joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400b2190
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0x350]
sub rsp, 0x450
mov rax, qword [0x1401d4770]
xor rax, rsp
mov qword [rbp + 0x340], rax
call fcn.14010bd18
mov ebx, eax
test eax, eax
je 0x1400b234a
cmp dword [reloc.WS2_32.dll_closesocket], 1
jl 0x1400b23bc
mov edx, 2
lea rcx, [rsp + 0x20]
call fcn.1400269f0
nop
movsxd rcx, dword [rsp + 0x20]
lea r8d, [rcx + 7]
mov edx, dword [rsp + 0x30]
cmp r8d, edx
jle 0x1400b2201
mov eax, dword [rsp + 0x34]
add eax, 7
mov dword [rsp + 0x34], eax
jmp 0x1400b2236
mov rdx, rcx
add rdx, qword [rsp + 0x28]
mov eax, dword [str.e_0_90m]
mov dword [rdx], eax
movzx eax, word [0x1401a8b6c]
mov word [rdx + 4], ax
movzx eax, byte [0x1401a8b6e]
mov byte [rdx + 6], al
mov dword [rsp + 0x20], r8d
mov ecx, r8d
mov eax, dword [rsp + 0x34]
mov edx, dword [rsp + 0x30]
lea r8d, [rcx + 5]
cmp r8d, edx
jle 0x1400b2248
add eax, 5
mov dword [rsp + 0x34], eax
jmp 0x1400b2272
movsxd rdx, ecx
add rdx, qword [rsp + 0x28]
mov eax, dword [str.Util]
mov dword [rdx], eax
movzx eax, byte [0x1401a43fc]
mov byte [rdx + 4], al
mov dword [rsp + 0x20], r8d
mov ecx, r8d
mov eax, dword [rsp + 0x34]
mov edx, dword [rsp + 0x30]
lea r8d, [rcx + 7]
cmp r8d, edx
jle 0x1400b2284
add eax, 7
mov dword [rsp + 0x34], eax
jmp 0x1400b22ae
movsxd rdx, ecx
add rdx, qword [rsp + 0x28]
mov eax, dword [str.e_0_31m]
mov dword [rdx], eax
movzx eax, word [0x1401a8b64]
mov word [rdx + 4], ax
movzx eax, byte [0x1401a8b66]
mov byte [rdx + 6], al
mov dword [rsp + 0x20], r8d
mov ecx, ebx
call fcn.14010c5b8
mov r9, rax
movsxd rdx, dword [rsp + 0x20]
lea r10d, [rdx + 0x1f]
mov r8d, dword [rsp + 0x30]
cmp r10d, r8d
jle 0x1400b22d8
mov ecx, dword [rsp + 0x34]
add ecx, 0x1f
mov dword [rsp + 0x34], ecx
jmp 0x1400b2323
add rdx, qword [rsp + 0x28]
movups xmm0, xmmword [str.failed_to_create_rwlock__error]
movups xmmword [rdx], xmm0
movsd xmm1, qword [0x1401b27b0]
movsd qword [rdx + 0x10], xmm1
mov eax, dword [0x1401b27b8]
mov dword [rdx + 0x18], eax
movzx eax, word [0x1401b27bc]
mov word [rdx + 0x1c], ax
movzx eax, byte [0x1401b27be]
mov byte [rdx + 0x1e], al
mov dword [rsp + 0x20], r10d
mov edx, r10d
mov ecx, dword [rsp + 0x34]
mov r8d, dword [rsp + 0x30]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp byte [r9 + rax], 0
jne 0x1400b2330
lea ebx, [rdx + rax]
cmp ebx, r8d
jle 0x1400b236a
add ecx, eax
mov dword [rsp + 0x34], ecx
jmp 0x1400b238c
mov rcx, qword [rbp + 0x340]
xor rcx, rsp
call fcn.140140c60
mov rbx, qword [rsp + 0x468]
add rsp, 0x450
pop rbp
ret
movsxd r8, eax
movsxd rcx, edx
add rcx, qword [rsp + 0x28]
mov rdx, r9
call fcn.140145200
mov dword [rsp + 0x20], ebx
mov edx, ebx
mov ecx, dword [rsp + 0x34]
mov r8d, dword [rsp + 0x30]
lea r9d, [rdx + 4]
cmp r9d, r8d
jle 0x1400b239e
add ecx, 4
mov dword [rsp + 0x34], ecx
jmp 0x1400b23b2
movsxd rcx, edx
mov rax, qword [rsp + 0x28]
mov dword [rcx + rax], 0x6d305b1b
mov dword [rsp + 0x20], r9d
lea rcx, [rsp + 0x20]
call fcn.140026c70
lea rcx, str.D:_ap2poolp2pool_srcutil.cpp:311
