joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140044a80
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1400d4080]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140044b53
cmp byte [rcx + 0x71], 0
je 0x140044b53
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + Ordinal_26]
cmp eax, 0xffffffff
je 0x140044b4f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140044b14
sub eax, 1
je 0x140044b18
cmp eax, 2
jne 0x140044b4f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400aa6f0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140044b46
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x140044b4f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x140044afc
xor al, al
jmp 0x140044afc
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400aa6f0
add rsp, 0x60
pop rbx
ret
Function at 0x140045600
Capabilities:
Move file
Set console window title

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov rax, qword [0x1400d4080]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rdx
mov dword [rsp + 0x20], 0
mov rax, qword [rdx + 0x10]
mov rsi, rdx
cmp qword [rdx + 0x18], 0x10
jb 0x14004564a
mov rsi, qword [rdx]
cmp rax, 4
jb 0x1400456dc
lea rbp, [rax + rsi]
lea r8, [rbp - 3]
sub r8, rsi
mov edx, reloc.WLDAP32.dll_Ordinal_46
mov rcx, rsi
call sub.VCRUNTIME140.dll_memchr
mov r9, rax
test rax, rax
je 0x1400456dc
lea r14, str..exe
nop dword [rax + rax]
xor eax, eax
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [r9 + rax]
inc rax
cmp cl, byte [r14 + rax - 1]
jne 0x1400456a9
cmp rax, 4
jne 0x140045690
xor eax, eax
jmp 0x1400456ae
sbb eax, eax
or eax, 1
test eax, eax
je 0x1400456d3
inc r9
lea r8, [rbp - 3]
sub r8, r9
mov edx, reloc.WLDAP32.dll_Ordinal_46
mov rcx, r9
call sub.VCRUNTIME140.dll_memchr
mov r9, rax
test rax, rax
jne 0x140045680
jmp 0x1400456dc
sub r9, rsi
cmp r9, 0xffffffffffffffff
jne 0x1400456e4
mov rcx, rbx
call fcn.1400457c0
mov rcx, rdi
call fcn.1400451f0
mov dword [rsp + 0x20], 1
mov rcx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x140045701
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov rcx, rdi
call fcn.1400457c0
cmp qword [rax + 0x18], 0x10
jb 0x140045719
mov rax, qword [rax]
mov rcx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x140045726
mov rcx, qword [rbx]
mov rdx, rax
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_rename]
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x140045766
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x140045761
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14004579c
mov rcx, r8
call fcn.1400aa99c
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rax, rdi
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400aa6f0
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x140045b70
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r10, rcx
mov r9d, 0x270
mov ecx, dword [rcx]
cmp ecx, r9d
jne 0x140045bd1
lea r8, [r10 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x140045b90
mov ecx, dword [r10]
jmp 0x140045cba
cmp ecx, 0x4e0
jb 0x140045cba
lea r11, [r10 + 0x9c4]
mov qword [rsp], rbx
mov eax, dword [r11]
mov ebx, 0xe3
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x140045bf0
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x140045c40
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
xor ecx, ecx
mov dword [r10], ecx
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x1400465f0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 6], sil
je 0x140046624
mov eax, esi
lea ecx, [rax - 0x3d]
xor byte [r8 + rax], cl
inc rax
cmp rax, 5
jb 0x140046610
mov byte [r8 + 6], sil
add r8, 5
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.140045fd0
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140046649
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140052d40
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x1400466c3
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400466be
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400466be
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400aa99c
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x1400466d0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 7], sil
je 0x140046704
mov eax, esi
lea ecx, [rax - 0x3d]
xor byte [r8 + rax], cl
inc rax
cmp rax, 6
jb 0x1400466f0
mov byte [r8 + 7], sil
add r8, 6
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.140045fd0
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140046729
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140052d40
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x1400467a3
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004679e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004679e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400aa99c
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400467b0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 8], sil
je 0x1400467e4
mov eax, esi
lea ecx, [rax - 0x3d]
xor byte [r8 + rax], cl
inc rax
cmp rax, 7
jb 0x1400467d0
mov byte [r8 + 8], sil
add r8, 7
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.140045fd0
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140046809
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140052d40
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140046883
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004687e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004687e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400aa99c
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x140046890
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 9], sil
je 0x1400468c4
mov eax, esi
lea ecx, [rax - 0x3d]
xor byte [r8 + rax], cl
inc rax
cmp rax, 8
jb 0x1400468b0
mov byte [r8 + 9], sil
add r8, 8
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.140045fd0
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x1400468e9
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140052d40
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140046963
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004695e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004695e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400aa99c
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x140046970
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 0xa], sil
je 0x1400469a4
mov eax, esi
lea ecx, [rax - 0x3d]
xor byte [r8 + rax], cl
inc rax
cmp rax, 9
jb 0x140046990
mov byte [r8 + 0xa], sil
add r8, 9
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.140045fd0
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x1400469c9
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140052d40
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140046a43
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140046a3e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140046a3e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400aa99c
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x140046a50
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r10, r8
mov rdi, rdx
mov rsi, rcx
mov qword [rsp + 0x28], rcx
xor ebx, ebx
cmp byte [r8 + 0xb], bl
je 0x140046a84
mov ecx, ebx
lea eax, [rcx - 0x3d]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 0xa
jb 0x140046a70
mov byte [r8 + 0xb], bl
add r8, 0xa
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x50]
call fcn.140045fd0
nop
cmp byte [rdi + 0xb], 0
je 0x140046ab4
lea eax, [rbx - 0x3d]
xor byte [rbx + rdi], al
inc rbx
cmp rbx, 0xa
jb 0x140046aa1
mov byte [rdi + 0xb], 0
lea r8, [rdi + 0xa]
lea r9, [rsp + 0x20]
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.140045fd0
nop
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
movzx edx, byte [rsp + 0x20]
mov rcx, rsi
call fcn.14004c6d0
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140046b24
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140046b1e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140046b1e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400aa99c
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x140046b64
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140046b5f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140046b5f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400aa99c
mov rax, rsi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x140046b70
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 0xc], sil
je 0x140046ba4
mov eax, esi
lea ecx, [rax - 0x3d]
xor byte [r8 + rax], cl
inc rax
cmp rax, 0xb
jb 0x140046b90
mov byte [r8 + 0xc], sil
add r8, 0xb
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.140045fd0
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140046bc9
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140052d40
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140046c43
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140046c3e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140046c3e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400aa99c
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x14004d990
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 9], al
je 0x14004d9b3
lea edx, [rax - 0x3d]
xor byte [rax + rcx], dl
inc rax
cmp rax, 8
jb 0x14004d9a0
mov byte [rcx + 9], 0
lea r8, [rcx + 8]
mov rdx, rcx
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.140045fd0
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x14004d9d0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 0x10], al
je 0x14004d9f3
lea edx, [rax - 0x3d]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xf
jb 0x14004d9e0
mov byte [rcx + 0x10], 0
lea r8, [rcx + 0xf]
mov rdx, rcx
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.140045fd0
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x14004ed00
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 5], 0
je 0x14004ed23
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x3d]
xor byte [rax + rcx], dl
inc rax
cmp rax, 4
jb 0x14004ed10
mov byte [rcx + 5], 0
mov rax, rcx
ret

Function at 0x14004ed30
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x136], 0
je 0x14004ed58
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x3d]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x135
jb 0x14004ed40
mov byte [rcx + 0x136], 0
mov rax, rcx
ret

Function at 0x14004ed60
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x44], 0
je 0x14004ed83
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x3d]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x43
jb 0x14004ed70
mov byte [rcx + 0x44], 0
mov rax, rcx
ret
Function at 0x14004ed90
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x47], 0
je 0x14004edb3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x3d]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x46
jb 0x14004eda0
mov byte [rcx + 0x47], 0
mov rax, rcx
ret
Function at 0x14004f4c0
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
mov r10, rcx
mov ecx, r9d
test r8, r8
je 0x14004f5a7
sub r10, rdx
cmp r8, 8
jb 0x14004f583
mov rax, r8
lea r9, [rdx + 4]
and rax, 0xfffffffffffffff8
xorps xmm3, xmm3
xorps xmm2, xmm2
movd xmm1, dword [r10 + r9 - 4]
add rcx, 8
movd xmm0, dword [r9 - 4]
lea r9, [r9 + 8]
punpcklbw xmm1, xmm1
punpcklwd xmm1, xmm1
punpcklbw xmm0, xmm0
psrad xmm1, 0x18
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
pxor xmm1, xmm0
movd xmm0, dword [r9 - 8]
punpcklbw xmm0, xmm0
por xmm3, xmm1
movd xmm1, dword [r10 + r9 - 8]
punpcklbw xmm1, xmm1
punpcklwd xmm1, xmm1
punpcklwd xmm0, xmm0
psrad xmm1, 0x18
psrad xmm0, 0x18
pxor xmm1, xmm0
por xmm2, xmm1
cmp rcx, rax
jb 0x14004f4f0
por xmm2, xmm3
movdqa xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movdqa xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movd r9d, xmm2
cmp rcx, r8
jae 0x14004f5a7
lea rax, [rcx + rdx]
sub r8, rcx
nop word [rax + rax]
movsx edx, byte [r10 + rax]
movsx ecx, byte [rax]
lea rax, [rax + 1]
xor edx, ecx
or r9d, edx
sub r8, 1
jne 0x14004f590
test r9d, r9d
sete al
ret
Function at 0x140050880
Capabilities:
Execute command

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x1400d4080]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rsi, rcx
mov qword [rsp + 0x78], rcx
mov r8, rcx
lea rdx, str.start_cmd__C__color_b__title_Error__echo
lea rcx, [rsp + 0x58]
call fcn.140046490
mov rdi, rax
mov rcx, qword [rax + 0x10]
mov rdx, qword [rax + 0x18]
mov rax, rdx
sub rax, rcx
cmp rax, 0x11
jb 0x14005090a
lea rax, [rcx + 0x11]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x1400508eb
mov rax, qword [rdi]
lea rbx, [rax + rcx]
mov r8d, reloc.WS2_32.dll_recvfrom
lea rdx, str.__timeout__t_5_
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x11], 0
jmp 0x14005092c
mov qword [rsp + 0x20], reloc.WS2_32.dll_recvfrom
lea r9, str.__timeout__t_5_
xor r8d, r8d
lea edx, [r8 + 0x11]
mov rcx, rdi
call fcn.1400459c0
mov rdi, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
movups xmm0, xmmword [rdi]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rdi + 0x10], 0
mov qword [rdi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rdi], 0
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 0x10
cmovae rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x1400509b8
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400509b3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400509b3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400aa99c
movdqa xmm0, xmmword [0x1400c3f50]
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x30], 0
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x140050a0b
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140050a06
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140050a06
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400aa99c
xor ecx, ecx
int 0x29
mov rdx, qword [rsi + 0x18]
cmp rdx, 0x10
jb 0x140050a45
inc rdx
mov rcx, qword [rsi]
cmp rdx, 0x1000
jb 0x140050a40
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140050a7d
mov rcx, r8
call fcn.1400aa99c
mov qword [rsi + 0x10], 0
mov qword [rsi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rsi], 0
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400aa6f0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x1400604f0
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__read]
cdqe
add rsp, 0x28
ret
Function at 0x140071cd0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx + 0x718], 0
mov rsi, r9
mov rbp, r8
movsxd rbx, edx
mov rdi, rcx
je 0x140071d2e
mov dl, 1
call fcn.1400627e0
mov rax, qword [rdi + 0x670]
mov r9, rsi
mov r8, rbp
mov qword [rsp + 0x20], rax
mov edx, ebx
mov rcx, rdi
call qword [rdi + 0x718]
xor edx, edx
mov rcx, rdi
mov ebx, eax
call fcn.1400627e0
mov eax, ebx
jmp 0x140071d72
cmp ebx, 2
ja 0x140071d70
mov r9, qword [rdi + 0x668]
lea rdx, [0x1400b36c0]
lea rcx, [rbx + rbx*2]
add rcx, rdx
mov edx, 2
lea r8d, [rdx - 1]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r9, qword [rdi + 0x668]
mov r8d, 1
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x140071d90
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rdi
sub rsp, 0x160
mov rax, qword [0x1400d4080]
xor rax, rsp
mov qword [rsp + 0x140], rax
cmp byte [rcx + 0xf1e], 0
mov rdi, rcx
jne 0x140071dd3
cmp qword [rcx + 0x678], 0
je 0x140071eb0
mov r8, rdx
mov qword [rsp + 0x158], rbx
mov edx, 0x100
lea r9, [rsp + 0x180]
lea rcx, [rsp + 0x30]
call fcn.1400608e0
lea rax, [rsp + 0x30]
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x140071e01
mov rcx, qword [rdi + 0x678]
test rcx, rcx
je 0x140071e48
cmp byte [rdi + 0x1597], 0
jne 0x140071e48
lea rdx, [rsp + 0x30]
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rdx]
lea rdx, [rdx + 1]
mov byte [rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x140071e30
mov byte [rdi + 0x1597], 1
cmp byte [rdi + 0xf1e], 0
je 0x140071ea8
mov byte [rsp + rbx + 0x30], 0xa
inc rbx
cmp rbx, 0x102
jae 0x140071f03
cmp qword [rdi + 0x718], 0
mov byte [rsp + rbx + 0x30], 0
je 0x140071ec9
mov dl, 1
mov rcx, rdi
call fcn.1400627e0
mov rax, qword [rdi + 0x670]
lea r8, [rsp + 0x30]
mov r9, rbx
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, rdi
call qword [rdi + 0x718]
xor edx, edx
mov rcx, rdi
call fcn.1400627e0
mov rbx, qword [rsp + 0x158]
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400aa6f0
add rsp, 0x160
pop rdi
ret
mov r9, qword [rdi + 0x668]
lea rcx, [0x1400b36c0]
mov edx, 2
lea r8d, [rdx - 1]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r9, qword [rdi + 0x668]
lea rcx, [rsp + 0x30]
mov r8d, 1
mov rdx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
jmp 0x140071ea8
call fcn.1400aaad8
int3