joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140028130
Capabilities:
Get socket status

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x658
mov r15, r8
mov r12, rdx
mov rsi, rcx
mov rax, qword [0x140183d00]
xor rax, rsp
mov qword [rsp + 0x650], rax
mov qword [rsp + 0x450], rcx
mov dword [rsp + 0x448], 1
lea rdi, [rsp + 0x240]
lea rbx, [rsp + 0x448]
mov r8d, 0x208
mov rcx, rdi
mov rdx, rbx
call sub.VCRUNTIME140.dll_memcpy
lea r14, [rsp + 0x38]
mov r8d, 0x208
mov rcx, r14
mov rdx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x34], r15d
lea ebp, [rsi + 1]
lea r15, [rsp + 0x30]
mov r12, qword [sym.imp.WS2_32.dll_select]
mov r13, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
nop dword [rax + rax]
mov qword [rsp + 0x20], r15
mov ecx, ebp
mov rdx, rbx
mov r8, rdi
mov r9, r14
call r12
test eax, eax
jns 0x1400281f6
call r13
cmp dword [rax], 4
je 0x1400281d0
mov esi, 2
jmp 0x14002826e
je 0x140028269
lea rdx, [rsp + 0x448]
mov rcx, rsi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
jne 0x140028220
lea rdx, [rsp + 0x240]
mov rcx, rsi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x1400281ef
mov dword [rsp + 0x2c], 0
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x28]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x2c]
mov rcx, rsi
mov edx, 0xffff
mov r8d, 0x1007
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
sets al
cmp dword [rsp + 0x2c], 0
setne cl
or cl, al
movzx esi, cl
add esi, esi
jmp 0x14002826e
mov esi, recv
mov rcx, qword [rsp + 0x650]
xor rcx, rsp
call fcn.1400f0d70
mov eax, esi
add rsp, 0x658
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x140028610
Capabilities:
Get socket status

