joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400b7dd0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0xffffffff
mov r8, qword [rsp + 0x60]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jne 0x1400b7e13
jmp 0x1400b7f05
movsxd rax, dword [rsp + 0x30]
shl rax, 1
mov rdx, rax
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x1400b7e4c
lea rdx, str.Win32:_Failed_to_allocate_global_handle_for_clipboard
mov ecx, 0x10008
call fcn.1400c4ce0
jmp 0x1400b7f05
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
jne 0x1400b7e85
lea rdx, [0x140189ca8]
mov ecx, 0x10008
call fcn.1400c4ce0
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x1400b7f05
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
mov r8, qword [rsp + 0x60]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, qword [0x1401b8d08]
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x1400b7ee9
lea rdx, [0x140189cd0]
mov ecx, 0x10008
call fcn.1400c4ce0
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x1400b7f05
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov rdx, qword [rsp + 0x38]
mov ecx, reloc.WS2_32.dll_listen
call qword [sym.imp.USER32.dll_SetClipboardData]
call qword [sym.imp.USER32.dll_CloseClipboard]
add rsp, 0x50
pop rdi
ret

Function at 0x1400b7f20
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push rdi
sub rsp, 0x30
mov rcx, qword [0x1401b8d08]
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x1400b7f4f
lea rdx, str.Win32:_Failed_to_open_clipboard
mov ecx, 0x10008
call fcn.1400c4ce0
xor eax, eax
jmp 0x1400b7feb
mov ecx, reloc.WS2_32.dll_listen
call qword [sym.imp.USER32.dll_GetClipboardData]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1400b7f82
lea rdx, str.Win32:_Failed_to_convert_clipboard_to_string
mov ecx, 0x10009
call fcn.1400c4ce0
call qword [sym.imp.USER32.dll_CloseClipboard]
xor eax, eax
jmp 0x1400b7feb
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x1400b7fb5
lea rdx, str.Win32:_Failed_to_lock_global_handle
mov ecx, 0x10008
call fcn.1400c4ce0
call qword [sym.imp.USER32.dll_CloseClipboard]
xor eax, eax
jmp 0x1400b7feb
mov rcx, qword [0x1401b8d20]
call qword [0x14012de50]
mov rcx, qword [rsp + 0x28]
call fcn.1400c4930
mov qword [0x1401b8d20], rax
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rax, qword [0x1401b8d20]
add rsp, 0x30
pop rdi
ret
Function at 0x1400baac0
Capabilities:
Register raw input devices

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
lea rdi, [rsp + 0x20]
mov ecx, ntohs
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x60]
mov eax, 1
mov word [rsp + 0x28], ax
mov eax, 2
mov word [rsp + 0x2a], ax
mov dword [rsp + 0x2c], 0
mov rax, qword [rsp + 0x60]
mov rax, qword [rax + 0x358]
mov qword [rsp + 0x30], rax
mov r8d, reloc.WS2_32.dll_recv
mov edx, 1
lea rcx, [rsp + 0x28]
call qword [sym.imp.USER32.dll_RegisterRawInputDevices]
test eax, eax
jne 0x1400bab38
lea rdx, str.Win32:_Failed_to_register_raw_input_device
mov ecx, 0x10008
call fcn.1400c4ce0
mov rcx, rsp
lea rdx, reloc.WS2_32.dll_accept
call fcn.140126290
add rsp, 0x50
pop rdi
ret

Function at 0x1400bab60
Capabilities:
Register raw input devices

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
lea rdi, [rsp + 0x20]
mov ecx, ntohs
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x60]
mov eax, 1
mov word [rsp + 0x28], ax
mov eax, 2
mov word [rsp + 0x2a], ax
mov dword [rsp + 0x2c], 1
mov qword [rsp + 0x30], 0
mov r8d, reloc.WS2_32.dll_recv
mov edx, 1
lea rcx, [rsp + 0x28]
call qword [sym.imp.USER32.dll_RegisterRawInputDevices]
test eax, eax
jne 0x1400babd0
lea rdx, str.Win32:_Failed_to_remove_raw_input_device
mov ecx, 0x10008
call fcn.1400c4ce0
mov rcx, rsp
lea rdx, reloc.WS2_32.dll_accept
call fcn.140126290
add rsp, 0x50
pop rdi
ret

