joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140121510
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x30
mov eax, dword [0x14049a6a0]
mov rbx, rcx
mov dword [rsp + 0x50], 0x4020
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x58], 4
test eax, eax
jne 0x140121574
lea r9d, [rax + 2]
mov dword [rsp + 0x20], 3
xor r8d, r8d
lea ecx, [rax + 6]
xor edx, edx
call fcn.140128040
test al, al
je 0x140121568
mov dword [0x14049a6a0], 2
add rsp, 0x30
pop rbx
ret
mov dword [0x14049a6a0], 1
jmp 0x140121579
cmp eax, 2
je 0x1401215cb
lea rax, [rsp + 0x58]
mov edx, 0xffff
lea r9, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r8d, 0x1001
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x1401215aa
mov eax, dword [rsp + 0x50]
cmp dword [rsp + 0x48], eax
jg 0x1401215cb
lea r9, [rsp + 0x50]
mov dword [rsp + 0x20], 4
mov edx, 0xffff
mov r8d, 0x1001
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_setsockopt]
add rsp, 0x30
pop rbx
ret

Function at 0x140121f80
Capabilities:
Connect socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rbx, qword [rcx + 0x10]
mov rdi, rdx
mov rbp, rcx
mov r8d, dword [rbx + 0x14]
lea rdx, [rbx + 0x18]
mov rcx, qword [rbx + 0x98]
lea rsi, [rbx + 0xe0]
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x140121fd5
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov rdx, rsi
mov rcx, rdi
mov r8d, eax
call fcn.140122620
jmp 0x140122052
mov rdx, rdi
mov byte [rbx + 0x17e], 1
mov rcx, rbp
call fcn.140122350
cmp dword [rbx], 5
lea rax, str.QUIC
lea rcx, [rbx + 0x114]
mov rdx, rbp
lea r9, [0x14034fcd8]
cmove r9, rax
lea r8, str._s_socket__qd_connected:___s:_d_______s:_d_
mov eax, dword [rbx + 0x110]
mov dword [rsp + 0x40], eax
mov eax, dword [rbx + 0x144]
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x30], eax
mov rax, qword [rbx + 0x98]
mov qword [rsp + 0x28], rcx
mov rcx, rdi
mov qword [rsp + 0x20], rax
call fcn.1400ee030
mov rcx, qword [rbx + 0x98]
mov edx, 1
call fcn.14012d340
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret

Function at 0x1401220d0
Capabilities:
Connect socket

Disassembly:
mov rcx, qword [rcx + 0x10]
test r8b, r8b
jne 0x1401220ef
mov r8d, dword [rcx + 0x14]
lea rdx, [rcx + 0x18]
mov rcx, qword [rcx + 0x98]
jmp qword [sym.imp.WS2_32.dll_connect]
mov eax, 0xffffffff
ret
Function at 0x140122100
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x148
mov rax, qword [0x140462680]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rax, qword [rcx]
mov rdi, rcx
mov rsi, r9
mov rbp, r8
mov rcx, qword [rax + 0x10]
mov dword [r9], 0
xor r9d, r9d
mov rcx, qword [rcx + 0x98]
call qword [sym.imp.WS2_32.dll_recv]
movsxd rbx, eax
cmp rbx, 0xffffffffffffffff
jne 0x1401221a1
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, eax
cmp eax, 0x2733
jne 0x140122165
mov dword [rsi], 0x51
jmp 0x14012219a
mov r8d, 0x100
lea rdx, [rsp + 0x30]
mov ecx, ebx
call fcn.140100770
mov rcx, qword [rdi + 8]
lea rdx, str.Recv_failure:__s
mov r8, rax
call fcn.1400edea0
mov rax, qword [rdi + 8]
mov dword [rax + 0xd64], ebx
mov dword [rsi], reloc.WS2_32.dll_getservbyport
mov rbx, 0xffffffffffffffff
mov edx, dword [rsi]
lea r8, str.nw_in_read_len_zu______d__err_d
mov rcx, qword [rdi + 8]
mov r9, rbp
mov dword [rsp + 0x28], edx
mov rdx, qword [rdi]
mov dword [rsp + 0x20], ebx
call fcn.1400ee030
mov rax, rbx
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.14033bfd0
add rsp, 0x148
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x140122320
Capabilities:
Set socket configuration

