joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400030d0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x70
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x1400030f4
xor eax, eax
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
mov rax, qword [rcx + 0x40]
mov rcx, qword [rax]
test rcx, rcx
je 0x140003137
mov rdx, qword [rbx + 0x58]
movsxd r8, dword [rdx]
lea rax, [rcx + r8]
cmp rcx, rax
jae 0x140003137
lea eax, [r8 - 1]
mov dword [rdx], eax
mov rcx, qword [rbx + 0x40]
mov rdx, qword [rcx]
lea rax, [rdx + 1]
mov qword [rcx], rax
mov eax, edi
mov byte [rdx], dil
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0x80], rsi
je 0x140003268
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14000317a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x1400031a5
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmove edi, ecx
mov eax, edi
jmp 0x14000326d
lea rax, [rsp + 0x90]
mov byte [rsp + 0x40], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x41]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x40]
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14000321a
sub eax, 1
je 0x14000321a
cmp eax, 2
jne 0x140003268
movsx ecx, byte [rsp + 0x40]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmove edi, ecx
mov eax, edi
jmp 0x14000326d
mov rsi, qword [rsp + 0x90]
lea rax, [rsp + 0x48]
sub rsi, rax
je 0x14000324b
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x48]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x140003268
lea rax, [rsp + 0x40]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x98], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x14000326d
mov eax, 0xffffffff
mov rsi, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
Function at 0x1400036b0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x50
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140003779
cmp byte [rcx + 0x71], 0
je 0x140003779
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x68], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14000376c
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x60]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140003728
sub eax, 1
je 0x14000372c
cmp eax, 2
jne 0x14000376c
mov rdi, qword [rsp + 0x68]
mov al, 1
mov byte [rbx + 0x71], 0
add rsp, 0x50
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x60]
lea rax, [rsp + 0x30]
sub rdi, rax
je 0x14000375a
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x30]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14000376c
cmp byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x68]
sete al
add rsp, 0x50
pop rbx
ret
mov rdi, qword [rsp + 0x68]
xor al, al
add rsp, 0x50
pop rbx
ret
mov al, 1
add rsp, 0x50
pop rbx
ret

Function at 0x1400044b0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400044fa
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400044fa
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400044fa
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400044fa
cmp dword [rcx + 0x84], 0xe
jbe 0x1400044fa
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400044fc
xor al, al
add rsp, 0x28
ret
Function at 0x140001050
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
xor bl, bl
xor edi, edi
nop
mov ecx, 0x52
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140001074
mov bl, 1
jmp 0x14000108d
mov ecx, 0x46
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140001088
xor bl, bl
jmp 0x140001060
cmp bl, 1
jne 0x140001060
xor edx, edx
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
lea ecx, [rdx + 2]
call qword [sym.imp.USER32.dll_mouse_event]
xor edx, edx
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
lea ecx, [rdx + 4]
call qword [sym.imp.USER32.dll_mouse_event]
mov ecx, 0x4b
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140001060

Function at 0x140001bf8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001c42
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001c42
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001c42
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001c42
cmp dword [rcx + 0x84], 0xe
jbe 0x140001c42
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001c44
xor al, al
add rsp, 0x28
ret
Function at 0x140003d50
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [rdx + 0x4a], 0
mov rbx, rcx
je 0x140003d76
xor eax, eax
lea r8d, [rax - 0x4c]
xor byte [rax + rdx], r8b
inc rax
cmp rax, 0x49
jb 0x140003d61
mov byte [rdx + 0x4a], 0
call fcn.140006080
mov rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x140003d90
