joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003bdda
Capabilities:
Decrypt data via sspi

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0xa0
mov rax, qword [rdx + 0x48]
cmp rax, qword [rdx + 0x40]
ja 0x14003bfa1
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rdx + 0x38]
xorps xmm0, xmm0
lea r8, [rsp + 0x28]
movups xmmword [r8 + 0x30], xmm0
mov dword [r8], eax
mov dword [r8 + 4], 1
mov qword [r8 + 8], rcx
movups xmmword [r8 + 0x10], xmm0
movups xmmword [r8 + 0x20], xmm0
movabs rax, 0x400000000
lea rdx, [rsp + 0x68]
mov qword [rdx], rax
mov qword [rdx + 8], r8
lea rcx, [rdi + 0xe8]
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.secur32.dll_DecryptMessage]
cmp eax, 0x80090318
je 0x14003bf64
test eax, eax
je 0x14003beb4
cmp eax, 0x90317
je 0x14003bf5e
cmp eax, 0x90321
jne 0x14003bf82
mov dword [rdi + 0xa0], 0x10000
xor ebx, ebx
mov byte [rdi + 0xa4], bl
cmp dword [rsp + 0x5c], 5
mov rdx, qword [rdi + 0x48]
mov eax, 0
cmove eax, dword [rsp + 0x58]
sub rdx, rax
mov rcx, rdi
call fcn.14003bd82
and qword [rdi + 0x108], 0
mov byte [rsi + 1], bl
jmp 0x14003bf90
mov rax, qword [rdi + 0x28]
mov rdx, qword [rdi + 0x20]
sub rdx, rax
jb 0x14003bfa1
mov r14, qword [rsp + 0x40]
mov r15d, dword [rsp + 0x38]
lea rbx, [rdi + 0x10]
sub r14, qword [rdi + 0x38]
add r15, r14
and qword [rdi + 0x20], 0
mov r8, qword [rdi + 0x18]
lea r9, [r8 + rax]
lea rcx, [rsp + 0x78]
mov qword [rcx + 0x18], rax
mov qword [rcx + 0x20], rdx
mov qword [rcx], r8
mov qword [rcx + 8], r9
mov qword [rcx + 0x10], rbx
call fcn.140008a92
mov rcx, qword [rdi + 0x38]
mov rdx, qword [rdi + 0x40]
mov r8, r14
mov r9, r15
call fcn.14003bfad
lea r8, [rdx + rax]
mov rcx, rbx
mov rdx, rax
call fcn.140007bbe
and qword [rdi + 0x28], 0
xor ebx, ebx
cmp dword [rsp + 0x5c], 5
mov rdx, qword [rdi + 0x48]
mov eax, dword [rsp + 0x58]
cmovne eax, ebx
sub rdx, rax
mov rcx, rdi
call fcn.14003bd82
xor eax, eax
cmp qword [rdi + 0x48], rbx
sete al
mov qword [rdi + 0x108], rax
mov byte [rsi + 1], 0
jmp 0x14003bf90
mov byte [rsi + 1], 1
jmp 0x14003bf7e
cmp dword [rsp + 0x3c], 4
mov eax, 1
cmove eax, dword [rsp + 0x38]
mov qword [rdi + 0x108], rax
mov byte [rsi + 1], 0
xor ebx, ebx
jmp 0x14003bf90
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov bl, 1
mov byte [rsi], bl
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
ud2
Function at 0x14003bfc6
Capabilities:
Receive data
Receive data on socket

