joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18008b094
Capabilities:
Encode data using xor

Disassembly:
jmp 0x18008af7f
dec qword [rsp + 0x18]
mov cx, r11w
mov ecx, dword [rsp]
jmp 0x18008b116
mov cx, 0x9f2
jmp 0x18008ae83
lea rsp, [rsp + 8]
mov rcx, qword [rsp + 0x18]
call fcn.18008b010
mov word [rsp], cx
jmp 0x18008b0ab
dec ecx
jmp 0x18008b043
mov dword [rsp], r14d
call 0x18008b0d2
jbe 0x18008b090
invalid
lea rsp, [rsp + 8]
jne 0x18008ae7e
je 0x18008ae64
lea rsp, [rsp + 0x10]
dec qword [rsp + 0x18]
call fcn.18008b0ef
mov word [0x13818ad66], es
xor al, 0x48
lea esp, [rsp + 2]
jmp 0x18008b0bc
mov dl, byte [r10 + riz]
mov rcx, rbp
call fcn.18008b08b
mov r10b, spl
mov r10, r9
setge r10b
lea r8, [r8 + riz - 0x65]
mov r14w, 0xad13
bswap r8
jmp 0x18008b161
xchg r10b, r14b
mov r14, qword [rsp + 0x10]
mov r8b, byte [rsp]
xchg r8w, r10w
call fcn.18008b1b3
je 0x18008b170
shr al, 1
cmp eax, 0x74000000
clc
outsb dx, byte [rsi]
or eax, edi
pop rdx
invalid

Function at 0x1800d4170
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea rsp, [rsp + 1]
push word [rsp + 6]
jmp 0x1800d419c
lea rsp, [rsp + 1]
lea rsp, [rsp + 8]
mov rax, rsp
not r11d
mov r11d, ecx
jmp 0x1800d4748
mov qword [rax + riz + 8], rcx
bswap r10
bswap rbx
mov r9d, dword [rsp]
jmp 0x1800d452f
lea rsp, [rsp + 2]
mov qword [rax + riz + 0x10], rdx
xchg r10w, r9w
mov r9b, r8b
xchg r9b, r10b
jmp 0x1800d41ca
xor edx, edx
mov r11b, byte [rsp]
bswap r11d
inc bl
jmp 0x1800d428f
mov r10, rdx
bsr r11, rsi
bsf rbx, r12
sbb ebx, r14d
sub rsp, 6
lea rsp, [rsp + 6]
jmp 0x1800d41f6
movzx r9d, word [r8 + riz + 0xe]
movzx eax, word [r8 + riz + 0xc]
mov r11d, dword [rsp]
bsr bx, r8w
jmp 0x1800d420c
lea rsp, [rsp + 6]
jmp 0x1800d4275
sub rsp, 0
mov r11, rcx
push r8
mov dword [rsp], edx
pop word [rsp + 2]
jmp 0x1800d424c
mov dword [rsp + 0x30], edx
clc
call fcn.1800d42cb
fisttp word [r15 + 0x2a]
fst dword [rdi - 0x55]
xor byte [rsi - 0x527dcf3f], ah
mov esp, 0x344168f
enter 0xffffffffffff8b49, 0xffffffffffffffd8
add r9d, eax
mov rbx, r8
bswap r11
mov r11, 0x6d9900a3
jmp 0x1800d4262
sub rsp, 0x50
inc ax
xchg bl, r9b
xchg r10b, r9b
jmp 0x1800d4235
push rsi
mov r9, r11
mov r10d, dword [rsp]
mov r11b, 0x6b
push rdi
jmp 0x1800d42fd
push rbp
bswap r9d
xchg r11, r10
lea r11, [r14*4]
jmp 0x1800d43de
mov r9b, byte [rsp]
mov qword [rax + riz + 0x18], r8
mov r9w, 0x7004
xchg r9, r11
push si
jmp 0x1800d41e0
push rbp
bswap r9
lea rsp, [rsp + 8]
mov qword [rax + riz + 0x20], rbx
bsr r9d, r15d
jmp 0x1800d4578
Function at 0x140001480
Capabilities:
Initialize winsock library

Disassembly:
push rbx
sub rsp, 0x1c0
shl r8d, 8
movzx edx, dl
lea rax, [rsp + 0x20]
mov rbx, rcx
or r8d, edx
mov rdx, rax
movzx ecx, r8w
call qword [sym.imp.WS2_32.dll_WSAStartup]
xchg dword [rbx + 4], eax
add rsp, 0x1c0
pop rbx
ret

Function at 0x1400028f0
Capabilities:
Get socket status

Disassembly:
push rsi
push rbx
sub rsp, 0x268
mov rbx, rdx
cmp rcx, 0xffffffffffffffff
je 0x14000298f
mov qword [rsp + 0x58], rcx
xor r9d, r9d
add ecx, 1
lea r8, [rsp + 0x50]
mov dword [rsp + 0x50], 1
xor edx, edx
mov qword [rsp + 0x20], 0
call qword [sym.imp.WS2_32.dll_select]
mov esi, eax
test eax, eax
js 0x140002960
mov dword [rbx], 0
mov qword [rbx + 8], 0
mov qword [rbx + 0x10], 0
mov eax, esi
add rsp, 0x268
pop rbx
pop rsi
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, [0x140268c60]
cmp eax, 1
mov dword [rbx], eax
mov eax, 2
sbb rax, 0xffffffffffffffff
mov qword [rbx + 8], rdx
mov qword [rbx + 0x10], rax
mov eax, esi
add rsp, 0x268
pop rbx
pop rsi
ret
lea rcx, [rsp + 0x30]
mov edx, 0x2719
mov esi, 0xffffffff
call fcn.140238b20
movdqu xmm0, xmmword [rsp + 0x30]
movups xmmword [rbx], xmm0
mov rax, qword [rsp + 0x40]
mov qword [rbx + 0x10], rax
jmp 0x14000294b
Function at 0x140002d70
Capabilities:
Get socket status

Disassembly:
push rsi
push rbx
sub rsp, 0x268
mov rbx, rdx
cmp rcx, 0xffffffffffffffff
je 0x140002e0f
mov qword [rsp + 0x58], rcx
lea rdx, [rsp + 0x50]
add ecx, 1
xor r9d, r9d
mov dword [rsp + 0x50], 1
xor r8d, r8d
mov qword [rsp + 0x20], 0
call qword [sym.imp.WS2_32.dll_select]
mov esi, eax
test eax, eax
js 0x140002de0
mov dword [rbx], 0
mov qword [rbx + 8], 0
mov qword [rbx + 0x10], 0
mov eax, esi
add rsp, 0x268
pop rbx
pop rsi
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, [0x140268c60]
cmp eax, 1
mov dword [rbx], eax
mov eax, 2
sbb rax, 0xffffffffffffffff
mov qword [rbx + 8], rdx
mov qword [rbx + 0x10], rax
mov eax, esi
add rsp, 0x268
pop rbx
pop rsi
ret
lea rcx, [rsp + 0x30]
mov edx, 0x2719
mov esi, 0xffffffff
call fcn.140238b20
movdqu xmm0, xmmword [rsp + 0x30]
movups xmmword [rbx], xmm0
mov rax, qword [rsp + 0x40]
mov qword [rbx + 0x10], rax
jmp 0x140002dcc
Function at 0x1400031b0
Capabilities:
Set socket configuration

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
add rsp, 0xffffffffffffff80
mov rsi, rcx
mov rdi, rdx
mov rbx, r9
cmp rcx, 0xffffffffffffffff
je 0x1400031ff
test r8b, r8b
je 0x1400031d9
movzx eax, byte [rdx]
test al, 8
jne 0x140003298
mov rbp, qword [sym.imp.WS2_32.dll_closesocket]
mov rcx, rsi
call rbp
test eax, eax
jne 0x140003210
mov dword [rbx], 0
mov qword [rbx + 8], 0
mov qword [rbx + 0x10], 0
sub rsp, 0xffffffffffffff80
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rcx, rbx
lea r12, [rsp + 0x60]
call fcn.140001a70
mov edx, 0x2733
mov rcx, r12
call fcn.140238b20
mov rdx, r12
mov rcx, rbx
call fcn.14024c2f0
test al, al
jne 0x14000325a
lea r12, [rsp + 0x40]
mov edx, 0x4d5
mov rcx, r12
call fcn.140238b20
mov rdx, r12
mov rcx, rbx
call fcn.14024c2f0
test al, al
je 0x1400031ff
mov rcx, rsi
lea r8, [rsp + 0x3c]
mov edx, 0x8004667e
mov dword [rsp + 0x3c], 0
call qword [sym.imp.WS2_32.dll_ioctlsocket]
and byte [rdi], 0xfc
mov rcx, rsi
call rbp
test eax, eax
je 0x1400031e9
mov rcx, rbx
call fcn.140001a70
jmp 0x1400031ff
or eax, 8
mov dword [rsp + 0x40], 0
lea r9, [rsp + 0x40]
mov r8d, pe_nt_image_headers64
mov byte [rdx], al
mov edx, 0xffff
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x1400031d9
lea rcx, [rsp + 0x60]
call fcn.140001a70
jmp 0x1400031d9

Function at 0x1400037c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
movsxd rax, dword [rcx + 0x3c]
mov r13d, dword [rcx + rax + 0x88]
add r13, rcx
mov rsi, rcx
mov r11, rdx
mov edi, dword [r13 + 0x14]
test edi, edi
je 0x1400038c6
cmp byte [rdx], 0
je 0x1400038d5
mov ebp, dword [r13 + 0x20]
xor r12d, r12d
xor ebx, ebx
add rbp, rcx
mov edx, dword [rbp]
nop dword [rax]
mov rax, r11
nop dword [rax + rax]
add rax, 1
cmp byte [rax], 0
jne 0x140003810
sub rax, r11
mov rcx, rax
je 0x140003876
xor eax, eax
lea r14, [rsi + rdx]
jmp 0x140003841
add edx, 0x20
cmp dl, r8b
jne 0x1400038a8
add rax, 1
cmp rcx, rax
je 0x140003876
movzx r9d, byte [r11 + rax]
lea edx, [r9 - 0x41]
mov r8d, r9d
cmp edx, 0x19
ja 0x14000385a
add r9d, 0x20
add r8d, 0x20
movzx r10d, byte [r14 + rax]
lea r15d, [r10 - 0x41]
mov edx, r10d
cmp r15d, 0x19
jbe 0x140003830
cmp r10b, r8b
jne 0x1400038ac
test r9d, r9d
jne 0x140003838
mov eax, dword [r13 + 0x24]
lea edx, [r12 + r12]
add rax, rsi
movzx eax, word [rax + rdx]
mov edx, dword [r13 + 0x1c]
shl eax, 2
cdqe
add rax, rsi
mov eax, dword [rax + rdx]
add rax, rsi
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
add r10d, 0x20
cmp r9d, r10d
je 0x140003876
add rbx, 1
cmp rdi, rbx
je 0x1400038c6
mov edx, dword [rbp + rbx*4]
mov r12d, ebx
jmp 0x140003808
xor eax, eax
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
xor r12d, r12d
jmp 0x140003876
Function at 0x14000fa90
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rax, qword [rcx + 8]
mov rax, qword [rax + 0xc0]
mov rsi, rdx
lea rbp, [r9 + 1]
mov rdx, qword [rdx + 8]
test byte [rax + 0x60], 1
je 0x14000fbe8
lea r9, [rbp + r8]
xor eax, eax
cmp rdx, r9
jb 0x14000fbd9
movdqu xmm0, xmmword [rsi + 0x20]
movq xmm2, r8
mov r9, qword [rsi + 0x20]
mov rax, rdx
movddup xmm1, xmm2
sub rax, r8
paddq xmm0, xmm1
add r9, r8
movups xmmword [rsi + 0x20], xmm0
movq xmm0, rdx
movhps xmm0, qword [rsi + 0x10]
psubq xmm0, xmm1
movups xmmword [rsi + 8], xmm0
mov rcx, qword [rcx + 0x438]
movzx ebx, byte [r9 + rax - 1]
call fcn.1400b7fc0
mov rdi, rbx
mov rcx, rax
call fcn.1400b7fe0
test eax, 0x200000
jne 0x14000fc00
mov r11, qword [rsi + 8]
add rbp, rbx
mov r10d, 0x100
mov rax, r11
sub rax, rbp
xor rax, rbp
xor rbp, r11
or rax, rbp
xor rax, r11
sar rax, 0x3f
cmp r11, r10
mov r9, rax
cmovbe r10, r11
not r9
test r11, r11
je 0x14000fbad
mov rbp, r11
mov r8, rbx
xor ecx, ecx
sub rbp, rbx
add rbp, qword [rsi + 0x20]
nop dword [rax + rax]
mov rdx, r8
mov rax, rbx
xor rdx, rcx
xor rax, rcx
add rcx, 1
or rax, rdx
movzx edx, byte [rbp + r8 - 1]
sub r8, 1
xor rax, rbx
xor edx, edi
sar rax, 0x3f
movzx edx, dl
not rdx
or rax, rdx
and r9, rax
cmp rcx, r10
jb 0x14000fb70
mov rax, r9
not rax
movzx edx, al
or r9, 0xffffffffffffff00
add rbx, 1
sub rdx, 1
and rdx, r9
sar rdx, 0x3f
and rbx, rdx
mov eax, edx
not edx
sub r11, rbx
mov qword [rsi + 8], r11
and eax, 1
or eax, edx
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
xor eax, eax
cmp rdx, rbp
jb 0x14000fbd9
mov r9, qword [rsi + 0x20]
mov rax, rdx
jmp 0x14000fafc
not rbx
add qword [rsi + 8], rbx
mov eax, 1
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x1400109d0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xa8
mov eax, 0x40
mov r13, qword [rdx + 0x10]
cmp r13, rax
cmovbe rax, r13
mov rbp, rdx
mov rsi, rcx
mov rbx, r8
xor edx, edx
cmp rax, r8
jae 0x140010a20
mov eax, edx
add rsp, 0xa8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [rsp + 0x20]
mov rdx, r13
mov rdi, qword [rbp + 8]
mov rax, rcx
sub rdx, r8
neg rax
and eax, 0x3f
add rcx, rax
lea rax, [r8 + 0x100]
lea r8, [rdx - 0x100]
cmp rax, r13
mov eax, 0
cmovb rax, r8
mov r8, rbx
xor edx, edx
mov r14, rax
call sub.msvcrt.dll_memset
mov rcx, rax
cmp r14, r13
jae 0x140010b60
sub r14, rdi
mov r12, rdi
mov r11, r13
xor eax, eax
mov r8, r14
mov r14, qword [rbp + 0x20]
sub r12, rbx
sub r11, rdi
xor edx, edx
xor r9d, r9d
add r14, rdi
mov rbp, r14
nop dword [rax]
lea r14, [rdi + r8]
mov r13, r12
mov r15, rdi
xor r13, r14
xor r15, r8
mov r10, r13
sub r13, 1
not r10
and r10, r13
mov r13, rdi
xor r13, r14
sar r10, 0x3f
or r13, r15
or r9, r10
and r10, rdx
xor r13, r14
or rax, r10
lea r10, [rdx + 1]
sar r13, 0x3f
and r9, r13
movzx r13d, byte [rbp + r8]
add r8, 1
and r13d, r9d
or byte [rcx + rdx], r13b
mov rdx, r10
mov r13, rbx
sub rdx, rbx
xor r13, r10
xor rdx, rbx
or rdx, r13
xor rdx, r10
sar rdx, 0x3f
and rdx, r10
cmp r11, r8
jne 0x140010a98
lea r9, [rsi + rbx]
test rbx, rbx
je 0x140010b55
nop dword [rax]
mov rdx, rax
mov r8, rbx
add rsi, 1
xor rdx, 0x20
add rdx, rcx
movzx edx, byte [rdx]
lea rdx, [rax + 1]
movzx eax, byte [rcx + rax]
xor r8, rdx
mov byte [rsi - 1], al
mov rax, rdx
sub rax, rbx
xor rax, rbx
or rax, r8
xor rax, rdx
sar rax, 0x3f
and rax, rdx
cmp r9, rsi
jne 0x140010b18
mov edx, 1
jmp 0x140010a03
xor eax, eax
jmp 0x140010b0b
Function at 0x14003e530
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
rol dx, 8
mov rbx, rcx
xor ecx, ecx
mov rsi, r8
mov word [rsp + 0x3e], dx
mov rdx, qword [rbx + 0xb0]
lea rax, [rsp + 0x38]
mov word [rsp + 0x3c], cx
mov rcx, qword [rdx + 0x120]
mov rdx, rax
mov dword [rsp + 0x38], 0
call fcn.140055740
test rax, rax
je 0x14003e6e8
mov dword [rsi], 1
mov rsi, qword [rax + 8]
lea rbp, [rbx + 0x830]
mov rax, qword [rbx + 0x88]
cmp dword [rsi + 0x28], 1
mov r8, qword [rsi + 8]
sbb rdi, rdi
mov rdx, qword [rsi + 0x58]
mov rcx, qword [rax + 8]
and edi, 0xb
add rdi, 1
add r8, rdi
call sub.msvcrt.dll_memcpy
mov rdx, qword [rsi + 8]
mov rax, qword [rbx + 0xb0]
movzx r8d, word [rsi + 0x10]
mov rcx, qword [rsi + 0x20]
add rdi, rdx
mov qword [rbx + 0x98], rdi
movzx r9d, byte [rsi]
mov qword [rax + 0x140], rdx
mov byte [rax + 0x138], r9b
mov rdx, qword [rbx + 0x16e0]
mov word [rax + 0x148], r8w
mov r15, qword [rbx + 0x468]
movzx edi, word [rdx + 2]
mov qword [rax + 0x158], rcx
mov rcx, rbp
mov qword [rax + 0x150], 0
mov r14, qword [rbx + 0x480]
mov r13, qword [rbx + 0x458]
mov r12, qword [rbx + 0x508]
mov dword [rax + 0x200], 1
mov rax, qword [rsi + 0x30]
movzx edx, word [rsi + 0x50]
mov qword [rbx + 0x468], rax
mov rax, qword [rsi + 0x38]
mov qword [rbx + 0x480], rax
mov rax, qword [rsi + 0x40]
mov qword [rbx + 0x458], rax
mov rax, qword [rsi + 0x48]
mov qword [rbx + 0x508], rax
call fcn.140009f20
cmp dword [rsi + 0x28], 1
mov rcx, rbx
sbb edx, edx
and edx, 2
add edx, 0x14
call fcn.14003d850
mov qword [rbx + 0x468], r15
movzx edx, di
mov rcx, rbp
mov qword [rbx + 0x480], r14
mov esi, eax
mov qword [rbx + 0x458], r13
mov qword [rbx + 0x508], r12
call fcn.140009f20
mov rcx, qword [rbx + 0x18]
xor r9d, r9d
xor r8d, r8d
mov rax, qword [rbx + 0xb0]
mov edx, 0xb
mov dword [rax + 0x200], 0
call fcn.14006e2b0
mov eax, esi
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea rax, str.ssl_statem_statem_dtls.c
mov r9d, 0x44
mov edx, 0x50
mov dword [rsp + 0x28], 0x45a
mov qword [rsp + 0x20], rax
mov r8d, 0x186
mov rcx, rbx
call fcn.140034b30
mov dword [rsi], 0
xor esi, esi
jmp 0x14003e6d1

Function at 0x140066bc0
Capabilities:
Get thread local storage value

Disassembly:
lea rcx, [0x14032c254]
jmp fcn.14011b580
Function at 0x140067cd0
Capabilities:
Resolve dns

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x470
mov rbp, rcx
mov ebx, edx
mov r12, r8
mov r13, r9
call fcn.14006af80
mov esi, eax
cmp eax, 1
je 0x140067d10
xor esi, esi
mov eax, esi
add rsp, 0x470
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
lea r14, [rsp + 0x60]
xor eax, eax
mov ecx, pe_nt_image_headers64
neg ebx
mov rdi, r14
sbb ebx, ebx
mov edx, 0x10
mov r9d, 0x401
rep stosq qword [rdi], rax
and ebx, 0xa
mov r8, r14
cmp word [rbp], 2
mov eax, 0x1c
mov rcx, rbp
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
cmovne edx, eax
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
mov byte [rdi], 0
lea rdi, [rsp + 0x40]
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], 0x20
mov qword [rsp + 0x20], rdi
call qword [sym.imp.WS2_32.dll_getnameinfo]
mov ebx, eax
test eax, eax
jne 0x140067e90
cmp byte [rsp + 0x40], 0
jne 0x140067dd3
movzx eax, word [rbp]
cmp ax, 2
je 0x140067f38
cmp ax, 0x17
je 0x140067f38
mov ecx, ebx
call qword [sym.imp.WS2_32.dll_ntohs]
lea r8, [0x140283654]
mov edx, 0x20
mov rcx, rdi
movzx r9d, ax
call fcn.14006aad0
test r12, r12
je 0x140067f00
lea rbx, str.crypto_bio_b_addr.c
mov r8d, 0xed
mov rcx, r14
mov rdx, rbx
call fcn.1400d2170
mov qword [r12], rax
test r13, r13
je 0x140067ed0
mov rcx, rdi
mov r8d, 0xef
mov rdx, rbx
call fcn.1400d2170
mov qword [r13], rax
mov rcx, qword [r12]
test rcx, rcx
je 0x140067f48
test rax, rax
jne 0x140067cfa
mov r8d, 0xfe
mov rdx, rbx
call fcn.1400c47e0
mov qword [r12], 0
mov rax, qword [r13]
mov r8d, 0x102
mov rdx, rbx
mov rcx, rax
call fcn.1400c47e0
mov qword [r13], 0
mov r8d, 0x41
mov edx, 0x86
mov ecx, 0x20
mov dword [rsp + 0x20], 0x105
lea r9, str.crypto_bio_b_addr.c
call fcn.1400a0f90
jmp 0x140067cf8
mov r8d, 2
mov edx, 0x86
mov ecx, 0x20
mov dword [rsp + 0x20], 0xdb
lea r9, str.crypto_bio_b_addr.c
call fcn.1400a0f90
mov ecx, ebx
call fcn.14021a360
mov ecx, 1
mov rdx, rax
call fcn.1400a2e00
jmp 0x140067cf8
test rax, rax
jne 0x140067cfa
mov r8d, 0xfe
mov rdx, rbx
xor ecx, ecx
call fcn.1400c47e0
mov qword [r12], 0
jmp 0x140067e5f
test r13, r13
je 0x140067cfa
lea rbx, str.crypto_bio_b_addr.c
mov r8d, 0xef
mov rcx, rdi
mov rdx, rbx
call fcn.1400d2170
mov qword [r13], rax
test rax, rax
jne 0x140067cfa
jmp 0x140067e46
movzx ebx, word [rbp + 2]
jmp 0x140067db3
mov r8d, 0xfe
mov rdx, rbx
xor ecx, ecx
call fcn.1400c47e0
mov qword [r12], 0
mov rax, qword [r13]
jmp 0x140067e46
Function at 0x140068650
Capabilities:
Resolve dns

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x78
mov r12, rcx
mov rbp, rdx
mov edi, r8d
mov ebx, r9d
cmp r9d, 0x17
ja 0x1400686a0
mov eax, 0x800005
bt rax, r9
jae 0x1400686a0
call fcn.14006af80
mov esi, eax
cmp eax, 1
je 0x1400686d0
xor esi, esi
mov eax, esi
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov r8d, 0x83
mov edx, 0x8f
mov ecx, 0x20
mov dword [rsp + 0x20], 0x297
lea r9, str.crypto_bio_b_addr.c
call fcn.1400a0f90
jmp 0x140068685
mov eax, dword [rsp + 0xd0]
pxor xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
mov dword [rsp + 0x44], ebx
mov dword [rsp + 0x48], eax
movups xmmword [rsp + 0x60], xmm0
test r12, r12
je 0x140068770
test ebx, ebx
jne 0x140068770
mov dword [rsp + 0x40], 0x400
mov eax, 0x401
cmp edi, 1
jne 0x140068711
mov dword [rsp + 0x40], eax
mov rbx, qword [sym.imp.WS2_32.dll_getaddrinfo]
xor r13d, r13d
lea rdi, [rsp + 0x40]
mov r9, qword [rsp + 0xd8]
mov r8, rdi
mov rdx, rbp
mov rcx, r12
call rbx
test eax, eax
je 0x140068687
cmp eax, 8
jne 0x140068780
mov r8d, 0x41
mov edx, 0x8f
mov ecx, 0x20
mov dword [rsp + 0x20], 0x2cb
lea r9, str.crypto_bio_b_addr.c
call fcn.1400a0f90
jmp 0x140068685
mov eax, 1
jmp 0x140068708
mov edx, dword [rsp + 0x40]
test dh, 4
je 0x140068798
and dh, 0xfb
mov r13d, eax
or edx, 4
mov dword [rsp + 0x40], edx
jmp 0x140068720
lea r9, str.crypto_bio_b_addr.c
mov r8d, 2
mov edx, 0x8f
mov dword [rsp + 0x20], 0x2da
mov ecx, 0x20
mov dword [rsp + 0x3c], eax
call fcn.1400a0f90
mov eax, dword [rsp + 0x3c]
test r13d, r13d
cmovne eax, r13d
mov ecx, eax
call fcn.14021a360
mov ecx, 1
mov rdx, rax
call fcn.1400a2e00
jmp 0x140068685

Function at 0x14006af80
Capabilities:
Initialize winsock library

Disassembly:
push rdi
sub rsp, 0x30
mov eax, dword [0x14032c418]
test eax, eax
je 0x14006afa0
mov eax, 1
add rsp, 0x30
pop rdi
ret
lea rdx, [0x14032c280]
xor eax, eax
mov ecx, 0x33
mov dword [0x14032c418], 1
mov rdi, rdx
rep stosq qword [rdi], rax
mov ecx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x14006af8f
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, 9
mov ecx, 2
mov dword [rsp + 0x20], 0x87
mov r8d, eax
lea r9, [0x1402839a0]
call fcn.1400a0f90
mov r8d, 0x7a
mov edx, 0x70
mov dword [rsp + 0x20], 0x88
lea r9, [0x1402839a0]
mov ecx, 0x20
call fcn.1400a0f90
mov eax, 0xffffffff
jmp 0x14006af94

Function at 0x14006b4d0
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x40
mov dword [rsp + 0x3c], edx
movsxd rcx, ecx
lea r8, [rsp + 0x3c]
mov edx, 0x8004667e
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov ebx, eax
test eax, eax
js 0x14006b500
xor eax, eax
test ebx, ebx
sete al
add rsp, 0x40
pop rbx
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, 5
mov ecx, 2
mov dword [rsp + 0x20], 0xc3
mov r8d, eax
lea r9, [0x1402839a0]
call fcn.1400a0f90
xor eax, eax
test ebx, ebx
sete al
add rsp, 0x40
pop rbx
ret
Function at 0x140070610
Capabilities:
Check if file exists

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rbx, rdx
mov rbp, rcx
call fcn.1400d1f60
mov edx, 0x62
mov rcx, rbx
mov rdi, rax
call sub.msvcrt.dll_strchr
cmp rax, 1
sbb esi, esi
and esi, 0x10
add esi, 1
test rdi, rdi
je 0x140070688
lea rcx, [0x140283f20]
call fcn.14006cad0
mov rbx, rax
test rax, rax
je 0x140070720
xor edx, edx
mov rcx, rax
call fcn.14006ced0
mov r9, rdi
mov r8d, esi
mov edx, 0x6a
mov rcx, rbx
call fcn.14006e2b0
mov rax, rbx
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, 1
mov ecx, 2
mov dword [rsp + 0x20], 0x45
mov r8d, eax
lea r9, str.crypto_bio_bss_file.c
call fcn.1400a0f90
lea rax, [0x140283e52]
mov qword [rsp + 0x20], rbx
mov r8, rbp
mov qword [rsp + 0x28], rax
lea r9, [0x140283e46]
mov ecx, 5
lea rdx, str.fopen_
call fcn.1400a2e00
mov rbx, qword [sym.imp.msvcrt.dll__errno]
call rbx
cmp dword [rax], 2
je 0x1400706f0
call rbx
cmp dword [rax], 6
jne 0x140070730
mov dword [rsp + 0x20], 0x4c
lea r9, str.crypto_bio_bss_file.c
mov r8d, pe_nt_image_headers64
xor ebx, ebx
mov edx, 0x6d
mov ecx, 0x20
call fcn.1400a0f90
jmp 0x140070679
mov rcx, rdi
xor ebx, ebx
call sub.msvcrt.dll_fclose
jmp 0x140070679
mov dword [rsp + 0x20], 0x4e
lea r9, str.crypto_bio_bss_file.c
mov r8d, 2
xor ebx, ebx
mov edx, 0x6d
mov ecx, 0x20
call fcn.1400a0f90
jmp 0x140070679

Function at 0x140072ca0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rdx
cmp rdx, r8
je 0x140072d53
mov r10, rcx
sub rcx, 1
not r10
and r10, rcx
mov ecx, dword [rdx + 8]
mov edx, dword [r8 + 8]
shr r10, 0x3f
xor edx, ecx
sub r10, 1
movsxd rdx, edx
and rdx, r10
xor ecx, edx
mov dword [rax + 8], ecx
mov ecx, dword [rax + 0x10]
xor dword [r8 + 8], edx
mov edx, dword [r8 + 0x10]
xor edx, ecx
movsxd rdx, edx
and rdx, r10
xor ecx, edx
mov dword [rax + 0x10], ecx
mov ecx, dword [rax + 0x14]
xor dword [r8 + 0x10], edx
mov edx, dword [r8 + 0x14]
xor edx, ecx
and rdx, r10
and edx, 4
xor ecx, edx
mov dword [rax + 0x14], ecx
xor dword [r8 + 0x14], edx
test r9d, r9d
jle 0x140072d53
mov rax, qword [rax]
mov rdx, qword [r8]
cmp r9d, 1
je 0x140072d27
lea rcx, [rax + 0xf]
sub rcx, rdx
cmp rcx, 0x1e
ja 0x140072d58
movsxd r9, r9d
lea r9, [rax + r9*8]
nop
mov r8, qword [rax]
mov rcx, qword [rdx]
add rax, 8
xor rcx, r8
and rcx, r10
xor r8, rcx
mov qword [rax - 8], r8
xor qword [rdx], rcx
add rdx, 8
cmp r9, rax
jne 0x140072d30
ret
mov r11d, r9d
movq xmm5, r10
mov r8, rax
mov rcx, rdx
shr r11d, 1
movddup xmm2, xmm5
shl r11, 4
add r11, rax
nop dword [rax]
movdqu xmm3, xmmword [r8]
movdqu xmm0, xmmword [rcx]
add r8, 0x10
add rcx, 0x10
pxor xmm0, xmm3
movdqa xmm1, xmm3
pand xmm0, xmm2
pxor xmm1, xmm0
movups xmmword [r8 - 0x10], xmm1
movdqu xmm4, xmmword [rcx - 0x10]
pxor xmm0, xmm4
movups xmmword [rcx - 0x10], xmm0
cmp r11, r8
jne 0x140072d78
mov ecx, r9d
and ecx, 0xfffffffe
and r9d, 1
je 0x140072d53
shl rcx, 3
add rax, rcx
add rdx, rcx
mov r8, qword [rax]
mov rcx, qword [rdx]
xor rcx, r8
and rcx, r10
xor r8, rcx
mov qword [rax], r8
xor qword [rdx], rcx
ret