call fcn.1400b18e0
int3
Function at 0x1400b23d0
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
lea rbp, [rsp - 0x350]
sub rsp, 0x450
mov rax, qword [0x1401d4770]
xor rax, rsp
mov qword [rbp + 0x340], rax
call fcn.14010d2a0
mov ebx, eax
test eax, eax
je 0x1400b256f
cmp dword [reloc.WS2_32.dll_closesocket], 1
jl 0x1400b25e1
mov edx, 2
lea rcx, [rsp + 0x20]
call fcn.1400269f0
nop
movsxd rcx, dword [rsp + 0x20]
lea r8d, [rcx + 7]
mov edx, dword [rsp + 0x30]
cmp r8d, edx
jle 0x1400b2441
mov eax, dword [rsp + 0x34]
add eax, 7
mov dword [rsp + 0x34], eax
jmp 0x1400b2476
mov rdx, rcx
add rdx, qword [rsp + 0x28]
mov eax, dword [str.e_0_90m]
mov dword [rdx], eax
movzx eax, word [0x1401a8b6c]
mov word [rdx + 4], ax
movzx eax, byte [0x1401a8b6e]
mov byte [rdx + 6], al
mov dword [rsp + 0x20], r8d
mov ecx, r8d
mov eax, dword [rsp + 0x34]
mov edx, dword [rsp + 0x30]
lea r8d, [rcx + 5]
cmp r8d, edx
jle 0x1400b2488
add eax, 5
mov dword [rsp + 0x34], eax
jmp 0x1400b24b2
movsxd rdx, ecx
add rdx, qword [rsp + 0x28]
mov eax, dword [str.Util]
mov dword [rdx], eax
movzx eax, byte [0x1401a43fc]
mov byte [rdx + 4], al
mov dword [rsp + 0x20], r8d
mov ecx, r8d
mov eax, dword [rsp + 0x34]
mov edx, dword [rsp + 0x30]
lea r8d, [rcx + 7]
cmp r8d, edx
jle 0x1400b24c4
add eax, 7
mov dword [rsp + 0x34], eax
jmp 0x1400b24ee
movsxd rdx, ecx
add rdx, qword [rsp + 0x28]
mov eax, dword [str.e_0_31m]
mov dword [rdx], eax
movzx eax, word [0x1401a8b64]
mov word [rdx + 4], ax
movzx eax, byte [0x1401a8b66]
mov byte [rdx + 6], al
mov dword [rsp + 0x20], r8d
mov ecx, ebx
call fcn.14010c5b8
mov r9, rax
movsxd rdx, dword [rsp + 0x20]
lea r10d, [rdx + 0x1c]
mov r8d, dword [rsp + 0x30]
cmp r10d, r8d
jle 0x1400b2518
mov ecx, dword [rsp + 0x34]
add ecx, 0x1c
mov dword [rsp + 0x34], ecx
jmp 0x1400b254e
add rdx, qword [rsp + 0x28]
movups xmm0, xmmword [str.uv_async_init_failed__error]
movups xmmword [rdx], xmm0
movsd xmm1, qword [0x1401a9828]
movsd qword [rdx + 0x10], xmm1
mov eax, dword [0x1401a9830]
mov dword [rdx + 0x18], eax
mov dword [rsp + 0x20], r10d
mov edx, r10d
mov ecx, dword [rsp + 0x34]
mov r8d, dword [rsp + 0x30]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [r9 + rax], 0
jne 0x1400b2555
lea ebx, [rdx + rax]
cmp ebx, r8d
jle 0x1400b258f
add ecx, eax
mov dword [rsp + 0x34], ecx
jmp 0x1400b25b1
mov rcx, qword [rbp + 0x340]
xor rcx, rsp
call fcn.140140c60
mov rbx, qword [rsp + 0x478]
add rsp, 0x450
pop rbp
ret
movsxd r8, eax
movsxd rcx, edx
add rcx, qword [rsp + 0x28]
mov rdx, r9
call fcn.140145200
mov dword [rsp + 0x20], ebx
mov edx, ebx
mov ecx, dword [rsp + 0x34]
mov r8d, dword [rsp + 0x30]
lea r9d, [rdx + 4]
cmp r9d, r8d
jle 0x1400b25c3
add ecx, 4
mov dword [rsp + 0x34], ecx
jmp 0x1400b25d7
movsxd rcx, edx
mov rax, qword [rsp + 0x28]
mov dword [rcx + rax], 0x6d305b1b
mov dword [rsp + 0x20], r9d
lea rcx, [rsp + 0x20]
call fcn.140026c70
lea rcx, str.D:_ap2poolp2pool_srcutil.cpp:320
call fcn.1400b18e0
int3
Function at 0x1400c10d0
Capabilities:
Encode data using xor

