joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140035f80
Capabilities:
Set socket configuration

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x60
lea rbp, [rsp + 0x60]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rbx, r9
mov r14d, r8d
mov edi, edx
mov rsi, rcx
mov rcx, qword [rcx + 0x30]
cmp rcx, 0xffffffffffffffff
jne 0x140035fdc
cmp edi, 1
mov eax, 6
mov r8d, reloc.WS2_32.dll_recvfrom
cmove r8d, eax
mov ecx, reloc.WS2_32.dll_socket
mov edx, edi
call qword [sym.imp.WS2_32.dll_socket]
mov rcx, rax
mov qword [rsi + 0x30], rax
cmp rax, 0xffffffffffffffff
je 0x140036087
rol r14w, 8
xorps xmm0, xmm0
movups xmmword [rsi + 0x38], xmm0
mov word [rsi + 0x48], r14w
movups xmmword [rbp - 0x28], xmm0
mov qword [rbp - 0x18], 0
mov word [rbp - 0x2c], reloc.WS2_32.dll_socket
mov word [rbp - 0x2a], r14w
movups xmm0, xmmword [rbx]
movups xmmword [rbp - 0x24], xmm0
mov dword [rbp - 0xc], 1
mov dword [rsp + 0x20], 4
lea r9, [rbp - 0xc]
mov edx, 0xffff
mov r8d, 4
call qword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x140036087
mov rcx, qword [rsi + 0x30]
lea rdx, [rbp - 0x2c]
mov r8d, 0x1c
call qword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
je 0x140036087
cmp edi, 1
jne 0x140036066
mov rcx, qword [rsi + 0x30]
mov edx, 0x64
call qword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
je 0x140036087
mov dword [rbp - 0x10], 1
mov rcx, qword [rsi + 0x30]
lea r8, [rbp - 0x10]
mov edx, 0x8004667e
call qword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
sete al
jmp 0x140036089
xor eax, eax
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret

Function at 0x140036130
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rbx, r9
mov r14d, r8d
mov edi, edx
mov rsi, rcx
mov rcx, qword [rcx + 0x30]
cmp rcx, 0xffffffffffffffff
jne 0x14003618c
cmp edi, 1
mov eax, 6
mov r8d, reloc.WS2_32.dll_recvfrom
cmove r8d, eax
mov ecx, 2
mov edx, edi
call qword [sym.imp.WS2_32.dll_socket]
mov rcx, rax
mov qword [rsi + 0x30], rax
cmp rax, 0xffffffffffffffff
je 0x140036232
rol r14w, 8
xorps xmm0, xmm0
movups xmmword [rsi + 0x38], xmm0
mov word [rsi + 0x48], r14w
mov qword [rbp - 0x18], 0
mov word [rbp - 0x20], 2
mov word [rbp - 0x1e], r14w
mov eax, dword [rbx + 0xc]
mov dword [rbp - 0x1c], eax
mov dword [rbp - 0xc], 1
mov dword [rsp + 0x20], 4
lea r9, [rbp - 0xc]
mov edx, 0xffff
mov r8d, 4
call qword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x140036232
mov rcx, qword [rsi + 0x30]
lea rdx, [rbp - 0x20]
mov r8d, reloc.WS2_32.dll_recv
call qword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
je 0x140036232
cmp edi, 1
jne 0x140036211
mov rcx, qword [rsi + 0x30]
mov edx, 0x64
call qword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
je 0x140036232
mov dword [rbp - 0x10], 1
mov rcx, qword [rsi + 0x30]
lea r8, [rbp - 0x10]
mov edx, 0x8004667e
