joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400fd680
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x1300]
mov eax, 0x1400
call fcn.140250630
sub rsp, rax
movaps xmmword [rsp + 0x13f0], xmm6
movaps xmmword [rsp + 0x13e0], xmm7
movaps xmmword [rsp + 0x13d0], xmm8
movaps xmm8, xmm0
call sub.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_
mov dword [rsp + 0x44], eax
mov edx, 1
mov dword [rbp + 0x12c4], 0xffffffff
nop word [rax + rax]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [rsp + rdx*4 + 0x44], eax
inc rdx
cmp rdx, 0x270
jb 0x1400fd6e0
mov esi, dword [0x1404daff4]
lea rax, [rsp + 0x40]
mov qword [rbp + 0x1340], rax
mov r14d, reloc.WLDAP32.dll_Ordinal_60
lea rax, [rsp + 0x40]
mov dword [rsp + 0x40], 0x270
mov qword [rbp + 0x1338], rax
mov r15d, 0x80000000
lea rax, [rsp + 0x40]
mov qword [rbp + 0x1348], rax
nop dword [rax]
lea rcx, [rbp + 0x1340]
call fcn.1400a90e0
mov eax, eax
imul rax, rax, 0xa1
cmp eax, 0x50
ja 0x1400fd77a
nop word [rax + rax]
lea rcx, [rbp + 0x1340]
call fcn.1400a90e0
mov eax, eax
imul rax, rax, 0xa1
cmp eax, 0x51
jb 0x1400fd760
shr rax, 0x20
add eax, 0xc8
movd xmm7, eax
lea eax, [rsi + r15]
cvtdq2ps xmm7, xmm7
cmp esi, r15d
jb 0x1400fd799
lea eax, [rsi - 0x80000000]
lea rcx, [rbp + 0x1338]
cmp eax, 0x7fffffff
jne 0x1400fd7b0
call fcn.1400a90e0
mov ecx, eax
jmp 0x1400fd7fa
lea edi, [rax - 0x7fffffff]
mov ebx, edi
call fcn.1400a90e0
mov ecx, eax
imul rcx, rbx
cmp ecx, edi
jae 0x1400fd7f6
mov eax, edi
xor edx, edx
neg eax
div edi
mov edi, edx
cmp ecx, edx
jae 0x1400fd7f6
nop word [rax + rax]
lea rcx, [rbp + 0x1338]
call fcn.1400a90e0
mov ecx, eax
imul rcx, rbx
cmp ecx, edi
jb 0x1400fd7e0
shr rcx, 0x20
movd xmm6, ecx
lea rcx, [rbp + 0x1348]
cvtdq2ps xmm6, xmm6
call fcn.1400a90e0
mov edx, eax
shl rdx, 2
shr rdx, 0x20
xorps xmm0, xmm0
movss dword [rsp + 0x20], xmm6
add edx, 0x80000002
movss dword [rsp + 0x24], xmm7
cmp edx, r15d
movss dword [rsp + 0x3c], xmm8
movups xmmword [rsp + 0x28], xmm0
lea eax, [rdx + r15]
lea ecx, [rdx - 0x80000000]
mov rdx, qword [0x1404db000]
cmovae ecx, eax
cmp rdx, qword [0x1404db008]
movd xmm0, ecx
cvtdq2ps xmm0, xmm0
movss dword [rsp + 0x38], xmm0
je 0x1400fd880
movups xmm0, xmmword [rsp + 0x20]
movups xmm1, xmmword [rsp + 0x30]
movups xmmword [rdx], xmm0
movups xmmword [rdx + 0x10], xmm1
add qword [0x1404db000], 0x20
jmp 0x1400fd897
lea r8, [rsp + 0x20]
lea rcx, [0x1404daff8]
call fcn.1400fd4d0
mov esi, dword [0x1404daff4]
sub r14, 1
jne 0x1400fd740
lea r11, [rsp + 0x1400]
mov rbx, qword [r11 + 0x30]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140108e50
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 7], sil
je 0x140108e84
mov eax, esi
lea ecx, [rax - 0x6a]
xor byte [r8 + rax], cl
inc rax
cmp rax, 6
jb 0x140108e70
mov byte [r8 + 7], sil
add r8, 6
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.140086770
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x140108ea9
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.1400b4a50
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x140108f23
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140108f1e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140108f1e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1402502b0
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x140108f30
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 9], sil
je 0x140108f64
mov eax, esi
lea ecx, [rax - 0x6a]
xor byte [r8 + rax], cl
inc rax
cmp rax, 8
jb 0x140108f50
mov byte [r8 + 9], sil
add r8, 8
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.140086770
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x140108f89
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.1400b4a50
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x140109003
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140108ffe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140108ffe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1402502b0
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x140109010
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 0xa], sil
je 0x140109044
mov eax, esi
lea ecx, [rax - 0x6a]
xor byte [r8 + rax], cl
inc rax
cmp rax, 9
jb 0x140109030
mov byte [r8 + 0xa], sil
add r8, 9
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.140086770
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x140109069
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.1400b4a50
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x1401090e3
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401090de
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1401090de
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1402502b0
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x1401090f0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 0x31], sil
je 0x140109124
mov eax, esi
lea ecx, [rax - 0x6a]
xor byte [r8 + rax], cl
inc rax
cmp rax, 0x30
jb 0x140109110
mov byte [r8 + 0x31], sil
add r8, 0x30
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.140086770
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x140109149
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.1400b4a50
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x1401091c3
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401091be
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1401091be
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1402502b0
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x1401091d0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r10, r8
mov rdi, rdx
mov rsi, rcx
mov qword [rsp + 0x28], rcx
xor ebx, ebx
cmp byte [r8 + 0xb], bl
je 0x140109204
mov ecx, ebx
lea eax, [rcx - 0x6a]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 0xa
jb 0x1401091f0
mov byte [r8 + 0xb], bl
add r8, 0xa
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x50]
call fcn.140086770
nop
cmp byte [rdi + 0xb], 0
je 0x140109234
lea eax, [rbx - 0x6a]
xor byte [rdi + rbx], al
inc rbx
cmp rbx, 0xa
jb 0x140109221
mov byte [rdi + 0xb], 0
lea r8, [rdi + 0xa]
lea r9, [rsp + 0x20]
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.140086770
nop
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
movzx edx, byte [rsp + 0x20]
mov rcx, rsi
call fcn.14009ded0
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x1401092a4
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14010929e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14010929e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1402502b0
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x1401092e4
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401092df
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1401092df
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1402502b0
mov rax, rsi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret

Function at 0x1401092f0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 0xc], sil
je 0x140109324
mov eax, esi
lea ecx, [rax - 0x6a]
xor byte [r8 + rax], cl
inc rax
cmp rax, 0xb
jb 0x140109310
mov byte [r8 + 0xc], sil
add r8, 0xb
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.140086770
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x140109349
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.1400b4a50
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x1401093c3
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401093be
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1401093be
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1402502b0
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x140110f60
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
mov rdx, rcx
cmp byte [rcx + 8], al
je 0x140110f93
nop dword [rax]
nop word [rax + rax]
lea ecx, [rax - 0x6a]
xor byte [rdx + rax], cl
inc rax
cmp rax, 7
jb 0x140110f80
mov byte [rdx + 8], 0
lea r8, [rdx + 7]
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.140086770
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x140110fb0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
mov rdx, rcx
cmp byte [rcx + 9], al
je 0x140110fe3
nop dword [rax]
nop word [rax + rax]
lea ecx, [rax - 0x6a]
xor byte [rdx + rax], cl
inc rax
cmp rax, 8
jb 0x140110fd0
mov byte [rdx + 9], 0
lea r8, [rdx + 8]
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.140086770
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x140111000
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
mov rdx, rcx
cmp byte [rcx + 0x10], al
je 0x140111033
nop dword [rax]
nop word [rax + rax]
lea ecx, [rax - 0x6a]
xor byte [rdx + rax], cl
inc rax
cmp rax, 0xf
jb 0x140111020
mov byte [rdx + 0x10], 0
lea r8, [rdx + 0xf]
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.140086770
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x1401123a0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 5], 0
je 0x1401123c3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x6a]
xor byte [rcx + rax], dl
inc rax
cmp rax, 4
jb 0x1401123b0
mov byte [rcx + 5], 0
mov rax, rcx
ret