Disassembly:
mov r9, qword [rcx + 0x9e8]
mov ecx, 8
add r9, rdx
sub r9, r8
mov rax, qword [r9 + r8]
xor qword [r8], rax
lea r8, [r8 + 8]
sub rcx, 1
jne 0x1400c10e2
ret

Function at 0x1400c1450
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
lea r8, [rcx + 0x40]
mov rbx, rcx
mov rcx, rdx
call fcn.1400c9c64
mov rcx, rbx
call fcn.1400c2340
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x1400c110c

Function at 0x1400c1724
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1401d4770]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r15, rcx
lea r9, [r8 + 1]
movabs rax, 0x5851f42d4c957f2d
movabs rcx, 0x810a978a59f5a1fc
imul r9, rax
mov rbx, r8
mov rdi, rdx
mov qword [rbp - 0x50], r9
lea rsi, [r15 + 0x28]
mov rax, r9
mov r14d, 8
xor rax, rcx
movabs rcx, 0xa77099df38c2d846
mov qword [rbp - 0x48], rax
mov rax, r9
xor rax, rcx
movabs rcx, 0x8126b91cbf22495c
mov qword [rbp - 0x40], rax
mov rax, r9
xor rax, rcx
movabs rcx, 0x494d2597179f8a62
mov qword [rbp - 0x38], rax
mov rax, r9
xor rax, rcx
movabs rcx, 0x9237efb9ceaaec0c
mov qword [rbp - 0x30], rax
mov rax, r9
xor rax, rcx
movabs rcx, 0x2f2a56746ce62d78
mov qword [rbp - 0x28], rax
mov rax, r9
xor rax, rcx
mov qword [rbp - 0x20], rax
movabs rax, 0x84853bf7b62ce54e
xor r9, rax
mov qword [rbp - 0x18], r9
and ebx, 0x3fffff
shl rbx, 6
add rbx, qword [r15]
prefetchnta byte [rbx]
lea r8, [r15 + 0x8368]
mov rdx, rsi
lea rcx, [rbp - 0x50]
call fcn.1400c8a28
xor edx, edx
lea r8, [rbp - 0x50]
lea eax, [rdx*8]
inc edx
mov rax, qword [rax + rbx]
xor qword [r8], rax
lea r8, [r8 + 8]
cmp edx, 8
jb 0x1400c1826
movsxd rax, dword [rsi + 0x1004]
add rsi, 0x1068
mov rbx, qword [rbp + rax*8 - 0x50]
sub r14, 1
jne 0x1400c17fd
movaps xmm0, xmmword [rbp - 0x50]
movaps xmm1, xmmword [rbp - 0x40]
movups xmmword [rdi], xmm0
movaps xmm0, xmmword [rbp - 0x30]
movups xmmword [rdi + 0x10], xmm1
movaps xmm1, xmmword [rbp - 0x20]
movups xmmword [rdi + 0x20], xmm0
movups xmmword [rdi + 0x30], xmm1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140140c60
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret

Function at 0x1400c2560
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push rbx
sub rsp, 0x40
cmp qword [rcx + 0x9f8], 0
mov rbx, rcx
je 0x1400c259f
movdqa xmm0, xmmword [0x1404672e0]
mov ecx, 0x200000
aesenc xmm0, xmm0
movdqa xmmword [0x1404672e0], xmm0
call fcn.1400c2aac
mov qword [rbx + 0x9f0], rax
add rsp, 0x40
pop rbx
ret
lea rdx, str.Cache_Dataset_not_set
lea rcx, [rsp + 0x20]
call fcn.1400c2244
lea rdx, [0x1401d2228]
lea rcx, [rsp + 0x20]
call fcn.140145880
int3
Function at 0x1400c25d0
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
mov r8, qword [rcx + 0x9f0]
mov rcx, rdx
jmp 0x1400c993c
movdqu xmm0, xmmword [rcx]
lea rdx, [r8 + 0x200000]
movdqu xmm1, xmmword [rcx + 0x10]
movdqu xmm2, xmmword [rcx + 0x20]
movdqu xmm3, xmmword [rcx + 0x30]
cmp r8, rdx
je 0x1400c99a7
add r8, 0x20
aesdec xmm0, xmmword [0x1401b4190]
aesenc xmm1, xmmword [0x1401b4050]
aesdec xmm2, xmmword [0x1401b40d0]
aesenc xmm3, xmmword [0x1401b40e0]
movdqu xmmword [r8 - 0x20], xmm0
movdqu xmmword [r8 - 0x10], xmm1
movdqu xmmword [r8], xmm2
movdqu xmmword [r8 + 0x10], xmm3
lea r8, [r8 + 0x40]
lea rax, [r8 - 0x20]
cmp rax, rdx
jne 0x1400c995f
movdqu xmmword [rcx], xmm0
movdqu xmmword [rcx + 0x10], xmm1
movdqu xmmword [rcx + 0x20], xmm2
movdqu xmmword [rcx + 0x30], xmm3
ret

Function at 0x1400c27f0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push rbx
sub rsp, 0x40
cmp qword [rcx + 0x9f8], 0
mov rbx, rcx
je 0x1400c282f
movdqa xmm0, xmmword [0x1404672e0]
mov ecx, 0x200000
aesenc xmm0, xmm0
movdqa xmmword [0x1404672e0], xmm0
call fcn.1400c295c
mov qword [rbx + 0x9f0], rax
add rsp, 0x40
pop rbx
ret
lea rdx, str.Cache_Dataset_not_set
lea rcx, [rsp + 0x20]
call fcn.1400c2244
lea rdx, [0x1401d2228]
lea rcx, [rsp + 0x20]
call fcn.140145880
int3

Function at 0x1400c2ae0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x70
mov rax, qword [0x1401d4770]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rcx, qword [rcx + 0x9f8]
mov rbx, r8
shr rdx, 6
mov r8d, edx
lea rdx, [rsp + 0x20]
call fcn.1400c1724
lea rdx, [rsp + 0x20]
mov ecx, 8
sub rdx, rbx
mov rax, qword [rdx + rbx]
xor qword [rbx], rax
lea rbx, [rbx + 8]
sub rcx, 1
jne 0x1400c2b1d
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140140c60
add rsp, 0x70
pop rbx
ret

Function at 0x1400c2bc0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x40
mov rbx, rcx
and qword [rcx], 0
and qword [rcx + 8], 0
and qword [rcx + 0x10], 0
mov edx, 0x13000
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbx + 0x38], rax
test rax, rax
je 0x1400c2c39
movsxd r8, dword [0x140467128]
lea rdx, [0x140475040]
mov rcx, rax
call fcn.140145200
movsxd r8, dword [0x140467134]
movsxd rcx, dword [0x140467150]
add rcx, qword [rbx + 0x38]
lea rdx, [0x140475380]
call fcn.140145200
nop
mov rax, rbx
add rsp, 0x40
pop rbx
ret
lea rdx, str.allocMemoryPages
lea rcx, [rsp + 0x20]
call fcn.1400097e0
lea rdx, [0x1401d1ff8]
lea rcx, [rsp + 0x20]
call fcn.140145880
int3

Function at 0x1400c2ccc
Capabilities:
Allocate or change rwx memory

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx + 0x38]
lea r9, [rsp + 0x30]
mov edx, 0x13000
mov r8d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1400c2cf4
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x28
ret
Function at 0x1400c5c34
Capabilities:
Encode data using xor
Hash data using sha512

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1401d4770]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, rcx
mov rdi, rdx
xor ecx, ecx
test rbx, rbx
jne 0x1400c5c6a
or rax, 0xffffffffffffffff
jmp 0x1400c5d26
lea rax, [rdx - 1]
cmp rax, 0x3f
ja 0x1400c5d12
xor eax, eax
mov dword [rbp - 0x4c], ecx
xorps xmm0, xmm0
mov qword [rbp - 0x48], rcx
mov word [rbp - 0x40], cx
xor edx, edx
mov rcx, rbx
mov qword [rbp - 0x1e], rax
mov r8d, 0xf0
mov dword [rbp - 0x16], eax
movups xmmword [rbp - 0x3e], xmm0
mov word [rbp - 0x12], ax
movups xmmword [rbp - 0x2e], xmm0
mov byte [rbp - 0x50], dil
mov word [rbp - 0x4f], 0x100
mov byte [rbp - 0x4d], 1
call fcn.140145ba0
movaps xmm0, xmmword [0x1401a5060]
lea r8, [rbp - 0x50]
movups xmmword [rbx], xmm0
mov rcx, rbx
sub r8, rbx
movaps xmm1, xmmword [0x1401a5070]
mov edx, 8
movups xmmword [rbx + 0x10], xmm1
movaps xmm0, xmmword [0x1401a5080]
movups xmmword [rbx + 0x20], xmm0
movaps xmm1, xmmword [0x1401a5090]
movups xmmword [rbx + 0x30], xmm1
mov rax, qword [r8 + rcx]
xor qword [rcx], rax
lea rcx, [rcx + 8]
sub rdx, 1
jne 0x1400c5cf3
movzx eax, dil
mov dword [rbx + 0xe4], eax
xor eax, eax
jmp 0x1400c5d26
or rax, 0xffffffffffffffff
cmp byte [rbx + 0xe8], cl
je 0x1400c5d22
mov qword [rbx + 0x58], rax
mov qword [rbx + 0x50], rax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140140c60
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x1400c9520
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
movdqa xmm2, xmmword [0x1401b41b0]
lea rdx, [rcx + 0x200000]
movdqa xmm3, xmmword [0x1401b4170]
movdqa xmm4, xmmword [0x1401b41d0]
movdqa xmm5, xmmword [0x1401b4100]
cmp rcx, rdx
je 0x1400c9574
add rcx, 0x20
aesenc xmm2, xmmword [rcx - 0x20]
aesdec xmm3, xmmword [rcx - 0x10]
aesenc xmm4, xmmword [rcx]
aesdec xmm5, xmmword [rcx + 0x10]
lea rcx, [rcx + 0x40]
lea rax, [rcx - 0x20]
cmp rax, rdx
jne 0x1400c9550
movdqa xmm0, xmmword [0x1401b4020]
movdqa xmm1, xmmword [0x1401b41e0]
aesenc xmm2, xmm0
aesdec xmm3, xmm0
aesenc xmm4, xmm0
aesdec xmm5, xmm0
aesenc xmm2, xmm1
aesdec xmm3, xmm1
aesenc xmm4, xmm1
aesdec xmm5, xmm1
movdqu xmmword [r8], xmm2
movdqu xmmword [r8 + 0x10], xmm3
movdqu xmmword [r8 + 0x20], xmm4
movdqu xmmword [r8 + 0x30], xmm5
ret

