joyce8/EMBER2024-capa huggingface dataset:
Function at 0x54d4a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x54d680
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x80], r8
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x88], r9
mov qword [rsp + 0x90], r10
lea rax, [0x006662e0]
call fcn.0040d960
mov qword [rsp + 0x40], rax
xor ecx, ecx
xor edx, edx
xor ebx, ebx
jmp 0x54d50b
mov rax, rdx
mov rcx, r10
mov rdx, qword [rsp + 0x30]
mov rbx, r8
mov rsi, qword [rsp + 0x60]
cmp rsi, rcx
jle 0x54d639
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rdx
mov rdx, qword [rsp + 0x70]
mov rsi, qword [rdx + 0x38]
mov rax, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x90]
call rsi
mov rdx, qword [rsp + 0x70]
mov rsi, qword [rdx + 0x38]
mov rax, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x40]
mov ecx, 4
mov rdi, rcx
call rsi
mov rdx, qword [rsp + 0x70]
mov rsi, qword [rdx + 0x30]
mov rax, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x38]
xor ecx, ecx
mov rdi, qword [rsp + 0x30]
call rsi
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x30], rcx
mov rdx, qword [rsp + 0x70]
mov rsi, qword [rdx + 0x20]
mov rax, qword [rsp + 0x78]
call rsi
mov rdx, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x58]
mov r8, qword [rsp + 0x38]
mov r9, qword [rsp + 0x60]
mov r10, qword [rsp + 0x20]
xor eax, eax
jmp 0x54d660
mov rdx, qword [rsp + 0x40]
movzx r11d, byte [rdx + 3]
lea r12d, [r11 + 1]
mov byte [rdx + 3], r12b
nop word [rax + rax]
cmp r11b, 0xff
jne 0x54d4fd
movzx r11d, byte [rdx + 2]
lea r12d, [r11 + 1]
mov byte [rdx + 2], r12b
nop word [rax + rax]
cmp r11b, 0xff
jne 0x54d4fd
movzx r11d, byte [rdx + 1]
lea r12d, [r11 + 1]
mov byte [rdx + 1], r12b
nop word [rax + rax]
cmp r11b, 0xff
jne 0x54d4fd
movzx r11d, byte [rdx]
inc r11d
mov byte [rdx], r11b
jmp 0x54d4fd
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
movzx r11d, byte [r10 + rsi]
movzx r12d, byte [r8 + rax]
xor r11d, r12d
mov byte [rsi + r10], r11b
inc rax
inc r10
nop word [rax + rax]
cmp rdx, rax
jle 0x54d5c8
cmp r9, r10
jle 0x54d5c8
ja 0x54d643
mov rax, r10
mov rcx, r9
call fcn.00465f20
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x40], r10
call fcn.004638c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
mov r10, qword [rsp + 0x40]
jmp fcn.0054d4a0
Function at 0x54e760
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x54e99c
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x58], rax
call fcn.004c0e60
xorps xmm15, xmm15
mov r14, qword [0x008f05f0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
add qword [rcx + 0x68], rax
mov rdx, qword [rcx + 0x60]
test rdx, rdx
jle 0x54e8aa
nop
cmp rdx, 0x40
ja 0x54e98e
lea rsi, [rdx - 0x40]
mov rdi, rsi
neg rsi
cmp rax, rsi
cmovl rsi, rax
mov qword [rsp + 0x28], rsi
sar rdi, 0x3f
and rdi, rdx
lea rdx, [rcx + rdi]
lea rdx, [rdx + 0x20]
mov rbx, qword [rsp + 0x60]
cmp rbx, rdx
je 0x54e819
mov rax, rdx
mov rcx, rsi
nop
call fcn.004668c0
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdx, qword [rcx + 0x60]
add rdx, rsi
mov qword [rcx + 0x60], rdx
cmp rdx, 0x40
jne 0x54e881
mov qword [rsp], rcx