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov r15, rdx
mov r12, rcx
mov qword [rsp + 0x40], r8
mov rcx, r8
call fcn.14003c1a5
mov qword [rsp + 0x50], rax
mov rbp, qword [r12 + 8]
mov esi, 0x7fffffff
cmp rdx, rsi
mov qword [rsp + 0x48], rdx
cmovb rsi, rdx
mov rdi, qword [r12 + 0x10]
mov r13, qword [r12 + 0x18]
lea rcx, [rsp + 0x20]
mov rdx, rbp
mov r8, r15
xor r9d, r9d
call fcn.140086887
mov al, byte [rsp + 0x29]
cmp al, 3
je 0x14003c128
mov rbx, qword [rsp + 0x20]
cmp al, 2
je 0x14003c13a
mov cl, byte [rsp + 0x28]
lea r8, [rsp + 0x2a]
movzx edx, word [r8 + 4]
lea r9, [rsp + 0x3a]
mov word [r9 + 4], dx
mov edx, dword [r8]
mov dword [r9], edx
mov qword [rsp + 0x30], rbx
mov byte [rsp + 0x38], cl
mov byte [rsp + 0x39], al
cmp rdi, 0xffffffffffffffff
je 0x14003c189
mov rcx, rdi
mov rdx, qword [rsp + 0x50]
mov r8d, esi
xor r9d, r9d
call qword [sym.imp.ws2_32.dll_recv]
cmp eax, 0xffffffff
jne 0x14003c12f
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
cmp eax, 0x274a
je 0x14003c138
mov ebx, eax
test r13, r13
sete r14b
shl rbx, 0x20
or rbx, 2
mov rcx, rbx
call fcn.140017601
cmp al, 0xd
setne al
or al, r14b
jne 0x14003c102
mov rcx, qword [r13]
mov rdx, qword [r13 + 8]
lock inc qword [rdx]
jle 0x14003c189
add rcx, 0x10
mov r8, qword [r13 + 0x10]
mov r9b, byte [r13 + 0x18]
call fcn.140034c2e
mov r14, rax
xor ecx, ecx
call fcn.140034084
test r14, r14
je 0x14003c102
mov ecx, 1
mov rdx, rbx
call fcn.140034d14
mov rbx, r14
mov rcx, rbx
call fcn.140084193
cmp al, 0xd
jne 0x14003c13a
mov rcx, r12
lea rdx, [rsp + 0x30]
call fcn.1400867c5
mov rcx, rbx
call fcn.140084429
jmp 0x14003c00e
mov edi, 1
jmp 0x14003c13c
movsxd rsi, eax
xor ebx, ebx
xor edi, edi
jmp 0x14003c13e
xor ebx, ebx
xor edi, edi
xor esi, esi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], rbx
test rdi, rdi
jne 0x14003c172
test rbx, rbx
jne 0x14003c172
cmp rsi, qword [rsp + 0x48]
ja 0x14003c189
lea rcx, [rsp + 0x58]
call fcn.14003c18b
mov rcx, qword [rsp + 0x40]
mov rdx, rsi
call fcn.14003c1b8
xor ebx, ebx
mov rax, rdi
mov rdx, rbx
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
ud2
Function at 0x14003c3de
Capabilities:
Decrypt data via sspi