Function at 0x1400c9c64
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
movdqa xmm4, xmmword [0x1401b4150]
lea rdx, [r8 + 0x880]
movdqa xmm5, xmmword [0x1401b4160]
movdqu xmm0, xmmword [rcx]
movdqu xmm1, xmmword [rcx + 0x10]
movdqu xmm2, xmmword [rcx + 0x20]
movdqu xmm3, xmmword [rcx + 0x30]
cmp r8, rdx
je 0x1400c9d43
add r8, 0x20
aesdec xmm2, xmmword [0x1401b4070]
aesenc xmm3, xmmword [0x1401b4070]
aesdec xmm2, xmmword [0x1401b4180]
aesenc xmm3, xmmword [0x1401b4180]
aesdec xmm2, xmmword [0x1401b41f0]
aesenc xmm3, xmmword [0x1401b41f0]
aesdec xmm2, xmmword [0x1401b41a0]
aesenc xmm3, xmmword [0x1401b41a0]
aesdec xmm0, xmm4
aesenc xmm1, xmm4
aesdec xmm0, xmm5
aesdec xmm0, xmmword [0x1401b4060]
aesdec xmm0, xmmword [0x1401b41c0]
aesenc xmm1, xmm5
aesenc xmm1, xmmword [0x1401b4060]
aesenc xmm1, xmmword [0x1401b41c0]
movdqu xmmword [r8 - 0x20], xmm0
movdqu xmmword [r8 - 0x10], xmm1
movdqu xmmword [r8], xmm2
movdqu xmmword [r8 + 0x10], xmm3
lea r8, [r8 + 0x40]
lea rax, [r8 - 0x20]
cmp rax, rdx
jne 0x1400c9c9b
ret
Function at 0x1400c9d44
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 0x28
movdqa xmm2, xmmword [0x1401b41b0]
lea rdx, [rcx + 0x1000]
movdqa xmm3, xmmword [0x1401b4170]
mov r10, rcx
movdqa xmm4, xmmword [0x1401b41d0]
mov rax, rcx
movdqa xmm5, xmmword [0x1401b4100]
add rcx, 0x1ff000
movdqu xmm0, xmmword [r9]
mov r11d, 2
movdqu xmm1, xmmword [r9 + 0x10]
movaps xmmword [rsp + 0x10], xmm6
movdqu xmm6, xmmword [r9 + 0x20]
movaps xmmword [rsp], xmm7
movdqu xmm7, xmmword [r9 + 0x30]
cmp rax, rcx
jae 0x1400c9e05
sub rdx, rax
aesenc xmm2, xmmword [rax]
aesdec xmm3, xmmword [rax + 0x10]
aesenc xmm4, xmmword [rax + 0x20]
aesdec xmm5, xmmword [rax + 0x30]
aesdec xmm0, xmmword [0x1401b4190]
aesenc xmm1, xmmword [0x1401b4050]
aesdec xmm6, xmmword [0x1401b40d0]
aesenc xmm7, xmmword [0x1401b40e0]
movdqu xmmword [rax], xmm0
movdqu xmmword [rax + 0x10], xmm1
movdqu xmmword [rax + 0x20], xmm6
movdqu xmmword [rax + 0x30], xmm7
prefetcht0 byte [rdx + rax]
add rax, 0x40
cmp rax, rcx
jb 0x1400c9daa
add rcx, 0x1000
mov rdx, r10
sub r11, 1
jne 0x1400c9da2
movdqu xmmword [r9], xmm0
movdqa xmm0, xmmword [0x1401b4020]
movdqu xmmword [r9 + 0x10], xmm1
movdqa xmm1, xmmword [0x1401b41e0]
movdqu xmmword [r9 + 0x20], xmm6
movaps xmm6, xmmword [rsp + 0x10]
movdqu xmmword [r9 + 0x30], xmm7
movaps xmm7, xmmword [rsp]
aesenc xmm2, xmm0
aesdec xmm3, xmm0
aesenc xmm4, xmm0
aesdec xmm5, xmm0
aesenc xmm2, xmm1
aesdec xmm3, xmm1
aesenc xmm4, xmm1
aesdec xmm5, xmm1
movdqu xmmword [r8], xmm2
movdqu xmmword [r8 + 0x10], xmm3
movdqu xmmword [r8 + 0x20], xmm4
movdqu xmmword [r8 + 0x30], xmm5
add rsp, 0x28
ret