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x248
mov rax, qword [0x140183d00]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rsi, qword [rcx + 8]
mov qword [rsp + 0x40], rsi
mov dword [rsp + 0x38], 1
movdqu xmm0, xmmword [rcx + 0x10]
pshufd xmm0, xmm0, 0xe8
movq qword [rsp + 0x30], xmm0
inc esi
lea r14, [rsp + 0x30]
lea rdi, [rsp + 0x38]
mov r15, qword [sym.imp.WS2_32.dll_select]
mov r12, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
nop dword [rax]
mov qword [rsp + 0x20], r14
mov ecx, esi
mov rdx, rdi
xor r8d, r8d
xor r9d, r9d
call r15
mov ebx, eax
test eax, eax
jns 0x140028691
call r12
cmp dword [rax], 4
je 0x140028670
test ebx, ebx
setg bl
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1400f0d70
mov eax, ebx
add rsp, 0x248
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x1400286c0
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x248
mov rsi, rcx
mov rax, qword [0x140183d00]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rdi, qword [rcx + 8]
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x38], 1
movdqu xmm0, xmmword [rcx + 0x20]
pshufd xmm0, xmm0, 0xe8
movq qword [rsp + 0x30], xmm0
inc edi
lea r15, [rsp + 0x30]
lea rbx, [rsp + 0x38]
mov r12, qword [sym.imp.WS2_32.dll_select]
mov r14, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov qword [rsp + 0x20], r15
mov ecx, edi
xor edx, edx
mov r8, rbx
xor r9d, r9d
call r12
test eax, eax
jns 0x140028740
call r14
cmp dword [rax], 4
je 0x140028720
jmp 0x14002879a
je 0x14002879a
mov rsi, qword [rsi + 8]
mov qword [rsp + 0x40], rsi
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x30], 0
lea edi, [rsi + 1]
lea rbx, [rsp + 0x38]
nop word cs:[rax + rax]
mov qword [rsp + 0x20], r15
mov ecx, edi
mov rdx, rbx
xor r8d, r8d
xor r9d, r9d
call r12
test eax, eax
jns 0x1400287bf
call r14
cmp dword [rax], 4
je 0x140028770
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 9
jne 0x1400287c1
xor esi, esi
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1400f0d70
mov eax, esi
add rsp, 0x248
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
je 0x1400287fb
lea rdi, [rsp + 0x38]
mov r15, qword [sym.imp.WS2_32.dll_recv]
nop dword [rax]
mov rcx, rsi
mov rdx, rdi
mov r8d, 1
mov r9d, 2
call r15
mov ebx, eax
test eax, eax
jns 0x1400287f3
call r14
cmp dword [rax], 4
je 0x1400287d0
test ebx, ebx
setg sil
jmp 0x14002879c
mov sil, 1
jmp 0x14002879c
Function at 0x140028800
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x248
mov rsi, rdx
mov rbx, rcx
mov rax, qword [0x140183d00]
xor rax, rsp
cmp r8, 0x7fffffff
mov edi, 0x7fffffff
cmovb rdi, r8
mov qword [rsp + 0x240], rax
mov rdx, qword [rcx + 0x48]
mov r14, qword [rcx + 0x50]
sub r14, rdx
jbe 0x140028867
add rdx, qword [rbx + 0x30]
cmp rdi, r14
cmovb r14, rdi
mov rcx, rsi
mov r8, r14
call sub.VCRUNTIME140.dll_memcpy
add qword [rbx + 0x48], r14
jmp 0x140028960
lea rax, [rbx + 0x48]
mov qword [rsp + 0x28], rax
mov r14, qword [rbx + 8]
mov qword [rsp + 0x40], r14
mov dword [rsp + 0x38], 1
movdqu xmm0, xmmword [rbx + 0x10]
pshufd xmm0, xmm0, 0xe8
movq qword [rsp + 0x30], xmm0
inc r14d
lea rbp, [rsp + 0x30]
lea r15, [rsp + 0x38]
mov r13, qword [sym.imp.WS2_32.dll_select]
mov r12, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
nop dword [rax]
mov qword [rsp + 0x20], rbp
mov ecx, r14d
mov rdx, r15
xor r8d, r8d
xor r9d, r9d
call r13
test eax, eax
jns 0x1400288d2
call r12
cmp dword [rax], 4
je 0x1400288b0
jmp 0x140028922
je 0x140028922
pxor xmm0, xmm0
mov rax, qword [rsp + 0x28]
movdqu xmmword [rax], xmm0
cmp rdi, 0xfff
ja 0x14002892b
mov r14, qword [rbx + 8]
mov r15, qword [rbx + 0x30]
mov r13, qword [sym.imp.WS2_32.dll_recv]
nop dword [rax]
mov rcx, r14
mov rdx, r15
mov r8d, 0x1000
xor r9d, r9d
call r13
mov ebp, eax
test eax, eax
jns 0x140028987
call r12
cmp dword [rax], 4
je 0x140028900
jmp 0x14002895d
mov r14, 0xffffffffffffffff
jmp 0x140028960
mov rbx, qword [rbx + 8]
mov r14, qword [sym.imp.WS2_32.dll_recv]
nop word cs:[rax + rax]
mov rcx, rbx
mov rdx, rsi
mov r8d, edi
xor r9d, r9d
call r14
mov ebp, eax
test eax, eax
jns 0x14002895d
call r12
cmp dword [rax], 4
je 0x140028940
movsxd r14, ebp
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1400f0d70
mov rax, r14
add rsp, 0x248
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r14d, ebp
je 0x140028960
mov rdx, qword [rbx + 0x30]
mov rcx, rsi
cmp rdi, r14
jae 0x1400289ad
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov qword [rbx + 0x48], rdi
mov qword [rbx + 0x50], r14
mov r14, rdi
jmp 0x140028960
mov r8, r14
call sub.VCRUNTIME140.dll_memcpy
jmp 0x140028960

Function at 0x1400289c0
Capabilities:
Send data
Send data on socket

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
call fcn.1400286c0
mov ecx, eax
mov rax, 0xffffffffffffffff
test cl, cl
je 0x140028a20
mov rbx, qword [rbx + 8]
mov r14, qword [sym.imp.WS2_32.dll_send]
mov r15, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
nop dword [rax]
mov rcx, rbx
mov rdx, rdi
mov r8d, esi
xor r9d, r9d
call r14
mov ebp, eax
test eax, eax
jns 0x140028a1d
call r15
cmp dword [rax], 4
je 0x140028a00
movsxd rax, ebp
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140028a30
Capabilities:
Resolve dns

