joyce8/EMBER2024-capa huggingface dataset:
Function at 0x77aa70
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x10
mov rbp, rsp
mov word [rbp + 0xa], 0xf7b
mov word [rbp + 0xc], 0xf9c
mov word [rbp + 0xe], 0x18c3
cmp r8d, dword [rbp + 0x40]
jne 0x77aae0
mov ecx, 1
mov eax, ecx
cmp eax, r8d
ja 0x77aadb
sub r8d, ecx
add r8d, 1
movzx eax, word [rbp + 0xe]
shr eax, 8
movzx rcx, byte [rdx]
xor cl, al
mov eax, ecx
mov byte [r9], al
add al, byte [rbp + 0xe]
movzx ax, al
imul ax, word [rbp + 0xa]
add ax, word [rbp + 0xc]
mov word [rbp + 0xe], ax
add rdx, 1
add r9, 1
sub r8d, 1
test r8d, r8d
jne 0x77aaa4
nop
mov al, 1
jmp 0x77aae2
xor eax, eax
lea rsp, [rbp + 0x10]
pop rbp
ret

Function at 0x77ade0
Capabilities:
Get graphical window text

Disassembly:
push rbp
sub rsp, 0x40
mov rbp, rsp
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x28], rbp
mov qword [rbp + 0x50], rcx
mov qword [rbp + 0x58], rdx
mov qword [rbp + 0x60], r8
nop
mov rcx, qword [rbp + 0x58]
call fcn.00411360
nop
mov rcx, qword [rbp + 0x60]
call sub.user32.dll_GetWindowTextLengthW
test eax, eax
je 0x77ae7f
mov rcx, qword [rbp + 0x60]
call sub.user32.dll_GetWindowTextLengthW
lea rcx, [rbp + 0x38]
mov edx, eax
call fcn.00412a50
mov dword [rbp + 0x34], 0
mov rax, qword [rbp + 0x38]
test rax, rax
je 0x77ae42
mov eax, dword [rax - 4]
mov dword [rbp + 0x34], eax
mov rcx, qword [rbp + 0x38]
call fcn.004127c0
mov rcx, qword [rbp + 0x60]
mov rdx, rax
mov r8d, dword [rbp + 0x34]
add r8d, 1
call sub.user32.dll_GetWindowTextW
mov rcx, qword [rbp + 0x58]
mov rdx, qword [rbp + 0x38]
call fcn.00411990
jmp 0x77ae7f
nop
lea rcx, [rbp + 0x38]
call fcn.00411360
mov rax, qword [rbp + 0x58]
lea rsp, [rbp + 0x40]
pop rbp
ret
Function at 0x77b210
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x90
mov rbp, rsp
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x88], 0
mov qword [rbp + 0x78], 0
mov qword [rbp + 0x58], rbp
mov qword [rbp + 0xa0], rcx
mov qword [rbp + 0xa8], rdx
mov qword [rbp + 0xb0], r8
mov dword [rbp + 0xb8], r9d
nop
movzx rax, word [rbp + 0xb8]
mov word [rbp + 0x76], ax
lea rcx, [rbp + 0x78]
mov rdx, qword [rbp + 0xb0]
call fcn.00436070
mov dword [rbp + 0x6c], 0
mov rax, qword [rbp + 0x78]
test rax, rax
je 0x77b2a1
mov eax, dword [rax - 4]
mov dword [rbp + 0x6c], eax
lea rcx, [rbp + 0x88]
mov r8d, 2
mov eax, dword [rbp + 0x6c]
cdq
idiv r8d
mov rdx, rax
xor r8, r8
call fcn.00412210
mov dword [rbp + 0x84], 1
nop
jmp 0x77b35e
lea rcx, [rbp + 0x48]
mov rax, qword [rbp + 0x78]
movsxd rdx, dword [rbp + 0x84]
movzx rdx, word [rax + rdx*2 - 2]
call fcn.00412810
lea rcx, [rbp + 0x40]
mov rax, qword [rbp + 0x78]
mov edx, dword [rbp + 0x84]
add edx, 1
movsxd rdx, edx
movzx rdx, word [rax + rdx*2 - 2]
call fcn.00412810
lea rcx, [rbp + 0x50]
mov edx, 3
lea r8, [0x0077b4ec]
mov r9, qword [rbp + 0x48]
mov rax, qword [rbp + 0x40]
mov qword [rsp + 0x20], rax
call fcn.00412d30
mov rcx, qword [rbp + 0x50]
call fcn.00437790
mov ecx, eax
mov r8, qword [rbp + 0x88]
mov r9d, 2
mov eax, dword [rbp + 0x84]
cdq
idiv r9d
movsxd rax, eax
mov byte [r8 + rax], cl
add dword [rbp + 0x84], 2
mov rcx, qword [rbp + 0x78]
call fcn.00411b60
cmp dword [rbp + 0x84], eax
jl 0x77b2d1
jmp 0x77b397
mov dword [rbp + 0x68], 0
mov rax, qword [rbp + 0x88]
test rax, rax
je 0x77b3b0
mov eax, dword [rax - 4]
mov dword [rbp + 0x68], eax
xor eax, eax
mov ecx, dword [rbp + 0x68]
sub ecx, 1
mov dword [rbp + 0x84], eax
cmp dword [rbp + 0x84], ecx
jg 0x77b425
sub ecx, eax
add ecx, 1
movsxd rax, dword [rbp + 0x84]
mov rdx, qword [rbp + 0x88]
movzx rdx, byte [rdx + rax]
mov dword [rbp + 0x80], edx
mov rdx, qword [rbp + 0x88]
lea rax, [rdx + rax]
movzx edx, word [rbp + 0x76]
shr edx, 8
xor byte [rax], dl
movzx rax, word [rbp + 0x80]
add ax, word [rbp + 0x76]
imul ax, word [rbp + 0xc0]
