joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001bf90
Capabilities:
Set console window title
Terminate process

Disassembly:
push rdi
sub rsp, 0xc0
call qword [sym.imp.SecureEngineSDK64.dll_Ordinal_151]
lea rcx, [0x1400b3e48]
call fcn.140019c10
lea rcx, [0x1400b3b98]
call fcn.140019bd0
lea rcx, [0x1400b51f0]
call fcn.140019b90
lea rcx, [0x1400b3b2c]
call fcn.140019b10
lea rcx, [0x1400b3ba8]
call fcn.140019b50
lea rcx, [0x1400b3bd0]
call fcn.1400303c0
movzx eax, byte [0x1400b3de0]
test eax, eax
jne 0x14001c21b
call fcn.14001b790
lea rcx, [0x1400b3e48]
call fcn.140019c10
lea rcx, [0x1400b3b98]
call fcn.140019bd0
lea rcx, [0x1400b51f0]
call fcn.140019b90
lea rcx, [0x1400b3b2c]
call fcn.140019b10
lea rcx, [0x1400b3ba8]
call fcn.140019b50
call fcn.140016ac0
mov edx, listen
lea rcx, [rsp + 0x88]
call fcn.140017f80
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x30]
call fcn.14000d040
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
lea rcx, [rsp + 0x88]
call fcn.1400067b0
lea rax, [rsp + 0x20]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x20]
call fcn.140015d10
mov rcx, rax
call fcn.1400154a0
mov edx, 7
mov rcx, rax
call fcn.140016b00
mov ecx, Ordinal_151
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rsp + 0x21]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rsp + 0xa8]
lea rcx, [rsp + 0x21]
call fcn.140015fc0
mov rcx, rax
call fcn.1400152a0
mov edx, reloc.WS2_32.dll_ntohs
mov rcx, rax
call fcn.140016b00
mov ecx, Ordinal_151
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rsp + 0x22]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x22]
call fcn.1400160e0
mov rcx, rax
call fcn.1400154a0
mov edx, 7
mov rcx, rax
call fcn.140016b00
mov ecx, Ordinal_151
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rsp + 0x23]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x23]
call fcn.140016230
mov rcx, rax
call fcn.140015440
mov edx, 2
mov rcx, rax
call fcn.140016b00
mov ecx, Ordinal_151
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rsp + 0x24]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x24]
call fcn.140016320
mov rcx, rax
call fcn.140015200
mov edx, listen
mov rcx, rax
call fcn.140016b00
mov rax, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x25]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x25]
call fcn.1400163a0
mov rcx, rax
call fcn.140015460
mov qword [rsp + 0x38], rax
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
call fcn.1400117d0
lea rdx, [0x1400b3de8]
mov rcx, rax
call fcn.140011780
lea rcx, [0x1400b3de8]
call fcn.140019af0
call fcn.140017ce0
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
call fcn.140017230
call qword [sym.imp.SecureEngineSDK64.dll_Ordinal_551]
jmp 0x14001c22a
xor eax, eax
add rsp, 0xc0
pop rdi
ret
Function at 0x14001de90
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov rax, qword [rsp + 0x20]
mov qword [rsp], rax
mov rax, qword [rsp]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14001deb4
xor eax, eax
jmp 0x14001dee2
mov rax, qword [rsp]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 8], rax
mov rax, qword [rsp + 8]
cmp dword [rax], 0x4550
je 0x14001dedd
xor eax, eax
jmp 0x14001dee2
mov rax, qword [rsp + 8]
add rsp, 0x18
ret
Function at 0x14001fe50
Capabilities:
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x30], 0xffffffffffffffff
inc qword [rsp + 0x30]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
cmp byte [rax + rcx], 0
jne 0x14001fe79
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x88]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x88]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
movzx eax, word [rax + 0x14]
mov rcx, qword [rsp + 0x40]
lea rax, [rcx + rax + 0x18]
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x20], 0
jmp 0x14001fee3
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x40]
movzx eax, word [rax + 6]
cmp dword [rsp + 0x20], eax
jae 0x14001ffa9
mov eax, dword [rsp + 0x20]
imul rax, rax, 0x28
mov rcx, qword [rsp + 0x58]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov r8, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x80]
mov rcx, rax
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14001ffa4
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x38], 0xffffffffffffffff
inc qword [rsp + 0x38]
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x38]
cmp byte [rax + rcx], 0
jne 0x14001ff3f
mov rax, qword [rsp + 0x38]
cmp qword [rsp + 0x48], rax
jne 0x14001ffa4
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0xc], 0
jne 0x14001ff6f
xor eax, eax
jmp 0x14001ffab