Disassembly:
mov rcx, qword [rcx + 8]
jmp 0x140028a60
push rsi
push rdi
push rbx
sub rsp, 0x4d0
mov rdi, r8
mov rsi, rdx
mov rax, qword [0x140183d00]
xor rax, rsp
mov qword [rsp + 0x4c8], rax
mov dword [rsp + 0x3c], 0x80
lea rdx, [rsp + 0x40]
lea r8, [rsp + 0x3c]
call qword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
jne 0x140028b69
mov ebx, dword [rsp + 0x3c]
movzx eax, word [rsp + 0x40]
cmp eax, 0x17
je 0x140028ab9
cmp eax, 2
jne 0x140028b69
movzx ecx, word [rsp + 0x42]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
mov dword [rdi], eax
lea rdi, [rsp + 0xc7]
mov r8d, 0x401
mov rcx, rdi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x40]
mov edx, ebx
mov r8, rdi
mov r9d, 0x401
call qword [sym.imp.WS2_32.dll_getnameinfo]
test eax, eax
jne 0x140028b69
lea rcx, [rsp + 0xc7]
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov rdi, rax
mov rax, qword [rsi + 0x18]
cmp rax, rdi
jae 0x140028b42
lea r9, [rsp + 0xc7]
mov rcx, rsi
mov rdx, rdi
call fcn.14001c000
jmp 0x140028b69
mov rbx, rsi
cmp rax, 0x10
jb 0x140028b4e
mov rbx, qword [rsi]
mov qword [rsi + 0x10], rdi
lea rdx, [rsp + 0xc7]
mov rcx, rbx
mov r8, rdi
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + rdi], 0
mov rcx, qword [rsp + 0x4c8]
xor rcx, rsp
call fcn.1400f0d70
nop
add rsp, 0x4d0
pop rbx
pop rdi
pop rsi
ret

Function at 0x140028a40
Capabilities:
Get local ipv4 addresses
Get socket information
Resolve dns

Disassembly:
mov rcx, qword [rcx + 8]
jmp 0x140028b90
push rsi
push rdi
push rbx
sub rsp, 0x4d0
mov rdi, r8
mov rsi, rdx
mov rax, qword [0x140183d00]
xor rax, rsp
mov qword [rsp + 0x4c8], rax
mov dword [rsp + 0x3c], 0x80
lea rdx, [rsp + 0x40]
lea r8, [rsp + 0x3c]
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x140028c99
mov ebx, dword [rsp + 0x3c]
movzx eax, word [rsp + 0x40]
cmp eax, 0x17
je 0x140028be9
cmp eax, 2
jne 0x140028c99
movzx ecx, word [rsp + 0x42]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
mov dword [rdi], eax
lea rdi, [rsp + 0xc7]
mov r8d, 0x401
mov rcx, rdi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x40]
mov edx, ebx
mov r8, rdi
mov r9d, 0x401
call qword [sym.imp.WS2_32.dll_getnameinfo]
test eax, eax
jne 0x140028c99
lea rcx, [rsp + 0xc7]
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov rdi, rax
mov rax, qword [rsi + 0x18]
cmp rax, rdi
jae 0x140028c72
lea r9, [rsp + 0xc7]
mov rcx, rsi
mov rdx, rdi
call fcn.14001c000
jmp 0x140028c99
mov rbx, rsi
cmp rax, 0x10
jb 0x140028c7e
mov rbx, qword [rsi]
mov qword [rsi + 0x10], rdi
lea rdx, [rsp + 0xc7]
mov rcx, rbx
mov r8, rdi
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + rdi], 0
mov rcx, qword [rsp + 0x4c8]
xor rcx, rsp
call fcn.1400f0d70
nop
add rsp, 0x4d0
pop rbx
pop rdi
pop rsi
ret
Function at 0x140028a60
Capabilities:
Resolve dns