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x68], rcx
xor esi, esi
cmp byte [r8 + 6], sil
je 0x140003dc4
mov ecx, esi
lea eax, [rcx - 0x4c]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 5
jb 0x140003db0
mov byte [r8 + 6], sil
lea rax, [r8 + 5]
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x48], sil
cmp r9, rax
je 0x140003df9
mov r8d, 5
mov rdx, r9
lea rcx, [rsp + 0x48]
call fcn.140005980
nop
cmp byte [rbx + 0xa], 0
je 0x140003e23
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x4c]
xor byte [rcx + rbx], al
inc rcx
cmp rcx, 9
jb 0x140003e10
mov byte [rbx + 0xa], 0
lea rax, [rbx + 9]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], 0
cmp rbx, rax
je 0x140003e58
mov r8d, 9
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.140005980
nop
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x28]
mov rcx, rdi
call fcn.140007480
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x140003eac
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003ea6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003ea6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140062ec4
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x140003eec
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003ee7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003ee7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140062ec4
mov rax, rdi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x140003f00
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x48], rcx
xor esi, esi
cmp byte [r8 + 7], sil
je 0x140003f34
mov ecx, esi
lea eax, [rcx - 0x4c]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 6
jb 0x140003f20
mov byte [r8 + 7], sil
lea rax, [r8 + 6]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], sil
cmp r9, rax
je 0x140003f69
mov r8d, 6
mov rdx, r9
lea rcx, [rsp + 0x28]
call fcn.140005980
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140003f77
mov rbx, qword [rbx]
mov r8, rbx
lea rcx, [rsp + 0x28]
call fcn.1400085a0
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x140003fec
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003fe7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003fe7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140062ec4
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x140004000
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x48], rcx
xor esi, esi
cmp byte [r8 + 0xa], sil
je 0x140004034
mov ecx, esi
lea eax, [rcx - 0x4c]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 9
jb 0x140004020
mov byte [r8 + 0xa], sil
lea rax, [r8 + 9]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], sil
cmp r9, rax
je 0x140004069
mov r8d, 9
mov rdx, r9
lea rcx, [rsp + 0x28]
call fcn.140005980
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140004077
mov rbx, qword [rbx]
mov r8, rbx
lea rcx, [rsp + 0x28]
call fcn.1400085a0
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x1400040ec
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400040e7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400040e7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140062ec4
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x140004180
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x48], rcx
xor esi, esi
cmp byte [r8 + 0xc], sil
je 0x1400041b4
mov ecx, esi
lea eax, [rcx - 0x4c]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 0xb
jb 0x1400041a0
mov byte [r8 + 0xc], sil
lea rax, [r8 + 0xb]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], sil
cmp r9, rax
je 0x1400041e9
mov r8d, listen
mov rdx, r9
lea rcx, [rsp + 0x28]
call fcn.140005980
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x1400041f7
mov rbx, qword [rbx]
mov r8, rbx
lea rcx, [rsp + 0x28]
call fcn.1400085a0
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x14000426c
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004267
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004267
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140062ec4
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x140004a50
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x68], rcx
xor esi, esi
cmp byte [r8 + 6], sil
je 0x140004a84
mov ecx, esi
lea eax, [rcx - 0x4c]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 5
jb 0x140004a70
mov byte [r8 + 6], sil
lea rax, [r8 + 5]
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x48], sil
cmp r9, rax
je 0x140004ab9
mov r8d, 5
mov rdx, r9
lea rcx, [rsp + 0x48]
call fcn.140005980
nop
cmp byte [rbx + 0xd], 0