add ax, word [rbp + 0xc8]
mov word [rbp + 0x76], ax
add dword [rbp + 0x84], 1
sub ecx, 1
test ecx, ecx
jne 0x77b3cb
nop
lea rcx, [rbp + 0x38]
mov rdx, qword [rbp + 0x88]
call fcn.00418f90
mov rcx, qword [rbp + 0xa8]
mov rdx, qword [rbp + 0x38]
call fcn.00412940
nop
lea rcx, [rbp + 0x38]
call fcn.00411400
lea rcx, [rbp + 0x40]
mov edx, 3
call fcn.00411440
lea rcx, [rbp + 0x78]
call fcn.00411360
lea rcx, [rbp + 0x88]
call fcn.004113b0
mov rax, qword [rbp + 0xa8]
lea rsp, [rbp + 0x90]
pop rbp
ret
Function at 0x77ba10
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x10
mov rbp, rsp
mov word [rbp + 0xa], 0xf7b
mov word [rbp + 0xc], 0xf9c
mov word [rbp + 0xe], 0x18c3
cmp r8d, dword [rbp + 0x40]
jne 0x77ba80
mov ecx, 1
mov eax, ecx
cmp eax, r8d
ja 0x77ba7b
sub r8d, ecx
add r8d, 1
movzx eax, word [rbp + 0xe]
shr eax, 8
movzx rcx, byte [rdx]
xor cl, al
mov eax, ecx
mov byte [r9], al
add al, byte [rbp + 0xe]
movzx ax, al
imul ax, word [rbp + 0xa]
add ax, word [rbp + 0xc]
mov word [rbp + 0xe], ax
add rdx, 1
add r9, 1
sub r8d, 1
test r8d, r8d
jne 0x77ba44
nop
mov al, 1
jmp 0x77ba82
xor eax, eax
lea rsp, [rbp + 0x10]
pop rbp
ret
Function at 0x6c12d0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x6c12dd
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x6c12ed
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x6c12d5
lea eax, [rcx + 1]
jmp 0x6c12fb
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x6c130e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x6c12f4
sub eax, 3
jb 0x6c132e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x6c137d
sar eax, 1
movsxd rbp, eax
jb 0x6c1364
jmp 0x6c133c
add ebx, ebx
jne 0x6c133a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x6c1364
inc ecx
add ebx, ebx
jne 0x6c134a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x6c1364
call r11
adc ecx, ecx
add ebx, ebx
jne 0x6c135d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x6c134c
add ecx, 2
jmp 0x6c1369
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.006c1292
jmp 0x6c12dd
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0xf3800
mov dl, 0x1c
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x6c13c9
cmp rsi, rcx
jae 0x6c13d1
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x6c13b0
cmp al, 0x8f
ja 0x6c13b0
cmp byte [rsi - 2], 0xf
je 0x6c13b6
sub al, 0xe8
cmp al, 1
ja 0x6c139a
cmp rsi, rcx
jae 0x6c13d1
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x6c13a0
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x6c13d1
lodsb al, byte [rsi]
jmp 0x6c13b0
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x2bd000]
mov eax, dword [rdi]
or eax, eax
je 0x6c142e
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x2c1000]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x6c13de
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x6c1428
mov qword [rbx], rax
add rbx, 8
jmp 0x6c13fe
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x6c1468
cmp al, 0xef
ja 0x6c145a
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x6c143a
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x6c1449
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x6c14bc
sub rsp, 0xffffffffffffff80
jmp 0x46a100
Function at 0x140001c70
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x70
mov rbx, rcx
xor edx, edx
mov ecx, 0x5c
call fcn.140001b20
mov ecx, 0x5c
mov word [rsp + 0x40], ax
lea edx, [rcx - 0x5b]
call fcn.140001b20
mov ecx, reloc.WLDAP32.dll_Ordinal_46
mov word [rsp + 0x42], ax
lea edx, [rcx - 0x2c]
call fcn.140001b20
mov ecx, 0x5c
mov word [rsp + 0x44], ax
lea edx, [rcx - 0x59]
call fcn.140001b20
mov ecx, 0x45
mov word [rsp + 0x46], ax
lea edx, [rcx - 0x41]
call fcn.140001b20
mov ecx, 0x49
mov word [rsp + 0x48], ax
lea edx, [rcx - 0x44]
call fcn.140001b20
mov ecx, 0x51
mov word [rsp + 0x4a], ax
lea edx, [rcx - 0x4b]
call fcn.140001b20
mov ecx, 0x44
mov word [rsp + 0x4c], ax
lea edx, [rcx - 0x3d]
call fcn.140001b20
mov ecx, 0x56
mov word [rsp + 0x4e], ax
lea edx, [rcx - 0x4e]
call fcn.140001b20
xor ecx, ecx
mov word [rsp + 0x50], ax
lea edx, [rcx + 9]
call fcn.140001b20
movzx ecx, word [0x14007f5e4]
mov edx, 0xa
mov word [rsp + 0x52], ax
call fcn.140001b20
movzx ecx, word [0x14007f5e6]
mov edx, ntohs
mov word [rsp + 0x54], ax
call fcn.140001b20
movzx ecx, word [str.string_too_long]
mov edx, ntohs
mov word [rsp + 0x56], ax
call fcn.140001b20
movzx ecx, word [0x14007f5ea]
mov edx, reloc.WS2_32.dll_listen
mov word [rsp + 0x58], ax
call fcn.140001b20
movzx ecx, word [0x14007f5ec]
mov edx, reloc.WS2_32.dll_ntohl
mov word [rsp + 0x5a], ax
call fcn.140001b20
movzx ecx, word [0x14007f5ee]
mov edx, reloc.WS2_32.dll_ntohs
mov word [rsp + 0x5c], ax
call fcn.140001b20
movzx ecx, word [0x14007f5f0]
mov edx, reloc.WS2_32.dll_recv
mov word [rsp + 0x5e], ax
call fcn.140001b20
movzx ecx, word [0x14007f5f2]
mov edx, reloc.WS2_32.dll_recvfrom
mov word [rsp + 0x60], ax
call fcn.140001b20
movzx ecx, word [0x14007f5f4]
mov edx, reloc.WS2_32.dll_select
mov word [rsp + 0x62], ax
call fcn.140001b20
mov word [rsp + 0x64], ax
mov r9d, 0x133
xor eax, eax
mov word [rsp + 0x66], ax
xor r10d, r10d
nop
movsxd rcx, eax
lea rdx, [rsp + 0x40]
lea rdx, [rdx + rcx*2]
lea ecx, [r9 + rax]
inc eax
xor word [rdx], cx
cmp eax, 0x13
jb 0x140001e00
mov qword [rsp + 0x30], r10
lea rcx, [rsp + 0x40]
xor r9d, r9d
mov dword [rsp + 0x28], r10d
mov edx, 0xc0000000
mov word [rsp + 0x66], r10w
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbx + 8], rax
add rsp, 0x70
pop rbx
ret
Function at 0x1400050a0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x14023db80]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140005173
cmp byte [rcx + 0x71], 0
je 0x140005173
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + Ordinal_26]
cmp eax, 0xffffffff
je 0x14000516f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140005134
sub eax, 1
je 0x140005138
cmp eax, 2
jne 0x14000516f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400797e0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140005166
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14000516f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14000511c
xor al, al
jmp 0x14000511c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400797e0
add rsp, 0x60
pop rbx
ret
Function at 0x140005c40
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x14023db80]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov esi, edx
mov rdi, rcx
cmp edx, 0xffffffff
jne 0x140005c6d
xor eax, eax
jmp 0x140005dd6
mov qword [rsp + 0xa0], rbx
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
test rax, rax
je 0x140005cad
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::epptr_void_const___ptr64]
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
cmp rax, rbx
jae 0x140005cad
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], sil
mov eax, esi
jmp 0x140005dce
cmp qword [rdi + 0x80], 0
je 0x140005dc9
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::eback_void_const___ptr64]
lea rcx, [rdi + 0x70]
cmp rax, rcx
jne 0x140005ce7
mov rdx, qword [rdi + 0x88]
mov rcx, rdi
mov r9, qword [rdi + 0x90]
mov r8, rdx
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::setg_char____ptr64__char____ptr64__char____ptr64____ptr64]
mov rcx, qword [rdi + 0x68]
test rcx, rcx
jne 0x140005d12
mov rdx, qword [rdi + 0x80]
movsx ecx, sil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, esi
mov eax, ecx
jmp 0x140005dce
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], sil
mov qword [rsp + 0x38], rax
lea rdx, [rdi + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140005d81
sub eax, 1
je 0x140005d81
cmp eax, 2
jne 0x140005dc9
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rdi + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, esi
mov eax, ecx
jmp 0x140005dce
mov rbx, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rbx, rax
je 0x140005daf
mov r9, qword [rdi + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rbx
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rbx, rax
jne 0x140005dc9
lea rax, [rsp + 0x50]
mov byte [rdi + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, esi
mov eax, ecx
jmp 0x140005dce
mov eax, 0xffffffff
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400797e0
mov rsi, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x140005f20
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
push r14
mov r14, rcx
mov rsi, r8
mov rbp, rdx
sub r14, qword [r8 + 0x30]
je 0x1400060a2
test byte [r8 + 0x5e], 0x40
jne 0x140005f4d
xor eax, eax
mov rbp, qword [rsp + 0x30]
pop r14
pop rsi
ret
movzx edx, word [rsi + 0x14]
movzx eax, word [rsi + 6]
add rdx, 0x18
mov r8d, dword [r8 + 0xb0]
add rdx, rsi
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
cmp rdx, r9
jae 0x1400060a2
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jb 0x140005f86
mov eax, dword [rdx + 8]
add eax, ecx
cmp r8, rax
jb 0x140005f9d
add rdx, 0x28
cmp rdx, r9
jb 0x140005f74
mov eax, 1
mov rbp, qword [rsp + 0x30]
pop r14
pop rsi
ret
mov qword [rsp + 0x18], rbx
mov ebx, dword [rdx + 0x14]
sub rbx, rcx
mov qword [rsp + 0x28], r15
mov r15d, dword [rsi + 0xb4]
add rbx, r8
add rbx, rbp
add r15, rbx
test rbx, rbx
je 0x140006098
cmp rbx, r15
jae 0x140006098
mov qword [rsp + 0x20], rdi
mov eax, dword [rbx + 4]
test eax, eax
je 0x140006093
add eax, 0xfffffff8
shr eax, 1
je 0x140006084
lea r11, [rbx + 8]
mov edi, eax
movzx r8d, word [r11]
movzx eax, r8w
shr ax, 0xc
and r8d, 0x80000fff
jge 0x140006012
dec r8d
or r8d, 0xfffff000
inc r8d
cmp ax, 3
je 0x14000601e
cmp ax, 0xa
jne 0x140006076
movzx eax, word [rsi + 0x14]
movzx ecx, word [rsi + 6]
add rax, 0x18
mov r9d, dword [rbx]
add rax, rsi
lea rdx, [rcx + rcx*4]
lea r10, [rax + rdx*8]
cmp rax, r10
jae 0x14000606b
nop dword [rax]
mov edx, dword [rax + 0xc]
cmp r9, rdx
jb 0x140006052
mov ecx, dword [rax + 8]
add ecx, edx
cmp r9, rcx
jb 0x14000605d
add rax, 0x28
cmp rax, r10
jb 0x140006040
jmp 0x14000606b
mov ecx, dword [rax + 0x14]
sub rcx, rdx
add rcx, r9
add rcx, rbp
jne 0x14000606e
mov rcx, rbp
movzx eax, r8w
add qword [rax + rcx], r14
add r11, 2
sub rdi, 1
jne 0x140005ff0
mov eax, dword [rbx + 4]
add rbx, rax
cmp rbx, r15
jb 0x140005fd4
mov rdi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x18]
mov r15, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x30]
mov eax, 1
pop r14
pop rsi
ret
Function at 0x140006d50
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rsi, r8
mov r14, rdx
mov rbp, rcx
test r8, r8
jg 0x140006d72
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je case.default.0x140006d81
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov qword [rsp + 0x28], rbx
mov rbx, rsi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Gnavail_void_const___ptr64]
test rax, rax
je 0x140006dd2
cmp rax, rsi
mov rdi, rsi
mov rcx, rbp
cmovb rdi, rax
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gptr_void_const___ptr64]
mov r8, rdi
mov rcx, r14
mov rdx, rax
call sub.VCRUNTIME140.dll_memcpy
mov edx, edi
mov rcx, rbp
add r14, rdi
sub rbx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int____ptr64]
cmp qword [rbp + 0x80], 0
mov rdi, rbx
je 0x140006e41
mov rcx, rbp
call fcn.1400051b0
cmp rbx, 0xfff
jbe 0x140006e21
mov r9, qword [rbp + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
add r14, rax
mov rdi, rbx
cmp rax, 0xfff
jne 0x140006e5a
cmp rbx, rax
ja 0x140006df0
test rdi, rdi
je 0x140006e41