Disassembly:
mov rcx, qword [rcx + 8]
jmp 0x140028a60
push rsi
push rdi
push rbx
sub rsp, 0x4d0
mov rdi, r8
mov rsi, rdx
mov rax, qword [0x140183d00]
xor rax, rsp
mov qword [rsp + 0x4c8], rax
mov dword [rsp + 0x3c], 0x80
lea rdx, [rsp + 0x40]
lea r8, [rsp + 0x3c]
call qword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
jne 0x140028b69
mov ebx, dword [rsp + 0x3c]
movzx eax, word [rsp + 0x40]
cmp eax, 0x17
je 0x140028ab9
cmp eax, 2
jne 0x140028b69
movzx ecx, word [rsp + 0x42]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
mov dword [rdi], eax
lea rdi, [rsp + 0xc7]
mov r8d, 0x401
mov rcx, rdi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x40]
mov edx, ebx
mov r8, rdi
mov r9d, 0x401
call qword [sym.imp.WS2_32.dll_getnameinfo]
test eax, eax
jne 0x140028b69
lea rcx, [rsp + 0xc7]
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov rdi, rax
mov rax, qword [rsi + 0x18]
cmp rax, rdi
jae 0x140028b42
lea r9, [rsp + 0xc7]
mov rcx, rsi
mov rdx, rdi
call fcn.14001c000
jmp 0x140028b69
mov rbx, rsi
cmp rax, 0x10
jb 0x140028b4e
mov rbx, qword [rsi]
mov qword [rsi + 0x10], rdi
lea rdx, [rsp + 0xc7]
mov rcx, rbx
mov r8, rdi
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + rdi], 0
mov rcx, qword [rsp + 0x4c8]
xor rcx, rsp
call fcn.1400f0d70
nop
add rsp, 0x4d0
pop rbx
pop rdi
pop rsi
ret

Function at 0x140028b90
Capabilities:
Get local ipv4 addresses
Get socket information
Resolve dns