je 0x140004ae3
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x4c]
xor byte [rcx + rbx], al
inc rcx
cmp rcx, 0xc
jb 0x140004ad0
mov byte [rbx + 0xd], 0
lea rax, [rbx + 0xc]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], 0
cmp rbx, rax
je 0x140004b18
mov r8d, recvfrom
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.140005980
nop
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x28]
mov rcx, rdi
call fcn.140007480
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x140004b6c
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004b66
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004b66
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140062ec4
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x140004bac
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004ba7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004ba7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140062ec4
mov rax, rdi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x140004bc0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x14007f080]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, rdx
mov rdi, rcx
mov qword [rbp - 0x38], rcx
mov qword [rbp - 0x38], rdx
xor r14d, r14d
call fcn.140003470
call fcn.140015640
mov rsi, rax
test rax, rax
jne 0x140004ca2
mov qword [rdi], r14
mov qword [rdi + 0x10], r14
mov qword [rdi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rdi], al
lea r8d, [r14 + 4]
lea rdx, str.null
mov rcx, rdi
call fcn.140005980
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x140004c6c
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x140004c67
add rdx, 0x27
mov rax, qword [rcx - 8]
sub rcx, rax
add rcx, 0xfffffffffffffff8
cmp rcx, 0x1f
ja 0x140004dfa
mov rcx, rax
call fcn.140062ec4
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov rax, rdi
mov byte [rbx], 0
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140063220
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x18], reloc.WS2_32.dll_ntohs
movdqa xmm0, xmmword [0x140075490]
movdqu xmmword [rbp - 0x60], xmm0
mov dword [rbp - 0x50], 0xe8a8acb3
mov dword [rbp - 0x4c], 0xe4a3b9a9
mov dword [rbp - 0x48], 0xe0ffe3fd
mov word [rbp - 0x44], 0x100
mov rcx, r14
nop dword [rax]
lea eax, [rcx - 0x4c]
xor byte [rbp + rcx - 0x60], al
inc rcx
cmp rcx, 0x1c
jb 0x140004ce0
mov byte [rbp - 0x43], 0
lea r8, [rbp - 0x60]
mov edx, 0x2712
mov rcx, rsi
call fcn.140019160
xor r8d, r8d
lea edx, [r8 + 0x40]
mov rcx, rsi
call fcn.140019160
xor r8d, r8d
lea edx, [r8 + 0x51]
mov rcx, rsi
call fcn.140019160
lea r8, str.keyauth.win
mov edx, 0x27c1
mov rcx, rsi
call fcn.140019160
mov r8, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x140004d44
mov r8, qword [rbx]
mov edx, 0x271f
mov rcx, rsi
call fcn.140019160
lea r8, [0x140004100]
mov edx, 0x4e2b
mov rcx, rsi
call fcn.140019160
lea r8, [rbp - 0x30]
mov edx, 0x2711
mov rcx, rsi
call fcn.140019160
mov rcx, rsi
call fcn.140015700
test eax, eax
je 0x140004d9d
mov ecx, eax
call fcn.1400162b0
mov rdx, rax
mov r9d, reloc.WS2_32.dll_recv
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
movups xmm0, xmmword [rbp - 0x30]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rbp - 0x20]
movups xmmword [rdi + 0x10], xmm1
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x30], 0
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x140004c6c
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x140004c67
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140004dfa
mov rcx, r8
jmp 0x140004c67
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x140012cd0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [rdx + 3], 0
mov rbx, rcx
je 0x140012cf6
xor eax, eax
lea r8d, [rax + 0x18]
xor byte [rax + rdx], r8b
inc rax
cmp rax, 2
jb 0x140012ce1
mov byte [rdx + 3], 0
call fcn.140006080
mov rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x140012d10
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [rdx + 8], 0
mov rbx, rcx
je 0x140012d36
xor eax, eax
lea r8d, [rax + 0x18]
xor byte [rax + rdx], r8b
inc rax
cmp rax, 7
jb 0x140012d21
mov byte [rdx + 8], 0
call fcn.140006080
mov rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x140012d50
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [rdx + 0x17], 0
mov rbx, rcx
je 0x140012d76
xor eax, eax
lea r8d, [rax + 0x18]
xor byte [rax + rdx], r8b
inc rax
cmp rax, 0x16
jb 0x140012d61
mov byte [rdx + 0x17], 0
call fcn.140006080
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x140014990
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 4], 0
