joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401834e0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 0xa], sil
je 0x140183514
mov eax, esi
lea ecx, [rax + 0x7f]
xor byte [r8 + rax], cl
inc rax
cmp rax, 9
jb 0x140183500
mov byte [r8 + 0xa], sil
add r8, 9
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.1400049d0
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140183539
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.1400048e0
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x1401835b3
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401835ae
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1401835ae
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401988f4
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x1401835c0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 0xc], sil
je 0x1401835f4
mov eax, esi
lea ecx, [rax + 0x7f]
xor byte [r8 + rax], cl
inc rax
cmp rax, 0xb
jb 0x1401835e0
mov byte [r8 + 0xc], sil
add r8, 0xb
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.1400049d0
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140183619
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.1400048e0
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140183693
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14018368e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14018368e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401988f4
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x1401898e0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 9], al
je 0x140189903
lea edx, [rax + 0x7f]
xor byte [rax + rcx], dl
inc rax
cmp rax, 8
jb 0x1401898f0
mov byte [rcx + 9], 0
lea r8, [rcx + 8]
mov rdx, rcx
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.1400049d0
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x140189920
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 0x10], al
je 0x140189943
lea edx, [rax + 0x7f]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xf
jb 0x140189930
mov byte [rcx + 0x10], 0
lea r8, [rcx + 0xf]
mov rdx, rcx
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.1400049d0
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x14018a6b0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 5], 0
je 0x14018a6d3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x7f]
xor byte [rax + rcx], dl
inc rax
cmp rax, 4
jb 0x14018a6c0
mov byte [rcx + 5], 0
mov rax, rcx
ret

Function at 0x14018a6e0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x136], 0
je 0x14018a708
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x7f]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x135
jb 0x14018a6f0
mov byte [rcx + 0x136], 0
mov rax, rcx
ret

Function at 0x14018a710
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x44], 0
je 0x14018a733
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x7f]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x43
jb 0x14018a720
mov byte [rcx + 0x44], 0
mov rax, rcx
ret

Function at 0x14018a740
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x47], 0
je 0x14018a763
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x7f]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x46
jb 0x14018a750
mov byte [rcx + 0x47], 0
mov rax, rcx
ret
Function at 0x14018bb50
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
mov r10, rcx
mov ecx, r9d
test r8, r8
je 0x14018bc37
sub r10, rdx
cmp r8, 8
jb 0x14018bc13
mov rax, r8
lea r9, [rdx + 4]
and rax, 0xfffffffffffffff8
xorps xmm3, xmm3
xorps xmm2, xmm2
movd xmm1, dword [r10 + r9 - 4]
add rcx, 8
movd xmm0, dword [r9 - 4]
lea r9, [r9 + 8]
punpcklbw xmm1, xmm1
punpcklwd xmm1, xmm1
punpcklbw xmm0, xmm0
psrad xmm1, 0x18
