joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14005a270
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movsxd r15, ecx
lea r9, [0x1400844c0]
mov rax, r15
mov rbp, r15
and eax, 0x3f
sar rbp, 6
mov ecx, 4
xor esi, esi
mov r14, rdx
lea rdi, [rax + rax*8]
mov rax, qword [r9 + rbp*8]
lea r13d, [rcx + 6]
mov r10, qword [rax + rdi*8 + 0x28]
test r8, r8
je 0x14005a2c7
cmp word [rdx], r13w
jne 0x14005a2c7
or byte [rax + rdi*8 + 0x38], cl
jmp 0x14005a2cc
and byte [rax + rdi*8 + 0x38], 0xfb
lea r8, [rdx + r8*2]
mov rbx, r14
cmp r14, r8
jae 0x14005a3f1
mov r11d, 0xd
lea r12d, [r11 - 0xb]
movzx ecx, word [rdx]
cmp cx, 0x1a
je 0x14005a412
lea r9, [rdx + 2]
cmp cx, r11w
je 0x14005a305
mov rdx, r9
mov word [rbx], cx
jmp 0x14005a32c
cmp r9, r8
jae 0x14005a33c
cmp word [r9], r13w
mov rax, r12
mov ecx, 4
cmove rax, rcx
add rdx, rax
mov eax, r13d
cmp word [r9], r13w
cmovne ax, r11w
mov word [rbx], ax
mov rax, r12
add rbx, rax
cmp rdx, r8
jb 0x14005a2e6
jmp 0x14005a3f1
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rsi
mov r8d, r12d
lea rdx, [rsp + 0x70]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14005a3e6
cmp dword [rsp + 0x80], esi
je 0x14005a3e6
lea r8, [0x1400844c0]
mov rax, qword [r8 + rbp*8]
test byte [rax + rdi*8 + 0x38], 0x48
je 0x14005a3be
movzx eax, word [rsp + 0x70]
cmp ax, r13w
jne 0x14005a38e
mov word [rbx], r13w
jmp 0x14005a3ee
mov ecx, 0xd
mov word [rsp + 0x78], ax
mov word [rbx], cx
mov rax, qword [r8 + rbp*8]
lea rcx, [rax + rdi*8]
mov al, byte [rsp + rsi + 0x78]
mov byte [rcx + rsi + 0x3a], al
inc rsi
cmp rsi, r12
jl 0x14005a39b
mov rax, qword [r8 + rbp*8]
mov byte [rax + rdi*8 + 0x3c], r13b
jmp 0x14005a3ee
cmp word [rsp + 0x70], r13w
jne 0x14005a3cb
cmp rbx, r14
je 0x14005a388
mov rdx, 0xfffffffffffffffe
mov ecx, r15d
lea r8d, [rdx + 3]
call fcn.14005aed8
cmp word [rsp + 0x70], r13w
je 0x14005a3f1
mov ecx, 0xd
mov word [rbx], cx
add rbx, r12
sub rbx, r14
sar rbx, 1
lea eax, [rbx + rbx]
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea r8, [0x1400844c0]
mov rdx, qword [r8 + rbp*8]
mov al, byte [rdx + rdi*8 + 0x38]
test al, 0x40
jne 0x14005a3eb
or al, r12b
mov byte [rdx + rdi*8 + 0x38], al
jmp 0x14005a3f1
Function at 0x14005ec04
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x14005ec8b
mov rsi, rbx
cmp word [rax], bp
je 0x14005ec4a
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x14005ec34
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x14005ec30
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.140055c20
mov rdi, rax
test rax, rax
je 0x14005ec78
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140066d70
mov rbp, rdi
xor ecx, ecx
call fcn.140055be4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140061d74
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov ebx, ecx
call fcn.140055884
mov ecx, ebx
lea r8, [rsp + 0x30]
and ecx, 0x3ff
mov r9d, 2
bts ecx, 0xa
mov edx, 0x20000001
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor edx, edx
test eax, eax
je 0x140061e15
cmp ebx, dword [rsp + 0x30]
je 0x140061e0e
test esi, esi
je 0x140061e0e
mov r10, qword [rdi + 0x98]
mov r9d, edx
movzx r8d, word [r10]
lea rcx, [r10 + 2]
lea eax, [r8 - 0x41]
cmp ax, 0x19
jbe 0x140061de9