mov r9, qword [rbp + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rdi, rax
sub rsi, rdi
mov rbx, qword [rsp + 0x28]
mov rax, rsi
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
sub rsi, rbx
jmp 0x140006e44
js str.O1maUdHgGM6yGiPVnW1v
xor qword [r13 + 0x61], r13
push rbp
jns 0x140118a83
imul edx, dword [rax + 0x56], 0x7631576e
add byte [rax + 0x55], ch
push 0x52465155
add byte [rbp + 0x4f], al
jne str.b6NPXgHgW1nh89SN6aq4
outsb dx, byte [rsi]
push rdi
je 0x140118b01
xor eax, dword [rbp + 0x62]
xor byte [0x1a346f30b], dh
add byte [rbx + rbp*2 + 0x53], r9b
invalid
invalid
push rbx
invalid
invalid
js 0x140118b4b
invalid
pop rax
ja 0x140118bc0
add byte [r9 + r13*2 + 0x47], spl
invalid
invalid
invalid
invalid
push rsi
push rax
xor dword [rcx], esi
add byte [rbp + 0x63], al
invalid
invalid
imul ebp, dword [rax + 0x73], 0x4a
xor byte [eax + edx*2 + 0x71], dh
push rax
invalid
Function at 0x140006e60
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je case.default.0x140006e81
add rsp, 0x20
pop r14
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov rbp, rax
test rbx, rbx
jle 0x140006efc
test rax, rax
jle 0x140006edc
cmp rbx, rax
mov rcx, rdi
cmovl rbp, rbx
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, rbp
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov edx, ebp
mov rcx, rdi
add r14, rbp
sub rbx, rbp
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
test rbx, rbx
jle 0x140006efc
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140006efc
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov rbp, qword [rsp + 0x40]
sub rsi, rbx
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rbx
ret
insb byte [rdi], dx
push rdx
outsb dx, byte [rsi]
push rax
insd dword [rdi], dx
insd dword [rdi], dx
invalid
Function at 0x14000eeb0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 7], sil
je 0x14000eee4
mov eax, esi
lea ecx, [rax - 0x24]
xor byte [r8 + rax], cl
inc rax
cmp rax, 6
jb 0x14000eed0
mov byte [r8 + 7], sil
add r8, 6
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.14000e720
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x14000ef09
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140023660
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x14000ef83
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ef7e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000ef7e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007983c
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x14000ef90
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r10, r8
mov rdi, rdx
mov rsi, rcx
mov qword [rsp + 0x28], rcx
xor ebx, ebx
cmp byte [r8 + 9], bl
je 0x14000efc4
mov ecx, ebx
lea eax, [rcx - 0x24]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 8
jb 0x14000efb0
mov byte [r8 + 9], bl
add r8, 8
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x50]
call fcn.14000e720
nop
cmp byte [rdi + 9], 0
je 0x14000eff4
lea eax, [rbx - 0x24]
xor byte [rbx + rdi], al
inc rbx
cmp rbx, 8
jb 0x14000efe1
mov byte [rdi + 9], 0
lea r8, [rdi + 8]
lea r9, [rsp + 0x20]
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.14000e720
nop
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
movzx edx, byte [rsp + 0x20]
mov rcx, rsi
call fcn.140015b80
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x14000f064
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f05e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000f05e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007983c
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x14000f0a4
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f09f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000f09f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007983c
mov rax, rsi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret