joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400515c0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x380
mov rbp, rcx
test rcx, rcx
je 0x14005161d
xor r14d, r14d
xor edx, edx
mov ecx, 2
mov esi, r14d
mov ebx, r14d
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14005161d
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x238
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x140051640
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
lea r11, [rsp + 0x380]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
lea r9, [rsp + 0x5c]
mov qword [rsp + 0x3a0], r14
mov r8d, 0x104
mov qword [rsp + 0x20], 0x104
lea rdx, [rsp + 0x270]
lea rcx, [rsp + 0x3a0]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstombs_s]
mov rdx, rbp
lea rcx, [rsp + 0x270]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x140051695
mov eax, dword [rsp + 0x4c]
cmp eax, ebx
jbe 0x140051695
mov esi, dword [rsp + 0x38]
mov ebx, eax
lea rdx, [rsp + 0x30]
mov rcx, rdi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x140051640
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
jmp 0x14005161f

Function at 0x1400516c0
Capabilities:
Enumerate processes

Disassembly:
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x270
mov rdi, rdx
test rdx, rdx
je 0x1400517fc
xor r13d, r13d
xor edx, edx
mov ecx, 2
mov r15d, r13d
mov esi, r13d
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x1400517fc
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x238
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x1400517e0
mov qword [rsp + 0x2a0], rbx
mov qword [rsp + 0x2b0], rbp
mov qword [rsp + 0x2b8], r12
mov r12, 0xffffffffffffffff
nop word [rax + rax]
mov rbx, r12
inc rbx
cmp byte [rdi + rbx], r13b
jne 0x140051743
inc rbx
mov eax, 2
mul rbx
cmovb rax, r12
mov rcx, rax
call fcn.1400bbd4c
mov r9, rdi
mov qword [rsp + 0x2a8], r13
mov r8, rbx
mov qword [rsp + 0x20], r12
mov rdx, rax
lea rcx, [rsp + 0x2a8]
mov rbp, rax
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_mbstowcs_s]
mov rdx, rbp
lea rcx, [rsp + 0x5c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x1400517ab
mov eax, dword [rsp + 0x4c]
cmp eax, esi
jbe 0x1400517ab
mov r15d, dword [rsp + 0x38]
mov esi, eax
mov rcx, rbp
call fcn.1400bb684
lea rdx, [rsp + 0x30]
mov rcx, r14
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x140051740
mov r12, qword [rsp + 0x2b8]
mov rbp, qword [rsp + 0x2b0]
mov rbx, qword [rsp + 0x2a0]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, r15d
add rsp, 0x270
pop r15
pop r14
pop r13
pop rdi
pop rsi
ret
xor eax, eax
add rsp, 0x270
pop r15
pop r14
pop r13
pop rdi
pop rsi
ret
Function at 0x1400528f0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov rbx, r9
mov rdi, r8
mov rbp, rdx
mov r14, rcx
mov r12, qword [rsp + 0xa0]
mov rcx, r12
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__msize]
mov rsi, rax
test eax, eax
jg 0x140052937
xor al, al
jmp 0x140052a1d
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x38], xmm0
xor r13d, r13d
mov qword [rsp + 0x48], r13
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9, rbx
mov r8, rdi
mov rdx, rbp
mov rcx, r14
call fcn.140050da0
mov rbx, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
cmp rbx, rdi
jne 0x140052977
xor dil, dil
jmp 0x1400529d8
mov ebp, r13d
sub rdi, rbx
sar rdi, 3
test rdi, rdi
je 0x1400529d5
movsxd r15, esi
mov rsi, rbx
nop dword [rax]
mov edx, dword [rsi]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x40
mov r8, r15
mov rcx, qword [r14 + 8]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov qword [rsp + 0x20], r13
mov r9, r15
mov r8, r12
mov rdx, qword [rsi]
mov rcx, qword [r14 + 8]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
inc ebp
lea rsi, [rsi + 8]
movsxd rax, ebp
cmp rax, rdi
jb 0x140052990
mov dil, 1
test rbx, rbx
je 0x140052a19
mov rdx, qword [rsp + 0x48]
sub rdx, rbx
and rdx, 0xfffffffffffffff8
mov rax, rbx
cmp rdx, 0x1000
jb 0x140052a11
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140052a11
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.1400bb684
movzx eax, dil
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400589d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x50
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor edi, edi
cmp byte [r8 + 6], dil
je 0x140058a04
mov eax, edi
nop dword [rax]
lea ecx, [rax - 0xb]
xor byte [r8 + rax], cl
inc rax
cmp rax, 5
jb 0x1400589f0
mov byte [r8 + 6], dil
lea rax, [r8 + 5]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x140058a34
mov qword [rsp + 0x30], rdi
mov byte [rsp + 0x20], dil
jmp 0x140058a4d
mov qword [rsp + 0x30], 5
mov eax, dword [r8]
mov dword [rsp + 0x20], eax
movzx eax, byte [r8 + 4]
mov byte [rsp + 0x24], al
mov r9, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x140058a5b
mov rdx, qword [rdx]
mov r8, rdx
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.140065d60
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x140058ad5
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140058ad0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140058ad0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400bb684
mov rax, rbx
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x140058af0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x50
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor edi, edi
cmp byte [r8 + 7], dil
je 0x140058b24
mov eax, edi
nop dword [rax]
lea ecx, [rax - 0xb]
xor byte [r8 + rax], cl
inc rax
cmp rax, 6
jb 0x140058b10
mov byte [r8 + 7], dil
lea rax, [r8 + 6]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x140058b54
mov qword [rsp + 0x30], rdi
mov byte [rsp + 0x20], dil
jmp 0x140058b6e
mov qword [rsp + 0x30], 6
mov eax, dword [r8]
mov dword [rsp + 0x20], eax
movzx eax, word [r8 + 4]
mov word [rsp + 0x24], ax
mov r9, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x140058b7c
mov rdx, qword [rdx]
mov r8, rdx
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.140065d60
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x140058bf6
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140058bf1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140058bf1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400bb684
mov rax, rbx
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x140058c10
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x50
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor edi, edi
cmp byte [r8 + 9], dil
je 0x140058c44
mov eax, edi
nop dword [rax]
lea ecx, [rax - 0xb]
xor byte [r8 + rax], cl
inc rax
cmp rax, 8
jb 0x140058c30
mov byte [r8 + 9], dil
lea rax, [r8 + 8]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x140058c74
mov qword [rsp + 0x30], rdi
mov byte [rsp + 0x20], dil
jmp 0x140058c85
mov qword [rsp + 0x30], 8
mov rax, qword [r8]
mov qword [rsp + 0x20], rax
mov r9, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x140058c93
mov rdx, qword [rdx]
mov r8, rdx
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.140065d60
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x140058d0d
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140058d08
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140058d08
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400bb684
mov rax, rbx
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x140058d20
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rbx, rcx
mov qword [rbp - 0x10], rcx
xor r9d, r9d
cmp byte [r8 + 6], r9b
je 0x140058d64
mov ecx, r9d
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0xb]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 5
jb 0x140058d50
mov byte [r8 + 6], r9b
lea rax, [r8 + 5]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
mov qword [rbp - 0x28], r9
mov qword [rbp - 0x20], r9
mov qword [rbp - 0x20], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x140058d8e
mov qword [rbp - 0x28], r9
mov byte [rbp - 0x38], r9b
jmp 0x140058da4
mov qword [rbp - 0x28], 5
mov eax, dword [r8]
mov dword [rbp - 0x38], eax
movzx eax, byte [r8 + 4]
mov byte [rbp - 0x34], al
cmp byte [rdx + 0xa], 0
je 0x140058dc3
mov rcx, r9
nop dword [rax]
lea eax, [rcx - 0xb]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 9
jb 0x140058db0
mov byte [rdx + 0xa], 0
lea rax, [rdx + 9]
xorps xmm0, xmm0
movups xmmword [rbp - 0x58], xmm0
mov qword [rbp - 0x48], r9
mov qword [rbp - 0x40], r9
mov qword [rbp - 0x40], reloc.WS2_32.dll_ntohs
cmp rdx, rax
jne 0x140058ded
mov qword [rbp - 0x48], r9
mov byte [rbp - 0x58], 0
jmp 0x140058e05
mov qword [rbp - 0x48], 9
movsd xmm0, qword [rdx]
movsd qword [rbp - 0x58], xmm0
movzx eax, byte [rdx + 8]
mov byte [rbp - 0x50], al
lea r9, [rbp - 0x38]
lea r8, [rbp - 0x58]
movzx edx, byte [rbp - 0x60]
mov rcx, rbx
call fcn.140039f30
nop
mov rdx, qword [rbp - 0x40]
cmp rdx, 0x10
jb 0x140058e59
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140058e53
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140058e53
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400bb684
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x140058e97
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140058e92
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140058e92
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400bb684
mov rax, rbx
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rbp
ret