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
pxor xmm1, xmm0
movd xmm0, dword [r9 - 8]
punpcklbw xmm0, xmm0
por xmm3, xmm1
movd xmm1, dword [r10 + r9 - 8]
punpcklbw xmm1, xmm1
punpcklwd xmm1, xmm1
punpcklwd xmm0, xmm0
psrad xmm1, 0x18
psrad xmm0, 0x18
pxor xmm1, xmm0
por xmm2, xmm1
cmp rcx, rax
jb 0x14018bb80
por xmm2, xmm3
movdqa xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movdqa xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movd r9d, xmm2
cmp rcx, r8
jae 0x14018bc37
lea rax, [rcx + rdx]
sub r8, rcx
nop word [rax + rax]
movsx edx, byte [r10 + rax]
movsx ecx, byte [rax]
lea rax, [rax + 1]
xor edx, ecx
or r9d, edx
sub r8, 1
jne 0x14018bc20
test r9d, r9d
sete al
ret
Function at 0x14018e6d0
Capabilities:
Execute command

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0xa0
mov rax, qword [0x1401da800]
xor rax, rsp
mov qword [rsp + 0x98], rax
mov rdi, rcx
mov qword [rsp + 0x90], rcx
mov rcx, qword [rcx + 0x10]
movabs rax, 0x7fffffffffffffff
sub rax, rcx
cmp rax, 0x2d
jb 0x14018e91b
mov rax, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x14018e722
mov rax, qword [rdi]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], reloc.WLDAP32.dll_Ordinal_45
lea r9, str.start_cmd__C__color_b__title_Error__echo
mov r8, rdi
movzx edx, byte [rsp + 0x40]
lea rcx, [rsp + 0x68]
call fcn.140003350
nop
mov rcx, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x80]
mov rax, rdx
sub rax, rcx
cmp rax, 0x11
jb 0x14018e7a3
lea rax, [rcx + 0x11]
mov qword [rsp + 0x78], rax
lea rbx, [rsp + 0x68]
cmp rdx, 0x10
cmovae rbx, qword [rsp + 0x68]
add rbx, rcx
mov r8d, reloc.WS2_32.dll_recvfrom
lea rdx, str.__timeout__t_5_
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x11], 0
lea rax, [rsp + 0x68]
jmp 0x14018e7c4
mov qword [rsp + 0x20], reloc.WS2_32.dll_recvfrom
lea r9, str.__timeout__t_5_
xor r8d, r8d
lea edx, [r8 + 0x11]
lea rcx, [rsp + 0x68]
call fcn.140003210
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x58], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x58], xmm1
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rcx, [rsp + 0x48]
cmp qword [rsp + 0x60], 0x10
cmovae rcx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x14018e850
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14018e84b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14018e84b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401988f4
movdqa xmm0, xmmword [0x1401c1a90]
movdqu xmmword [rsp + 0x58], xmm0
mov byte [rsp + 0x48], 0
mov rdx, qword [rsp + 0x80]
cmp rdx, 0x10
jb 0x14018e8a6
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14018e8a1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14018e8a1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401988f4
xor ecx, ecx
int 0x29
mov rdx, qword [rdi + 0x18]
cmp rdx, 0x10
jb 0x14018e8e0
inc rdx
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x14018e8db
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14018e914
mov rcx, r8
call fcn.1401988f4
mov qword [rdi + 0x10], 0
mov qword [rdi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rdi], 0
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.140198890
mov rbx, qword [rsp + 0xb8]
add rsp, 0xa0
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.140001d90
nop
int3
Function at 0x14018f180
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x60
mov rdi, rcx
mov qword [rsp + 0x58], rcx
xor ebx, ebx
mov dword [rsp + 0x30], ebx
lea rcx, str.ALLUSERSPROFILE
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x14018f1e0
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rbx
mov qword [rdi + 0x18], rbx
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], bl
jne 0x14018f1c7
mov rdx, rax