Function at 0x1401123d0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 8], 0
je 0x1401123f3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x6a]
xor byte [rcx + rax], dl
inc rax
cmp rax, 7
jb 0x1401123e0
mov byte [rcx + 8], 0
mov rax, rcx
ret

Function at 0x140112400
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x136], 0
je 0x140112428
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x6a]
xor byte [rcx + rax], dl
inc rax
cmp rax, 0x135
jb 0x140112410
mov byte [rcx + 0x136], 0
mov rax, rcx
ret

Function at 0x140112430
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x32], 0
je 0x140112453
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x6a]
xor byte [rcx + rax], dl
inc rax
cmp rax, 0x31
jb 0x140112440
mov byte [rcx + 0x32], 0
mov rax, rcx
ret

Function at 0x140112460
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x44], 0
je 0x140112483
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x6a]
xor byte [rcx + rax], dl
inc rax
cmp rax, 0x43
jb 0x140112470
mov byte [rcx + 0x44], 0
mov rax, rcx
ret

Function at 0x140112490
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x47], 0
je 0x1401124b3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x6a]
xor byte [rcx + rax], dl
inc rax
cmp rax, 0x46
jb 0x1401124a0
mov byte [rcx + 0x47], 0
mov rax, rcx
ret
Function at 0x140117ca0
Capabilities:
Execute command