cmp qword [rsp + 0x90], 0
je 0x14001ff8c
mov rax, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x28]
mov ecx, dword [rcx + 8]
mov dword [rax], ecx
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0xc]
mov rcx, qword [rsp + 0x88]
add rcx, rax
mov rax, rcx
jmp 0x14001ffab
jmp 0x14001fed9
xor eax, eax
add rsp, 0x78
ret
Function at 0x14001ffb0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x270
mov rax, qword [0x1400b30c0]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov dword [rsp + 0x20], 0
lea rax, [rsp + 0x50]
mov rdi, rax
xor eax, eax
mov ecx, 0x20a
rep stosb byte [rdi], al
lea rdx, [rsp + 0x50]
mov ecx, 0x105
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0
je 0x14002000d
cmp dword [rsp + 0x24], 0x105
jbe 0x140020039
lea rdx, [0x140096858]
mov rcx, qword [rsp + 0x280]
call fcn.140005cb0
mov eax, dword [rsp + 0x20]
or eax, 1
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x280]
jmp 0x1400200ec
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x28], 0xffffffffffffffff
inc qword [rsp + 0x28]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x28]
cmp word [rax + rcx*2], 0
jne 0x14002004c
mov rax, qword [rsp + 0x28]
movzx eax, word [rsp + rax*2 + 0x4e]
cmp eax, 0x5c
jne 0x1400200c7
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], 0xffffffffffffffff
inc qword [rsp + 0x30]
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
cmp word [rax + rcx*2], 0
jne 0x140020084
mov rax, qword [rsp + 0x30]
lea rax, [rax + rax - 2]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0x20a
jae 0x1400200b6
jmp 0x1400200bb
call fcn.140087e14
xor eax, eax
mov rcx, qword [rsp + 0x38]
mov word [rsp + rcx + 0x50], ax
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x280]
call fcn.140005cb0
mov eax, dword [rsp + 0x20]
or eax, 1
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x280]
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140087a80
add rsp, 0x270
pop rdi
ret
Function at 0x140020110
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x98
mov rax, qword [0x1400b30c0]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x60], 0
lea r9, [rsp + 0x60]
mov r8d, dword [rsp + 0x60]
mov rdx, qword [rsp + 0x28]
mov ecx, listen
call sub.ntdll.dll_NtQuerySystemInformation
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0xc0000004
jne 0x1400201bf
cmp qword [rsp + 0x28], 0
je 0x140020181
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, dword [rsp + 0x60]
mov r9d, 4
mov r8d, 0x3000
mov edx, eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x60]
mov r8d, dword [rsp + 0x60]
mov rdx, qword [rsp + 0x28]
mov ecx, listen
call sub.ntdll.dll_NtQuerySystemInformation
mov dword [rsp + 0x30], eax
jmp 0x14002015c
cmp dword [rsp + 0x30], 0
jge 0x1400201e8
cmp qword [rsp + 0x28], 0
je 0x1400201e1
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
jmp 0x140020303
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x140020201
xor eax, eax
jmp 0x140020303
mov dword [rsp + 0x20], 0
jmp 0x140020215
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x38]
mov eax, dword [rax]
cmp dword [rsp + 0x20], eax
jae 0x1400202ee
mov eax, dword [rsp + 0x20]
imul rax, rax, 0x128
mov rcx, qword [rsp + 0x38]
lea rax, [rcx + rax + 8]
mov ecx, dword [rsp + 0x20]
imul rcx, rcx, 0x128
mov rdx, qword [rsp + 0x38]
movzx ecx, word [rdx + rcx + 0x2e]
lea rax, [rax + rcx + 0x28]
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.140005c10
mov rcx, qword [rsp + 0xa0]
call fcn.14000d040
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x68]
call fcn.14000d040
mov qword [rsp + 0x48], rax
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x1400202df
mov eax, dword [rsp + 0x20]
imul rax, rax, 0x128
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx + rax + 0x18]
mov qword [rsp + 0x50], rax
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x68]
call fcn.1400067b0
mov rax, qword [rsp + 0x58]
jmp 0x140020303
lea rcx, [rsp + 0x68]
call fcn.1400067b0
jmp 0x14002020b
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140087a80
add rsp, 0x98
ret
Function at 0x140020d10
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 7], sil
je 0x140020d44
mov eax, esi
lea ecx, [rax + 0x7f]
xor byte [r8 + rax], cl
inc rax
cmp rax, 6
jb 0x140020d30
mov byte [r8 + 7], sil
add r8, 6
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.140020680
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140020d69
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140031820
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140020de3
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140020dde