sub r8w, 0x61
cmp r8w, 0x19
ja 0x140061df6
movzx r8d, word [rcx]
inc r9d
add rcx, 2
jmp 0x140061dd3
or rax, 0xffffffffffffffff
inc rax
cmp word [r10 + rax*2], dx
jne 0x140061dfa
cmp r9d, eax
setne dl
mov eax, edx
jmp 0x140061e17
mov eax, 1
jmp 0x140061e17
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1400654b0
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14005aed8
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14005aed8
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x140065600
cmp rax, 0xffffffffffffffff
je 0x140065600
xor edi, edi
test rbp, rbp
jle 0x1400655ab
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.140055f50
mov rbx, rax
test rax, rax
jne 0x140065538
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x1400655a1
mov edx, 0x8000
mov ecx, r14d
call fcn.140053164
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.140059628
cmp eax, 0xffffffff
je 0x140065581
cdqe
sub rbp, rax
test rbp, rbp
jg 0x140065548
mov edx, r15d
mov ecx, r14d
call fcn.140053164
jmp 0x1400655a1
cmp byte [rsi + 0x38], dil
je 0x140065598
cmp dword [rsi + 0x34], 5
jne 0x140065598
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x1400655a1
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.140055be4
jmp 0x140065614
jns 0x140065614
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14005aed8
cmp rax, 0xffffffffffffffff
jne 0x1400655cc
cmp byte [rsi + 0x30], dil
je 0x140065614
mov edi, dword [rsi + 0x2c]
jmp 0x140065614
mov ecx, r14d
call fcn.14005f820
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x140065614
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x140065614
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x14006560d
mov eax, dword [rsi + 0x2c]
jmp 0x140065612
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14005aed8
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x140066980
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400669a8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1400669a8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140001001
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x1400043c0]
mov rcx, qword [0x140004340]
xor edx, edx
mov dword [rax], 1
mov rax, qword [0x1400043d0]
cmp word [rcx], 0x5a4d
mov dword [rax], 1
mov rax, qword [0x1400043e0]
mov dword [rax], 1
jne 0x140001083
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
cmp dword [rax], 0x4550
jne 0x140001083
mov ecx, dword [rax + 0x18]
cmp cx, 0x10b
je 0x14000105e
cmp cx, 0x20b
je 0x14000106d
jmp 0x140001083
cmp dword [rax + 0x74], 0xe
jbe 0x140001083
cmp dword [rax + 0xe8], 0
jmp 0x14000107d
cmp dword [rax + 0x84], 0xe
jbe 0x140001083
cmp dword [rax + 0xf8], 0
setne dl
movzx edx, dl
mov rax, qword [0x1400043b0]
mov dword [0x14000700c], edx
mov ecx, 2
cmp dword [rax], 0
jne 0x14000109f
mov ecx, 1
call sym.__set_app_type
call sym.__p__fmode
mov rdx, qword [0x140004480]
mov edx, dword [rdx]
mov dword [rax], edx
call sym.__p__commode
mov rdx, qword [0x140004460]
mov edx, dword [rdx]
mov dword [rax], edx
call sym._setargv
mov rax, qword [0x140004320]
cmp dword [rax], 1
jne 0x1400010e1
mov rcx, qword [sym._matherr]
call sym.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret

Function at 0x140001360
Capabilities:
Accept command line arguments
Create process on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
call sym.__main
mov rax, qword [sym.imp.KERNEL32.dll_GetCommandLineA]
call rax
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessA]
call rax
jmp 0x14000136d

Function at 0x140001b90
Capabilities:
Get thread local storage value

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
lea rdi, [0x140007100]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1400070e0]
test rbx, rbx
je 0x140001bdc
mov ecx, dword [rbx]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test rsi, rsi
je 0x140001bd6
test eax, eax
jne 0x140001bd6
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
jmp 0x140001bae
mov rcx, rdi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x140001d90
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x140001db3
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
jne 0x140001db3
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x140001db4
Capabilities:
Enumerate pe sections

Disassembly:
xor r8d, r8d
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
movzx r9d, word [rcx + 6]
lea rax, [rcx + rax + 0x18]
cmp r8d, r9d
jae 0x140001dee
mov r10d, dword [rax + 0xc]
mov rcx, r10
cmp rdx, r10
jb 0x140001de5
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x140001df0
inc r8d
add rax, 0x28
jmp 0x140001dcc
xor eax, eax
ret
Function at 0x140001e61
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x140004340]
mov r8, rcx
mov rcx, r9
call sym._ValidateImageBase
test eax, eax
je 0x140001e8d
mov rdx, r8
mov rcx, r9
sub rdx, r9
add rsp, 0x28
jmp sym._FindPESection
xor eax, eax
add rsp, 0x28
ret

Function at 0x141557058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1415571df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x141557089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14155706f
add dl, dl
jne 0x141557096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1415570f6
xor eax, eax
add dl, dl
jne 0x1415570a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1415571ad
add dl, dl
jne 0x1415570b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1415570c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1415570d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1415570dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1415570ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14155707e
mov eax, 1
add dl, dl
jne 0x141557106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141557113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1415570fb
sub eax, ebx
mov ebx, 1
jne 0x14155714c
mov ecx, 1
add dl, dl
jne 0x14155712e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14155713b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141557123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14155707e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x141557168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141557175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14155715d
cmp eax, 0x7d00
jae 0x14155719b
cmp eax, 0x500
jb 0x141557196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14155707e
cmp eax, 0x7f
ja 0x14155719e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14155707e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1415571d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14155707e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140013a17
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov qword [rbp - 8], 0
mov rdx, qword [rbp + 0x20]
mov rax, qword [rbp + 0x18]
mov r9, qword [rbp + 0x10]
mov r8, rdx
mov edx, 1
mov rcx, rax
call sym.fwrite
mov qword [rbp - 8], rax
mov dword [rbp - 0xc], 0
mov rcx, qword [rbp + 0x10]
call sym.fflush
mov dword [rbp - 0xc], eax
nop
add rsp, 0x30
pop rbp
ret