Function at 0x1400bb110
Capabilities:
Log keystrokes via polling

Disassembly:
push rdi
sub rsp, 0x30
mov dword [rsp + 0x20], 0
mov ecx, reloc.WS2_32.dll_recv
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1400bb13e
mov eax, dword [rsp + 0x20]
or eax, 1
mov dword [rsp + 0x20], eax
mov ecx, reloc.WS2_32.dll_recvfrom
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1400bb15e
mov eax, dword [rsp + 0x20]
or eax, 2
mov dword [rsp + 0x20], eax
mov ecx, reloc.WS2_32.dll_select
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1400bb17e
mov eax, dword [rsp + 0x20]
or eax, 4
mov dword [rsp + 0x20], eax
mov ecx, 0x5b
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
mov dword [rsp + 0x24], eax
mov ecx, 0x5c
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
mov ecx, dword [rsp + 0x24]
or ecx, eax
mov eax, ecx
and eax, 0x8000
test eax, eax
je 0x1400bb1b6
mov eax, dword [rsp + 0x20]
or eax, 8
mov dword [rsp + 0x20], eax
mov ecx, reloc.WS2_32.dll_sendto
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 1
test eax, eax
je 0x1400bb1d4
mov eax, dword [rsp + 0x20]
or eax, 0x10
mov dword [rsp + 0x20], eax
mov ecx, 0x90
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 1
test eax, eax
je 0x1400bb1f2
mov eax, dword [rsp + 0x20]
or eax, 0x20
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
add rsp, 0x30
pop rdi
ret
Function at 0x1400c23e0
Capabilities:
Allocate thread local storage

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0
je 0x1400c2410
mov r8d, reloc.WLDAP32.dll_Ordinal_41
lea rdx, [0x1401a8260]
lea rcx, str.tls__win32.allocated__GLFW_FALSE
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
xor eax, eax
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov rcx, qword [rsp + 0x30]
mov dword [rcx + 4], eax
mov rax, qword [rsp + 0x30]
cmp dword [rax + 4], 0xffffffff
jne 0x1400c243e
lea rdx, str.Win32:_Failed_to_allocate_TLS_index
mov ecx, 0x10008
call fcn.1400c4ce0
xor eax, eax
jmp 0x1400c244e
mov rax, qword [rsp + 0x30]
mov dword [rax], 1
mov eax, 1
add rsp, 0x20
pop rdi
ret

Function at 0x1400c24a0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
mov rax, qword [rsp + 0x30]
cmp dword [rax], 1
je 0x1400c24d0
mov r8d, 0x40
lea rdx, [0x1401a8330]
lea rcx, [0x1401a8390]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
xor eax, eax
mov rax, qword [rsp + 0x30]
mov ecx, dword [rax + 4]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x20
pop rdi
ret

Function at 0x1400c24f0
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
mov rax, qword [rsp + 0x30]
cmp dword [rax], 1
je 0x1400c2525
mov r8d, 0x46
lea rdx, [0x1401a83e0]
lea rcx, str.tls__win32.allocated__GLFW_TRUE
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
xor eax, eax
mov rdx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x30]
mov ecx, dword [rax + 4]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
add rsp, 0x20
pop rdi
ret
Function at 0x1400c4e30
Capabilities:
Log keystrokes