lea rax, [rcx + 0x20]
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 0x40
mov qword [rsp + 0x18], 0x40
call fcn.0054eee0
xorps xmm15, xmm15
mov r14, qword [0x008f05f0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x60], 0
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
cmp rax, rsi
jb 0x54e983
mov rdi, qword [rsp + 0x70]
sub rdi, rsi
mov rdx, rax
sub rax, rsi
mov r8, rdi
neg rdi
sar rdi, 0x3f
and rsi, rdi
add rbx, rsi
jmp 0x54e8b7
mov rdx, rax
mov rbx, qword [rsp + 0x60]
mov r8, qword [rsp + 0x70]
cmp rax, 0x40
jl 0x54e937
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp], rcx
mov qword [rsp + 8], rbx
and rax, 0xffffffffffffffc0
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x10], rax
mov qword [rsp + 0x18], r8
call fcn.0054eee0
xorps xmm15, xmm15
mov r14, qword [0x008f05f0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x38]
mov rdx, rax
sub rax, rcx
sar rax, 0x3f
mov rcx, qword [rsp + 0x30]
and rax, rcx
and rax, 0xffffffffffffffc0
mov rbx, qword [rsp + 0x40]
add rbx, rax
sub rcx, rdx
mov rdx, qword [rsp + 0x68]
mov rax, rcx
mov rcx, qword [rsp + 0x58]
test rax, rax
je 0x54e972
cmp rax, 0x40
mov esi, 0x40
cmovl rsi, rax
lea rax, [rcx + 0x20]
cmp rbx, rax
je 0x54e96e
mov qword [rsp + 0x38], rsi
mov rcx, rsi
call fcn.004668c0
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x38]
mov qword [rcx + 0x60], rsi
mov rax, rdx
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov rcx, rax
mov rax, rsi
call fcn.00465fe0
mov rax, rdx
mov ecx, 0x40
call fcn.00465fe0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.004638c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.0054e760
Function at 0x560a00
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x560b5b
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
movups xmmword [rsp + 0x40], xmm15
mov qword [rsp + 0x30], 0
mov rax, qword [0x0089ae90]
call fcn.00516080
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x28], rbx
movups xmmword [rsp + 0x50], xmm15
mov qword [rsp + 0x60], 0
lea rcx, [0x00560b80]
mov qword [rsp + 0x50], rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x58], rcx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x60], rcx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x2b
call fcn.00403240
xorps xmm15, xmm15
mov r14, qword [0x008f05f0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rcx, qword [rsp + 0x18]
cmp rcx, 0xffffffffffffffff
je 0x560b1b
mov rdx, qword [rsp + 0x28]
cmp rdx, rcx
jb 0x560b55
mov qword [rsp + 0x20], rcx
mov rsi, qword [rsp + 0x50]
mov rax, qword [rsp + 0x38]
mov rbx, rcx
lea rdx, [rsp + 0x50]
call rsi
mov rax, qword [rsp + 0x20]
lea rcx, [rax + 1]
mov rbx, qword [rsp + 0x28]
cmp rbx, rcx
jb 0x560b4a
mov rsi, qword [rsp + 0x50]
sub rbx, rax
dec rbx
mov rdi, rbx
neg rbx
sar rbx, 0x3f
and rcx, rbx
mov r8, qword [rsp + 0x38]
lea rax, [r8 + rcx]
mov rbx, rdi
lea rdx, [rsp + 0x50]
nop
call rsi
mov rcx, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x28]
lea rdx, [rsp + 0x50]
call rcx
mov rcx, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov rax, rcx
mov rcx, rbx
call fcn.00465fe0