Function at 0x140016ed4
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x90
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
lea rax, str.echoBinSafe
mov qword [rbp - 0x58], rax
lea rax, [0x1400b4af8]
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x50], 0
mov word [rbp - 0x40], 0
lea rax, [rbp - 0x60]
mov rcx, rax
call sym.nimFrame_7
call sym.nimErrorFlag_7
mov qword [rbp - 0x10], rax
mov qword [rbp - 0x50], 0xb5f
lea rax, [0x1400d8180]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov qword [rbp - 0x18], 0
mov qword [rbp - 0x50], 0x12
lea rax, [0x1400b5270]
mov qword [rbp - 0x48], rax
mov qword [rbp - 8], 0
mov qword [rbp - 0x50], 0x13
mov rax, qword [rbp - 8]
cmp rax, qword [rbp + 0x18]
jge 0x140017034
mov qword [rbp - 0x50], 0xb60
lea rax, [0x1400b4af8]
mov qword [rbp - 0x48], rax
cmp qword [rbp - 8], 0
js 0x140016f98
mov rax, qword [rbp - 8]
cmp rax, qword [rbp + 0x18]
jl 0x140016fb1
mov rax, qword [rbp + 0x18]
lea rdx, [rax - 1]
mov rax, qword [rbp - 8]
mov rcx, rax
call sym.raiseIndexError2
jmp 0x1400170c5
mov rax, qword [rbp - 8]
shl rax, 4
mov rdx, rax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x50], 0xb77
mov ecx, 1
mov rax, qword [sym.__acrt_iob_func]
call rax
mov rcx, rax
mov rax, qword [rbp - 0x18]
mov rdx, qword [rax + 8]
mov rax, qword [rax]
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], rdx
lea rax, [rbp - 0x70]
mov r8d, 0
mov rdx, rax
call sym.writeWindows__system_u9091
mov rax, qword [rbp - 0x10]
movzx eax, byte [rax]
movzx eax, al
test eax, eax
jne 0x1400170c4
mov qword [rbp - 0x50], 0xd
lea rax, [0x1400b5270]
mov qword [rbp - 0x48], rax
add qword [rbp - 8], 1
jmp 0x140016f66
nop
mov qword [rbp - 0x50], 0xb7b
lea rax, [0x1400b4af8]
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x20], 0
mov ecx, 1
mov rax, qword [sym.__acrt_iob_func]
call rax
mov r9, rax
mov r8d, 1
mov edx, 1
lea rax, [0x1400b4ae9]
mov rcx, rax
call sym.fwrite
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x50], 0xb7c
mov dword [rbp - 0x24], 0
mov ecx, 1
mov rax, qword [sym.__acrt_iob_func]
call rax
mov rcx, rax
call sym.fflush
mov dword [rbp - 0x24], eax
mov qword [rbp - 0x50], 0xb80
lea rax, [0x1400d8180]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x1400170c5
nop
call sym.popFrame_7
nop
add rsp, 0x90
pop rbp
ret
Function at 0x140003af0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x47], 0
mov r8, rcx
je 0x140003b78
mov r9, 0xfffffffffffffffe
lea rax, [rcx + 2]
sub r9, rcx
nop word [rax + rax]
lea edx, [rax + r9]
xor byte [rax + 7], dl
lea ecx, [rdx - 9]
xor byte [rax - 2], cl
lea rax, [rax + 0xe]
lea ecx, [rdx - 8]
xor byte [rax - 0xf], cl
lea ecx, [rdx - 7]
xor byte [rax - 0xe], cl
lea ecx, [rdx - 6]
xor byte [rax - 0xd], cl
lea ecx, [rdx - 5]
xor byte [rax - 0xc], cl
lea ecx, [rdx - 4]
xor byte [rax - 0xb], cl
lea ecx, [rdx - 3]
xor byte [rax - 0xa], cl
lea ecx, [rdx - 2]
xor byte [rax - 9], cl
lea ecx, [rdx - 1]
xor byte [rax - 8], cl
lea ecx, [rdx + 1]
xor byte [rax - 6], cl
lea ecx, [rdx + 2]
xor byte [rax - 5], cl
lea ecx, [rdx + 3]
xor byte [rax - 4], cl
add dl, 4
xor byte [rax - 3], dl
lea rcx, [r9 + rax]
cmp rcx, 0x46
jb 0x140003b10
mov byte [r8 + 0x47], 0
mov rax, r8
ret

Function at 0x140003f10
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x136], 0
je 0x140003f38
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 9]
xor byte [rcx + rax], dl
inc rax
cmp rax, 0x135
jb 0x140003f20
mov byte [rcx + 0x136], 0
mov rax, rcx
ret
Function at 0x14001bd50
Capabilities:
Resolve function by fnv-1a hash

