joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001560
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x680
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x670], rax
lea rbx, [0x14001ea30]
mov rbp, rcx
mov rdi, rbx
mov esi, 0x1a
xor r14d, r14d
cmp byte [rbx + 0x19], r14b
je 0x140001672
movsx ecx, byte [rbx]
call fcn.140005fa8
mov r8d, 0x104
mov word [rsp + 0x40], ax
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x42], 0x3a
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
cmp eax, 4
jbe 0x140001672
cmp word [rsp + 0x50], 0x5c
jne 0x140001672
cmp word [rsp + 0x52], 0x3f
jne 0x140001672
cmp word [rsp + 0x54], 0x3f
jne 0x140001672
cmp word [rsp + 0x56], 0x5c
jne 0x140001672
mov qword [rsp + 0x38], r14
lea rax, [rsp + 0x260]
mov qword [rsp + 0x30], r14
lea r8, [rsp + 0x58]
mov dword [rsp + 0x28], 0x410
or r9d, 0xffffffff
xor edx, edx
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov rdx, rdi
mov rcx, rbp
call section..text
lea rdx, [0x14001438c]
mov rcx, rbp
call section..text
lea rdx, [rsp + 0x260]
mov rcx, rbp
call section..text
lea rdx, [0x14001438c]
mov rcx, rbp
call section..text
add rdi, 0x20
add rbx, 0x20
sub rsi, 1
jne 0x1400015a2
mov rcx, qword [rsp + 0x670]
xor rcx, rsp
call fcn.140002550
lea r11, [rsp + 0x680]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x1400091c8
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
mov rdx, rcx
test rcx, rcx
jne 0x1400091a5
call fcn.1400079b4
mov dword [rax], 0x16
call fcn.1400086c8
or eax, 0xffffffff
jmp 0x1400091c2
sub dword [rcx + 0x10], 1
jns 0x1400091b4
add rsp, 0x28
jmp 0x14000ddc0
mov rax, qword [rcx]
movzx ecx, byte [rax]
inc rax
mov qword [rdx], rax
mov eax, ecx
add rsp, 0x28
ret
jmp 0x140009184
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x14000dc60
call fcn.1400079b4
mov dword [rax], 0x16
call fcn.1400086c8
or eax, 0xffffffff
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x14000dc48
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x14000dc48
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x10]
shr ecx, 1
test cl, 1
je 0x14000dc92
lock or dword [rax + 0x14], 0x10
jmp 0x14000dc48
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x14000dcaf
mov rcx, qword [rbp + 0x10]
call fcn.1400105c0
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.14000915c
mov rdx, qword [rbp + 0x10]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.140010b54
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x10]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 1
ja 0x14000dd06
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x10]
and dword [rax + 0x10], 0
jmp 0x14000dc48
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x14000dd72
mov rcx, qword [rbp + 0x10]
call fcn.14000915c
cmp eax, 0xffffffff
je 0x14000dd59
mov rcx, qword [rbp + 0x10]
call fcn.14000915c
cmp eax, 0xfffffffe
je 0x14000dd59
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.14000915c
movsxd rdi, eax
lea rsi, [0x14001f8b0]
mov rcx, rbx
sar rdi, 6
call fcn.14000915c
and eax, 0x3f
shl rax, 6
add rax, qword [rsi + rdi*8]
jmp 0x14000dd60
lea rax, [0x14001e2d0]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x14000dd72
mov rax, qword [rbp + 0x10]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x10]
cmp dword [rax + 0x20], 0x200
jne 0x14000dda8
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x14000dda4
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x14000dda4
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x10]
dec dword [rax + 0x10]
mov rcx, qword [rax]
movzx edx, byte [rcx]
inc rcx
mov qword [rax], rcx
mov eax, edx
jmp 0x14000dc4b
jmp 0x14000dc18
Function at 0x140004090
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x47], 0
je 0x1400040b3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x47]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x46
jb 0x1400040a0
mov byte [rcx + 0x47], 0
mov rax, rcx
ret

Function at 0x1400040c0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x68], rcx
xor esi, esi
cmp byte [r8 + 6], sil
je 0x1400040f4
mov ecx, esi
lea eax, [rcx + 0x47]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 5
jb 0x1400040e0
mov byte [r8 + 6], sil
lea rax, [r8 + 5]
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x48], sil
cmp r9, rax
je 0x140004129
mov r8d, 5
mov rdx, r9
lea rcx, [rsp + 0x48]
call fcn.140008e20
nop
cmp byte [rbx + 0xa], 0
je 0x140004153
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x47]
xor byte [rcx + rbx], al
inc rcx
cmp rcx, 9
jb 0x140004140
mov byte [rbx + 0xa], 0
lea rax, [rbx + 9]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], 0
cmp rbx, rax
je 0x140004188
mov r8d, 9
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.140008e20
nop
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x28]
movzx edx, byte [rsp + 0x20]
mov rcx, rdi
call fcn.14000b2e0
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x1400041e1
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400041db
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400041db
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140147368
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x140004221
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000421c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000421c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140147368
mov rax, rdi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x140004230
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x48], rcx
xor esi, esi
cmp byte [r8 + 7], sil
je 0x140004264
mov eax, esi
lea ecx, [rax + 0x47]
xor byte [r8 + rax], cl
inc rax
cmp rax, 6
jb 0x140004250
mov byte [r8 + 7], sil
lea rax, [r8 + 6]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], sil
cmp r9, rax
je 0x140004299
mov r8d, 6
mov rdx, r9
lea rcx, [rsp + 0x28]
call fcn.140008e20
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x1400042a7
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x28]
call fcn.14000c3f0
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x14000431e
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004319
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004319
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140147368
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x140004330
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x48], rcx
xor esi, esi
cmp byte [r8 + 0xa], sil
je 0x140004364
mov eax, esi
lea ecx, [rax + 0x47]
xor byte [r8 + rax], cl
inc rax
cmp rax, 9
jb 0x140004350
mov byte [r8 + 0xa], sil
lea rax, [r8 + 9]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], sil
cmp r9, rax
je 0x140004399
mov r8d, 9
mov rdx, r9
lea rcx, [rsp + 0x28]
call fcn.140008e20
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x1400043a7
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x28]
call fcn.14000c3f0
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x14000441e
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004419
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004419
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140147368
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x140004430
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x136], 0
je 0x140004458
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x47]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x135
jb 0x140004440
mov byte [rcx + 0x136], 0
mov rax, rcx
ret
Function at 0x140004fe0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x68], rcx
xor esi, esi
cmp byte [r8 + 0xb], sil
je 0x140005014
mov ecx, esi
lea eax, [rcx + 0x47]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 0xa
jb 0x140005000
mov byte [r8 + 0xb], sil
lea rax, [r8 + 0xa]
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x48], sil
cmp r9, rax
je 0x140005049
mov r8d, 0xa
mov rdx, r9
lea rcx, [rsp + 0x48]
call fcn.140008e20
nop
cmp byte [rbx + 0xb], 0
je 0x140005073
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x47]
xor byte [rcx + rbx], al
inc rcx
cmp rcx, 0xa
jb 0x140005060
mov byte [rbx + 0xb], 0
lea rax, [rbx + 0xa]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], 0
cmp rbx, rax
je 0x1400050a8
mov r8d, 0xa
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.140008e20
nop
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x28]
movzx edx, byte [rsp + 0x20]
mov rcx, rdi
call fcn.14000b2e0
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x140005101
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400050fb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400050fb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140147368
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x140005141
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000513c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000513c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140147368