call qword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
sete al
jmp 0x140036234
xor eax, eax
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
Function at 0x140039270
Capabilities:
Send data
Send data on socket

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rsi, rcx
mov rax, qword [rcx + 0xc0]
cmp rax, qword [rcx + 0xc8]
je 0x1400392a6
mov rcx, rsi
add rsp, 0x50
pop rdi
pop rsi
pop rbp
jmp fcn.140039400
mov rdi, qword [r8 + 0x10]
mov eax, edi
rol ax, 8
mov byte [rbp - 0x28], dl
mov word [rbp - 0x27], 0x303
mov word [rbp - 0x25], ax
mov qword [rbp - 0x23], 0
mov dword [rbp - 0x1c], 0
mov qword [rbp - 0x18], 5
mov qword [rbp - 0x10], setsockopt
cmp qword [r8 + 0x18], 0x10
jb 0x1400392e6
mov r8, qword [r8]
cmp rdi, 0xa
jbe 0x140039310
mov qword [rsp + 0x20], rdi
lea rcx, [rbp - 0x28]
mov rdx, rdi
mov r9, r8
call fcn.140008a00
mov edi, dword [rbp - 0x18]
cmp qword [rbp - 0x10], 0x10
jb 0x140039336
mov rdx, qword [rbp - 0x28]
jmp 0x14003933a
lea rcx, [rbp - 0x23]
lea rax, [rdi + 5]
mov qword [rbp - 0x18], rax
mov rdx, r8
mov r8, rdi
call fcn.1400c91a0
mov byte [rbp + rdi - 0x23], 0
mov edi, dword [rbp - 0x18]
cmp qword [rbp - 0x10], 0x10
jae 0x14003930a
lea rdx, [rbp - 0x28]
mov rcx, qword [rsi + 0x30]
mov r8d, edi
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_send]
mov esi, eax
mov rax, qword [rbp - 0x10]
cmp rax, 0x10
jb 0x140039387
mov rcx, qword [rbp - 0x28]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140039382
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140039394
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.14009a7e4
cmp esi, edi
sete al
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
call fcn.1400a4324
int3
Function at 0x140039400
Capabilities:
Send data
Send data on socket

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x80
lea rbp, [rsp + 0x80]
mov qword [rbp - 8], 0xfffffffffffffffe
mov r9, r8
mov bl, dl
mov rsi, rcx
add rcx, 0xb8
lea rdx, [rbp - 0x58]
mov r8d, ebx
call fcn.140073090
mov word [rbp - 0xd], 0x303
mov byte [rbp - 0xe], bl
mov rdi, qword [rbp - 0x50]
sub rdi, qword [rbp - 0x58]
mov word [rbp - 0xa], di
add rdi, 5
mov rcx, rdi
call fcn.140079a50
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], 0
mov qword [rbp - 0x18], rdi
mov byte [rbp - 0x38], 0
lea rcx, method.std::codecvt_char__char__struct__Mbstatet_.virtual_0
mov qword [rbp - 0x40], rcx
lea rcx, [rbp - 0x28]
mov qword [rbp - 0x30], rcx
test rdi, rdi
je 0x14003959d
xor ecx, ecx
lea rdx, [rbp - 0xd]
mov byte [rax + rcx], bl
inc qword [rbp - 0x20]
mov rax, qword [rbp - 0x40]
lea rcx, [rbp - 0x40]
mov r8d, 1
call qword [rax + ioctlsocket]
test al, al
je 0x1400394f9
lea rdx, [rbp - 0xc]
mov rax, qword [rbp - 0x40]
lea rcx, [rbp - 0x40]
mov r8d, 1
call qword [rax + ioctlsocket]
test al, al
je 0x1400394f9
cmp byte [rbp - 0x38], 0
je 0x1400394d8
lea rdx, [rbp - 0xa]
mov rax, qword [rbp - 0x40]
lea rcx, [rbp - 0x40]
jmp 0x1400394f0
movzx eax, word [rbp - 0xa]
rol ax, 8
mov word [rbp - 0x10], ax
mov rax, qword [rbp - 0x40]
lea rcx, [rbp - 0x40]
lea rdx, [rbp - 0x10]
mov r8d, 2
call qword [rax + ioctlsocket]
mov rbx, qword [rbp - 0x58]
mov rdi, qword [rbp - 0x50]
sub rdi, rbx
mov rax, qword [rbp - 0x28]
mov rcx, qword [rbp - 0x20]
lea rdx, [rdi + rcx]
cmp qword [rbp - 0x18], rdx
jb 0x1400395bf
add rcx, rax
mov rdx, rbx
mov r8, rdi
call fcn.1400c91a0
add rdi, qword [rbp - 0x20]
mov qword [rbp - 0x20], rdi
mov rdx, qword [rbp - 0x28]
mov rcx, qword [rsi + 0x30]
mov r8d, edi
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_send]
mov esi, eax
mov rcx, qword [rbp - 0x28]
test rcx, rcx
je 0x140039554
call fcn.1400a44e8
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x14003958a
mov rdx, qword [rbp - 0x48]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x140039585
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x1400395e4
add rdx, 0x27
mov rcx, rax
call fcn.14009a7e4
cmp esi, edi
sete al
add rsp, 0x80
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
mov edx, 1
mov rcx, rax
call fcn.140079aa0
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x18], 1
mov rcx, qword [rbp - 0x20]
jmp 0x14003948b
mov r14, rdx
shr r14, 1
add r14, rdx
mov rcx, rax
mov rdx, r14
call fcn.140079aa0
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x18], r14
mov rcx, qword [rbp - 0x20]
jmp 0x14003951a
call fcn.1400a4324
int3
Function at 0x140039920
Capabilities:
Send data
Send data on socket

Disassembly:
push rbp
push rsi
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov qword [rbp], 0xfffffffffffffffe
mov r8, rdx
mov rax, qword [rcx + 0xc0]
cmp rax, qword [rcx + 0xc8]
je 0x140039953
mov dl, reloc.WS2_32.dll_socket
add rsp, 0x28
pop rsi
pop rbp
jmp fcn.140039400
mov esi, dword [r8 + 0x10]
cmp qword [r8 + 0x18], 0x10
jb 0x140039961
mov r8, qword [r8]
mov rcx, qword [rcx + 0x30]
mov rdx, r8
mov r8d, esi
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_send]
cmp eax, esi
sete al
add rsp, 0x28
pop rsi
pop rbp
ret

Function at 0x140039af0
Capabilities:
Create udp socket
Send data
Send data on socket

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [rdx + 0x10]
mov qword [rcx + 0x48], rax
movups xmm0, xmmword [rdx]
movups xmmword [rcx + 0x38], xmm0
cmp qword [rcx + 0x30], 0xffffffffffffffff
jne 0x140039b68
movzx eax, word [rdi]
or ax, word [rdi + 2]
movzx ecx, word [rdi + 0xa]
not ecx
or cx, word [rdi + 8]
or cx, word [rdi + 6]
or cx, word [rdi + 4]
or cx, ax
mov eax, 2
mov ecx, reloc.WS2_32.dll_socket
cmove ecx, eax
mov edx, 2
mov r8d, reloc.WS2_32.dll_recvfrom
call qword [sym.imp.WS2_32.dll_socket]
mov qword [rbx + 0x30], rax
cmp rax, 0xffffffffffffffff
je 0x140039b7e
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop rbp
jmp fcn.140039bb0
xor eax, eax
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop rbp
ret

Function at 0x140039bb0
Capabilities:
Send data
Send data on socket

Disassembly:
push rbp
push rsi
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, r8
cmp qword [rdx], 0
jne 0x140039c31
cmp word [rdx + 8], 0
jne 0x140039c31
cmp word [rdx + 0xa], 0xffff
jne 0x140039c31
mov qword [rbp - 0x14], 0
mov word [rbp - 0x1c], 2
movzx eax, word [rdx + 0x10]
mov word [rbp - 0x1a], ax
mov eax, dword [rdx + 0xc]
mov dword [rbp - 0x18], eax
mov r8d, dword [rsi + 0x10]
cmp qword [rsi + 0x18], 0x10
mov rdx, rsi
jb 0x140039c07
mov rdx, qword [rsi]
mov rcx, qword [rcx + 0x30]
lea rax, [rbp - 0x1c]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], reloc.WS2_32.dll_recv
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_sendto]
cdqe
cmp qword [rsi + 0x10], rax
je 0x140039c8c
xor eax, eax
jmp 0x140039c8e
xorps xmm0, xmm0
movups xmmword [rbp - 0x18], xmm0
mov qword [rbp - 8], 0
mov word [rbp - 0x1c], reloc.WS2_32.dll_socket
movups xmm0, xmmword [rdx]
movups xmmword [rbp - 0x14], xmm0
movzx eax, word [rdx + 0x10]
mov word [rbp - 0x1a], ax
mov r8d, dword [rsi + 0x10]
cmp qword [rsi + 0x18], 0x10
mov rdx, rsi
jb 0x140039c66
mov rdx, qword [rsi]
mov rcx, qword [rcx + 0x30]
lea rax, [rbp - 0x1c]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 0x1c
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_sendto]
cdqe
cmp qword [rsi + 0x10], rax
jne 0x140039c2d
mov al, 1
add rsp, 0x58
pop rsi
pop rbp
ret
Function at 0x14003ab10
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx + 0x30]
lea rdx, [rsp + 0x27]
mov r8d, 1
mov r9d, 2
call qword [sym.imp.WS2_32.dll_recv]
cmp eax, 1
sete al
add rsp, 0x28
ret

Function at 0x14003ab90
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x60
lea rbp, [rsp + 0x60]
mov qword [rbp - 8], 0xfffffffffffffffe
xorps xmm0, xmm0
movaps xmmword [rbp - 0x20], xmm0
movaps xmmword [rbp - 0x30], xmm0
test r8d, r8d
js 0x14003ad6c
mov edi, r8d
mov rsi, rdx
mov rbx, rcx
movsxd r14, r8d
cmp r8d, 0xf
ja 0x14003ac04
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x18], setsockopt
lea rcx, [rbp - 0x30]
xor edx, edx
mov r8, r14
call fcn.1400c8de0
lea r15, [r14 + rbp]
add r15, 0xffffffffffffffd0
mov byte [r15], 0
cmp qword [rbp - 0x18], 0x10
jb 0x14003ac71
mov rdx, qword [rbp - 0x30]
jmp 0x14003ac75
mov rax, r14
or rax, 0xf
cmp rax, 0x17
mov r12d, socket
cmovae r12, rax
cmp r12, 0xfff
jb 0x14003ac3d
lea rcx, [r12 + 0x28]
call fcn.14009a7a0
mov r15, rax
add r15, 0x27
and r15, 0xffffffffffffffe0
mov qword [r15 - 8], rax
jmp 0x14003ac4a
lea rcx, [r12 + 1]
call fcn.14009a7a0
mov r15, rax
mov qword [rbp - 0x30], r15
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x18], r12
mov rcx, r15
xor edx, edx
mov r8, r14
call fcn.1400c8de0
add r15, r14
mov byte [r15], 0
cmp qword [rbp - 0x18], 0x10
jae 0x14003abfe
lea rdx, [rbp - 0x30]
mov rcx, qword [rbx + 0x30]
mov r8d, edi
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x14003acbf
mov edi, eax
mov rcx, qword [rbp - 0x20]
mov r8, rdi
sub r8, rcx
jbe 0x14003ad12
mov rax, qword [rbp - 0x18]
mov rdx, rax
sub rdx, rcx
cmp rdx, r8
jae 0x14003ad23
mov byte [rsp + 0x20], 0
lea rcx, [rbp - 0x30]
mov rdx, r8
mov r9, r8
call fcn.140011390
jmp 0x14003ad4b
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], 0
mov qword [rsi + 0x18], setsockopt
mov rax, qword [rbp - 0x18]
cmp rax, 0x10
jb 0x14003ad5a
mov rcx, qword [rbp - 0x30]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14003ad0b
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003ad71
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.14009a7e4
jmp 0x14003ad5a
mov qword [rbp - 0x20], rdi
cmp qword [rbp - 0x18], 0x10
jb 0x14003ad33
mov rbx, qword [rbp - 0x30]
jmp 0x14003ad47
mov qword [rbp - 0x20], rdi
cmp rax, 0x10
jb 0x14003ad39
mov rbx, qword [rbp - 0x30]
jmp 0x14003ad3d
lea rbx, [rbp - 0x30]
jmp 0x14003ad47
lea rbx, [rbp - 0x30]
add rcx, rbx
xor edx, edx
call fcn.1400c8de0
mov byte [rbx + rdi], 0
movaps xmm0, xmmword [rbp - 0x30]
movaps xmm1, xmmword [rbp - 0x20]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rax, rsi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
call fcn.140004740
call fcn.1400a4324
int3
Function at 0x140040c50
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 0x18
movdqa xmmword [rsp], xmm6
mov eax, dword [rcx]
cmp eax, 0x138
jne 0x140040cee
movq xmm0, qword [rcx + 8]
pshufd xmm3, xmm0, 0x44
mov rax, 0xfffffffffffffec8
movaps xmm0, xmmword [0x1400cd2b0]
movaps xmm1, xmmword [0x1400cd2c0]
movdqa xmm2, xmmword [0x1400cd2d0]
nop dword [rax]
movups xmm4, xmmword [rcx + rax*8 + 0x9d0]
shufps xmm3, xmm4, 0x4e
andps xmm3, xmm0
movaps xmm5, xmm4
andps xmm5, xmm1
orps xmm5, xmm3
psrlq xmm5, 1
pshufd xmm3, xmm4, 0xa0
pslld xmm3, 0x1f
psrad xmm3, 0x1f
pand xmm3, xmm2
movdqu xmm6, xmmword [rcx + rax*8 + 0xea8]
pxor xmm6, xmm3
pxor xmm6, xmm5
movdqu xmmword [rcx + rax*8 + 0x1388], xmm6
movdqa xmm3, xmm4
add rax, 2
jne 0x140040c90
mov eax, 0x138
jmp 0x140040e7b
cmp eax, 0x270
jb 0x140040e7b
movq xmm0, qword [rcx + 0x9c8]
pshufd xmm3, xmm0, 0x44
mov rax, 0xffffffffffffff64
movaps xmm0, xmmword [0x1400cd2b0]
movaps xmm1, xmmword [0x1400cd2c0]
movdqa xmm2, xmmword [0x1400cd2d0]
nop word cs:[rax + rax]
movups xmm4, xmmword [rcx + rax*8 + 0xeb0]
shufps xmm3, xmm4, 0x4e
andps xmm3, xmm0
movaps xmm5, xmm4
andps xmm5, xmm1
orps xmm5, xmm3
psrlq xmm5, 1
pshufd xmm3, xmm4, 0xa0
pslld xmm3, 0x1f
psrad xmm3, 0x1f
pand xmm3, xmm2
movdqu xmm6, xmmword [rcx + rax*8 + 0x1388]
pxor xmm6, xmm3
pxor xmm6, xmm5
movdqu xmmword [rcx + rax*8 + 0x4e8], xmm6
movdqa xmm3, xmm4
add rax, 2
jne 0x140040d30
movq xmm3, qword [rcx + 0xea8]
pshufd xmm3, xmm3, 0x44
xor eax, eax
nop word cs:[rax + rax]
movdqa xmm4, xmm3
movups xmm3, xmmword [rcx + rax*8 + 0xeb0]
shufps xmm4, xmm3, 0x4e
andps xmm4, xmm0
movaps xmm5, xmm3
andps xmm5, xmm1
orps xmm5, xmm4
psrlq xmm5, 1
pshufd xmm4, xmm3, 0xa0
pslld xmm4, 0x1f
psrad xmm4, 0x1f
pand xmm4, xmm2
movdqu xmm6, xmmword [rcx + rax*8 + 8]
pxor xmm6, xmm4
pxor xmm6, xmm5
movdqu xmmword [rcx + rax*8 + 0x4e8], xmm6
add rax, 2
cmp rax, 0x9a
jne 0x140040da0
pshufd xmm0, xmm3, 0xee
movq rax, xmm0
and rax, 0xffffffff80000000
mov rdx, qword [rcx + 0x1380]
mov r8d, edx
and r8d, 0x7ffffffe
or r8, rax
shr r8, 1
mov eax, edx
and eax, 1
neg rax
movabs r9, 0xb5026f5aa96619e9
and rax, r9
xor rax, qword [rcx + 0x4d8]
xor rax, r8
mov qword [rcx + 0x9b8], rax
and rdx, 0xffffffff80000000
mov rax, qword [rcx + 8]
mov r8d, eax
and r8d, 0x7ffffffe
or r8, rdx
and eax, 1
neg rax
and rax, r9
xor rax, qword [rcx + 0x4e0]
shr r8, 1
xor rax, r8
mov qword [rcx + 0x9c0], rax
xor eax, eax
lea edx, [rax + 1]
mov dword [rcx], edx
mov eax, eax
mov rax, qword [rcx + rax*8 + 8]
mov rdx, rax
shr rdx, 0x1d
and rdx, qword [rcx + 0x1388]
xor rdx, rax
mov rax, rdx
shl rax, 0x11
movabs rcx, 0x71d67fffeda60000
and rcx, rax
xor rcx, rdx
mov edx, ecx
and edx, 0x7ffbf77
shl rdx, 0x25
xor rdx, rcx
mov rax, rdx
shr rax, 0x2b
xor rax, rdx
movaps xmm6, xmmword [rsp]
add rsp, 0x18
ret
Function at 0x140045a20
Capabilities:
Set socket configuration

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x40]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, rdx
mov rdi, rcx
mov rax, qword [rdx]
mov rax, qword [rax]
mov dword [rbp - 0xc], 1
mov rcx, qword [rax + 0x30]
mov dword [rsp + 0x20], 4
lea r9, [rbp - 0xc]
mov edx, 6
mov r8d, 1
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rax, qword [rsi]
mov qword [rbp - 8], rax
xor eax, eax
xchg qword [rsi], rax
mov rax, qword [rdi]
lea rdx, [rbp - 8]
mov rcx, rdi
call qword [rax + ioctlsocket]
cmp qword [rbp - 8], 0
je 0x140045ac5
mov rdi, qword [rbp - 8]
lock dec dword [rdi + 8]
jne 0x140045ac5
cmp byte [rdi + 0xc], 0
mov rbx, qword [rdi]
je 0x140045aab
mov rax, qword [rbx]
mov rcx, rbx
xor edx, edx
call qword [rax]
mov rcx, rbx
jmp 0x140045ac0
test rbx, rbx
je 0x140045abd
mov rax, qword [rbx]
mov rcx, rbx
mov edx, 1
call qword [rax]
mov rcx, rdi
call fcn.14009a7dc
cmp qword [rsi], 0
je 0x140045b06
mov rsi, qword [rsi]
lock dec dword [rsi + 8]
jne 0x140045b06
cmp byte [rsi + 0xc], 0
mov rdi, qword [rsi]
je 0x140045aec
mov rax, qword [rdi]
mov rcx, rdi
xor edx, edx
call qword [rax]
mov rcx, rdi
jmp 0x140045b01
test rdi, rdi
je 0x140045afe
mov rax, qword [rdi]
mov rcx, rdi
mov edx, 1
call qword [rax]
mov rcx, rsi
call fcn.14009a7dc
nop
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop rbp
ret
Function at 0x14004ce80
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movdqu xmm0, xmmword [rdx]
movdqa xmmword [rcx], xmm0
aeskeygenassist xmm1, xmm0, 1
movdqa xmm2, xmm0
pslldq xmm2, 4
pxor xmm2, xmm0
movdqa xmm0, xmm2
pslldq xmm0, 4
pxor xmm0, xmm2
movdqa xmm2, xmm0
pslldq xmm2, 4
pshufd xmm1, xmm1, 0xff
pxor xmm2, xmm0
pxor xmm2, xmm1
movdqa xmmword [rcx + 0x10], xmm2
aeskeygenassist xmm0, xmm2, 2
movdqa xmm1, xmm2
pslldq xmm1, 4
pxor xmm1, xmm2
movdqa xmm2, xmm1
pslldq xmm2, 4
pxor xmm2, xmm1
movdqa xmm1, xmm2
pslldq xmm1, 4
pshufd xmm0, xmm0, 0xff
pxor xmm1, xmm2
pxor xmm1, xmm0
movdqa xmmword [rcx + 0x20], xmm1
aeskeygenassist xmm0, xmm1, 4
movdqa xmm2, xmm1
pslldq xmm2, 4
pxor xmm2, xmm1
movdqa xmm1, xmm2
pslldq xmm1, 4
pxor xmm1, xmm2
movdqa xmm2, xmm1
pslldq xmm2, 4
pshufd xmm0, xmm0, 0xff
pxor xmm2, xmm1
pxor xmm2, xmm0
movdqa xmmword [rcx + 0x30], xmm2
aeskeygenassist xmm0, xmm2, 8
movdqa xmm1, xmm2
pslldq xmm1, 4
pxor xmm1, xmm2
movdqa xmm2, xmm1
pslldq xmm2, 4
pxor xmm2, xmm1
movdqa xmm1, xmm2
pslldq xmm1, 4
pshufd xmm0, xmm0, 0xff
pxor xmm1, xmm2
pxor xmm1, xmm0
movdqa xmmword [rcx + 0x40], xmm1
aeskeygenassist xmm0, xmm1, 0x10
movdqa xmm2, xmm1
pslldq xmm2, 4
pxor xmm2, xmm1
movdqa xmm1, xmm2
pslldq xmm1, 4
pxor xmm1, xmm2
movdqa xmm2, xmm1
pslldq xmm2, 4
pshufd xmm0, xmm0, 0xff
pxor xmm2, xmm1
pxor xmm2, xmm0
movdqa xmmword [rcx + 0x50], xmm2
aeskeygenassist xmm0, xmm2, 0x20
movdqa xmm1, xmm2
pslldq xmm1, 4
pxor xmm1, xmm2
movdqa xmm2, xmm1
pslldq xmm2, 4
pxor xmm2, xmm1
movdqa xmm1, xmm2
pslldq xmm1, 4
pshufd xmm0, xmm0, 0xff
pxor xmm1, xmm2
pxor xmm1, xmm0
movdqa xmmword [rcx + 0x60], xmm1
aeskeygenassist xmm0, xmm1, 0x40
movdqa xmm2, xmm1
pslldq xmm2, 4
pxor xmm2, xmm1
movdqa xmm1, xmm2
pslldq xmm1, 4
pxor xmm1, xmm2
movdqa xmm2, xmm1
pslldq xmm2, 4
pshufd xmm0, xmm0, 0xff
pxor xmm2, xmm1
pxor xmm2, xmm0
movdqa xmmword [rcx + 0x70], xmm2
aeskeygenassist xmm0, xmm2, 0x80
movdqa xmm1, xmm2
pslldq xmm1, 4
pxor xmm1, xmm2
movdqa xmm2, xmm1
pslldq xmm2, 4
pxor xmm2, xmm1
movdqa xmm1, xmm2
pslldq xmm1, 4
pshufd xmm0, xmm0, 0xff
pxor xmm1, xmm2
pxor xmm1, xmm0
movdqa xmmword [rcx + 0x80], xmm1
aeskeygenassist xmm0, xmm1, 0x1b
movdqa xmm2, xmm1
pslldq xmm2, 4
pxor xmm2, xmm1
movdqa xmm1, xmm2
pslldq xmm1, 4
pxor xmm1, xmm2
movdqa xmm2, xmm1
pslldq xmm2, 4
pshufd xmm0, xmm0, 0xff
pxor xmm2, xmm1
pxor xmm2, xmm0
movdqa xmmword [rcx + 0x90], xmm2
aeskeygenassist xmm0, xmm2, 0x36
movdqa xmm1, xmm2
pslldq xmm1, 4
pxor xmm1, xmm2
movdqa xmm2, xmm1
pslldq xmm2, 4
pxor xmm2, xmm1
movdqa xmm1, xmm2
pslldq xmm1, 4
pshufd xmm0, xmm0, 0xff
pxor xmm1, xmm2
pxor xmm1, xmm0
movdqa xmmword [rcx + 0xa0], xmm1
ret
Function at 0x14004d0e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movdqu xmm1, xmmword [rdx]
movq xmm2, qword [rdx + 0x10]
movdqa xmmword [rcx], xmm1
aeskeygenassist xmm0, xmm2, 1
pshufd xmm3, xmm0, 0x55
movdqa xmm4, xmm1
pslldq xmm4, 4
movdqa xmm5, xmm1
pslldq xmm5, 8
movdqa xmm0, xmm1
pslldq xmm0, 0xc
pxor xmm0, xmm4
pxor xmm0, xmm5
pxor xmm0, xmm1
pxor xmm0, xmm3
pshufd xmm1, xmm0, 0xff
movdqa xmm3, xmm2
pslldq xmm3, 4
pxor xmm3, xmm2
pxor xmm3, xmm1
punpcklqdq xmm2, xmm0
movdqa xmmword [rcx + 0x10], xmm2
aeskeygenassist xmm1, xmm3, 2
movdqa xmm2, xmm3
pslldq xmm2, 4
pxor xmm2, xmm3
palignr xmm3, xmm0, 8
movdqa xmmword [rcx + 0x20], xmm3
pshufd xmm1, xmm1, 0x55
movdqa xmm3, xmm0
pslldq xmm3, 4
movdqa xmm4, xmm0
pslldq xmm4, 8
movdqa xmm5, xmm0
pslldq xmm5, 0xc
pxor xmm5, xmm3
pxor xmm5, xmm4
pxor xmm5, xmm0
pxor xmm5, xmm1
pshufd xmm0, xmm5, 0xff
pxor xmm2, xmm0
movdqa xmmword [rcx + 0x30], xmm5
aeskeygenassist xmm0, xmm2, 4
pshufd xmm1, xmm0, 0x55
movdqa xmm3, xmm5
pslldq xmm3, 4
movdqa xmm4, xmm5
pslldq xmm4, 8
movdqa xmm0, xmm5
pslldq xmm0, 0xc
pxor xmm0, xmm3
pxor xmm0, xmm4
pxor xmm0, xmm5
pxor xmm0, xmm1
pshufd xmm1, xmm0, 0xff
movdqa xmm3, xmm2
pslldq xmm3, 4
pxor xmm3, xmm2
pxor xmm3, xmm1
punpcklqdq xmm2, xmm0
movdqa xmmword [rcx + 0x40], xmm2
aeskeygenassist xmm1, xmm3, 8
movdqa xmm2, xmm3
pslldq xmm2, 4
pxor xmm2, xmm3
palignr xmm3, xmm0, 8
movdqa xmmword [rcx + 0x50], xmm3
pshufd xmm1, xmm1, 0x55
movdqa xmm3, xmm0
pslldq xmm3, 4
movdqa xmm4, xmm0
pslldq xmm4, 8
movdqa xmm5, xmm0
pslldq xmm5, 0xc
pxor xmm5, xmm3
pxor xmm5, xmm4
pxor xmm5, xmm0
pxor xmm5, xmm1
pshufd xmm0, xmm5, 0xff
pxor xmm2, xmm0
movdqa xmmword [rcx + 0x60], xmm5
aeskeygenassist xmm0, xmm2, 0x10
pshufd xmm1, xmm0, 0x55
movdqa xmm3, xmm5
pslldq xmm3, 4
movdqa xmm4, xmm5
pslldq xmm4, 8
movdqa xmm0, xmm5
pslldq xmm0, 0xc
pxor xmm0, xmm3
pxor xmm0, xmm4
pxor xmm0, xmm5
pxor xmm0, xmm1
pshufd xmm1, xmm0, 0xff
movdqa xmm3, xmm2
pslldq xmm3, 4
pxor xmm3, xmm2
pxor xmm3, xmm1
punpcklqdq xmm2, xmm0
movdqa xmmword [rcx + 0x70], xmm2
aeskeygenassist xmm1, xmm3, 0x20
movdqa xmm2, xmm3
pslldq xmm2, 4
pxor xmm2, xmm3
palignr xmm3, xmm0, 8
movdqa xmmword [rcx + 0x80], xmm3
pshufd xmm1, xmm1, 0x55
movdqa xmm3, xmm0
pslldq xmm3, 4
movdqa xmm4, xmm0
pslldq xmm4, 8
movdqa xmm5, xmm0
pslldq xmm5, 0xc
pxor xmm5, xmm3
pxor xmm5, xmm4
pxor xmm5, xmm0
pxor xmm5, xmm1
pshufd xmm0, xmm5, 0xff
pxor xmm2, xmm0
movdqa xmmword [rcx + 0x90], xmm5
aeskeygenassist xmm0, xmm2, 0x40
pshufd xmm1, xmm0, 0x55
movdqa xmm3, xmm5
pslldq xmm3, 4
movdqa xmm4, xmm5
pslldq xmm4, 8
movdqa xmm0, xmm5
pslldq xmm0, 0xc
pxor xmm0, xmm3
pxor xmm0, xmm4
pxor xmm0, xmm5
pxor xmm0, xmm1
pshufd xmm1, xmm0, 0xff
movdqa xmm3, xmm2
pslldq xmm3, 4
pxor xmm3, xmm2
pxor xmm3, xmm1
punpcklqdq xmm2, xmm0
movdqa xmmword [rcx + 0xa0], xmm2
aeskeygenassist xmm1, xmm3, 0x80
palignr xmm3, xmm0, 8
movdqa xmmword [rcx + 0xb0], xmm3
pshufd xmm1, xmm1, 0x55
movdqa xmm2, xmm0
pslldq xmm2, 4
movdqa xmm3, xmm0
pslldq xmm3, 8
movdqa xmm4, xmm0
pslldq xmm4, 0xc
pxor xmm4, xmm2
pxor xmm4, xmm3
pxor xmm4, xmm0
pxor xmm4, xmm1
movdqa xmmword [rcx + 0xc0], xmm4
ret