mov rcx, rdi
call fcn.140004460
jmp 0x14018f2c0
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
movdqa xmm1, xmmword [0x1401c1a70]
movdqu xmmword [rsp + 0x48], xmm1
mov word [rsp + 0x38], bx
mov dword [rsp + 0x30], 2
lea rcx, [rsp + 0x38]
call fcn.140189bc0
test eax, eax
jne 0x14018f2e0
lea rbp, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
call fcn.140197d40
mov r14d, eax
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rbx
mov qword [rdi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rdi], 0
mov dword [rsp + 0x30], Ordinal_35
test rsi, rsi
je 0x14018f2b6
cmp rsi, 0x7fffffff
ja 0x14018f2ef
mov dword [rsp + 0x20], ebx
xor r9d, r9d
mov r8d, esi
mov rdx, rbp
mov ecx, eax
call fcn.140197db0
mov rbx, rax
shr rax, 0x20
test eax, eax
jne 0x14018f2fa
movsxd rdx, ebx
xor r8d, r8d
mov rcx, rdi
call fcn.1400057a0
mov r9, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x14018f29c
mov r9, qword [rdi]
mov dword [rsp + 0x20], ebx
mov r8d, esi
mov rdx, rbp
mov ecx, r14d
call fcn.140197db0
shr rax, 0x20
test eax, eax
jne 0x14018f2d8
lea rcx, [rsp + 0x38]
call fcn.140058bf0
mov rax, rdi
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
mov ecx, eax
call fcn.1400d1db0
nop
mov edx, eax
lea rcx, str.current_path__
call fcn.1400d9630
nop
mov ecx, reloc.WLDAP32.dll_Ordinal_22
call fcn.1400d1ae0
int3
mov ecx, eax
call fcn.1400d1db0
int3
Function at 0x1401971d0
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov r8d, dword [rcx + 0x28]
mov rdi, rdx
mov rbx, rcx
cmp r8d, 0x40
jae 0x140197388
lea ecx, [r8*8]
mov qword [rsp + 0x30], rsi
add qword [rbx], rcx
mov byte [r8 + rbx + 0x2c], 0x80
mov eax, dword [rbx + 0x28]
inc eax
mov dword [rbx + 0x28], eax
cmp eax, 0x38
jbe 0x140197248
cmp eax, 0x40
jae 0x140197232
nop word [rax + rax]
mov byte [rax + rbx + 0x2c], 0
mov eax, dword [rbx + 0x28]
inc eax
mov dword [rbx + 0x28], eax
cmp eax, 0x40
jb 0x140197220
lea rsi, [rbx + 0x2c]
mov rcx, rbx
mov rdx, rsi
call fcn.1401974b0
xor eax, eax
mov dword [rbx + 0x28], eax
jmp 0x140197250
lea rsi, [rbx + 0x2c]
jae 0x140197262
nop
mov byte [rax + rbx + 0x2c], 0
mov eax, dword [rbx + 0x28]
inc eax
mov dword [rbx + 0x28], eax
cmp eax, 0x38
jb 0x140197250
movzx eax, byte [rbx + 7]
mov rdx, rsi
mov byte [rbx + 0x64], al
mov rcx, rbx
movzx eax, byte [rbx + 6]
mov byte [rbx + 0x65], al
movzx eax, byte [rbx + 5]
mov byte [rbx + 0x66], al
movzx eax, byte [rbx + 4]
mov byte [rbx + 0x67], al
movzx eax, byte [rbx + 3]
mov byte [rbx + 0x68], al
movzx eax, byte [rbx + 2]
mov byte [rbx + 0x69], al
movzx eax, byte [rbx + 1]
mov byte [rbx + 0x6a], al
movzx eax, byte [rbx]
mov byte [rbx + 0x6b], al
call fcn.1401974b0
movzx eax, byte [rbx + 0xb]
mov byte [rdi], al
movzx eax, byte [rbx + 0xa]
mov byte [rdi + 1], al
movzx eax, byte [rbx + 9]
mov byte [rdi + 2], al
movzx eax, byte [rbx + 8]
mov byte [rdi + 3], al
movzx eax, byte [rbx + 0xf]
mov byte [rdi + 4], al
movzx eax, byte [rbx + 0xe]
mov byte [rdi + 5], al
movzx eax, byte [rbx + 0xd]
mov byte [rdi + 6], al
movzx eax, byte [rbx + 0xc]
mov byte [rdi + 7], al
movzx eax, byte [rbx + 0x13]
mov byte [rdi + 8], al
movzx eax, byte [rbx + 0x12]
mov byte [rdi + 9], al
movzx eax, byte [rbx + 0x11]
mov byte [rdi + 0xa], al
movzx eax, byte [rbx + 0x10]
mov byte [rdi + 0xb], al
movzx eax, byte [rbx + 0x17]
mov byte [rdi + 0xc], al
movzx eax, byte [rbx + 0x16]
mov byte [rdi + 0xd], al
movzx eax, byte [rbx + 0x15]
mov byte [rdi + 0xe], al
movzx eax, byte [rbx + 0x14]
mov byte [rdi + 0xf], al
movzx eax, byte [rbx + 0x1b]
mov byte [rdi + 0x10], al
movzx eax, byte [rbx + 0x1a]
mov byte [rdi + 0x11], al
movzx eax, byte [rbx + 0x19]
mov byte [rdi + 0x12], al
movzx eax, byte [rbx + 0x18]