mov rax, rdi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x140005150
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x48], rcx
xor esi, esi
cmp byte [r8 + 0xc], sil
je 0x140005184
mov eax, esi
lea ecx, [rax + 0x47]
xor byte [r8 + rax], cl
inc rax
cmp rax, 0xb
jb 0x140005170
mov byte [r8 + 0xc], sil
lea rax, [r8 + 0xb]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], sil
cmp r9, rax
je 0x1400051b9
mov r8d, listen
mov rdx, r9
lea rcx, [rsp + 0x28]
call fcn.140008e20
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x1400051c7
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x28]
call fcn.14000c3f0
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x14000523e
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005239
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005239
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140147368
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x140005eb0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x68], rcx
xor esi, esi
cmp byte [r8 + 0xb], sil
je 0x140005ee4
mov ecx, esi
lea eax, [rcx + 0x47]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 0xa
jb 0x140005ed0
mov byte [r8 + 0xb], sil
lea rax, [r8 + 0xa]
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x48], sil
cmp r9, rax
je 0x140005f19
mov r8d, 0xa
mov rdx, r9
lea rcx, [rsp + 0x48]
call fcn.140008e20
nop
cmp byte [rbx + 0xe], 0
je 0x140005f43
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x47]
xor byte [rcx + rbx], al
inc rcx
cmp rcx, 0xd
jb 0x140005f30
mov byte [rbx + 0xe], 0
lea rax, [rbx + 0xd]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], 0
cmp rbx, rax
je 0x140005f78
mov r8d, reloc.WS2_32.dll_listen
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.140008e20
nop
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x28]
movzx edx, byte [rsp + 0x20]
mov rcx, rdi
call fcn.14000b2e0
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x140005fd1
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005fcb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005fcb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140147368
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x140006011
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000600c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000600c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140147368
mov rax, rdi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x140006020
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x48], rcx
xor esi, esi
cmp byte [r8 + 6], sil
je 0x140006054
mov eax, esi
lea ecx, [rax + 0x47]
xor byte [r8 + rax], cl
inc rax
cmp rax, 5
jb 0x140006040
mov byte [r8 + 6], sil
lea rax, [r8 + 5]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], sil
cmp r9, rax
je 0x140006089
mov r8d, 5
mov rdx, r9
lea rcx, [rsp + 0x28]
call fcn.140008e20
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140006097
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x28]
call fcn.14000c3f0
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x14000610e
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006109
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006109
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140147368
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400068d0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x68], rcx
xor esi, esi
cmp byte [r8 + 6], sil
je 0x140006904
mov ecx, esi
lea eax, [rcx + 0x47]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 5
jb 0x1400068f0
mov byte [r8 + 6], sil
lea rax, [r8 + 5]
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x48], sil
cmp r9, rax
je 0x140006939
mov r8d, 5
mov rdx, r9
lea rcx, [rsp + 0x48]
call fcn.140008e20
nop
cmp byte [rbx + 0xc], 0
je 0x140006963
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x47]
xor byte [rcx + rbx], al
inc rcx
cmp rcx, 0xb
jb 0x140006950
mov byte [rbx + 0xc], 0
lea rax, [rbx + 0xb]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], 0
cmp rbx, rax
je 0x140006998
mov r8d, listen
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.140008e20
nop
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x28]
movzx edx, byte [rsp + 0x20]
mov rcx, rdi
call fcn.14000b2e0
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x1400069f1
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400069eb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400069eb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140147368
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x140006a31
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006a2c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006a2c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140147368
mov rax, rdi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x14001f280
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov rax, qword [0x1401d0680]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rbp, rcx
mov r15, r9
mov rcx, r8
mov rsi, r8
mov rdi, rdx
call sub.MSVCP140.dll__Mtx_lock
test eax, eax
jne 0x14001f40c
mov eax, dword [rsi + 0x4c]
cmp eax, 0x7fffffff
je 0x14001f3fc
mov rcx, rdi
call sub.libssl_3_x64.dll_SSL_new
mov rcx, rsi
mov rdi, rax
call sub.MSVCP140.dll__Mtx_unlock
test rdi, rdi
je 0x14001f38e
lea r8, [rsp + 0x20]
mov dword [rsp + 0x20], 1
mov edx, 0x8004667e
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_ioctlsocket]
xor edx, edx
mov ecx, ebp
call sub.libcrypto_3_x64.dll_BIO_new_socket
xor r9d, r9d
mov rcx, rax
mov r14, rax
lea edx, [r9 + 0x66]
lea r8d, [r9 + 1]
call sub.libcrypto_3_x64.dll_BIO_ctrl
mov r8, r14
mov rdx, r14
mov rcx, rdi
call sub.libssl_3_x64.dll_SSL_set_bio
mov r9, qword [rsp + 0x80]
add r9, 8
cmp qword [r9 + 0x18], 0xf
jbe 0x14001f343
mov r9, qword [r9]
xor r8d, r8d
mov rcx, rdi
lea edx, [r8 + 0x37]
call sub.libssl_3_x64.dll_SSL_ctrl
mov rdx, rdi
mov rcx, r15
call fcn.140026560
cmp al, 1
jne 0x14001f3af
xor r9d, r9d
xor r8d, r8d
mov rcx, r14
lea edx, [r9 + 0x66]
call sub.libcrypto_3_x64.dll_BIO_ctrl
lea r8, [rsp + 0x20]
mov dword [rsp + 0x20], 0
mov edx, 0x8004667e
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov rax, rdi
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140147480
mov rbx, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov rcx, rdi
call sub.libssl_3_x64.dll_SSL_shutdown
mov rcx, rsi
call sub.MSVCP140.dll__Mtx_lock
test eax, eax
jne 0x14001f40c
mov eax, dword [rsi + 0x4c]
cmp eax, 0x7fffffff
je 0x14001f3fc
mov rcx, rdi
call sub.libssl_3_x64.dll_SSL_free
mov rcx, rsi
call sub.MSVCP140.dll__Mtx_unlock
lea r8, [rsp + 0x20]
mov dword [rsp + 0x20], 0
mov edx, 0x8004667e
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_ioctlsocket]
xor eax, eax
jmp 0x14001f391
dec eax
mov ecx, 6
mov dword [rsi + 0x4c], eax
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
mov ecx, 5
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
Function at 0x14002f610
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov dword [rcx + 0x74], 0
mov rbx, rcx
mov edi, 0x7fffffff
movsx ecx, byte [rbx + 0x78]
lea eax, [rcx - 0x30]
cmp al, 9
ja 0x14002f6dc
lea r8d, [rcx - 0x30]
cmp r8d, 0xffffffff
je 0x14002f6dc
mov r9d, dword [rbx + 0x74]
mov ecx, 0x7fffffff
sub ecx, r8d
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp r9d, edx
jg 0x14002f6f5
lea eax, [r9 + r9*4]
dec edi
lea ecx, [r8 + rax*2]
mov rax, qword [rbx]
mov dword [rbx + 0x74], ecx
mov rcx, qword [rbx + 0x10]
cmp rax, rcx
je 0x14002f6cc
cmp byte [rax], 0x5c
jne 0x14002f6c6
lea rdx, [rax + 1]
cmp rdx, rcx
je 0x14002f6c6
mov r8d, dword [rbx + 0x80]
test r8b, 8
jne 0x14002f6b2
movzx ecx, byte [rdx]
sub cl, 0x28
cmp cl, 1
jbe 0x14002f6c3
test r8b, 0x10
jne 0x14002f6c6
movzx ecx, byte [rdx]
sub cl, 0x7b
test cl, 0xfd
jne 0x14002f6c6
mov rax, rdx
inc rax
mov qword [rbx], rax
mov rcx, rbx
call fcn.1400337a0
test edi, edi
jne 0x14002f630
mov rbx, qword [rsp + 0x30]
cmp edi, 0x7fffffff
mov rsi, qword [rsp + 0x38]
setne al
add rsp, 0x20
pop rdi
ret
mov edx, esi
mov rcx, rbx
call fcn.140031900
int3

Function at 0x1400316e0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1401d0680]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x1400317b3
cmp byte [rcx + 0x71], 0
je 0x1400317b3
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + Ordinal_26]
cmp eax, 0xffffffff
je 0x1400317af
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140031774
sub eax, 1
je 0x140031778
cmp eax, 2
jne 0x1400317af
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140147480
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x1400317a6
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x1400317af
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14003175c
xor al, al
jmp 0x14003175c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140147480
add rsp, 0x60
pop rbx
ret