Disassembly:
mov rcx, qword [rcx + 8]
jmp 0x140028b90
push rsi
push rdi
push rbx
sub rsp, 0x4d0
mov rdi, r8
mov rsi, rdx
mov rax, qword [0x140183d00]
xor rax, rsp
mov qword [rsp + 0x4c8], rax
mov dword [rsp + 0x3c], 0x80
lea rdx, [rsp + 0x40]
lea r8, [rsp + 0x3c]
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x140028c99
mov ebx, dword [rsp + 0x3c]
movzx eax, word [rsp + 0x40]
cmp eax, 0x17
je 0x140028be9
cmp eax, 2
jne 0x140028c99
movzx ecx, word [rsp + 0x42]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
mov dword [rdi], eax
lea rdi, [rsp + 0xc7]
mov r8d, 0x401
mov rcx, rdi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x40]
mov edx, ebx
mov r8, rdi
mov r9d, 0x401
call qword [sym.imp.WS2_32.dll_getnameinfo]
test eax, eax
jne 0x140028c99
lea rcx, [rsp + 0xc7]
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov rdi, rax
mov rax, qword [rsi + 0x18]
cmp rax, rdi
jae 0x140028c72
lea r9, [rsp + 0xc7]
mov rcx, rsi
mov rdx, rdi
call fcn.14001c000
jmp 0x140028c99
mov rbx, rsi
cmp rax, 0x10
jb 0x140028c7e
mov rbx, qword [rsi]
mov qword [rsi + 0x10], rdi
lea rdx, [rsp + 0xc7]
mov rcx, rbx
mov r8, rdi
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + rdi], 0
mov rcx, qword [rsp + 0x4c8]
xor rcx, rsp
call fcn.1400f0d70
nop
add rsp, 0x4d0
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400290f0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0x70]
mov qword [rbp], 0xfffffffffffffffe
mov rdi, r9
mov rbx, r8
mov rsi, rdx
mov r14, rcx
mov rdx, qword [rbp + 0x70]
lea r13, [rbp - 0x40]
mov rcx, r13
call fcn.1400293e0
cmp byte [0x1401847fd], 0
jne 0x1400291e3
mov ecx, 1
xor r8d, r8d
movabs r9, 0x842108421084211
lea r10, [0x1400fc250]
lea r11, [0x1401847db]
nop word cs:[rax + rax]
mov rax, rcx
mul r9
mov r15, rcx
sub r15, rdx
shr r15, 1
add r15, rdx
shr r15, 4
mov rax, r15
shl rax, 5
sub r15, rax
mov rax, r8
mul r9
mov rax, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 4
mov rdx, rax
shl rdx, 5
sub rax, rdx
lea rdx, [r10 + r8]
movzx eax, byte [rdx + rax + 0x174d]
xor al, byte [r8 + r10 + 0x176c]
mov byte [r8 + r11], al
movzx eax, byte [rdx + r15 + 0x174e]
xor al, byte [r8 + r10 + 0x176d]
mov byte [r8 + r11 + 1], al
add r8, 2
add rcx, 2
cmp r8, 0x22
jne 0x140029160
mov byte [0x1401847fd], 1
xorps xmm0, xmm0
movaps xmmword [rbp - 0x10], xmm0
movaps xmmword [rbp - 0x20], xmm0
lea rcx, [0x1401847db]
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
test rax, rax
js 0x14002934b
mov r12, rax
cmp rax, 0xf
ja 0x140029234
mov qword [rbp - 0x10], r12
mov qword [rbp - 8], reloc.WS2_32.dll_ntohs
lea rdx, [0x1401847db]
lea rcx, [rbp - 0x20]
mov r8, r12
call sub.VCRUNTIME140.dll_memcpy
add r12, rbp
add r12, 0xffffffffffffffe0
jmp 0x14002929d
mov rax, r12
or rax, 0xf
cmp rax, 0x17
mov r15d, reloc.WS2_32.dll_shutdown
cmovae r15, rax
cmp r15, 0xfff
jb 0x14002926c
lea rcx, [r15 + 0x28]
call fcn.1400f0b5c
mov r13, rax
add r13, 0x27
and r13, 0xffffffffffffffe0
mov qword [r13 - 8], rax
jmp 0x140029278
lea rcx, [r15 + 1]
call fcn.1400f0b5c
mov r13, rax
mov qword [rbp - 0x20], r13
mov qword [rbp - 0x10], r12
mov qword [rbp - 8], r15
lea rdx, [0x1401847db]
mov rcx, r13
mov r8, r12
call sub.VCRUNTIME140.dll_memcpy
add r12, r13
lea r13, [rbp - 0x40]
mov byte [r12], 0
lea rax, [rbp - 0x20]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
mov rcx, r14
mov rdx, rsi
mov r8, rbx
mov r9, rdi
call fcn.140029770
mov rax, qword [rbp - 8]
cmp rax, 0x10
jb 0x1400292fc
mov rcx, qword [rbp - 0x20]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x1400292f7
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140029350
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.1400f0ba0
mov rax, qword [rbp - 0x28]
cmp rax, 0x10
jb 0x140029337
mov rcx, qword [rbp - 0x40]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140029332
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140029350
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.1400f0ba0
mov rax, rsi
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call fcn.14001c100
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x140044270
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0xa0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x18], 0xfffffffffffffffe
mov rsi, rcx
cmp byte [rcx], 2
jne 0x1400442ab
mov rax, qword [rsi + 8]
shl rdx, 4
add rdx, qword [rax]
mov rax, rdx