Function at 0x1400cc0a8
Capabilities:
Send data
Send data on socket

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
movsxd rbx, dword [rsp + 0x60]
mov r12, rcx
movsxd rsi, r8d
mov r14, r9
mov r15, rdx
lea ebp, [rsi + rbx]
movsxd rcx, ebp
call fcn.1401515b0
mov rdi, rax
test rax, rax
jne 0x1400cc0ee
or eax, 0xffffffff
jmp 0x1400cc158
mov r8, rbx
mov rdx, r14
mov rcx, rdi
call fcn.140145200
mov r8, rsi
lea rcx, [rbx + rdi]
mov rdx, r15
call fcn.140145200
xor r9d, r9d
mov r8d, ebp
mov rdx, rdi
mov rcx, r12
call qword [sym.imp.WS2_32.dll_send]
mov esi, eax
test eax, eax
jns 0x1400cc14e
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, 2
mov ebx, eax
call fcn.14014b850
mov rcx, rax
lea r8, str.send
mov r9d, ebx
lea rdx, str.Socket_error:__s___d_n
call fcn.140024ee0
mov rcx, rdi
call fcn.1401509a0
mov eax, esi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x1400cc268
Capabilities:
Connect socket
Resolve dns

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xc0
mov rax, qword [0x1401d4770]
xor rax, rsp
mov qword [rbp + 0x27], rax
xorps xmm0, xmm0
movzx r9d, dx
movups xmmword [rbp - 0x61], xmm0
and dword [rbp - 0x5d], 0
mov eax, 8
mov r12d, r8d
mov dword [rbp - 0x61], eax
mov r15, rcx
mov dword [rbp - 0x59], 1
mov edx, eax
lea r8, [0x1401b3d6c]
lea rcx, [rbp - 0x31]
movups xmmword [rbp - 0x51], xmm0
movups xmmword [rbp - 0x41], xmm0
call fcn.14002b980
cmp byte [r15], 0x5b
jne 0x1400cc341
xor r14d, r14d
lea rbx, [r15 + 1]
mov al, byte [rbx]
lea edi, [r14 + 1]
test al, al
je 0x1400cc32d
xor esi, esi
cmp al, 0x5d
je 0x1400cc32d
cmp rsi, 0x40
jge 0x1400cc32d
movsxd rcx, edi
lea rdx, [0x1401b3ae8]
add rcx, r15
mov byte [rbp + rsi - 0x29], al
mov r8d, 3
call fcn.14014ae60
test eax, eax
jne 0x1400cc31c
add edi, 2
add rbx, 2
inc rbx
inc r14d
inc rsi
inc edi
mov al, byte [rbx]
test al, al
jne 0x1400cc2eb
movsxd rax, r14d
cmp rax, 0x41
jae 0x1400cc4ae
mov byte [rbp + rax - 0x29], 0
jmp 0x1400cc353
mov r8d, 0x40
lea rcx, [rbp - 0x29]
mov rdx, r15
call fcn.1401556a0
lea r9, [rbp - 0x69]
mov byte [rbp + 0x17], 0
lea r8, [rbp - 0x61]
lea rdx, [rbp - 0x31]
lea rcx, [rbp - 0x29]
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov r14d, eax
test eax, eax
je 0x1400cc399
mov ecx, 2
call fcn.14014b850
mov rcx, rax
lea rdx, str.getaddrinfo___error_:__d_n
mov r8d, r14d
call fcn.140024ee0
or rax, 0xffffffffffffffff
jmp 0x1400cc486
mov rbx, qword [rbp - 0x69]
or rsi, 0xffffffffffffffff
mov rdi, rsi
test rbx, rbx
je 0x1400cc40a
cmp rdi, rsi
je 0x1400cc3b7
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
mov r8d, dword [rbx + 0xc]
mov edx, dword [rbx + 8]
mov ecx, dword [rbx + 4]
call qword [sym.imp.WS2_32.dll_socket]
mov rdi, rax
cmp rax, rsi
je 0x1400cc3fd
mov rax, qword [rbx + 0x20]
mov rdx, rax
cmp word [rax], 0x17
jne 0x1400cc3e9
test r12d, r12d
je 0x1400cc3e9
mov dword [rax + 0x18], r12d
mov rdx, qword [rbx + 0x20]
mov r8d, dword [rbx + 0x10]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_connect]
mov r14d, eax
test eax, eax
jns 0x1400cc406
mov rbx, qword [rbx + 0x28]
test rbx, rbx
jne 0x1400cc3a9
mov rbx, qword [rbp - 0x69]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
cmp rdi, rsi
jne 0x1400cc448
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, 2
mov ebx, eax
call fcn.14014b850
mov rcx, rax
lea r8, str.socket
mov r9d, ebx
lea rdx, str.Socket_error:__s___d_n
call fcn.140024ee0
mov rax, rsi
jmp 0x1400cc486
test r14d, r14d
jns 0x1400cc483
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, 2
mov ebx, eax
call fcn.14014b850
mov rcx, rax
lea r8, str.connect
mov r9d, ebx
lea rdx, str.Socket_error:__s___d_n
call fcn.140024ee0
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
jmp 0x1400cc443
mov rax, rdi
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.140140c60
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
call fcn.140141070
int3
Function at 0x1400ccb48
Capabilities:
Get local ipv4 addresses
Get socket information
Resolve dns
Send data
Send data on socket
Send http request
Send http request with host header

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x8e8
mov rax, qword [0x1401d4770]
xor rax, rsp
mov qword [rsp + 0x8d0], rax
mov rdi, qword [rsp + 0x950]
mov r12, r8
mov r8d, dword [rsp + 0x960]
xor ebx, ebx
mov r13, qword [rsp + 0x968]
mov r15, r9
movzx r14d, dx
mov rbp, rcx
movzx edx, r14w
mov dword [r9], ebx
call fcn.1400cc268
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x1400cccaf
test rdi, rdi
je 0x1400ccc2b
lea r8, [rsp + 0x40]
mov dword [rsp + 0x40], 0x80
lea rdx, [rsp + 0x50]
mov rcx, rax
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jns 0x1400ccbe0
lea rcx, str.getsockname
call fcn.14015c558
jmp 0x1400ccc2b
mov edx, dword [rsp + 0x40]
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x30], 0xa
mov r9d, 0x28
mov dword [rsp + 0x28], ebx
mov r8, rdi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.WS2_32.dll_getnameinfo]
mov edi, eax
test eax, eax
je 0x1400ccc2b
mov ecx, 2
call fcn.14014b850
mov rcx, rax
lea rdx, str.getnameinfo___failed_:__d_n
mov r8d, edi
call fcn.140024ee0
mov dword [rsp + 0x30], r14d
lea rax, [0x1401b3a64]
mov edi, 0x800
mov qword [rsp + 0x28], rbp
mov edx, edi
mov qword [rsp + 0x20], rax
mov r9, r12
lea r8, str.GET__s_HTTP__s_r_nHost:__s:_d_r_nConnection:_Close_r_nUser_Agent:_Windows_UPnP_1.1_MiniUPnPc__r_n_r_n
lea rcx, [rsp + 0xd0]
call fcn.14002b980
mov ebp, eax
cmp eax, edi
jae 0x1400ccca6
mov edi, ebx
test eax, eax
jle 0x1400ccc95
mov r8d, ebp
movsxd rax, edi
lea rdx, [rsp + 0xd0]
sub r8d, edi
add rdx, rax
xor r9d, r9d
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
js 0x1400cccd6
add edi, eax
cmp edi, ebp
jl 0x1400ccc6b
mov r8, r13
mov rdx, r15
mov rcx, rsi
call fcn.1400cc4b4
mov rbx, rax
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_closesocket]
mov rax, rbx
mov rcx, qword [rsp + 0x8d0]
xor rcx, rsp
call fcn.140140c60
add rsp, 0x8e8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
lea rcx, str.send
call fcn.14015c558
jmp 0x1400ccca6