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0xa0
mov rax, qword [0x1404d1c80]
xor rax, rsp
mov qword [rsp + 0x98], rax
mov rdi, rcx
mov qword [rsp + 0x90], rcx
mov rcx, qword [rcx + 0x10]
movabs rax, 0x7fffffffffffffff
sub rax, rcx
cmp rax, 0x2d
jb 0x140117eeb
mov rax, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x140117cf2
mov rax, qword [rdi]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], reloc.WLDAP32.dll_Ordinal_45
lea r9, str.start_cmd__C__color_b__title_Error__echo
mov r8, rdi
movzx edx, byte [rsp + 0x40]
lea rcx, [rsp + 0x68]
call fcn.14009e0d0
nop
mov rcx, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x80]
mov rax, rdx
sub rax, rcx
cmp rax, 0x11
jb 0x140117d73
lea rax, [rcx + 0x11]
mov qword [rsp + 0x78], rax
lea rbx, [rsp + 0x68]
cmp rdx, 0xf
cmova rbx, qword [rsp + 0x68]
add rbx, rcx
mov r8d, reloc.WS2_32.dll_recvfrom
lea rdx, str.__timeout__t_5_
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x11], 0
lea rax, [rsp + 0x68]
jmp 0x140117d94
mov qword [rsp + 0x20], reloc.WS2_32.dll_recvfrom
lea r9, str.__timeout__t_5_
xor r8d, r8d
lea edx, [r8 + 0x11]
lea rcx, [rsp + 0x68]
call fcn.14008ebc0
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x58], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x58], xmm1
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rcx, [rsp + 0x48]
cmp qword [rsp + 0x60], 0xf
cmova rcx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rsp + 0x60]
cmp rdx, 0xf
jbe 0x140117e20
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140117e1b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140117e1b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1402502b0
movdqa xmm0, xmmword [0x1402aef80]
movdqu xmmword [rsp + 0x58], xmm0
mov byte [rsp + 0x48], 0
mov rdx, qword [rsp + 0x80]
cmp rdx, 0xf
jbe 0x140117e76
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140117e71
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140117e71
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1402502b0
xor ecx, ecx
int 0x29
mov rdx, qword [rdi + 0x18]
cmp rdx, 0xf
jbe 0x140117eb0
inc rdx
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x140117eab
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140117ee4
mov rcx, r8
call fcn.1402502b0
mov qword [rdi + 0x10], 0
mov qword [rdi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rdi], 0
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.140250c20
mov rbx, qword [rsp + 0xb8]
add rsp, 0xa0
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.140082d30
nop
int3
Function at 0x1401189a0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x60
mov rbx, rcx
mov qword [rsp + 0x38], rcx
xor edi, edi
mov dword [rsp + 0x30], edi
lea rcx, str.ALLUSERSPROFILE
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x140118a00
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], dil
jne 0x1401189e7
mov rdx, rax
mov rcx, rbx
call fcn.14007ad70
jmp 0x140118ab4
lea rcx, [rsp + 0x40]
call fcn.140113020
nop
mov rsi, rax
cmp qword [rax + 0x18], 7
jbe 0x140118a18
mov rsi, qword [rax]
mov rbp, qword [rax + 0x10]
call fcn.1402514bc
mov r14d, eax
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov dword [rsp + 0x30], reloc.WS2_32.dll_recv
test rbp, rbp
je 0x140118aaa
cmp rbp, 0x7fffffff
ja 0x140118ad6
mov dword [rsp + 0x20], edi
xor r9d, r9d
mov r8d, ebp
mov rdx, rsi
mov ecx, eax
call fcn.14025152c
mov rdi, rax
shr rax, 0x20
test eax, eax
jne 0x140118ae1
movsxd rdx, edi
xor r8d, r8d
mov rcx, rbx
call fcn.1400b7000
mov r9, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x140118a8d
mov r9, qword [rbx]
mov dword [rsp + 0x20], edi
mov r8d, ebp
mov rdx, rsi
mov ecx, r14d
call fcn.14025152c
mov rcx, rax
shr rax, 0x20
test eax, eax
jne 0x140118acc
lea rcx, [rsp + 0x40]
call fcn.1400aa310
mov rax, rbx
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
shr rcx, 0x20
call fcn.1400aa080
int3
mov ecx, reloc.WLDAP32.dll_Ordinal_22
call fcn.1400aa040
int3
shr rdi, 0x20
mov ecx, edi
call fcn.1400aa080
int3
Function at 0x1401277f0
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__read]
cdqe
add rsp, 0x28
ret
Function at 0x1401399c0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx + 0x718], 0
mov rsi, r9
mov rbp, r8
movsxd rbx, edx
mov rdi, rcx
je 0x140139a1e
mov dl, 1
call fcn.140129ae0
mov rax, qword [rdi + 0x670]
mov r9, rsi
mov r8, rbp
mov qword [rsp + 0x20], rax
mov edx, ebx
mov rcx, rdi
call qword [rdi + 0x718]
xor edx, edx
mov rcx, rdi
mov ebx, eax
call fcn.140129ae0
mov eax, ebx
jmp 0x140139a62
cmp ebx, 2
ja 0x140139a60
mov r9, qword [rdi + 0x668]
lea rdx, [0x1402b4060]
lea rcx, [rbx + rbx*2]
add rcx, rdx
mov edx, 2
lea r8d, [rdx - 1]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r9, qword [rdi + 0x668]
mov r8d, 1
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x140139a80
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rdi
sub rsp, 0x160
mov rax, qword [0x1404d1c80]
xor rax, rsp
mov qword [rsp + 0x140], rax
cmp byte [rcx + 0xf1e], 0
mov rdi, rcx
jne 0x140139ac3
cmp qword [rcx + 0x678], 0
je 0x140139ba0
mov r8, rdx
mov qword [rsp + 0x158], rbx
mov edx, 0x100
lea r9, [rsp + 0x180]
lea rcx, [rsp + 0x30]
call fcn.140127be0
lea rax, [rsp + 0x30]
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x140139af1
mov rcx, qword [rdi + 0x678]
test rcx, rcx
je 0x140139b38
cmp byte [rdi + 0x1597], 0
jne 0x140139b38
lea rdx, [rsp + 0x30]
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rdx]
lea rdx, [rdx + 1]
mov byte [rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x140139b20
mov byte [rdi + 0x1597], 1
cmp byte [rdi + 0xf1e], 0
je 0x140139b98
mov byte [rsp + rbx + 0x30], 0xa
inc rbx
cmp rbx, 0x102
jae 0x140139bf3
cmp qword [rdi + 0x718], 0
mov byte [rsp + rbx + 0x30], 0
je 0x140139bb9
mov dl, 1
mov rcx, rdi
call fcn.140129ae0
mov rax, qword [rdi + 0x670]
lea r8, [rsp + 0x30]
mov r9, rbx
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, rdi
call qword [rdi + 0x718]
xor edx, edx
mov rcx, rdi
call fcn.140129ae0
mov rbx, qword [rsp + 0x158]
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.140250c20
add rsp, 0x160
pop rdi
ret
mov r9, qword [rdi + 0x668]
lea rcx, [0x1402b4060]
mov edx, 2
lea r8d, [rdx - 1]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r9, qword [rdi + 0x668]
lea rcx, [rsp + 0x30]
mov r8d, 1
mov rdx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
jmp 0x140139b98
call fcn.140250dd8
int3
Function at 0x140139c00
Capabilities:
Write file on windows

Disassembly:
test rcx, rcx
je 0x140139d66
mov r11, rsp
mov qword [r11 + 0x10], rdx
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x20], r9
push rdi
sub rsp, 0x860
mov rax, qword [0x1404d1c80]
xor rax, rsp
mov qword [rsp + 0x840], rax
cmp byte [rcx + 0xf1e], 0
mov rdi, rcx
je 0x140139d4e
mov r8, rdx
mov qword [r11 - 0x10], rbx
mov edx, 0x801
lea r9, [r11 + 0x18]
lea rcx, [rsp + 0x30]
call fcn.140127be0
movsxd rcx, eax
mov rbx, 0xffffffffffffffff
cmp rcx, 0x801
jb 0x140139cc1
mov rcx, qword [rsp + 0x878]
mov rax, rbx
nop word [rax + rax]
cmp byte [rcx + rax + 1], 0
lea rax, [rax + 1]
jne 0x140139c80
cmp byte [rax + rcx - 1], 0xa
jne 0x140139ca8
lea r8, str...._n
mov edx, 5
lea rcx, [rsp + 0x82c]
jmp 0x140139cbc
lea r8, [0x14025b654]
mov edx, 4
lea rcx, [rsp + 0x82d]
call fcn.140127ae0
lea rax, [rsp + 0x30]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140139cc6
cmp qword [rdi + 0x718], 0
je 0x140139d0e
mov dl, 1
mov rcx, rdi
call fcn.140129ae0
mov rax, qword [rdi + 0x670]
lea r8, [rsp + 0x30]
mov r9, rbx
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, rdi
call qword [rdi + 0x718]
xor edx, edx
mov rcx, rdi
call fcn.140129ae0
jmp 0x140139d46
mov r9, qword [rdi + 0x668]
lea rcx, [0x1402b4060]
mov edx, 2
lea r8d, [rdx - 1]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r9, qword [rdi + 0x668]
lea rcx, [rsp + 0x30]
mov r8d, 1
mov rdx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rbx, qword [rsp + 0x858]
mov rcx, qword [rsp + 0x840]
xor rcx, rsp
call fcn.140250c20
add rsp, 0x860
pop rdi
ret

Function at 0x140139e00
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, r9
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recv]
movsxd rcx, eax
cmp rcx, 0xffffffffffffffff
jne 0x140139e42
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, Ordinal_60
mov qword [rbx], 0
cmp eax, 0x2733
mov edx, 0x51
cmove ecx, edx
mov eax, ecx
add rsp, 0x20
pop rbx
ret
mov qword [rbx], rcx
xor eax, eax
add rsp, 0x20
pop rbx
ret