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0xa0
mov rax, qword [rdx + 0x170]
cmp rax, qword [rdx + 0x168]
ja 0x14003c5d2
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rdx + 0x160]
xorps xmm0, xmm0
lea r8, [rsp + 0x28]
movups xmmword [r8 + 0x30], xmm0
mov dword [r8], eax
mov dword [r8 + 4], 1
mov qword [r8 + 8], rcx
movups xmmword [r8 + 0x10], xmm0
movups xmmword [r8 + 0x20], xmm0
movabs rax, 0x400000000
lea rdx, [rsp + 0x68]
mov qword [rdx], rax
mov qword [rdx + 8], r8
lea rcx, [rdi + 0x1e8]
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.secur32.dll_DecryptMessage]
cmp eax, 0x80090318
je 0x14003c595
test eax, eax
je 0x14003c4c4
cmp eax, 0x90317
je 0x14003c58f
cmp eax, 0x90321
jne 0x14003c5b3
mov dword [rdi + 0x1c8], 0x10000
xor ebx, ebx
mov byte [rdi + 0x1cc], bl
cmp dword [rsp + 0x5c], 5
mov rdx, qword [rdi + 0x170]
mov eax, 0
cmove eax, dword [rsp + 0x58]
sub rdx, rax
mov rcx, rdi
call fcn.14003c374
and qword [rdi + 0x208], 0
mov byte [rsi + 1], bl
jmp 0x14003c5c1
mov rax, qword [rdi + 0x150]
mov rdx, qword [rdi + 0x148]
sub rdx, rax
jb 0x14003c5d2
mov r14, qword [rsp + 0x40]
mov r15d, dword [rsp + 0x38]
lea rbx, [rdi + 0x138]
sub r14, qword [rdi + 0x160]
add r15, r14
and qword [rdi + 0x148], 0
mov r8, qword [rdi + 0x140]
lea r9, [r8 + rax]
lea rcx, [rsp + 0x78]
mov qword [rcx + 0x18], rax
mov qword [rcx + 0x20], rdx
mov qword [rcx], r8
mov qword [rcx + 8], r9
mov qword [rcx + 0x10], rbx
call fcn.140008a92
mov rcx, qword [rdi + 0x160]
mov rdx, qword [rdi + 0x168]
mov r8, r14
mov r9, r15
call fcn.14003bfad
lea r8, [rdx + rax]
mov rcx, rbx
mov rdx, rax
call fcn.140007bbe
and qword [rdi + 0x150], 0
xor ebx, ebx
cmp dword [rsp + 0x5c], 5
mov rdx, qword [rdi + 0x170]
mov eax, dword [rsp + 0x58]
cmovne eax, ebx
sub rdx, rax
mov rcx, rdi
call fcn.14003c374
xor eax, eax
cmp qword [rdi + 0x170], rbx
sete al
mov qword [rdi + 0x208], rax
mov byte [rsi + 1], 0
jmp 0x14003c5c1
mov byte [rsi + 1], 1
jmp 0x14003c5af
cmp dword [rsp + 0x3c], 4
mov eax, 1
cmove eax, dword [rsp + 0x38]
mov qword [rdi + 0x208], rax
mov byte [rsi + 1], 0
xor ebx, ebx
jmp 0x14003c5c1
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov bl, 1
mov byte [rsi], bl
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
ud2
Function at 0x14003c5d4
Capabilities:
Receive data
Receive data on socket

Disassembly:
cmp dword [rcx], 2
jne 0x14003c5e6
add rcx, 8
jmp fcn.14003bfc6
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x78
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
mov rcx, r8
call fcn.14003c1a5
lea rcx, [rsp + 0x58]
mov qword [rcx], rax
mov qword [rcx + 8], rdx
xorps xmm0, xmm0
movups xmmword [rcx + 0x10], xmm0
mov qword [rdi + 0xe0], rbx
call fcn.14003c792
mov r14, rax
mov r15, rdx
lea r12, [rsp + 0x30]
mov rcx, rdi
call fcn.14003c7ec
test rdx, rdx
jne 0x14003c69b
mov rcx, r12
mov rdx, rdi
call fcn.14003afd7
mov eax, dword [rsp + 0x30]
cmp eax, 2
je 0x14003c6f3
test al, 1
je 0x14003c69b
cmp qword [rdi + 0x108], 0
je 0x14003c682
mov rcx, rdi
call fcn.14003bbf7
mov rbx, rdx
test rax, rax
jne 0x14003c6ff
test rbx, rbx
je 0x14003c69b
and qword [rdi + 0x108], 0
mov rcx, r12
mov rdx, rdi
call fcn.14003bdda
cmp byte [rsp + 0x30], 0
jne 0x14003c6f3
cmp byte [rsp + 0x31], 0
je 0x14003c62e
mov rcx, rdi
call fcn.14003c7ec
mov rbx, rdx
test rax, rax
je 0x14003c6ff
cmp r15, rbx
cmovb rbx, r15
lea rcx, [0x1400ec930]
mov qword [rsp + 0x20], rcx
mov rcx, r14
mov rdx, rbx
mov r8, rax
mov r9, rbx
call fcn.140091ce0
mov rax, qword [rdi + 0x28]
add rax, rbx
cmp rax, qword [rdi + 0x20]
ja 0x14003c790
mov qword [rdi + 0x28], rax
lea rcx, [rsp + 0x58]
mov rdx, rbx
call fcn.14003c7d9
jmp 0x14003c732
mov rbx, qword [rsp + 0x38]
mov qword [rsp + 0x30], rbx
jmp 0x14003c709
mov qword [rsp + 0x30], rbx
test rbx, rbx
je 0x14003c732
mov rcx, rbx
call fcn.140017601
and qword [rdi + 0xe0], 0
cmp al, 0xd
jne 0x14003c742
lea rcx, [rsp + 0x30]
call fcn.140039ebc
mov edi, 1
xor ebx, ebx
xor eax, eax
jmp 0x14003c746
and qword [rdi + 0xe0], 0
mov al, 1
xor ebx, ebx
xor edi, edi
jmp 0x14003c746
xor edi, edi
mov al, 1
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rbx
test al, al
je 0x14003c77c
test rbx, rbx
jne 0x14003c77c
mov rbx, qword [rsp + 0x68]
cmp rbx, qword [rsp + 0x60]
ja 0x14003c790
lea rcx, [rsp + 0x48]
call fcn.14003c18b
mov rcx, rsi
mov rdx, rbx
call fcn.14003c1b8
xor ebx, ebx
mov rax, rdi
mov rdx, rbx
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
ud2
Function at 0x14004a9b5
Capabilities:
Check for software breakpoints
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov eax, 0x2da8
call fcn.140091d30
sub rsp, rax
movdqa xmmword [rsp + 0x2d90], xmm10
movdqa xmmword [rsp + 0x2d80], xmm9
movaps xmmword [rsp + 0x2d70], xmm8
movaps xmmword [rsp + 0x2d60], xmm7
movdqa xmmword [rsp + 0x2d50], xmm6
mov rbp, rdx
mov rbx, rcx
movabs r14, 0x8000000000000001
add byte [rax], al
add byte [rax], al
add byte [rax], al
or byte [rax - 0x73], 0xb1
cmp byte [rcx], al
add byte [rax], al
lea rax, [rcx + 0x1a0]
mov qword [rsp + 0x90], rax
lea rdi, [rcx + 0x220]
mov eax, 0xb8
add rcx, rax
mov qword [rsp + 0xb0], rcx
lea rcx, [rbx + 0x241]
mov qword [rsp + 0x4e8], rcx
mov ecx, 0xe0
lea rdx, [rbx + rcx]
mov qword [rsp + 0x4c0], rdx
lea rdx, [rsp + 0x2000]
add rcx, rdx
mov qword [rsp + 0x4c8], rcx
enter 4, 0
add rax, rdx
mov qword [rsp + 0x4d0], rax
pcmpeqd xmm6, xmm6
xorps xmm7, xmm7
movss xmm8, dword [0x140095870]
lea rax, [rbx + 0x140]
mov qword [rsp + 0x4e0], rax
and al, 0xe0
add al, 0
add byte [rax - 0x73], cl
xor eax, 1
add byte [rax], al
mov qword [rsp + 0xf0], rax
lea rax, [rbx + 0x1e1]
mov qword [rsp + 0x4d8], rax
lea rax, [rbx + 0x90]
mov qword [rsp + 0x120], rax
lea rax, [rbx + 0x158]
mov qword [rsp + 0x4b0], rax
lea rax, [rbx + 0xd0]
mov qword [rsp + 0x4b8], rax
lea rax, [rbx + 0x30]
mov qword [rsp + 0x270], rax
lea rax, [rbx + 0x10]
mov qword [rsp + 0xa0], rax
and al, 0xa0
add byte [rax], al
add byte [rax - 0x39], cl
test byte [rax + riz*2], ah
add dword [rax], eax
add byte [rax], al
add byte [rax], al
add byte [rbp + rcx*4 - 0x54], cl
and al, 0xf0
invalid
add byte [rax], al
lea r12, [rsp + 0x280]
mov qword [rsp + 0x260], rax
mov dword [rsp + 0x128], eax
xor eax, eax
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x98], rsi
mov qword [rsp + 0x78], rdi
Function at 0x14005a0c2
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov eax, 0x11d8
call fcn.140091d30
sub rsp, rax
movaps xmmword [rsp + 0x11c0], xmm6
mov qword [rsp + 0x80], r8
mov r14, rdx
mov qword [rsp + 0x178], rcx
mov rdx, qword [rdx + 0x498]
add rdx, 0x10
lea rsi, [rsp + 0x220]
mov rcx, rsi
call fcn.14001527b
mov rsi, qword [rsi + 8]
mov r15d, dword [rsi + 0xe0]
cmp r15d, 1
jne 0x14005a20b
lea rax, [rsi + 8]
mov qword [rsp + 0x50], rax
lea rbx, [rsi + 0x1b8]
lea r13, [rsi + 0xe0]
call fcn.14007e53c
mov rbp, rax
mov r12d, edx
mov rdi, qword [rsi + 0xa0]
mov eax, dword [rsi + 0xa8]
mov dword [rsp + 0xf0], eax
test r15b, 1
je 0x14005a20b
mov rax, qword [rsi + 0xe4]
mov qword [rsp + 0x228], rax
mov qword [rsp + 0x220], rbx
lea rcx, [rsp + 0x220]
call fcn.14001a90d
mov r9d, dword [rax + 0x48]
cmp r9d, 0x3b9aca00
je 0x140061056
mov r8, qword [rax + 0x40]
mov rcx, rbp
mov edx, r12d
call fcn.140081894
xor ecx, ecx
cmp rax, rdi
setne cl
mov eax, 0xff
cmovb ecx, eax
test cl, cl
jne 0x14005a1ca
cmp edx, dword [rsp + 0xf0]
setne cl
jb 0x14005a20b
cmp cl, 1
jne 0x14005a20b
lea rcx, [rsp + 0x430]
mov rdx, r13
mov r8, rbx
call fcn.14001cda8
cmp qword [rsp + 0x430], 0
je 0x14005a20b
mov rcx, qword [rsp + 0x50]
lea rdx, [rsp + 0x430]
mov r8b, 1
call fcn.14001ab66
mov r15d, dword [r13]
jmp 0x14005a15c
mov rcx, rsi
call fcn.14001537b
lea rax, [r14 + 0x3b8]
mov qword [rsp + 0x3d0], rax
lea rax, [r14 + 0x4a8]
mov qword [rsp + 0x9f8], rax
lea rax, [r14 + 0x48]
mov qword [rsp + 0xf0], rax
mov eax, 0x120
lea r12, [rsp + 0x220]
add rax, r12
mov qword [rsp + 0x728], rax
mov eax, 0x119
lea r13, [rsp + 0x430]
lea rcx, [r13 + rax]
mov qword [rsp + 0x5c0], rcx
mov ecx, 0x11d
lea rdx, [rcx + r13]
mov qword [rsp + 0x5b8], rdx
lea rdx, [rsp + 0xb70]
add rax, rdx
mov qword [rsp + 0xa08], rax
add rcx, rdx
mov qword [rsp + 0xa00], rcx
xorps xmm6, xmm6
lea r15, [rsp + 0x228]
lea rax, [r14 + 0x390]
mov qword [rsp + 0x3d8], rax
lea rax, [r14 + 0x3a8]
mov qword [rsp + 0xa18], rax
lea rax, [r14 + 0x430]
mov qword [rsp + 0x738], rax
lea rax, [r14 + 0x50]
mov qword [rsp + 0x9f0], rax
lea rax, [r14 + 0x58]
mov qword [rsp + 0x720], rax
lea rax, [r14 + 0x3f4]
mov qword [rsp + 0x730], rax
lea rax, [r14 + 0x1c8]
mov qword [rsp + 0x5a8], rax
lea rax, [r14 + 0x230]
mov qword [rsp + 0x398], rax
lea rdi, [r14 + 0x1a0]
lea rax, [r14 + 0x238]
mov qword [rsp + 0x5b0], rax
lea rax, [r14 + 0x358]
mov qword [rsp + 0x718], rax
lea rax, [r14 + 0x469]
mov qword [rsp + 0xa10], rax
mov qword [rsp + 0x1c8], rax
mov dword [rsp + 0xe4], eax
mov dword [rsp + 0xe0], eax
mov dword [rsp + 0x18c], eax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
mov dword [rsp + 0xc0], eax
mov dword [rsp + 0xbc], eax
mov dword [rsp + 0xac], eax
mov qword [rsp + 0x158], rax
mov qword [rsp + 0x3c8], rax
mov qword [rsp + 0x168], rax
mov qword [rsp + 0x140], rax
mov rbp, qword [rsp + 0x80]
mov qword [rsp + 0x50], rdi
Function at 0x14007a8ac
Capabilities:
Get remote cert context via schannel

Disassembly:
sub rsp, 0x28
lea r8, [rsp + 0x20]
and qword [r8], 0
mov edx, 0x53
call qword [sym.imp.secur32.dll_QueryContextAttributesW]
mov edx, eax
xor eax, eax
test edx, edx
setne cl
jne 0x14007a8d6
mov rdx, qword [rsp + 0x20]
jmp 0x14007a8de
shl rdx, 0x20
or rdx, 2
mov al, cl
add rsp, 0x28
ret
Function at 0x14007b08f
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x38
mov eax, edx
lea r9, [rsp + 0x34]
mov dword [r9], r8d
mov dword [rsp + 0x20], 4
mov edx, 0xffff
mov r8d, eax
call qword [sym.imp.ws2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x14007b0bc
xor eax, eax
jmp 0x14007b0c1
call fcn.140034637
nop
add rsp, 0x38
ret

Function at 0x14007c5e7
Capabilities:
Write file on windows

Disassembly:
mov r9, rcx
mov ecx, 0xfffffff4
invalid
invalid
invalid
jmp fcn.14007c63c
Function at 0x14007dc70
Capabilities:
Create thread

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rdi, r8
mov rbx, rdx
mov r14, rcx
mov ecx, 0x10

Function at 0x1400815fd
Capabilities:
Resolve dns

Disassembly:
push rsi
push rdi
sub rsp, 0x68
mov rax, r8
mov rdi, rdx
mov rsi, rcx
xorps xmm0, xmm0
lea r8, [rsp + 0x30]
movaps xmmword [r8], xmm0
movaps xmmword [r8 + 0x20], xmm0
movaps xmmword [r8 + 0x10], xmm0
mov dword [r8 + 8], 1
lea r9, [rsp + 0x28]
and qword [r9], 0
mov rcx, rax
xor edx, edx
call qword [sym.imp.ws2_32.dll_getaddrinfo]
test eax, eax
je 0x14008164e
call fcn.14008166e
mov ecx, 1
jmp 0x140081660
mov rax, qword [rsp + 0x28]
movzx ecx, word [rdi]
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], cx
xor ecx, ecx
mov qword [rsi + 8], rax
mov qword [rsi], rcx
add rsp, 0x68
pop rdi
pop rsi
ret

Function at 0x14008169f
Capabilities:
Initialize winsock library

Disassembly:
push rsi
push rdi
sub rsp, 0x1b8
mov rax, qword [rcx]
mov rdi, qword [rax]
and qword [rax], 0
test rdi, rdi
je 0x1400816f1
lea rsi, [rsp + 0x20]
mov r8d, 0x198
mov rcx, rsi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov cx, 0x202
mov rdx, rsi
call qword [sym.imp.ws2_32.dll_WSAStartup]
test eax, eax
jne 0x1400816f1
mov rax, qword [sym.imp.ws2_32.dll_WSACleanup]
mov qword [rdi], rax
add rsp, 0x1b8
pop rdi
pop rsi
ret
ud2

Function at 0x140086441
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rcx]
mov rdx, rax
xor rdx, 3
lock cmpxchg qword [rcx], rdx
jne 0x140086444
test al, 1
je 0x14008645f
test al, 2
jne 0x14008645f
xor rax, 3
ret
ud2

Function at 0x140086a43
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x38
cmp rcx, 0xffffffffffffffff
je 0x140086a85
movzx eax, dl
lea r9, [rsp + 0x34]
mov dword [r9], eax
mov dword [rsp + 0x20], 4
mov edx, 6
mov r8d, 1
call qword [sym.imp.ws2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x140086a7a
xor eax, eax
jmp 0x140086a7f
call fcn.14008166e
nop
add rsp, 0x38
ret
ud2
Function at 0x140086a87
Capabilities:
Send data
Send data on socket

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov qword [rsp + 0x40], r8
mov rdi, rdx
mov rbx, rcx
mov r14, qword [rcx + 8]
mov r15, qword [rcx + 0x10]
mov r12d, 0x7fffffff
cmp r9, r12
cmovb r12, r9
mov rsi, qword [rcx + 0x18]
lea rcx, [rsp + 0x20]
mov rdx, r14
mov r8, rdi
call fcn.140086a3b
mov al, byte [rsp + 0x29]
cmp al, 3
je 0x140086bc1
mov rbp, qword [rsp + 0x20]
cmp al, 2
je 0x140086bba
mov cl, byte [rsp + 0x28]
lea r8, [rsp + 0x2a]
movzx edx, word [r8 + 4]
lea r9, [rsp + 0x3a]
mov word [r9 + 4], dx
mov edx, dword [r8]
mov dword [r9], edx
mov qword [rsp + 0x30], rbp
mov byte [rsp + 0x38], cl
mov byte [rsp + 0x39], al
cmp r15, 0xffffffffffffffff
je 0x140086be1
mov rcx, r15
mov rdx, qword [rsp + 0x40]
mov r8d, r12d
xor r9d, r9d
call qword [sym.imp.ws2_32.dll_send]
cmp eax, 0xffffffff
jne 0x140086bc8
test rsi, rsi
sete r13b
call fcn.14008166e
mov rbp, rax
mov rcx, rax
call fcn.140017601
cmp al, 0xd
setne al
or al, r13b
jne 0x140086b94
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
lock inc qword [rdx]
jle 0x140086be1
add rcx, 0x10
mov r8, qword [rsi + 0x10]
mov r9b, byte [rsi + 0x18]
call fcn.140034c2e
mov r13, rax
xor ecx, ecx
call fcn.140034084
test r13, r13
je 0x140086b94
mov ecx, 1
mov rdx, rbp
call fcn.140034d14
mov rbp, r13
mov rcx, rbp
call fcn.140084193
cmp al, 0xd
jne 0x140086bba
mov rcx, rbx
lea rdx, [rsp + 0x30]
call fcn.1400867c5
mov rcx, rbp
call fcn.140084429
jmp 0x140086abb
mov eax, 1
jmp 0x140086bcd
mov eax, 2
jmp 0x140086bcd
movsxd rbp, eax
xor eax, eax
mov rdx, rbp
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
ud2
Function at 0x1400924ac
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.kernel32.dll_GetModuleHandleW]
test rax, rax
je 0x1400924f6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400924f6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400924f6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400924f6
cmp dword [rcx + 0x84], 0xe
jbe 0x1400924f6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400924f8
xor al, al
add rsp, 0x28
ret
Function at 0x140002760
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400027aa
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400027aa
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400027aa
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400027aa
cmp dword [rcx + 0x84], 0xe
jbe 0x1400027aa
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400027ac
xor al, al
add rsp, 0x28
ret
Function at 0x1400069c0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 7], sil
je 0x1400069f4
mov eax, esi
lea ecx, [rax - 0x65]
xor byte [r8 + rax], cl
inc rax
cmp rax, 6
jb 0x1400069e0
mov byte [r8 + 7], sil
add r8, 6
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.1400063a0
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140006a19
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140012ae0
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140006a93
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006a8e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006a8e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400675dc
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x140006aa0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 9], sil
je 0x140006ad4
mov eax, esi
lea ecx, [rax - 0x65]
xor byte [r8 + rax], cl
inc rax
cmp rax, 8
jb 0x140006ac0
mov byte [r8 + 9], sil
add r8, 8
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.1400063a0
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140006af9
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140012ae0
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140006b73
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006b6e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006b6e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400675dc
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret