joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d450
Capabilities:
Identify system language via api

Disassembly:
push rbp
sub rsp, 0x70
mov rbp, rsp
mov qword [rbp + 0x28], rcx
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x88], rdx
mov qword [rbp + 0x90], r8
mov rcx, qword [rbp + 0x88]
call fcn.00409b60
mov rcx, qword [rbp + 0x90]
call fcn.00409b60
nop
mov rcx, qword [rbp + 0x28]
call fcn.004099d0
cmp qword [rbp + 0x90], 0
je 0x40d616
lea rcx, [rbp + 0x60]
mov rdx, qword [rbp + 0x90]
call fcn.0040a010
xor rax, rax
cmp qword [rbp + 0x90], 0
je 0x40d501
mov rax, qword [rbp + 0x90]
mov eax, dword [rax - 4]
cmp eax, 1
jl 0x40d53b
mov rcx, qword [rbp + 0x90]
movsxd rdx, eax
cmp word [rcx + rdx*2 - 2], 0x2e
jne 0x40d534
lea rcx, [rbp + 0x60]
mov rdx, qword [rbp + 0x90]
mov r8d, 1
mov r9d, eax
call fcn.0040ae80
jmp 0x40d53b
sub eax, 1
test eax, eax
jne 0x40d506
nop
lea rcx, [rbp + 0x68]
mov rdx, qword [rbp + 0x88]
call fcn.0040d020
cmp qword [rbp + 0x68], 0
je 0x40d579
mov rcx, rbp
lea rdx, [rbp + 0x58]
mov r8, qword [rbp + 0x60]
mov r9, qword [rbp + 0x68]
call fcn.0040d1d0
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x58]
call fcn.00409f90
jmp 0x40d615
call sub.kernel32.dll_GetUserDefaultUILanguage
lea rcx, [rbp + 0x48]
mov edx, eax
call fcn.0040c770
mov rcx, rbp
lea rdx, [rbp + 0x50]
mov r8, qword [rbp + 0x60]
mov r9, qword [rbp + 0x48]
call fcn.0040d1d0
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x50]
call fcn.00409f90
mov rax, qword [rbp + 0x28]
cmp qword [rax], 0
jne 0x40d5ee
cmp byte [0x0078ae58], 0
jne 0x40d5ee
call sub.kernel32.dll_GetSystemDefaultUILanguage
lea rcx, [rbp + 0x38]
mov edx, eax
call fcn.0040c770
mov rcx, rbp
lea rdx, [rbp + 0x40]
mov r8, qword [rbp + 0x60]
mov r9, qword [rbp + 0x38]
call fcn.0040d1d0
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x40]
call fcn.00409f90
mov rax, qword [rbp + 0x28]
cmp qword [rax], 0
jne 0x40d615
mov rcx, rbp
lea rdx, [rbp + 0x30]
mov r8, qword [rbp + 0x60]
call fcn.0040d310
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x30]
call fcn.00409f90
nop
lea rcx, [rbp + 0x30]
mov edx, 8
call fcn.00409ab0
lea rcx, [rbp + 0x88]
mov edx, 2
call fcn.00409ab0
mov rax, qword [rbp + 0x28]
lea rsp, [rbp + 0x70]
pop rbp
ret

Function at 0x40dfd0
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
lea rcx, [rsp + 0x20]
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [rsp + 0x40]
add rsp, 0x58
ret

Function at 0x40dff0
Capabilities:
Check os version

Disassembly:
sub rsp, 0x28
call sub.kernel32.dll_GetVersion
mov ecx, eax
and ecx, 0xff
and eax, 0xff00
shr eax, 8
cmp ecx, 5
jne 0x40e014
cmp eax, 1
jae 0x40e019
cmp ecx, 5
jbe 0x40e025
mov dword [0x007869a0], 0x7f
jmp 0x40e02f
mov dword [0x007869a0], 0x409
add rsp, 0x28
ret
Function at 0x40e2e0
Capabilities:
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
call fcn.0040e2d0
mov ebx, eax
test ebx, ebx
je 0x40e32b
cmp dword [0x007122d0], 0xffffffff
jne 0x40e304
mov ecx, 0xe2
call fcn.00409860
mov ecx, ebx
call fcn.0040e2b0
test rax, rax
jne 0x40e31d
mov ecx, 0xe2
call fcn.00409860
jmp 0x40e32b
mov ecx, dword [0x007122d0]
mov rdx, rax
call sub.kernel32.dll_TlsSetValue
add rsp, 0x20
pop rbx
ret