mov byte [rdi + 0x13], al
movzx eax, byte [rbx + 0x1f]
mov byte [rdi + 0x14], al
movzx eax, byte [rbx + 0x1e]
mov byte [rdi + 0x15], al
movzx eax, byte [rbx + 0x1d]
mov byte [rdi + 0x16], al
movzx eax, byte [rbx + 0x1c]
mov byte [rdi + 0x17], al
movzx eax, byte [rbx + 0x23]
mov byte [rdi + 0x18], al
movzx eax, byte [rbx + 0x22]
mov byte [rdi + 0x19], al
movzx eax, byte [rbx + 0x21]
mov byte [rdi + 0x1a], al
movzx eax, byte [rbx + 0x20]
mov byte [rdi + 0x1b], al
movzx eax, byte [rbx + 0x27]
mov byte [rdi + 0x1c], al
movzx eax, byte [rbx + 0x26]
mov byte [rdi + 0x1d], al
movzx eax, byte [rbx + 0x25]
mov byte [rdi + 0x1e], al
movzx eax, byte [rbx + 0x24]
mov rsi, qword [rsp + 0x30]
mov byte [rdi + 0x1f], al
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1401973a0
Capabilities:
Hash data using sha256

Disassembly:
xor eax, eax
mov qword [rcx + 0x24], 0x5be0cd19
mov qword [rcx], rax
mov dword [rcx + 8], 0x6a09e667
mov dword [rcx + 0xc], 0xbb67ae85
mov dword [rcx + 0x10], 0x3c6ef372
mov dword [rcx + 0x14], 0xa54ff53a
mov dword [rcx + 0x18], 0x510e527f
mov dword [rcx + 0x1c], 0x9b05688c
mov dword [rcx + 0x20], 0x1f83d9ab
ret
Function at 0x140198460
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rdx, rcx
mov ecx, 0x105
call fcn.140197cf0
mov ebx, eax
test eax, eax
jne 0x140198490
and dword [rsp + 0x38], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x3c], eax
jmp 0x1401984f3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1401984ea
test al, 0x10
je 0x1401984ea
bt eax, 0xa
jae 0x1401984e3
mov r9d, 0x2000000
lea rcx, [rsp + 0x38]
mov r8d, 0x80
mov rdx, rdi
call fcn.140198504
mov rcx, qword [rsp + 0x38]
mov edi, eax
cmp rcx, 0xffffffffffffffff
je 0x1401984df
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x1401984df
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_abort]
int3
test edi, edi
jne 0x1401984ea
and dword [rsp + 0x3c], 0
jmp 0x1401984ef
or dword [rsp + 0x3c], 0xffffffff
mov dword [rsp + 0x38], ebx
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140198780
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x1401987ba
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x1401987bf
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x140198808
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, reloc.WS2_32.dll_accept
cmp byte [rcx + rax], 0
je 0x140198808
dec r8
sub rdx, 1
jne 0x1401987ee
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x140199820
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14019986a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14019986a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14019986a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14019986a
cmp dword [rcx + 0x84], 0xe
jbe 0x14019986a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14019986c
xor al, al
add rsp, 0x28
ret
Function at 0x7ff6475a7058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.7ff6475a71df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x7ff6475a7089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x7ff6475a706f
add dl, dl
jne 0x7ff6475a7096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x7ff6475a70f6
xor eax, eax
add dl, dl
jne 0x7ff6475a70a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x7ff6475a71ad
add dl, dl
jne 0x7ff6475a70b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7ff6475a70c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7ff6475a70d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7ff6475a70dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x7ff6475a70ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x7ff6475a707e
mov eax, 1
add dl, dl