add rsp, 0xa0
pop rdi
pop rsi
pop rbp
ret
mov rcx, rsi
call fcn.1400443f0
lea rcx, [rbp - 8]
mov rdx, rax
call fcn.140017480
cmp byte [0x140184cae], 0
jne 0x140044353
mov ecx, 1
xor r8d, r8d
movabs r10, 0xd79435e50d79435f
lea r11, [0x1400fc250]
lea rdi, [0x140184c7a]
nop dword [rax]
mov rax, rcx
mul r10
mov r9, rdx
shr r9, 4
mov rax, r8
mul r10
imul rax, r9, 0xffffffffffffffed
shr rdx, 4
imul rdx, rdx, 0xffffffffffffffed
lea r9, [r11 + r8]
movzx edx, byte [rdx + r9 + 0x25f2]
xor dl, byte [r8 + r11 + 0x2605]
mov byte [r8 + rdi], dl
movzx eax, byte [rax + r9 + 0x25f3]
xor al, byte [r8 + r11 + 0x2606]
mov byte [r8 + rdi + 1], al
add r8, 2
add rcx, 2
cmp r8, 0x34
jne 0x1400442f0
mov byte [0x140184cae], 1
lea rdx, [0x140184c7a]
lea rcx, [rbp - 0x28]
lea r8, [rbp - 8]
call fcn.140038bd0
lea rcx, [rbp - 0x60]
lea r8, [rbp - 0x28]
mov edx, 0x131
mov r9, rsi
call fcn.140043bc0
lea rdx, [0x14015b610]
lea rcx, [rbp - 0x60]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x14004cda0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
movdqa xmmword [rsp + 0x30], xmm6
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x140183d00]
xor rax, rsp
mov qword [rsp + 0x28], rax
movzx r9d, byte [rcx + 0x14]
lea rbx, [rcx + 0x50]
mov rax, qword [rcx + 0x60]
mov rcx, qword [rcx + 0x68]
cmp rax, rcx
jae 0x14004cdff
lea rdx, [rax + 1]
mov qword [rsi + 0x60], rdx
mov rdx, rbx
cmp rcx, 0x10
jb 0x14004cdf4
mov rdx, qword [rsi + 0x50]
mov byte [rdx + rax], r9b
mov byte [rdx + rax + 1], 0
jmp 0x14004ce0c
mov edx, 1
mov rcx, rbx
call fcn.140024d30
mov r12, qword [rdi]
mov bpl, 1
cmp r12, qword [rdi + 8]
je 0x14004cfcf
lea r14, [rsi + 0x38]
pcmpeqd xmm6, xmm6
lea r15, [rsp + 0x27]
jmp 0x14004ce4b
mov edx, 1
mov rcx, rbx
call fcn.140024d30
add r12, 8
cmp r12, qword [rdi + 8]
je 0x14004cfcf
movdqu xmm0, xmmword [rsi + 0x20]
psubq xmm0, xmm6
movdqu xmmword [rsi + 0x20], xmm0
cmp byte [rsi + 0x18], 0
je 0x14004ce90
mov byte [rsi + 0x18], 0
mov eax, dword [rsi + 0x14]
cmp eax, 0xffffffff
je 0x14004ceae
mov byte [rsp + 0x27], al
mov rdx, qword [rsi + 0x40]
cmp rdx, qword [rsi + 0x48]
je 0x14004cec0
mov byte [rdx], al
inc qword [rsi + 0x40]
jmp 0x14004cecb
mov rcx, qword [rsi]
cmp rcx, qword [rsi + 8]
je 0x14004cf28
movzx eax, byte [rcx]
inc rcx
mov qword [rsi], rcx
mov dword [rsi + 0x14], eax
cmp eax, 0xffffffff
jne 0x14004ce6b
mov r9d, 0xffffffff
jmp 0x14004cee7
mov rcx, r14
mov r8, r15
call fcn.14004cac0
mov r9d, dword [rsi + 0x14]
cmp r9d, 0xa
jne 0x14004cee7
inc qword [rsi + 0x30]
mov qword [rsi + 0x28], 0
mov r9d, 0xa
cmp dword [r12], r9d
jg 0x14004cf32
cmp r9d, dword [r12 + 4]
jg 0x14004cf32
mov rax, qword [rsi + 0x60]
mov rcx, qword [rsi + 0x68]
cmp rax, rcx
jae 0x14004ce30
lea rdx, [rax + 1]
mov qword [rsi + 0x60], rdx
mov rdx, rbx
cmp rcx, 0x10
jb 0x14004cf1a
mov rdx, qword [rsi + 0x50]
mov byte [rdx + rax], r9b
mov byte [rdx + rax + 1], 0
jmp 0x14004ce3d
mov eax, 0xffffffff
jmp 0x14004cea6
cmp byte [0x140185985], 0
jne 0x14004cfc2
mov ecx, 1
xor r8d, r8d
movabs r10, 0x97b425ed097b425f
lea r11, [0x1400fc250]
lea rdi, [0x14018595f]
mov rax, rcx
mul r10
mov r9, rdx
shr r9, 4
mov rax, r8
mul r10
imul rax, r9, 0xffffffffffffffe5
shr rdx, 4
imul rdx, rdx, 0xffffffffffffffe5
lea r9, [r11 + r8]
movzx edx, byte [rdx + r9 + 0x412a]
xor dl, byte [r8 + r11 + 0x4145]
mov byte [r8 + rdi], dl
movzx eax, byte [rax + r9 + 0x412b]
xor al, byte [r8 + r11 + 0x4146]
mov byte [r8 + rdi + 1], al
add r8, 2
add rcx, 2
cmp r8, 0x26
jne 0x14004cf5f
mov byte [0x140185985], 1
lea rax, [0x14018595f]
mov qword [rsi + 0x70], rax
xor ebp, ebp
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400f0d70
mov eax, ebp
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x14005b0c0
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp byte [0x1401848ee], 0
jne 0x14005b153
mov ecx, 1
xor r8d, r8d
movabs r10, 0xd79435e50d79435f
lea r11, [0x1400fc250]
lea rsi, [0x1401848d4]
nop
mov rax, rcx
mul r10
mov r9, rdx
shr r9, 4
mov rax, r8
mul r10
imul rax, r9, 0xffffffffffffffed
shr rdx, 4
imul rdx, rdx, 0xffffffffffffffed
lea r9, [r11 + r8]
movzx edx, byte [rdx + r9 + 0x1a8f]
xor dl, byte [r8 + r11 + 0x1aa2]
mov byte [r8 + rsi], dl
movzx eax, byte [rax + r9 + 0x1a90]
xor al, byte [r8 + r11 + 0x1aa3]
mov byte [r8 + rsi + 1], al
add r8, 2
add rcx, 2
cmp r8, 0x1a
jne 0x14005b0f0
mov byte [0x1401848ee], 1
pop rsi
ret