Disassembly:
push rsi
push rdi
sub rsp, 0x88
mov rax, qword [0x14009b180]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov dword [rsp + 0x24], 0
mov dword [rsp + 0x28], 0x3285501
lea rcx, [rsp + 0x40]
call fcn.1400204c0
nop
lea rax, [rsp + 0x50]
mov rcx, qword [rsp + 0x40]
mov rdi, rax
lea rsi, [rcx + 0x58]
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
movzx eax, word [rsp + 0x50]
sub eax, 8
mov word [rsp + 0x50], ax
cmp dword [rsp + 0x24], 0
je 0x14001bdc4
lea rcx, [rsp + 0x50]
call fcn.1400277a0
cmp eax, dword [rsp + 0x24]
jne 0x14001be91
mov rax, qword [rsp + 0x40]
mov rdx, qword [rax + 0x30]
lea rcx, [rsp + 0x60]
call fcn.140020140
nop
lea rcx, [rsp + 0x60]
call fcn.1400211b0
movzx eax, al
test eax, eax
je 0x14001be91
lea rcx, [rsp + 0x60]
call fcn.140029af0
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x2c], eax
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x2c], 0
je 0x14001be91
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x60]
call fcn.140027fe0
mov rcx, rax
call fcn.14001e960
cmp eax, dword [rsp + 0x28]
jne 0x14001be8c
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x60]
call fcn.140024c40
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x60]
call fcn.140027b30
movzx eax, al
test eax, eax
je 0x14001be85
mov rcx, qword [rsp + 0x30]
call fcn.140027820
mov qword [rsp + 0x38], rax
mov eax, dword [rsp + 0x3c]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x38]
mov dword [rsp + 0x24], eax
lea rcx, [rsp + 0x40]
call fcn.140028f80
nop
jmp 0x14001be91
mov rax, qword [rsp + 0x30]
jmp 0x14001bea8
jmp 0x14001bdfb
lea rcx, [rsp + 0x40]
call fcn.140028020
movzx eax, al
test eax, eax
jne 0x14001bd84
xor eax, eax
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140079450
add rsp, 0x88
pop rdi
pop rsi
ret
Function at 0x14001c310
Capabilities:
Resolve function by fnv-1a hash

Disassembly:
push rsi
push rdi
sub rsp, 0x88
mov rax, qword [0x14009b180]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov dword [rsp + 0x24], 0
mov dword [rsp + 0x28], 0x53b2070f
lea rcx, [rsp + 0x40]
call fcn.1400204c0
nop
lea rax, [rsp + 0x50]
mov rcx, qword [rsp + 0x40]
mov rdi, rax
lea rsi, [rcx + 0x58]
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
movzx eax, word [rsp + 0x50]
sub eax, 8
mov word [rsp + 0x50], ax
cmp dword [rsp + 0x24], 0
je 0x14001c384
lea rcx, [rsp + 0x50]
call fcn.1400277a0
cmp eax, dword [rsp + 0x24]
jne 0x14001c451
mov rax, qword [rsp + 0x40]
mov rdx, qword [rax + 0x30]
lea rcx, [rsp + 0x60]
call fcn.140020140
nop
lea rcx, [rsp + 0x60]
call fcn.1400211b0
movzx eax, al
test eax, eax
je 0x14001c451
lea rcx, [rsp + 0x60]
call fcn.140029af0
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x2c], eax
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x2c], 0
je 0x14001c451
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x60]
call fcn.140027fe0
mov rcx, rax
call fcn.14001e960
cmp eax, dword [rsp + 0x28]
jne 0x14001c44c
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x60]
call fcn.140024c40
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x60]
call fcn.140027b30
movzx eax, al
test eax, eax
je 0x14001c445
mov rcx, qword [rsp + 0x30]
call fcn.140027820
mov qword [rsp + 0x38], rax
mov eax, dword [rsp + 0x3c]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x38]
mov dword [rsp + 0x24], eax
lea rcx, [rsp + 0x40]
call fcn.140028f80
nop
jmp 0x14001c451
mov rax, qword [rsp + 0x30]
jmp 0x14001c468
jmp 0x14001c3bb
lea rcx, [rsp + 0x40]
call fcn.140028020
movzx eax, al
test eax, eax
jne 0x14001c344
xor eax, eax
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140079450
add rsp, 0x88
pop rdi
pop rsi
ret
Function at 0x14001c5f0
Capabilities:
Resolve function by fnv-1a hash