call fcn.00465f60
nop
nop dword [rax + rax]
call fcn.004638c0
jmp fcn.00560a00
Function at 0x580ec0
Capabilities:
Access peb ldr_data

Disassembly:
lea r12, [rsp - 0x30]
cmp r12, qword [r14 + 0x10]
jbe 0x581121
sub rsp, 0xb0
mov qword [rsp + 0xa8], rbp
lea rbp, [rsp + 0xa8]
test rax, rax
je 0x581105
mov qword [rsp + 0xb8], rax
mov rbx, qword [rax + 8]
mov rdx, qword [rax]
mov rcx, qword [rax + 0x10]
test rbx, rbx
jne 0x580f0d
xor ebx, ebx
xor ecx, ecx
jmp 0x580f20
mov rax, rdx
call fcn.005701e0
mov rcx, rax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x88], rcx
mov qword [rsp + 0x48], rbx
cmp qword [rax + 0x28], 0
je 0x581038
mov rcx, qword [rax + 0x18]
mov rax, rcx
nop
call fcn.00472cc0
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x58], rbx
mov rcx, qword [rsp + 0xb8]
mov r8, qword [rcx + 0x20]
mov r9, qword [rcx + 0x28]
mov rcx, qword [rsp + 0x48]
lea rdi, [0x00726bd8]
mov esi, 1
lea rax, [rsp + 0x68]
mov rbx, qword [rsp + 0x88]
call fcn.0044e800
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
call fcn.00403240
xorps xmm15, xmm15
mov r14, qword [0x008f05f0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x580ffb
xor eax, eax
lea rbx, [0x00726db0]
mov ecx, 1
mov rdi, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0x60]
lea r8, [0x006af4cd]
mov r9d, 2
mov r10, qword [rsp + 0x98]
mov r11, qword [rsp + 0x58]
call fcn.0044e8e0
jmp 0x581028
xor eax, eax
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x60]
lea rdi, [0x00726c80]
mov esi, 1
mov r8, qword [rsp + 0x98]
mov r9, qword [rsp + 0x58]
call fcn.0044e800
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
mov rax, qword [rax + 0x18]
nop dword [rax]
call fcn.00472cc0
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x50], rbx
mov rcx, qword [rsp + 0x88]
mov qword [rsp], rcx
mov rdx, qword [rsp + 0x48]
mov qword [rsp + 8], rdx
mov byte [rsp + 0x10], 0x3a
call fcn.00403240
xorps xmm15, xmm15
mov r14, qword [0x008f05f0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x5810c8
xor eax, eax
lea rbx, [0x00726db0]
mov ecx, 1
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x48]
lea r8, [0x006af4cd]
mov r9d, 2
mov r10, qword [rsp + 0x90]
mov r11, qword [rsp + 0x50]
call fcn.0044e8e0
jmp 0x5810f5
xor eax, eax
mov rbx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x48]
lea rdi, [0x00726c80]
mov esi, 1
mov r8, qword [rsp + 0x90]
mov r9, qword [rsp + 0x50]
call fcn.0044e800
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
lea rax, [0x006af8df]
mov ebx, 5
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
mov qword [rsp + 8], rax
call fcn.004638c0
mov rax, qword [rsp + 8]
jmp fcn.00580ec0
Function at 0x588940
Capabilities:
Parse credit card information

Disassembly:
lea ecx, [rax - 0x61]
cmp cl, 0x19
jbe 0x588958
lea ecx, [rax - 0x41]
cmp cl, 0x19
jbe 0x588958
lea ecx, [rax - 0x30]
cmp cl, 9
ja 0x588960
xor eax, eax
ret
cmp rbx, 3
je 0x58896c
cmp rbx, 4
jne 0x588999
cmp al, 0x2c
ja 0x588986
lea ecx, [rax - 0x21]
cmp cl, 1
jbe 0x588996
cmp al, 0x24
je 0x588996
nop dword [rax]
cmp al, 0x26
jae 0x588996
jmp 0x588999
lea ecx, [rax - 0x3a]
cmp cl, 4