Function at 0x40e380
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
sub rsp, 0x28
lea rax, [0x1a0]
test rax, rax
je 0x40e3c0
cmp dword [0x007122d0], 0xffffffff
je 0x40e3c0
mov ecx, dword [0x007122d0]
call sub.kernel32.dll_TlsGetValue
test rax, rax
je 0x40e3c0
mov rcx, rax
call sub.kernel32.dll_LocalFree
mov ecx, dword [0x007122d0]
xor rdx, rdx
call sub.kernel32.dll_TlsSetValue
add rsp, 0x28
ret

Function at 0x40e400
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
cmp byte [0x0078af34], 0
je 0x40e43b
mov ecx, dword [0x007122d0]
call sub.kernel32.dll_TlsGetValue
test rax, rax
jne 0x40e44f
call fcn.0040e2e0
mov ecx, dword [0x007122d0]
call sub.kernel32.dll_TlsGetValue
test rax, rax
jne 0x40e44f
mov rax, qword [0x0078af70]
jmp 0x40e44f
mov rax, qword gs:[0x58]
movsxd rcx, dword [0x007122d0]
mov rax, qword [rax + rcx*8]
add rsp, 0x28
ret

Function at 0x4232c0
Capabilities:
Get geographical location

Disassembly:
push rbp
push rbx
sub rsp, 0x38
mov rbp, rsp
mov ebx, r8d
lea r8, [rbp + 0x2c]
mov r9d, 2
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x4232e7
movzx rax, word [rbp + 0x2c]
jmp 0x4232e9
mov eax, ebx
lea rsp, [rbp + 0x38]
pop rbx
pop rbp
ret
Function at 0x424ac0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x8e0
mov rbp, rsp
mov qword [rbp + 0x40], rcx
mov qword [rbp + 0x48], rdx
mov qword [rbp + 0x58], 0
nop
mov rcx, qword [rbp + 0x40]
mov rdx, qword [rbp + 0x48]
lea r8, [rbp + 0x60]
mov r9d, 0x400
call fcn.00424860
mov ebx, eax
mov rax, qword [0x00785650]
cmp byte [rax], 0
je 0x424bf8
mov rcx, qword [0x00785438]
call fcn.00406490
call fcn.00405e20
mov ecx, 1
xor rdx, rdx
lea r8, [rbp + 0x60]
mov r9d, ebx
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
call sub.kernel32.dll_WideCharToMultiByte_1
mov esi, eax
lea rcx, [rbp + 0x58]
mov rdx, qword [0x00424a80]
mov r8d, 1
movsxd r9, esi
call fcn.0040bc10
mov ecx, 1
xor rdx, rdx
lea r8, [rbp + 0x60]
mov r9d, ebx
mov rax, qword [rbp + 0x58]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
call sub.kernel32.dll_WideCharToMultiByte_1
mov ecx, 0xfffffff4
call sub.kernel32.dll_GetStdHandle_1
mov rcx, rax
mov rdx, qword [rbp + 0x58]
mov r8d, esi
lea r9, [rbp + 0x54]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile_1
mov ecx, 0xfffffff4
call sub.kernel32.dll_GetStdHandle_1
mov rcx, rax
lea rdx, [0x00424c98]
mov r8d, 2
lea r9, [rbp + 0x54]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile_1
jmp 0x424c3e
mov rcx, qword [0x0078af38]
call fcn.0040bd80
mov rcx, rax
mov rax, qword [0x007853e0]
mov edx, dword [rax + 8]
lea r8, [rbp + 0x860]
mov r9d, 0x40
call sub.user32.dll_LoadStringW_1
xor rcx, rcx
lea rdx, [rbp + 0x60]
lea r8, [rbp + 0x860]
mov r9d, 0x2010
call sub.user32.dll_MessageBoxW
nop
lea rcx, [rbp + 0x58]
mov rdx, qword [0x00424a80]
call fcn.0040bc50
lea rsp, [rbp + 0x8e0]
pop rbx
pop rsi
pop rbp
ret

Function at 0x426980
Capabilities:
Check os version

Disassembly:
sub rsp, 0x148
mov dword [rsp + 0x2c], 0x114
lea rcx, [rsp + 0x2c]
call sub.kernel32.dll_GetVersionExW
test eax, eax
je 0x426a45
cmp dword [rsp + 0x30], 6
ja 0x4269b6
cmp dword [rsp + 0x30], 6
jne 0x4269ea
cmp dword [rsp + 0x34], 1
jbe 0x4269ea
mov dword [rsp + 0x20], 0xffffffff
lea rcx, [rsp + 0x28]
lea rdx, [rsp + 0x24]
lea r8, [rsp + 0x20]
call fcn.00426810
mov eax, dword [rsp + 0x28]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x24]
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x38], 0
mov eax, dword [rsp + 0x3c]
mov dword [0x007128f0], eax
mov eax, dword [rsp + 0x30]
mov dword [0x007128f4], eax
mov eax, dword [rsp + 0x34]
mov dword [0x007128f8], eax
cmp dword [0x007128f0], 1
jne 0x426a23
mov eax, dword [rsp + 0x38]
and eax, 0xffff
mov dword [0x007128fc], eax
jmp 0x426a2d
mov eax, dword [rsp + 0x38]
mov dword [0x007128fc], eax
lea rcx, [0x00712900]
lea rdx, [rsp + 0x40]
mov r8d, 0x80
call fcn.0040a9a0
add rsp, 0x148
ret
Function at 0x427620
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r13
push rdi
push rsi
push rbx
sub rsp, 0x240
mov rbp, rsp
mov rbx, rcx
mov rcx, rbx
call fcn.0040a130
mov r13d, eax
mov ecx, 0xfde9
xor rdx, rdx
mov r8, rbx
mov r9d, r13d
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
call fcn.0040dfb0
mov esi, eax
cmp esi, 0x104
jbe 0x42767d
mov ecx, esi
add ecx, ecx
mov ecx, ecx
call fcn.00405b10
mov rdi, rax
jmp 0x427681
lea rdi, [rbp + 0x38]
mov ecx, 0xfde9
xor rdx, rdx
mov r8, rbx
mov r9d, r13d
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], esi
call fcn.0040dfb0
mov rcx, rdi
call sub.user32.dll_CharUpperW
xor rbx, rbx
xor rax, rax
mov ecx, esi
sub ecx, 1
cmp eax, ecx
jg 0x4276d4
add ecx, 1
mov edx, ebx
shl edx, 5
shr ebx, 0x1b
or edx, ebx
mov ebx, edx
movsxd rdx, eax
movzx edx, word [rdi + rdx*2]
xor ebx, edx
add eax, 1
cmp eax, ecx
jne 0x4276b8
nop
lea rax, [rbp + 0x38]
cmp rdi, rax
je 0x4276e6
mov rcx, rdi
call fcn.00405b40
mov eax, ebx
lea rsp, [rbp + 0x240]
pop rbx
pop rsi
pop rdi
pop r13
pop rbp
ret
Function at 0x14000fee0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, qword [0x1402c9b30]
mov edi, edx
cmp byte [rbx + 0x2025], 0
jne 0x14000ff31
cmp byte [rbx + 0x2026], 0
jne 0x14000ff31
mov r9d, dword [rbx + 0x30c8]
lea r8, str.Tooltip__02d
mov edx, reloc.WS2_32.dll_recv
lea rcx, [rsp + 0x20]
call fcn.140002ca0
test dil, 1
je 0x140010056
jmp 0x14000ffb9
movss xmm1, dword [rbx + 0x1618]
lea r8, str.Tooltip__02d
movaps xmm0, xmm1
lea rcx, [rsp + 0x20]
mulss xmm0, dword [0x1400adcb4]
xor eax, eax
mulss xmm1, dword [0x1400adc9c]
addss xmm0, dword [rbx + 0x128]
lea edx, [rax + 0x10]
addss xmm1, dword [rbx + 0x12c]
mov qword [rbx + 0x1bd0], rax
mov dword [rbx + 0x1bbc], 1
movss dword [rbx + 0x1bc8], xmm0
movss dword [rbx + 0x1bcc], xmm1
movss xmm0, dword [rbx + 0x1684]
mulss xmm0, dword [0x1400adc34]
or dword [rbx + 0x1bb8], 0x41
movss dword [rbx + 0x1c18], xmm0
mov r9d, dword [rbx + 0x30c8]
call fcn.140002ca0
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x140010010
lea r11, [0x1400a7250]
nop dword [rax]
cmp r9b, 0x23
jne 0x14000fff3
cmp byte [r8], r9b
jne 0x14000fff3
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x14000ffe0
not ecx
call fcn.140009650
test rax, rax
je 0x140010056
cmp byte [rax + 0x86], 0
je 0x140010056
mov byte [rax + 0x8d], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xa4], 1
lea rcx, [rsp + 0x20]
inc dword [rbx + 0x30c8]
mov edx, reloc.WS2_32.dll_recv
mov r9d, dword [rbx + 0x30c8]
call fcn.140002ca0
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20c0347
call fcn.14000bc20
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x140033370
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x50
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor edi, edi
cmp byte [r8 + 7], dil
je 0x1400333a4
mov eax, edi
nop dword [rax]
lea ecx, [rax + 0x34]
xor byte [r8 + rax], cl
inc rax
cmp rax, 6
jb 0x140033390
mov byte [r8 + 7], dil
lea rax, [r8 + 6]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x1400333d4
mov qword [rsp + 0x30], rdi
mov byte [rsp + 0x20], dil
jmp 0x1400333ee
mov qword [rsp + 0x30], 6
mov eax, dword [r8]
mov dword [rsp + 0x20], eax
movzx eax, word [r8 + 4]
mov word [rsp + 0x24], ax
mov r9, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x1400333fc
mov rdx, qword [rdx]
mov r8, rdx
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.14003f870