jne 0x7ff6475a7106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7ff6475a7113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x7ff6475a70fb
sub eax, ebx
mov ebx, 1
jne 0x7ff6475a714c
mov ecx, 1
add dl, dl
jne 0x7ff6475a712e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x7ff6475a713b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x7ff6475a7123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x7ff6475a707e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x7ff6475a7168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x7ff6475a7175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x7ff6475a715d
cmp eax, 0x7d00
jae 0x7ff6475a719b
cmp eax, 0x500
jb 0x7ff6475a7196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x7ff6475a707e
cmp eax, 0x7f
ja 0x7ff6475a719e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x7ff6475a707e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x7ff6475a71d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x7ff6475a707e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1400c3760
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov ebx, r9d
mov r14, r8
mov r15d, edx
mov rsi, rcx
mov ecx, edx
sub ecx, 0xe
je 0x1400c38b2
sub ecx, 1
je 0x1400c380f
sub ecx, 1
je 0x1400c37e6
cmp ecx, 1
je 0x1400c37bd
test r9d, r9d
je 0x1400c3951
mov edx, r15d
mov rcx, r14
call fcn.140099690
add ebx, 0xffffffff
jne 0x1400c37a8
jmp 0x1400c3951
mov qword [rbp - 0x18], r14
xor edi, edi
mov byte [rbp - 0x10], dil
test r9d, r9d
je 0x1400c37e1
mov byte [rbp - 0x10], dil
lea rdx, [rbp - 0x20]
mov rcx, r14
call fcn.14009fc00
add ebx, 0xffffffff
jne 0x1400c37cc
jmp 0x1400c3951
mov qword [rbp - 0x18], r14
xor edi, edi
mov byte [rbp - 0x10], dil
test r9d, r9d
je 0x1400c380a
mov byte [rbp - 0x10], dil
lea rdx, [rbp - 0x20]
mov rcx, r14
call fcn.14009fc00
add ebx, 0xffffffff
jne 0x1400c37f5
jmp 0x1400c3951
mov qword [rbp - 0x18], r14
xor edi, edi
mov byte [rbp - 0x10], dil
mov word [rbp + 0x38], di
mov r9, rbx
mov r8, qword [rsi + 8]
mov rcx, qword [rsi]
mov rax, r8
sub rax, rcx
sar rax, 1
cmp rbx, rax
jae 0x1400c384f
lea rax, [rcx + rbx*2]
cmp rax, rcx
jne 0x1400c3844
mov qword [rsi + 8], rcx
jmp 0x1400c3869
cmp rax, r8
je 0x1400c3869
mov qword [rsi + 8], rax
jmp 0x1400c3869
jbe 0x1400c3869
sub r9, rax
lea rax, [rbp + 0x38]
mov qword [rsp + 0x20], rax
lea rdx, [rbp - 0x20]
mov rcx, rsi
call fcn.1400c6d60
mov r15, qword [rsi]
mov r12, qword [rsi + 8]
cmp r15, r12
je 0x1400c38ad
invalid
mov esi, 1
lea rbx, [r15 + 2]
mov byte [rbp - 0x10], dil
lea rdx, [rbp + 0x38]
mov rcx, r14
call fcn.1400a7220
movzx eax, word [rbp + 0x38]
movzx ecx, ax
shr cx, 1
and ax, si
neg ax
xor cx, ax
mov word [r15], cx
mov r15, rbx
cmp rbx, r12
jne 0x1400c387a
jmp 0x1400c3951
mov qword [rbp - 0x18], r14
xor edi, edi
mov byte [rbp - 0x10], dil
mov word [rbp + 0x38], di
mov r9, rbx
mov r8, qword [rsi + 8]
mov rcx, qword [rsi]
mov rax, r8
sub rax, rcx
sar rax, 1
cmp rbx, rax
jae 0x1400c38f2
lea rax, [rcx + rbx*2]
cmp rax, rcx
jne 0x1400c38e7
mov qword [rsi + 8], rcx
jmp 0x1400c390c
cmp rax, r8
je 0x1400c390c
mov qword [rsi + 8], rax
jmp 0x1400c390c
jbe 0x1400c390c
sub r9, rax
lea rax, [rbp + 0x38]
mov qword [rsp + 0x20], rax
lea rdx, [rbp - 0x20]
mov rcx, rsi
call fcn.1400c6d60
mov r8, qword [rsi]
mov r9, qword [rsi + 8]
cmp r8, r9
je 0x1400c3951
mov esi, 1
lea r11, [r8 + 2]
mov byte [rbp - 0x10], dil
mov r10d, dword [r14 + 0x20]
mov eax, dword [r14 + 0x18]
sub eax, r10d
cmp eax, esi
jb 0x1400c396b
mov rax, qword [r14 + 0x10]
movsx edx, byte [r10 + rax]
lea eax, [r10 + 1]
mov dword [r14 + 0x20], eax
mov word [r8], dx
mov r8, r11
cmp r11, r9
jne 0x1400c391d
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
mov edx, esi
mov rcx, r14
call fcn.140077984
int3