je 0x1400149b3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x18]
xor byte [rax + rcx], dl
inc rax
cmp rax, 3
jb 0x1400149a0
mov byte [rcx + 4], 0
mov rax, rcx
ret
Function at 0x140029420
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx + 0x718], 0
mov rsi, r9
mov rbp, r8
movsxd rbx, edx
mov rdi, rcx
je 0x14002947e
mov dl, 1
call fcn.140019e00
mov rax, qword [rdi + 0x670]
mov r9, rsi
mov r8, rbp
mov qword [rsp + 0x20], rax
mov edx, ebx
mov rcx, rdi
call qword [rdi + 0x718]
xor edx, edx
mov rcx, rdi
mov ebx, eax
call fcn.140019e00
mov eax, ebx
jmp 0x1400294c2
cmp ebx, 2
ja 0x1400294c0
mov r9, qword [rdi + 0x668]
lea rdx, [0x14006a380]
lea rcx, [rbx + rbx*2]
add rcx, rdx
mov edx, 2
lea r8d, [rdx - 1]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r9, qword [rdi + 0x668]
mov r8d, 1
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x1400294e0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rdi
sub rsp, 0x160
mov rax, qword [0x14007f080]
xor rax, rsp
mov qword [rsp + 0x140], rax
cmp byte [rcx + 0xf1e], 0
mov rdi, rcx
jne 0x140029523
cmp qword [rcx + 0x678], 0
je 0x140029600
mov r8, rdx
mov qword [rsp + 0x158], rbx
mov edx, 0x100
lea r9, [rsp + 0x180]
lea rcx, [rsp + 0x30]
call fcn.14002caf0
lea rax, [rsp + 0x30]
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x140029551
mov rcx, qword [rdi + 0x678]
test rcx, rcx
je 0x140029598
cmp byte [rdi + 0x1597], 0
jne 0x140029598
lea rdx, [rsp + 0x30]
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rdx]
lea rdx, [rdx + 1]
mov byte [rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x140029580
mov byte [rdi + 0x1597], 1
cmp byte [rdi + 0xf1e], 0
je 0x1400295f8
mov byte [rsp + rbx + 0x30], 0xa
inc rbx
cmp rbx, 0x102
jae 0x140029653
cmp qword [rdi + 0x718], 0
mov byte [rsp + rbx + 0x30], 0
je 0x140029619
mov dl, 1
mov rcx, rdi
call fcn.140019e00
mov rax, qword [rdi + 0x670]
lea r8, [rsp + 0x30]
mov r9, rbx
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, rdi
call qword [rdi + 0x718]
xor edx, edx
mov rcx, rdi
call fcn.140019e00
mov rbx, qword [rsp + 0x158]
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.140063220
add rsp, 0x160
pop rdi
ret
mov r9, qword [rdi + 0x668]
lea rcx, [0x14006a380]
mov edx, 2
lea r8d, [rdx - 1]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r9, qword [rdi + 0x668]
lea rcx, [rsp + 0x30]
mov r8d, 1
mov rdx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
jmp 0x1400295f8
call fcn.1400636d4
int3
Function at 0x140029660
Capabilities:
Write file on windows

Disassembly:
test rcx, rcx
je 0x1400297c6
mov r11, rsp
mov qword [r11 + 0x10], rdx
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x20], r9
push rdi
sub rsp, 0x860
mov rax, qword [0x14007f080]
xor rax, rsp
mov qword [rsp + 0x840], rax
cmp byte [rcx + 0xf1e], 0
mov rdi, rcx
je 0x1400297ae
mov r8, rdx
mov qword [r11 - 0x10], rbx
mov edx, 0x801
lea r9, [r11 + 0x18]
lea rcx, [rsp + 0x30]
call fcn.14002caf0
movsxd rcx, eax
mov rbx, 0xffffffffffffffff
cmp rcx, 0x801
jb 0x140029721
mov rcx, qword [rsp + 0x878]
mov rax, rbx
nop word [rax + rax]
cmp byte [rcx + rax + 1], 0
lea rax, [rax + 1]
jne 0x1400296e0
cmp byte [rax + rcx - 1], 0xa
jne 0x140029708
lea r8, str...._n
mov edx, 5
lea rcx, [rsp + 0x82c]
jmp 0x14002971c
lea r8, [0x14006a3a0]
mov edx, 4
lea rcx, [rsp + 0x82d]
call fcn.14002c9f0
lea rax, [rsp + 0x30]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140029726
cmp qword [rdi + 0x718], 0
je 0x14002976e
mov dl, 1
mov rcx, rdi
call fcn.140019e00
mov rax, qword [rdi + 0x670]
lea r8, [rsp + 0x30]
mov r9, rbx
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, rdi
call qword [rdi + 0x718]
xor edx, edx
mov rcx, rdi
call fcn.140019e00
jmp 0x1400297a6
mov r9, qword [rdi + 0x668]
lea rcx, [0x14006a380]
mov edx, 2
lea r8d, [rdx - 1]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r9, qword [rdi + 0x668]
lea rcx, [rsp + 0x30]
mov r8d, 1
mov rdx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rbx, qword [rsp + 0x858]
mov rcx, qword [rsp + 0x840]
xor rcx, rsp
call fcn.140063220
add rsp, 0x860
pop rdi
ret

Function at 0x140029860
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, r9
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recv]
movsxd rcx, eax
cmp rcx, 0xffffffffffffffff
jne 0x1400298a2
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, Ordinal_60
mov qword [rbx], 0
cmp eax, 0x2733
mov edx, 0x51
cmove ecx, edx
mov eax, ecx
add rsp, 0x20
pop rbx
ret
mov qword [rbx], rcx
xor eax, eax
add rsp, 0x20
pop rbx
ret