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140020dde
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400877e4
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x140020df0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r10, r8
mov rdi, rdx
mov rsi, rcx
mov qword [rsp + 0x28], rcx
xor ebx, ebx
cmp byte [r8 + 9], bl
je 0x140020e24
mov ecx, ebx
lea eax, [rcx + 0x7f]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 8
jb 0x140020e10
mov byte [r8 + 9], bl
add r8, 8
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x50]
call fcn.140020680
nop
cmp byte [rdi + 9], 0
je 0x140020e54
lea eax, [rbx + 0x7f]
xor byte [rbx + rdi], al
inc rbx
cmp rbx, 8
jb 0x140020e41
mov byte [rdi + 9], 0
lea r8, [rdi + 8]
lea r9, [rsp + 0x20]
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.140020680
nop
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
movzx edx, byte [rsp + 0x20]
mov rcx, rsi
call fcn.140026c30
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140020ec4
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140020ebe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140020ebe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400877e4
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x140020f04
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140020eff
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140020eff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400877e4
mov rax, rsi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x140020f10
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 9], sil
je 0x140020f44
mov eax, esi
lea ecx, [rax + 0x7f]
xor byte [r8 + rax], cl
inc rax
cmp rax, 8
jb 0x140020f30
mov byte [r8 + 9], sil
add r8, 8
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.140020680
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140020f69
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140031820
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140020fe3
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140020fde
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140020fde
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400877e4
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x140020ff0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 0xa], sil
je 0x140021024
mov eax, esi
lea ecx, [rax + 0x7f]
xor byte [r8 + rax], cl
inc rax
cmp rax, 9
jb 0x140021010
mov byte [r8 + 0xa], sil
add r8, 9
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.140020680
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140021049
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140031820
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x1400210c3
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400210be
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400210be
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400877e4
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400210d0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 0xc], sil
je 0x140021104
mov eax, esi
lea ecx, [rax + 0x7f]
xor byte [r8 + rax], cl
inc rax
cmp rax, 0xb
jb 0x1400210f0
mov byte [r8 + 0xc], sil
add r8, 0xb
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.140020680
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140021129
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140031820
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x1400211a3
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002119e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002119e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400877e4
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x140027f50
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 9], al
je 0x140027f73
lea edx, [rax + 0x7f]
xor byte [rax + rcx], dl
inc rax
cmp rax, 8
jb 0x140027f60
mov byte [rcx + 9], 0
lea r8, [rcx + 8]
mov rdx, rcx
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.140020680
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x140027f90
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 0x10], al
je 0x140027fb3
lea edx, [rax + 0x7f]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xf
jb 0x140027fa0
mov byte [rcx + 0x10], 0
lea r8, [rcx + 0xf]
mov rdx, rcx
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.140020680
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x140029ef0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 5], 0
je 0x140029f13
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x7f]
xor byte [rax + rcx], dl
inc rax
cmp rax, 4
jb 0x140029f00
mov byte [rcx + 5], 0
mov rax, rcx
ret

Function at 0x140029f20
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x136], 0
je 0x140029f48
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x7f]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x135
jb 0x140029f30
mov byte [rcx + 0x136], 0
mov rax, rcx
ret

Function at 0x140029f50
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x44], 0
je 0x140029f73
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x7f]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x43
jb 0x140029f60
mov byte [rcx + 0x44], 0
mov rax, rcx
ret

Function at 0x140029f80
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x47], 0
je 0x140029fa3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x7f]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x46
jb 0x140029f90
mov byte [rcx + 0x47], 0
mov rax, rcx
ret
Function at 0x14002b390
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
mov r10, rcx
mov ecx, r9d
test r8, r8
je 0x14002b477
sub r10, rdx
cmp r8, 8
jb 0x14002b453
mov rax, r8
lea r9, [rdx + 4]
and rax, 0xfffffffffffffff8
xorps xmm3, xmm3
xorps xmm2, xmm2
movd xmm1, dword [r10 + r9 - 4]
add rcx, 8
movd xmm0, dword [r9 - 4]
lea r9, [r9 + 8]
punpcklbw xmm1, xmm1
punpcklwd xmm1, xmm1
punpcklbw xmm0, xmm0
psrad xmm1, 0x18
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
pxor xmm1, xmm0
movd xmm0, dword [r9 - 8]
punpcklbw xmm0, xmm0
por xmm3, xmm1
movd xmm1, dword [r10 + r9 - 8]
punpcklbw xmm1, xmm1
punpcklwd xmm1, xmm1
punpcklwd xmm0, xmm0
psrad xmm1, 0x18
psrad xmm0, 0x18
pxor xmm1, xmm0
por xmm2, xmm1
cmp rcx, rax
jb 0x14002b3c0
por xmm2, xmm3
movdqa xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movdqa xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movd r9d, xmm2
cmp rcx, r8
jae 0x14002b477
lea rax, [rcx + rdx]
sub r8, rcx
nop word [rax + rax]
movsx edx, byte [r10 + rax]
movsx ecx, byte [rax]
lea rax, [rax + 1]
xor edx, ecx
or r9d, edx
sub r8, 1
jne 0x14002b460
test r9d, r9d
sete al
ret
Function at 0x14002eea0
Capabilities:
Execute command

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0xa0
mov rax, qword [0x1400b30c0]
xor rax, rsp
mov qword [rsp + 0x98], rax
mov rdi, rcx
mov qword [rsp + 0x90], rcx
mov rcx, qword [rcx + 0x10]
movabs rax, 0x7fffffffffffffff
sub rax, rcx
cmp rax, 0x2d
jb 0x14002f0eb
mov rax, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x14002eef2
mov rax, qword [rdi]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], reloc.WLDAP32.dll_Ordinal_45
lea r9, str.start_cmd__C__color_b__title_Error__echo
mov r8, rdi
movzx edx, byte [rsp + 0x40]
lea rcx, [rsp + 0x68]
call fcn.140026de0
nop
mov rcx, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x80]
mov rax, rdx
sub rax, rcx
cmp rax, 0x11
jb 0x14002ef73
lea rax, [rcx + 0x11]
mov qword [rsp + 0x78], rax
lea rbx, [rsp + 0x68]
cmp rdx, 0x10
cmovae rbx, qword [rsp + 0x68]
add rbx, rcx
mov r8d, reloc.WS2_32.dll_recvfrom
lea rdx, str.__timeout__t_5_
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x11], 0
lea rax, [rsp + 0x68]
jmp 0x14002ef94
mov qword [rsp + 0x20], reloc.WS2_32.dll_recvfrom
lea r9, str.__timeout__t_5_
xor r8d, r8d
lea edx, [r8 + 0x11]
lea rcx, [rsp + 0x68]
call fcn.140012980
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x58], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x58], xmm1
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rcx, [rsp + 0x48]
cmp qword [rsp + 0x60], 0x10
cmovae rcx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x14002f020
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002f01b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002f01b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400877e4
movdqa xmm0, xmmword [0x140097c40]
movdqu xmmword [rsp + 0x58], xmm0
mov byte [rsp + 0x48], 0
mov rdx, qword [rsp + 0x80]
cmp rdx, 0x10
jb 0x14002f076
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002f071
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002f071
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400877e4
xor ecx, ecx
int 0x29
mov rdx, qword [rdi + 0x18]
cmp rdx, 0x10
jb 0x14002f0b0
inc rdx
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x14002f0ab
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14002f0e4
mov rcx, r8
call fcn.1400877e4
mov qword [rdi + 0x10], 0
mov qword [rdi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rdi], 0
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.140087a80
mov rbx, qword [rsp + 0xb8]
add rsp, 0xa0
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.14000cee0
nop
int3