Function at 0x14005b160
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp byte [0x1401849e4], 0
jne 0x14005b206
mov ecx, 1
xor r8d, r8d
movabs r9, 0x8618618618618619
lea r10, [0x1400fc250]
lea r11, [0x1401849cc]
nop
mov rax, rcx
mul r9
mov rsi, rcx
sub rsi, rdx
shr rsi, 1
add rsi, rdx
shr rsi, 4
mov rax, r8
mul r9
imul rax, rsi, 0xffffffffffffffeb
mov rsi, r8
sub rsi, rdx
shr rsi, 1
add rsi, rdx
shr rsi, 4
imul rdx, rsi, 0xffffffffffffffeb
lea rsi, [r10 + r8]
movzx edx, byte [rdx + rsi + 0x1e98]
xor dl, byte [r8 + r10 + 0x1ead]
mov byte [r8 + r11], dl
movzx eax, byte [rax + rsi + 0x1e99]
xor al, byte [r8 + r10 + 0x1eae]
mov byte [r8 + r11 + 1], al
add r8, 2
add rcx, 2
cmp r8, 0x18
jne 0x14005b190
mov byte [0x1401849e4], 1
pop rsi
ret

Function at 0x14005b210
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp byte [0x140184ba7], 0
jne 0x14005b2a3
mov ecx, 1
xor r8d, r8d
movabs r10, 0xd79435e50d79435f
lea r11, [0x1400fc250]
lea rsi, [0x140184b71]
nop
mov rax, rcx
mul r10
mov r9, rdx
shr r9, 4
mov rax, r8
mul r10
imul rax, r9, 0xffffffffffffffed
shr rdx, 4
imul rdx, rdx, 0xffffffffffffffed
lea r9, [r11 + r8]
movzx edx, byte [rdx + r9 + 0x240c]
xor dl, byte [r8 + r11 + 0x241f]
mov byte [r8 + rsi], dl
movzx eax, byte [rax + r9 + 0x240d]
xor al, byte [r8 + r11 + 0x2420]
mov byte [r8 + rsi + 1], al
add r8, 2
add rcx, 2
cmp r8, 0x36
jne 0x14005b240
mov byte [0x140184ba7], 1
pop rsi
ret

Function at 0x14005b2b0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [0x140184be6], 0
jne 0x14005b31b
xor eax, eax
lea rcx, [0x1400fc250]
lea rdx, [0x140184ba8]
nop dword [rax]
mov r8d, eax
and r8d, 0xe
movzx r8d, byte [r8 + rcx + 0x2469]
lea r9d, [rax + 1]
and r9d, 0xf
movzx r9d, byte [r9 + rcx + 0x2469]
xor r8b, byte [rax + rcx + 0x2479]
xor r9b, byte [rax + rcx + 0x247a]
mov byte [rax + rdx], r8b
mov byte [rax + rdx + 1], r9b
add rax, 2
cmp rax, 0x3e
jne 0x14005b2d0
mov byte [0x140184be6], 1
ret