Disassembly:
push rsi
push rdi
sub rsp, 0x88
mov rax, qword [0x14009b180]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov dword [rsp + 0x24], 0
mov dword [rsp + 0x28], 0x820621f3
lea rcx, [rsp + 0x40]
call fcn.1400204c0
nop
lea rax, [rsp + 0x50]
mov rcx, qword [rsp + 0x40]
mov rdi, rax
lea rsi, [rcx + 0x58]
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
movzx eax, word [rsp + 0x50]
sub eax, 8
mov word [rsp + 0x50], ax
cmp dword [rsp + 0x24], 0
je 0x14001c664
lea rcx, [rsp + 0x50]
call fcn.1400277a0
cmp eax, dword [rsp + 0x24]
jne 0x14001c731
mov rax, qword [rsp + 0x40]
mov rdx, qword [rax + 0x30]
lea rcx, [rsp + 0x60]
call fcn.140020140
nop
lea rcx, [rsp + 0x60]
call fcn.1400211b0
movzx eax, al
test eax, eax
je 0x14001c731
lea rcx, [rsp + 0x60]
call fcn.140029af0
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x2c], eax
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x2c], 0
je 0x14001c731
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x60]
call fcn.140027fe0
mov rcx, rax
call fcn.14001e960
cmp eax, dword [rsp + 0x28]
jne 0x14001c72c
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x60]
call fcn.140024c40
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x60]
call fcn.140027b30
movzx eax, al
test eax, eax
je 0x14001c725
mov rcx, qword [rsp + 0x30]
call fcn.140027820
mov qword [rsp + 0x38], rax
mov eax, dword [rsp + 0x3c]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x38]
mov dword [rsp + 0x24], eax
lea rcx, [rsp + 0x40]
call fcn.140028f80
nop
jmp 0x14001c731
mov rax, qword [rsp + 0x30]
jmp 0x14001c748
jmp 0x14001c69b
lea rcx, [rsp + 0x40]
call fcn.140028020
movzx eax, al
test eax, eax
jne 0x14001c624
xor eax, eax
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140079450
add rsp, 0x88
pop rdi
pop rsi
ret
Function at 0x14001cd20
Capabilities:
Resolve function by fnv-1a hash

Disassembly:
push rsi
push rdi
sub rsp, 0x88
mov rax, qword [0x14009b180]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov dword [rsp + 0x24], 0
mov dword [rsp + 0x28], 0xbdcac9ce
lea rcx, [rsp + 0x40]
call fcn.1400204c0
nop
lea rax, [rsp + 0x50]
mov rcx, qword [rsp + 0x40]
mov rdi, rax
lea rsi, [rcx + 0x58]
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
movzx eax, word [rsp + 0x50]
sub eax, 8
mov word [rsp + 0x50], ax
cmp dword [rsp + 0x24], 0
je 0x14001cd94
lea rcx, [rsp + 0x50]
call fcn.1400277a0
cmp eax, dword [rsp + 0x24]
jne 0x14001ce61
mov rax, qword [rsp + 0x40]
mov rdx, qword [rax + 0x30]
lea rcx, [rsp + 0x60]
call fcn.140020140
nop
lea rcx, [rsp + 0x60]
call fcn.1400211b0
movzx eax, al
test eax, eax
je 0x14001ce61
lea rcx, [rsp + 0x60]
call fcn.140029af0
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x2c], eax
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x2c], 0
je 0x14001ce61
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x60]
call fcn.140027fe0
mov rcx, rax
call fcn.14001e960
cmp eax, dword [rsp + 0x28]
jne 0x14001ce5c
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x60]
call fcn.140024c40
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x60]
call fcn.140027b30
movzx eax, al
test eax, eax
je 0x14001ce55
mov rcx, qword [rsp + 0x30]
call fcn.140027820
mov qword [rsp + 0x38], rax
mov eax, dword [rsp + 0x3c]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x38]
mov dword [rsp + 0x24], eax
lea rcx, [rsp + 0x40]
call fcn.140028f80
nop
jmp 0x14001ce61
mov rax, qword [rsp + 0x30]
jmp 0x14001ce78
jmp 0x14001cdcb
lea rcx, [rsp + 0x40]
call fcn.140028020
movzx eax, al
test eax, eax
jne 0x14001cd54
xor eax, eax
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140079450
add rsp, 0x88
pop rdi
pop rsi
ret