jbe 0x588996
cmp al, 0x5b
je 0x588996
cmp al, 0x5d
jne 0x588999
xor eax, eax
ret
cmp al, 0x2f
ja 0x5889d2
nop dword [rax]
cmp al, 0x26
ja 0x5889b1
cmp al, 0x24
je 0x5889f1
cmp al, 0x26
je 0x5889f1
jmp 0x588a6b
lea ecx, [rax - 0x2b]
cmp cl, 1
jbe 0x5889f1
lea ecx, [rax - 0x2d]
nop dword [rax]
cmp cl, 1
jbe 0x588a68
cmp al, 0x2f
je 0x5889f1
jmp 0x588a6b
cmp al, 0x3d
ja 0x5889e9
lea ecx, [rax - 0x3a]
cmp cl, 1
jbe 0x5889f1
nop
cmp al, 0x3d
je 0x5889f1
jmp 0x588a6b
lea ecx, [rax - 0x3f]
cmp cl, 1
ja 0x588a60
cmp rbx, 2
jg 0x588a27
cmp rbx, 1
je 0x588a21
nop dword [rax]
cmp rbx, 2
jne 0x588a6b
cmp al, 0x2f
je 0x588a12
cmp al, 0x3b
je 0x588a12
cmp al, 0x2c
jne 0x588a19
mov ecx, 1
jmp 0x588a1e
cmp al, 0x3f
sete cl
mov eax, ecx
ret
cmp al, 0x3f
sete al
ret
cmp rbx, 5
jne 0x588a4a
cmp al, 0x40
je 0x588a39
cmp al, 0x2f
je 0x588a39
cmp al, 0x3f
jne 0x588a42
mov ecx, 1
nop
jmp 0x588a47
cmp al, 0x3a
sete cl
mov eax, ecx
ret
cmp rbx, 6
je 0x588a59
cmp rbx, 7
jne 0x588a6b
xor eax, eax
ret
mov eax, 1
ret
cmp al, 0x5f
je 0x588a68
cmp al, 0x7e
jne 0x588a6b
xor eax, eax
ret
cmp rbx, 7
jne 0x588a81
cmp al, 0x21
je 0x588a7d
lea ecx, [rax - 0x28]
cmp cl, 2
ja 0x588a81
xor eax, eax
nop
ret
mov eax, 1
ret
Function at 0x58dda0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x58dfb7
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x58], rax
add qword [rax + 0x58], rcx
mov rdx, qword [rax + 0x50]
test rdx, rdx
jle 0x58dece
nop dword [rax + rax]
cmp rdx, 0x40
ja 0x58dfa9
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rbx
lea rsi, [rdx - 0x40]
mov r8, rsi
neg rsi
cmp rcx, rsi
cmovl rsi, rcx
mov qword [rsp + 0x28], rsi
sar r8, 0x3f
and r8, rdx
lea rdx, [rax + r8]
lea rdx, [rdx + 0x10]
cmp rbx, rdx
je 0x58de42
mov rax, rdx
mov rcx, rsi
call fcn.004668c0
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
mov rdx, qword [rax + 0x50]
add rdx, rsi
mov qword [rax + 0x50], rdx
cmp rdx, 0x40
jne 0x58deaa
mov qword [rsp], rax
lea rcx, [rax + 0x10]
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], 0x40
mov qword [rsp + 0x18], 0x40
call fcn.0058e240
xorps xmm15, xmm15
mov r14, qword [0x008f05f0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x50], 0
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
cmp rcx, rsi
jb 0x58dfa1
sub rdi, rsi
mov rdx, rcx
sub rcx, rsi
mov r8, rdi
neg rdi
sar rdi, 0x3f
and rsi, rdi
add rbx, rsi
jmp 0x58ded4
mov rdx, rcx
mov r8, rdi
cmp rcx, 0x40
jl 0x58df51
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x40], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
and rcx, 0xffffffffffffffc0
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], r8
call fcn.0058e240
xorps xmm15, xmm15
mov r14, qword [0x008f05f0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x38]
mov rdx, rax
sub rax, rcx
sar rax, 0x3f
mov rcx, qword [rsp + 0x30]
and rax, rcx
and rax, 0xffffffffffffffc0
mov rbx, qword [rsp + 0x40]
add rbx, rax
sub rcx, rdx
mov rax, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x68]
test rcx, rcx
je 0x58df8f
cmp rcx, 0x40
mov esi, 0x40
cmovl rsi, rcx
lea rdi, [rax + 0x10]
cmp rbx, rdi
je 0x58df8b
mov qword [rsp + 0x38], rsi
mov rax, rdi
mov rcx, rsi
call fcn.004668c0
mov rax, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x38]
mov qword [rax + 0x50], rsi
mov rax, rdx
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
nop
ret
mov rax, rsi
call fcn.00465fe0
mov rax, rdx
mov ecx, 0x40
call fcn.00465fe0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.004638c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.0058dda0
Function at 0x140008a80
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x47], 0
mov r8, rcx
je 0x140008b0b
mov r9, 0xfffffffffffffffe
lea rax, [rcx + 2]
sub r9, rcx
nop dword [rax + rax]
lea edx, [rax + r9]
lea ecx, [rdx + 0x3f]
xor byte [rax - 2], cl
lea rax, [rax + 0xe]
lea ecx, [rdx + 0x40]
xor byte [rax - 0xf], cl
lea ecx, [rdx + 0x41]
xor byte [rax - 0xe], cl
lea ecx, [rdx + 0x42]
xor byte [rax - 0xd], cl
lea ecx, [rdx + 0x43]
xor byte [rax - 0xc], cl
lea ecx, [rdx + 0x44]
xor byte [rax - 0xb], cl
lea ecx, [rdx + 0x45]
xor byte [rax - 0xa], cl
lea ecx, [rdx + 0x46]
xor byte [rax - 9], cl
lea ecx, [rdx + 0x47]
xor byte [rax - 8], cl
lea ecx, [rdx + 0x48]
xor byte [rax - 7], cl
lea ecx, [rdx + 0x49]
xor byte [rax - 6], cl
lea ecx, [rdx + 0x4a]
xor byte [rax - 5], cl
lea ecx, [rdx + 0x4b]
xor byte [rax - 4], cl
add dl, 0x4c
xor byte [rax - 3], dl
lea rcx, [r9 + rax]
cmp rcx, 0x46
jb 0x140008aa0
mov byte [r8 + 0x47], 0
mov rax, r8
ret

Function at 0x140009020
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x44], 0
je 0x140009043
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x3f]
xor byte [rcx + rax], dl
inc rax
cmp rax, 0x43
jb 0x140009030
mov byte [rcx + 0x44], 0
mov rax, rcx
ret

Function at 0x140009050
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x82], 0
je 0x140009078
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x3f]
xor byte [rcx + rax], dl
inc rax
cmp rax, 0x81
jb 0x140009060
mov byte [rcx + 0x82], 0
mov rax, rcx
ret
Function at 0x14000b610
Capabilities:
Execute command

Disassembly:
push rbx
sub rsp, 0xa0
mov rax, qword [0x14009b080]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rbx, rcx
mov qword [rsp + 0x88], rcx
mov rcx, qword [rcx + 0x10]
movabs rax, 0x7fffffffffffffff
sub rax, rcx
cmp rax, 0x2d
jb 0x14000b7e9
mov rax, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x14000b65e
mov rax, qword [rbx]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], reloc.WLDAP32.dll_Ordinal_45
lea r9, str.start_cmd__C__color_b__title_Error__echo
lea rcx, [rsp + 0x68]
call fcn.140016fd0
nop
mov r8d, reloc.WS2_32.dll_recvfrom
lea rdx, str.__timeout__t_5_
lea rcx, [rsp + 0x68]
call fcn.140010f20
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0xf
cmova rcx, qword [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x14000b726
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b721
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000b721
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400784e0
movdqa xmm0, xmmword [0x14008d930]
movdqu xmmword [rsp + 0x50], xmm0
mov byte [rsp + 0x40], 0
mov rdx, qword [rsp + 0x80]
cmp rdx, 0xf
jbe 0x14000b77c
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b777
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000b777
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400784e0
xor ecx, ecx
int 0x29
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x14000b7b6
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x14000b7b1
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000b7e2
mov rcx, r8
call fcn.1400784e0
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140078160
add rsp, 0xa0
pop rbx
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.140002420
nop
int3
Function at 0x14000ec80
Capabilities:
Parse pe header

Disassembly:
cmp byte [rcx + 0x25], 0
je 0x14000ed1d
xor byte [rcx], 0x3f
xor byte [rcx + 1], 0x40
xor byte [rcx + 2], 0x41
xor byte [rcx + 3], 0x42
xor byte [rcx + 4], 0x43
xor byte [rcx + 5], 0x44
xor byte [rcx + 6], 0x45
xor byte [rcx + 7], 0x46
xor byte [rcx + 8], 0x47
xor byte [rcx + 9], 0x48
xor byte [rcx + 0xa], 0x49
xor byte [rcx + 0xb], 0x4a
xor byte [rcx + 0xc], 0x4b
xor byte [rcx + 0xd], 0x4c
xor byte [rcx + 0xe], 0x4d
xor byte [rcx + 0xf], 0x4e
xor byte [rcx + 0x10], 0x4f
xor byte [rcx + 0x11], 0x50
xor byte [rcx + 0x12], 0x51
xor byte [rcx + 0x13], 0x52
xor byte [rcx + 0x14], 0x53
xor byte [rcx + 0x15], 0x54
xor byte [rcx + 0x16], 0x55
xor byte [rcx + 0x17], 0x56
xor byte [rcx + 0x18], 0x57
xor byte [rcx + 0x19], 0x58
xor byte [rcx + 0x1a], 0x59
xor byte [rcx + 0x1b], 0x5a
xor byte [rcx + 0x1c], 0x5b
xor byte [rcx + 0x1d], 0x5c
xor byte [rcx + 0x1e], 0x5d
xor byte [rcx + 0x1f], 0x5e
xor byte [rcx + 0x20], 0x5f
xor byte [rcx + 0x21], 0x60
xor byte [rcx + 0x22], 0x61
xor byte [rcx + 0x23], 0x62
mov byte [rcx + 0x25], 0
ret

Function at 0x14000f440
Capabilities:
Parse pe header

Disassembly:
cmp byte [rcx + 0x31], 0
je 0x14000f50d
xor byte [rcx], 0x3f
xor byte [rcx + 1], 0x40
xor byte [rcx + 2], 0x41
xor byte [rcx + 3], 0x42
xor byte [rcx + 4], 0x43
xor byte [rcx + 5], 0x44
xor byte [rcx + 6], 0x45
xor byte [rcx + 7], 0x46
xor byte [rcx + 8], 0x47
xor byte [rcx + 9], 0x48
xor byte [rcx + 0xa], 0x49
xor byte [rcx + 0xb], 0x4a
xor byte [rcx + 0xc], 0x4b
xor byte [rcx + 0xd], 0x4c
xor byte [rcx + 0xe], 0x4d
xor byte [rcx + 0xf], 0x4e
xor byte [rcx + 0x10], 0x4f
xor byte [rcx + 0x11], 0x50
xor byte [rcx + 0x12], 0x51
xor byte [rcx + 0x13], 0x52
xor byte [rcx + 0x14], 0x53
xor byte [rcx + 0x15], 0x54
xor byte [rcx + 0x16], 0x55
xor byte [rcx + 0x17], 0x56
xor byte [rcx + 0x18], 0x57
xor byte [rcx + 0x19], 0x58
xor byte [rcx + 0x1a], 0x59
xor byte [rcx + 0x1b], 0x5a
xor byte [rcx + 0x1c], 0x5b
xor byte [rcx + 0x1d], 0x5c
xor byte [rcx + 0x1e], 0x5d
xor byte [rcx + 0x1f], 0x5e
xor byte [rcx + 0x20], 0x5f
xor byte [rcx + 0x21], 0x60
xor byte [rcx + 0x22], 0x61
xor byte [rcx + 0x23], 0x62
xor byte [rcx + 0x24], 0x63
xor byte [rcx + 0x25], 0x64
xor byte [rcx + 0x26], 0x65
xor byte [rcx + 0x27], 0x66
xor byte [rcx + 0x28], 0x67
xor byte [rcx + 0x29], 0x68
xor byte [rcx + 0x2a], 0x69
xor byte [rcx + 0x2b], 0x6a
xor byte [rcx + 0x2c], 0x6b
xor byte [rcx + 0x2d], 0x6c
xor byte [rcx + 0x2e], 0x6d
xor byte [rcx + 0x2f], 0x6e
mov byte [rcx + 0x31], 0
ret