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x140033476
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140033471
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140033471
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140092170
mov rax, rbx
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x140033490
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x50
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor edi, edi
cmp byte [r8 + 9], dil
je 0x1400334c4
mov eax, edi
nop dword [rax]
lea ecx, [rax + 0x34]
xor byte [r8 + rax], cl
inc rax
cmp rax, 8
jb 0x1400334b0
mov byte [r8 + 9], dil
lea rax, [r8 + 8]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x1400334f4
mov qword [rsp + 0x30], rdi
mov byte [rsp + 0x20], dil
jmp 0x140033505
mov qword [rsp + 0x30], 8
mov rax, qword [r8]
mov qword [rsp + 0x20], rax
mov r9, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x140033513
mov rdx, qword [rdx]
mov r8, rdx
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.14003f870
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x14003358d
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140033588
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140033588
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140092170
mov rax, rbx
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x1400335a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rbx, rcx
mov qword [rbp - 0x10], rcx
xor r9d, r9d
cmp byte [r8 + 6], r9b
je 0x1400335e4
mov ecx, r9d
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x34]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 5
jb 0x1400335d0
mov byte [r8 + 6], r9b
lea rax, [r8 + 5]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
mov qword [rbp - 0x28], r9
mov qword [rbp - 0x20], r9
mov qword [rbp - 0x20], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x14003360e
mov qword [rbp - 0x28], r9
mov byte [rbp - 0x38], r9b
jmp 0x140033624
mov qword [rbp - 0x28], 5
mov eax, dword [r8]
mov dword [rbp - 0x38], eax
movzx eax, byte [r8 + 4]
mov byte [rbp - 0x34], al
cmp byte [rdx + 0xa], 0
je 0x140033643
mov rcx, r9
nop dword [rax]
lea eax, [rcx + 0x34]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 9
jb 0x140033630
mov byte [rdx + 0xa], 0
lea rax, [rdx + 9]
xorps xmm0, xmm0
movups xmmword [rbp - 0x58], xmm0
mov qword [rbp - 0x48], r9
mov qword [rbp - 0x40], r9
mov qword [rbp - 0x40], reloc.WS2_32.dll_ntohs
cmp rdx, rax
jne 0x14003366d
mov qword [rbp - 0x48], r9
mov byte [rbp - 0x58], 0
jmp 0x140033685
mov qword [rbp - 0x48], 9
movsd xmm0, qword [rdx]
movsd qword [rbp - 0x58], xmm0
movzx eax, byte [rdx + 8]
mov byte [rbp - 0x50], al
lea r9, [rbp - 0x38]
lea r8, [rbp - 0x58]
movzx edx, byte [rbp - 0x60]
mov rcx, rbx
call fcn.140039280
nop
mov rdx, qword [rbp - 0x40]
cmp rdx, 0x10
jb 0x1400336d9
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400336d3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400336d3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140092170
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x140033717
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140033712
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140033712
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140092170
mov rax, rbx
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rbp
ret
Function at 0x140033730
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x50
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor edi, edi
cmp byte [r8 + 0xa], dil
je 0x140033764
mov eax, edi
nop dword [rax]
lea ecx, [rax + 0x34]
xor byte [r8 + rax], cl
inc rax
cmp rax, 9
jb 0x140033750
mov byte [r8 + 0xa], dil
lea rax, [r8 + 9]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x140033794
mov qword [rsp + 0x30], rdi
mov byte [rsp + 0x20], dil
jmp 0x1400337b1
mov qword [rsp + 0x30], 9
movsd xmm0, qword [r8]
movsd qword [rsp + 0x20], xmm0
movzx eax, byte [r8 + 8]
mov byte [rsp + 0x28], al
mov r9, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x1400337bf
mov rdx, qword [rdx]
mov r8, rdx
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.14003f870
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x140033839
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140033834
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140033834
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140092170
mov rax, rbx
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret

Function at 0x14003a4a0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 9], al
je 0x14003a4c3
lea edx, [rax + 0x34]
xor byte [rax + rcx], dl
inc rax
cmp rax, 8
jb 0x14003a4b0
mov byte [rcx + 9], 0
lea r8, [rcx + 8]
mov rdx, rcx
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.140032d60
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x14003a4e0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 0x10], al
je 0x14003a503
lea edx, [rax + 0x34]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xf
jb 0x14003a4f0
mov byte [rcx + 0x10], 0
lea r8, [rcx + 0xf]
mov rdx, rcx
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.140032d60
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x14003b850
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 5], 0
je 0x14003b873
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x34]
xor byte [rax + rcx], dl
inc rax
cmp rax, 4
jb 0x14003b860
mov byte [rcx + 5], 0
mov rax, rcx
ret

Function at 0x14003b880
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x136], 0
je 0x14003b8a8
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x34]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x135
jb 0x14003b890
mov byte [rcx + 0x136], 0
mov rax, rcx
ret
Function at 0x14003b8b0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x44], 0
je 0x14003b8d3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x34]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x43
jb 0x14003b8c0
mov byte [rcx + 0x44], 0
mov rax, rcx
ret

Function at 0x14003b8e0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x47], 0
je 0x14003b903
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x34]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x46
jb 0x14003b8f0
mov byte [rcx + 0x47], 0
mov rax, rcx
ret
Function at 0x14003d310
Capabilities:
Execute command

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x1400bb080]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rsi, rcx
mov qword [rsp + 0x78], rcx
mov r8, rcx
lea rdx, str.start_cmd__C__color_b__title_Error__echo
lea rcx, [rsp + 0x58]
call fcn.140033210
mov rdi, rax
mov rcx, qword [rax + 0x10]
mov rdx, qword [rax + 0x18]
mov rax, rdx
sub rax, rcx
cmp rax, 0x11
jb 0x14003d39a
lea rax, [rcx + 0x11]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x14003d37b
mov rax, qword [rdi]
lea rbx, [rax + rcx]
mov r8d, reloc.WS2_32.dll_recvfrom
lea rdx, str.__timeout__t_5_
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x11], 0
jmp 0x14003d3bc
mov qword [rsp + 0x20], reloc.WS2_32.dll_recvfrom
lea r9, str.__timeout__t_5_
xor r8d, r8d
lea edx, [r8 + 0x11]
mov rcx, rdi
call fcn.140032970
mov rdi, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
movups xmm0, xmmword [rdi]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rdi + 0x10], 0
mov qword [rdi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rdi], 0
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 0x10
cmovae rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x14003d448
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003d443
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003d443
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140092170
movdqa xmm0, xmmword [0x1400add80]
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x30], 0
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x14003d49b
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003d496
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003d496
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140092170
xor ecx, ecx
int 0x29
mov rdx, qword [rsi + 0x18]
cmp rdx, 0x10
jb 0x14003d4d5
inc rdx
mov rcx, qword [rsi]
cmp rdx, 0x1000
jb 0x14003d4d0
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14003d50d
mov rcx, r8
call fcn.140092170
mov qword [rsi + 0x10], 0
mov qword [rsi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rsi], 0
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400926d0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x140047d30
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__read]
cdqe
add rsp, 0x28
ret