Disassembly:
push rdi
sub rsp, 0x220
lea rdi, [rsp + 0x40]
mov ecx, 0x78
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x1401adf80]
xor rax, rsp
mov qword [rsp + 0x210], rax
lea rax, [rsp + 0x60]
mov rdi, rax
xor eax, eax
mov ecx, 0x100
rep stosb byte [rdi], al
mov r8d, 0x6d1
xor edx, edx
lea rcx, [0x1401b93e2]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x40], reloc.WLDAP32.dll_Ordinal_32
jmp 0x1400c4e95
mov eax, dword [rsp + 0x40]
inc eax
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0x15c
jg 0x1400c5099
movsxd rax, dword [rsp + 0x40]
lea rcx, [0x1401b9128]
movsx eax, word [rcx + rax*2]
mov dword [rsp + 0x168], eax
cmp dword [rsp + 0x168], 0xffffffff
jne 0x1400c4ec6
jmp 0x1400c4e8b
cmp dword [rsp + 0x40], 0x140
jl 0x1400c4fa2
cmp dword [rsp + 0x40], 0x14e
jg 0x1400c4fa2
mov dword [rsp + 0x1b8], 0x60
mov dword [rsp + 0x1bc], 0x61
mov dword [rsp + 0x1c0], 0x62
mov dword [rsp + 0x1c4], 0x63
mov dword [rsp + 0x1c8], 0x64
mov dword [rsp + 0x1cc], WSAGetLastError
mov dword [rsp + 0x1d0], WSASetLastError
mov dword [rsp + 0x1d4], WSASetLastError
mov dword [rsp + 0x1d8], WSASetLastError
mov dword [rsp + 0x1dc], WSASetLastError
mov dword [rsp + 0x1e0], WSASetLastError
mov dword [rsp + 0x1e4], reloc.WS2_32.dll_WSAGetLastError
mov dword [rsp + 0x1e8], WSASetLastError
mov dword [rsp + 0x1ec], WSASetLastError
mov dword [rsp + 0x1f0], WSASetLastError
mov eax, dword [rsp + 0x40]
sub eax, 0x140
cdqe
mov eax, dword [rsp + rax*4 + 0x1b8]
mov dword [rsp + 0x164], eax
jmp 0x1400c4fbb
mov edx, 1
mov ecx, dword [rsp + 0x168]
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov dword [rsp + 0x164], eax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
lea r9, [rsp + 0x178]
lea r8, [rsp + 0x60]
mov edx, dword [rsp + 0x168]
mov ecx, dword [rsp + 0x164]
call qword [sym.imp.USER32.dll_ToUnicode]
mov dword [rsp + 0x16c], eax
cmp dword [rsp + 0x16c], 0xffffffff
jne 0x1400c5035
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
lea r9, [rsp + 0x178]
lea r8, [rsp + 0x60]
mov edx, dword [rsp + 0x168]
mov ecx, dword [rsp + 0x164]
call qword [sym.imp.USER32.dll_ToUnicode]
mov dword [rsp + 0x16c], eax
cmp dword [rsp + 0x16c], 1
jge 0x1400c5044
jmp 0x1400c4e8b
movsxd rax, dword [rsp + 0x40]
imul rax, rax, 5
lea rcx, [0x1401b93e2]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], rax
mov r9d, 1
lea r8, [rsp + 0x178]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
jmp 0x1400c4e8b
mov rcx, rsp
lea rdx, reloc.WS2_32.dll_closesocket
call fcn.140126290
mov rcx, qword [rsp + 0x210]
xor rcx, rsp
call fcn.140125830
add rsp, 0x220
pop rdi
ret
Function at 0x1400c96c0
Capabilities:
Link many functions at runtime

