0
cmp byte [0x1401f4c89], 0
jne 0x1401095e0
mov rbx, qword [rsp + 0x40]
xor eax, eax
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
mov ecx, 6
mov dword [0x140250e9c], 0x7ffffffe
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov ecx, 5
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x140110cd8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140110d22
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140110d22
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140110d22
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140110d22
cmp dword [rcx + 0x84], 0xe
jbe 0x140110d22
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140110d24
xor al, al
add rsp, 0x28
ret
Function at 0x140003c40
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 4], 0
je 0x140003c63
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x1f]
xor byte [rax + rcx], dl
inc rax
cmp rax, 3
jb 0x140003c50
mov byte [rcx + 4], 0
mov rax, rcx
ret
Function at 0x140004800
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0xfd0]
mov eax, 0x10d0
call fcn.14012d940
sub rsp, rax
mov eax, dword [0x1401ef1d0]
lea r8, [rsp + 0x48]
xor esi, esi
mov dword [rsp + 0x4c], eax
mov qword [rsp + 0x38], rsi
lea rax, [rbp + 0xff0]
mov ebx, edx
mov rdi, rcx
mov rcx, qword [0x1401ef1c8]
mov edx, 0x22225c
mov qword [rsp + 0x30], rsi
lea r9d, [rsi + 0x10]
mov dword [rsp + 0x28], esi
mov qword [rbp + 0xff0], rsi
mov dword [rsp + 0x48], 0x89067
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov qword [rsp + 0x38], rsi
lea r9d, [rsi + 0x28]
mov eax, ebx
mov qword [rsp + 0x30], rsi
sar eax, 0x10
lea r8, [rsp + 0x58]
mov dword [rsp + 0x28], esi
mov edx, 0x222264
mov qword [rbp + 0x1000], rsi
mov dword [rsp + 0x79], esi
lea ecx, [rax*8 + 0x10]
mov word [rsp + 0x7d], si
mov rax, qword [rbp + 0xff0]
add rax, 0xab60e00
mov byte [rsp + 0x7f], sil
add rcx, rax
mov dword [rsp + 0x58], 0x89067
lea rax, [rbp + 0x1000]
mov qword [rsp + 0x60], rcx
mov rcx, qword [0x1401ef1c8]
mov qword [rsp + 0x68], rax
mov eax, dword [0x1401ef1d0]
mov dword [rsp + 0x5c], eax
mov qword [rsp + 0x70], 8
mov byte [rsp + 0x78], sil
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
xor edx, edx
lea rcx, [rbp + 0x7c0]
mov r8d, 0x808
call sub.VCRUNTIME140.dll_memset
mov rax, qword [rbp + 0x1000]
lea r9d, [rsi + 0x28]
mov qword [rsp + 0x38], rsi
lea r8, [rbp - 0x80]
mov qword [rsp + 0x30], rsi
mov edx, 0x222264
movzx ecx, bx
mov dword [rsp + 0x28], esi
mov dword [rbp - 0x5f], esi
mov word [rbp - 0x5b], si
lea rcx, [rax + rcx*4]
mov byte [rbp - 0x59], sil
lea rax, [rbp + 0x7c0]
mov qword [rbp - 0x78], rcx
mov rcx, qword [0x1401ef1c8]
mov qword [rbp - 0x70], rax
mov eax, dword [0x1401ef1d0]
mov dword [rbp - 0x7c], eax
mov dword [rbp - 0x80], 0x89067
mov qword [rbp - 0x68], 0x808
mov byte [rbp - 0x60], sil
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
lea rcx, [rbp - 0x50]
mov r8d, 0x808
lea rdx, [rbp + 0x7c0]
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [0x1401ef230]
call fcn.140018d40
mov qword [rbp + 0xff0], rax
movzx r9d, si
movzx eax, word [rbp + 0x7c4]
shr ax, 1
cmp si, ax
jae 0x140004a03
nop dword [rax]
movzx ecx, r9w
lea r8, [rbp - 0x4a]
add r8, rcx
movzx ecx, r9b
and ecx, 3
inc r9w
movzx edx, byte [rbp + rcx + 0xff0]
xor dl, byte [r8]
xor dl, al
mov byte [r8], dl
movzx eax, word [rbp - 0x4c]
shr ax, 1
cmp r9w, ax
jb 0x1400049d0
xorps xmm0, xmm0
lea rax, [rbp - 0x4a]
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov r8, 0xffffffffffffffff
mov qword [rdi + 0x18], rsi
nop dword [rax]
inc r8
cmp byte [rax + r8], sil
jne 0x140004a20
lea rdx, [rbp - 0x4a]
mov rcx, rdi
call fcn.140019c30
mov rbx, qword [rsp + 0x10f8]
mov rax, rdi
add rsp, 0x10d0
pop rdi
pop rsi
pop rbp
ret