Function at 0x140058eb0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x50
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor edi, edi
cmp byte [r8 + 0xa], dil
je 0x140058ee4
mov eax, edi
nop dword [rax]
lea ecx, [rax - 0xb]
xor byte [r8 + rax], cl
inc rax
cmp rax, 9
jb 0x140058ed0
mov byte [r8 + 0xa], dil
lea rax, [r8 + 9]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x140058f14
mov qword [rsp + 0x30], rdi
mov byte [rsp + 0x20], dil
jmp 0x140058f31
mov qword [rsp + 0x30], 9
movsd xmm0, qword [r8]
movsd qword [rsp + 0x20], xmm0
movzx eax, byte [r8 + 8]
mov byte [rsp + 0x28], al
mov r9, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x140058f3f
mov rdx, qword [rdx]
mov r8, rdx
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.140065d60
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x140058fb9
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140058fb4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140058fb4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400bb684
mov rax, rbx
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x140058fd0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rbx, rcx
mov qword [rbp - 0x10], rcx
xor r9d, r9d
cmp byte [r8 + 0xb], r9b
je 0x140059014
mov ecx, r9d
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0xb]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 0xa
jb 0x140059000
mov byte [r8 + 0xb], r9b
lea rax, [r8 + 0xa]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
mov qword [rbp - 0x28], r9
mov qword [rbp - 0x20], r9
mov qword [rbp - 0x20], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x14005903e
mov qword [rbp - 0x28], r9
mov byte [rbp - 0x38], r9b
jmp 0x140059059
mov qword [rbp - 0x28], 0xa
movsd xmm0, qword [r8]
movsd qword [rbp - 0x38], xmm0
movzx eax, word [r8 + 8]
mov word [rbp - 0x30], ax
cmp byte [rdx + 0xb], 0
je 0x140059083
mov rcx, r9
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0xb]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xa
jb 0x140059070
mov byte [rdx + 0xb], 0
lea rax, [rdx + 0xa]
xorps xmm0, xmm0
movups xmmword [rbp - 0x58], xmm0
mov qword [rbp - 0x48], r9
mov qword [rbp - 0x40], r9
mov qword [rbp - 0x40], reloc.WS2_32.dll_ntohs
cmp rdx, rax
jne 0x1400590ad
mov qword [rbp - 0x48], r9
mov byte [rbp - 0x58], 0
jmp 0x1400590c6
mov qword [rbp - 0x48], 0xa
movsd xmm0, qword [rdx]
movsd qword [rbp - 0x58], xmm0
movzx eax, word [rdx + 8]
mov word [rbp - 0x50], ax
lea r9, [rbp - 0x38]
lea r8, [rbp - 0x58]
movzx edx, byte [rbp - 0x60]
mov rcx, rbx
call fcn.140039f30
nop
mov rdx, qword [rbp - 0x40]
cmp rdx, 0x10
jb 0x14005911a
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140059114
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140059114
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400bb684
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x140059158
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140059153
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140059153
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400bb684
mov rax, rbx
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rbp
ret
Function at 0x140059170
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x50
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor edi, edi
cmp byte [r8 + 0xc], dil
je 0x1400591a4
mov eax, edi
nop dword [rax]
lea ecx, [rax - 0xb]
xor byte [r8 + rax], cl
inc rax
cmp rax, 0xb
jb 0x140059190
mov byte [r8 + 0xc], dil
lea rax, [r8 + 0xb]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x1400591d4
mov qword [rsp + 0x30], rdi
mov byte [rsp + 0x20], dil
jmp 0x1400591fb
mov qword [rsp + 0x30], recvfrom
movsd xmm0, qword [r8]
movsd qword [rsp + 0x20], xmm0
movzx eax, word [r8 + 8]
mov word [rsp + 0x28], ax
movzx eax, byte [r8 + 0xa]
mov byte [rsp + 0x2a], al
mov r9, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x140059209
mov rdx, qword [rdx]
mov r8, rdx
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.140065d60
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x140059283
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005927e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005927e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400bb684
mov rax, rbx
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x1400592a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rbx, rcx
mov qword [rbp - 0x10], rcx
xor r9d, r9d
cmp byte [r8 + 0xb], r9b
je 0x1400592e4
mov ecx, r9d
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0xb]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 0xa
jb 0x1400592d0
mov byte [r8 + 0xb], r9b
lea rax, [r8 + 0xa]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