Disassembly:
push rdi
sub rsp, 0x70
lea rdi, [rsp + 0x20]
mov ecx, reloc.WS2_32.dll_sendto
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x1401adf80]
xor rax, rsp
mov qword [rsp + 0x60], rax
lea rax, str.libOSMesa.dll
mov qword [rsp + 0x38], rax
lea rax, str.OSMesa.dll
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 0
cmp qword [0x1401b9d38], 0
je 0x1400c971b
mov eax, 1
jmp 0x1400c989b
mov dword [rsp + 0x20], 0
jmp 0x1400c972f
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
movsxd rax, dword [rsp + 0x20]
cmp qword [rsp + rax*8 + 0x38], 0
je 0x1400c9761
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + rax*8 + 0x38]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x1401b9d38], rax
cmp qword [0x1401b9d38], 0
je 0x1400c975f
jmp 0x1400c9761
jmp 0x1400c9725
cmp qword [0x1401b9d38], 0
jne 0x1400c9783
lea rdx, str.OSMesa:_Library_not_found
mov ecx, 0x10006
call fcn.1400bd8d0
xor eax, eax
jmp 0x1400c989b
lea rdx, str.OSMesaCreateContextExt
mov rcx, qword [0x1401b9d38]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401b9d40], rax
lea rdx, str.OSMesaCreateContextAttribs
mov rcx, qword [0x1401b9d38]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401b9d48], rax
lea rdx, str.OSMesaDestroyContext
mov rcx, qword [0x1401b9d38]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401b9d50], rax
lea rdx, str.OSMesaMakeCurrent
mov rcx, qword [0x1401b9d38]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401b9d58], rax
lea rdx, str.OSMesaGetColorBuffer
mov rcx, qword [0x1401b9d38]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401b9d60], rax
lea rdx, str.OSMesaGetDepthBuffer
mov rcx, qword [0x1401b9d38]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401b9d68], rax
lea rdx, str.OSMesaGetProcAddress
mov rcx, qword [0x1401b9d38]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401b9d70], rax
cmp qword [0x1401b9d40], 0
je 0x1400c987c
cmp qword [0x1401b9d50], 0
je 0x1400c987c
cmp qword [0x1401b9d58], 0
je 0x1400c987c
cmp qword [0x1401b9d60], 0
je 0x1400c987c
cmp qword [0x1401b9d68], 0
je 0x1400c987c
cmp qword [0x1401b9d70], 0
jne 0x1400c9896
lea rdx, str.OSMesa:_Failed_to_load_required_entry_points
mov ecx, 0x10008
call fcn.1400bd8d0
call fcn.1400c98d0
xor eax, eax
jmp 0x1400c989b
mov eax, 1
mov rdi, rax
mov rcx, rsp
lea rdx, reloc.WS2_32.dll_accept
call fcn.140126290
mov rax, rdi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140125830
add rsp, 0x70
pop rdi
ret
Function at 0x1400cacf0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 7], sil
je 0x1400cad24
mov eax, esi
lea ecx, [rax - 0x65]
xor byte [r8 + rax], cl
inc rax
cmp rax, 6
jb 0x1400cad10
mov byte [r8 + 7], sil
add r8, 6
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.140084830
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x1400cad49
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.14008a970
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x1400cadc3
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400cadbe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400cadbe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140125adc
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x1400cadd0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 9], sil
je 0x1400cae04
mov eax, esi
lea ecx, [rax - 0x65]
xor byte [r8 + rax], cl
inc rax
cmp rax, 8
jb 0x1400cadf0
mov byte [r8 + 9], sil
add r8, 8
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.140084830
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x1400cae29
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.14008a970
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x1400caea3
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400cae9e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400cae9e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140125adc
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400caeb0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 0xa], sil
je 0x1400caee4
mov eax, esi
lea ecx, [rax - 0x65]
xor byte [r8 + rax], cl
inc rax
cmp rax, 9
jb 0x1400caed0
mov byte [r8 + 0xa], sil
add r8, 9
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.140084830
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x1400caf09
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.14008a970
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x1400caf83
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400caf7e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400caf7e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140125adc
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x1400caf90
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 0xc], sil
je 0x1400cafc4
mov eax, esi
lea ecx, [rax - 0x65]
xor byte [r8 + rax], cl
inc rax
cmp rax, 0xb
jb 0x1400cafb0
mov byte [r8 + 0xc], sil
add r8, 0xb
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.140084830
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x1400cafe9
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.14008a970
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x1400cb063
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400cb05e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400cb05e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140125adc
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x1400cdc60
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 9], al
je 0x1400cdc83
lea edx, [rax - 0x65]
xor byte [rax + rcx], dl
inc rax
cmp rax, 8
jb 0x1400cdc70
mov byte [rcx + 9], 0
lea r8, [rcx + 8]
mov rdx, rcx
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.140084830
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x1400cdca0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 0x10], al
je 0x1400cdcc3
lea edx, [rax - 0x65]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xf
jb 0x1400cdcb0
mov byte [rcx + 0x10], 0
lea r8, [rcx + 0xf]
mov rdx, rcx
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.140084830
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x1400cdd40
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x136], 0
je 0x1400cdd68
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x65]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x135
jb 0x1400cdd50
mov byte [rcx + 0x136], 0
mov rax, rcx
ret