mov qword [rbp - 0x28], r9
mov qword [rbp - 0x20], r9
mov qword [rbp - 0x20], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x14005930e
mov qword [rbp - 0x28], r9
mov byte [rbp - 0x38], r9b
jmp 0x140059329
mov qword [rbp - 0x28], 0xa
movsd xmm0, qword [r8]
movsd qword [rbp - 0x38], xmm0
movzx eax, word [r8 + 8]
mov word [rbp - 0x30], ax
cmp byte [rdx + 0xe], 0
je 0x140059353
mov rcx, r9
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0xb]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xd
jb 0x140059340
mov byte [rdx + 0xe], 0
lea rax, [rdx + 0xd]
xorps xmm0, xmm0
movups xmmword [rbp - 0x58], xmm0
mov qword [rbp - 0x48], r9
mov qword [rbp - 0x40], r9
mov qword [rbp - 0x40], reloc.WS2_32.dll_ntohs
cmp rdx, rax
jne 0x14005937d
mov qword [rbp - 0x48], r9
mov byte [rbp - 0x58], 0
jmp 0x14005939b
mov qword [rbp - 0x48], reloc.WS2_32.dll_listen
movsd xmm0, qword [rdx]
movsd qword [rbp - 0x58], xmm0
mov eax, dword [rdx + 8]
mov dword [rbp - 0x50], eax
movzx eax, byte [rdx + 0xc]
mov byte [rbp - 0x4c], al
lea r9, [rbp - 0x38]
lea r8, [rbp - 0x58]
movzx edx, byte [rbp - 0x60]
mov rcx, rbx
call fcn.140039f30
nop
mov rdx, qword [rbp - 0x40]
cmp rdx, 0x10
jb 0x1400593ef
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400593e9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400593e9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400bb684
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x14005942d
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140059428
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140059428
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400bb684
mov rax, rbx
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rbp
ret

Function at 0x140060350
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 0x10], al
je 0x140060373
lea edx, [rax - 0xb]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xf
jb 0x140060360
mov byte [rcx + 0x10], 0
lea r8, [rcx + 0xf]
mov rdx, rcx
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.1400397d0
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x140061630
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x47], 0
je 0x140061653
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0xb]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x46
jb 0x140061640
mov byte [rcx + 0x47], 0
mov rax, rcx
ret
Function at 0x140063130
Capabilities:
Execute command

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x14017a6c0]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rsi, rcx
mov qword [rsp + 0x78], rcx
mov r8, rcx
lea rdx, str.start_cmd__C__color_b__title_Error__echo
lea rcx, [rsp + 0x58]
call fcn.140058870
mov rdi, rax
mov rcx, qword [rax + 0x10]
mov rdx, qword [rax + 0x18]
mov rax, rdx
sub rax, rcx
cmp rax, 0x11
jb 0x1400631ba
lea rax, [rcx + 0x11]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x14006319b
mov rax, qword [rdi]
lea rbx, [rax + rcx]
mov r8d, reloc.WS2_32.dll_recvfrom
lea rdx, str.__timeout__t_5_
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x11], 0
jmp 0x1400631dc
mov qword [rsp + 0x20], reloc.WS2_32.dll_recvfrom
lea r9, str.__timeout__t_5_
xor r8d, r8d
lea edx, [r8 + 0x11]
mov rcx, rdi
call fcn.14005a9b0
mov rdi, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
movups xmm0, xmmword [rdi]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rdi + 0x10], 0
mov qword [rdi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rdi], 0
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 0x10
cmovae rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140063268
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140063263
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140063263
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400bb684
movdqa xmm0, xmmword [0x1400ce430]
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x30], 0
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x1400632bb
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400632b6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400632b6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400bb684
xor ecx, ecx
int 0x29
mov rdx, qword [rsi + 0x18]
cmp rdx, 0x10
jb 0x1400632f5
inc rdx
mov rcx, qword [rsi]
cmp rdx, 0x1000
jb 0x1400632f0
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14006332d
mov rcx, r8
call fcn.1400bb684
mov qword [rsi + 0x10], 0
mov qword [rsi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rsi], 0
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400bc0e0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x1400713f0
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__read]
cdqe
add rsp, 0x28
ret