Function at 0x1400cdd70
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x44], 0
je 0x1400cdd93
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x65]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x43
jb 0x1400cdd80
mov byte [rcx + 0x44], 0
mov rax, rcx
ret

Function at 0x1400cdda0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x47], 0
je 0x1400cddc3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x65]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x46
jb 0x1400cddb0
mov byte [rcx + 0x47], 0
mov rax, rcx
ret
Function at 0x1400ceff0
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
mov r10, rcx
mov ecx, r9d
test r8, r8
je 0x1400cf0d7
sub r10, rdx
cmp r8, 8
jb 0x1400cf0b3
mov rax, r8
lea r9, [rdx + 4]
and rax, 0xfffffffffffffff8
xorps xmm3, xmm3
xorps xmm2, xmm2
movd xmm1, dword [r10 + r9 - 4]
add rcx, 8
movd xmm0, dword [r9 - 4]
lea r9, [r9 + 8]
punpcklbw xmm1, xmm1
punpcklwd xmm1, xmm1
punpcklbw xmm0, xmm0
psrad xmm1, 0x18
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
pxor xmm1, xmm0
movd xmm0, dword [r9 - 8]
punpcklbw xmm0, xmm0
por xmm3, xmm1
movd xmm1, dword [r10 + r9 - 8]
punpcklbw xmm1, xmm1
punpcklwd xmm1, xmm1
punpcklwd xmm0, xmm0
psrad xmm1, 0x18
psrad xmm0, 0x18
pxor xmm1, xmm0
por xmm2, xmm1
cmp rcx, rax
jb 0x1400cf020
por xmm2, xmm3
movdqa xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movdqa xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movd r9d, xmm2
cmp rcx, r8
jae 0x1400cf0d7
lea rax, [rcx + rdx]
sub r8, rcx
nop word [rax + rax]
movsx edx, byte [r10 + rax]
movsx ecx, byte [rax]
lea rax, [rax + 1]
xor edx, ecx
or r9d, edx
sub r8, 1
jne 0x1400cf0c0
test r9d, r9d
sete al
ret
Function at 0x1400cf730
Capabilities:
Execute command

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x1401adf80]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rsi, rcx
mov qword [rsp + 0x78], rcx
mov r8, rcx
lea rdx, str.start_cmd__C__color_b__title_Error__echo
lea rcx, [rsp + 0x58]
call fcn.140083e80
mov rdi, rax
mov rcx, qword [rax + 0x10]
mov rdx, qword [rax + 0x18]
mov rax, rdx
sub rax, rcx
cmp rax, 0x11
jb 0x1400cf7ba
lea rax, [rcx + 0x11]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x1400cf79b
mov rax, qword [rdi]
lea rbx, [rax + rcx]
mov r8d, reloc.WS2_32.dll_recvfrom
lea rdx, str.__timeout__t_5_
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x11], 0
jmp 0x1400cf7dc
mov qword [rsp + 0x20], reloc.WS2_32.dll_recvfrom
lea r9, str.__timeout__t_5_
xor r8d, r8d
lea edx, [r8 + 0x11]
mov rcx, rdi
call fcn.14003ac90
mov rdi, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
movups xmm0, xmmword [rdi]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rdi + 0x10], 0
mov qword [rdi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rdi], 0
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 0x10
cmovae rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x1400cf868
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400cf863
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400cf863
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140125adc
movdqa xmm0, xmmword [0x14016ca00]
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x30], 0
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x1400cf8bb
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400cf8b6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400cf8b6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140125adc
xor ecx, ecx
int 0x29
mov rdx, qword [rsi + 0x18]
cmp rdx, 0x10
jb 0x1400cf8f5
inc rdx
mov rcx, qword [rsi]
cmp rdx, 0x1000
jb 0x1400cf8f0
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400cf92d
mov rcx, r8
call fcn.140125adc
mov qword [rsi + 0x10], 0
mov qword [rsi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rsi], 0
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140125830
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x1400db030
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__read]
cdqe
add rsp, 0x28
ret