Disassembly:
mov dword [rsp + 0x10], edx
sub rsp, 0x38
mov edx, reloc.WLDAP32.dll_Ordinal_41
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x48]
lea r8d, [rdx - 0xe]
call qword [sym.imp.WS2_32.dll_setsockopt]
add rsp, 0x38
ret
Function at 0x140122350
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x1c0
mov rax, qword [0x140462680]
xor rax, rsp
mov qword [rsp + 0x1b0], rax
mov rax, qword [rdx + 0x20]
mov rsi, rdx
mov rbx, qword [rcx + 0x10]
mov rcx, qword [rax + 0x2c8]
test dword [rcx + 0x84], 0x800
jne 0x140122493
mov rcx, qword [rbx + 0x98]
lea r8, [rsp + 0x20]
xorps xmm0, xmm0
mov dword [rsp + 0x20], Ordinal_133
lea rdx, [rsp + 0x30]
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x90], xmm0
movups xmmword [rsp + 0xa0], xmm0
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x140122421
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r8d, 0x100
lea rdx, [rsp + 0xb0]
mov ecx, eax
mov ebx, eax
call fcn.140100770
mov r9, rax
lea rdx, str.getsockname___failed_with_errno__d:__s
mov r8d, ebx
mov rcx, rsi
call fcn.1400edea0
mov eax, 2
jmp 0x140122495
mov edx, dword [rsp + 0x20]
lea r9, [rbx + 0x144]
lea r8, [rbx + 0x114]
lea rcx, [rsp + 0x30]
call fcn.1400ef3a0
test al, al
jne 0x140122493
mov qword [rsp + 0x1e0], rdi
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ebx, dword [rax]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov r8d, 0x100
lea rdx, [rsp + 0xb0]
mov ecx, ebx
mov rdi, rax
call fcn.140100770
mov r8d, dword [rdi]
lea rdx, str.ssloc_inet_ntop___failed_with_errno__d:__s
mov r9, rax
mov rcx, rsi
call fcn.1400edea0
mov rdi, qword [rsp + 0x1e0]
mov eax, 2
jmp 0x140122495
xor eax, eax
mov rcx, qword [rsp + 0x1b0]
xor rcx, rsp
call fcn.14033bfd0
mov rbx, qword [rsp + 0x1e8]
add rsp, 0x1c0
pop rsi
ret
Function at 0x140122750
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x140462680]
xor rax, rsp
mov qword [rsp + 0x68], rax
xor esi, esi
mov dword [rsp + 0x20], 4
mov eax, esi
lea r9, [rsp + 0x50]
cmp byte [rcx + 0xa9a], al
mov rdi, rdx
mov rbx, rcx
mov edx, 0xffff
setne al
lea r8d, [rsi + 8]
mov rcx, rdi
mov dword [rsp + 0x50], eax
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x1401227bf
mov r8, rdi
lea rdx, str.Failed_to_set_SO_KEEPALIVE_on_fd__qd
mov rcx, rbx
call fcn.1400edf90
jmp 0x14012284e
mov ecx, dword [rbx + 0xa0c]
mov dword [rsp + 0x58], 1
call fcn.1400f0970
imul ecx, eax, 0x3e8
mov dword [rsp + 0x50], ecx
mov dword [rsp + 0x5c], ecx
mov ecx, dword [rbx + 0xa10]
call fcn.1400f0970
imul ecx, eax, 0x3e8
lea r8, [rsp + 0x58]
mov qword [rsp + 0x40], rsi
lea rax, [rsp + 0x54]
mov qword [rsp + 0x38], rsi
mov r9d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
mov qword [rsp + 0x30], rax
mov edx, 0x98000004
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x50], ecx
mov dword [rsp + 0x60], ecx
mov rcx, rdi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
je 0x14012284e
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r8, rdi
lea rdx, str.Failed_to_set_SIO_KEEPALIVE_VALS_on_fd__qd:__d
mov r9d, eax
mov rcx, rbx
call fcn.1400edf90
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14033bfd0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x140122870
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x150
mov rax, qword [0x140462680]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rax, rdx
mov dword [rsp + 0x30], 1
mov edx, 6
mov dword [rsp + 0x20], 4
mov rbx, rcx
lea r9, [rsp + 0x30]
mov rcx, rax
lea r8d, [rdx - 5]
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x1401228e6
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r8d, 0x100
lea rdx, [rsp + 0x40]
mov ecx, eax
call fcn.140100770
mov r8, rax
lea rdx, str.Could_not_set_TCP_NODELAY:__s
mov rcx, rbx
call fcn.1400edf90
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14033bfd0
add rsp, 0x150
pop rbx
ret
Function at 0x14012ffe0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push r15
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbp, rcx
mov ecx, dword [rcx + 0x20]
mov rsi, rdx
add rcx, 0x18
mov r15d, r8d
lea r9d, [rax + rax]
add rcx, r9
call qword [section..data]
mov rbx, rax
test rax, rax
jne 0x140130023
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop rsi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbp
mov qword [rax + 8], rcx
mov eax, dword [rbp + 0x18]
add rax, rcx
mov qword [rsp + 0x48], rdi
mov qword [rbx + 0x10], rax
lea rdi, [rbp + 8]
mov qword [rsp + 0x50], r14
cmp r15d, dword [rbp + 0x1c]
jbe 0x140130070
call qword [rbp]
mov rcx, qword [rbx + 8]
mov r8d, r15d
mov rdx, rsi
call qword [rdi]
mov esi, dword [rbp + 0x18]
add rsi, qword [rbx + 0x10]
mov rdx, qword [rbx + 8]
mov rcx, rsi
call qword [rbp + reloc.WS2_32.dll_recv]
mov r15d, dword [rbp + 0x20]
mov rcx, qword [rbx + 8]
call qword [rbp]
mov rcx, qword [rbx + 0x10]
call qword [rbp]
xor r14d, r14d
test r15, r15
je 0x1401300d2
mov r14, r15
nop dword [rax]
movzx eax, byte [rsi]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rbx + 8]
call qword [rdi]
movzx eax, byte [rsi]
lea rdx, [rsp + 0x40]
xor al, 0x5c
lea rsi, [rsi + 1]
mov byte [rsp + 0x40], al
mov r8d, 1
mov rcx, qword [rbx + 0x10]
call qword [rdi]
sub r15, 1
jne 0x140130090
lea rdi, [rbp + 8]
mov eax, dword [rbp + 0x1c]
cmp r14, rax
jae 0x140130111
nop word [rax + rax]
mov rcx, qword [rbx + 8]
lea rdx, [0x140351da0]
mov r8d, 1
call qword [rdi]
mov rcx, qword [rbx + 0x10]
lea rdx, [0x140351da1]
mov r8d, 1
call qword [rdi]
mov eax, dword [rbp + 0x1c]
inc r14
cmp r14, rax
jb 0x1401300e0
mov r14, qword [rsp + 0x50]
mov rax, rbx
mov rbx, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rsi
pop rbp
ret

Function at 0x140130760
Capabilities:
Create new key via cryptacquirecontext
Hash data using md4
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
lea rdi, [rcx + 8]
mov r9d, 1
xor r8d, r8d
mov qword [rdi], 0
xor edx, edx
mov qword [rcx], 0
mov rbx, rcx
mov dword [rsp + 0x20], 0xf0000040
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x1401307cb
mov rcx, qword [rbx]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov edx, 0x8002
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x1401307d8
mov rcx, qword [rbx]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov qword [rbx], 0
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x40]
mov eax, 1
add rsp, 0x30
pop rdi
ret
Function at 0x140178de0
Capabilities:
Get socket status

Disassembly:
push rbx
push rsi
push rdi
mov eax, 0x690
call fcn.14033cab0
sub rsp, rax
mov rax, qword [0x140462680]
xor rax, rsp
mov qword [rsp + 0x670], rax
mov rsi, qword [rsp + 0x6d8]
mov eax, edx
xor edx, edx
mov r10d, ecx
mov dword [rsp + 0x460], 0
mov dword [rsp + 0x250], 0
mov dword [rsp + 0x40], edx
cmp ecx, 0xffffffff
je 0x140178e48
test eax, eax
je 0x140178e48
mov qword [rsp + 0x468], r10
mov dword [rsp + 0x460], 1
cmp r8d, 0xffffffff
je 0x140178e69
test r9d, r9d
je 0x140178e69
mov eax, r8d
mov qword [rsp + 0x258], rax
mov dword [rsp + 0x250], 1
cmp r10d, 0xffffffff
je 0x140178e7d
mov edx, 1
mov qword [rsp + 0x48], r10
mov dword [rsp + 0x40], edx
cmp r8d, 0xffffffff
je 0x140178eb2
xor eax, eax
test edx, edx
je 0x140178e9d
mov r9d, r8d
nop dword [rax]
cmp qword [rsp + rax*8 + 0x48], r9
je 0x140178e9d
inc eax
cmp eax, edx
jb 0x140178e90
cmp eax, edx
jne 0x140178eb2
cmp edx, 0x40
jae 0x140178eb2
mov edx, r8d
mov qword [rsp + rax*8 + 0x48], rdx
inc dword [rsp + 0x40]
mov rbx, qword [rsp + 0x6d0]
cmp r8d, r10d
mov edi, r8d
cmovle edi, r10d
cmp r10d, 0xffffffff
jne 0x140178edc
cmp r8d, r10d
jne 0x140178edc
cmp rbx, 0xffffffffffffffff
jb 0x140178edc
xor eax, eax
jmp 0x140179013
mov qword [rsp + 0x6b8], rbp
mov qword [rsp + 0x688], r12
mov qword [rsp + 0x680], r15
test rsi, rsi
je 0x140178f01
mov rcx, rsi
call fcn.1401f5040
lea ebp, [rdi + 1]
movabs r15, 0x12e0be826d694b2f
movabs r12, 0x624dd2f1a9fbe77
nop dword [rax + rax]
cmp rbx, 0xffffffffffffffff
jae 0x140178fab
call fcn.1401deb10
cmp rax, rbx
jbe 0x140178f3b
mov ecx, 0x3e7
jmp 0x140178f5f
mov rcx, rbx
sub rcx, rax
mov rax, rcx
not rax
cmp rax, 0x3e7
jae 0x140178f58
mov rcx, 0xffffffffffffffff
jmp 0x140178f5f
add rcx, 0x3e7
mov rax, r15
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 0x1d
mov dword [rsp + 0x30], eax
imul rax, rax, 0x3b9aca00
sub rcx, rax
mov rax, r12
mul rcx
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 9
mov dword [rsp + 0x34], ecx
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x38]
jmp 0x140178fad
xor eax, eax
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x250]
mov ecx, ebp
lea rdx, [rsp + 0x460]
call qword [sym.imp.WS2_32.dll_select]
mov edi, eax
cmp eax, 0xffffffff
jne 0x140178fe7
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2714
je 0x140178f20
mov r15, qword [rsp + 0x680]
mov r12, qword [rsp + 0x688]
mov rbp, qword [rsp + 0x6b8]
test rsi, rsi
je 0x14017900c
mov rcx, rsi
call fcn.1401f4fd0
not edi
shr edi, 0x1f
mov eax, edi
mov rcx, qword [rsp + 0x670]
xor rcx, rsp
call fcn.14033bfd0
add rsp, 0x690
pop rdi
pop rsi
pop rbx
ret
Function at 0x14018cf50
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
mov eax, gethostbyaddr
call fcn.14033cab0
sub rsp, rax
mov rax, qword [0x140462680]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rbx, qword [rdx + 0x18]
lea r9, [rsp + 0x20]
mov rdi, qword [rdx]
mov r8, qword [rdx + 0x10]
mov rdx, qword [rdx + 8]
call fcn.14018c8b0
test eax, eax
je 0x14018cfd5
movzx ecx, byte [rdi]
shr cl, 3
not cl
and cl, 0x10
or cl, 0xf
and cl, byte [rsp + 0x20]
xor cl, byte [rdi]
mov byte [rdi], cl
and cl, 3
add cl, 1
je 0x14018cfd0
lea rdx, [rsp + 0x21]
movzx ecx, cl
sub rdx, rbx
nop dword [rax + rax]
movzx eax, byte [rdx + rbx]
xor byte [rbx], al
lea rbx, [rbx + 1]
sub rcx, 1
jne 0x14018cfc0
mov eax, 1
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14033bfd0
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x14018cff0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
mov eax, gethostbyaddr
call fcn.14033cab0
sub rsp, rax
mov rax, qword [0x140462680]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rbx, qword [rdx + 0x18]
lea r9, [rsp + 0x20]
mov rdi, qword [rdx]
mov r8, qword [rdx + 0x10]
mov rdx, qword [rdx + 8]
call fcn.14018c8b0
test eax, eax
je 0x14018d079
movzx eax, byte [rdi]
and al, 3
add al, 1
je 0x14018d060
lea rdx, [rsp + 0x21]
movzx ecx, al
sub rdx, rbx
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rdx + rbx]
xor byte [rbx], al
lea rbx, [rbx + 1]
sub rcx, 1
jne 0x14018d050
movzx ecx, byte [rdi]
mov eax, 1
shr cl, 3
not cl
and cl, 0x10
or cl, 0xf
and cl, byte [rsp + 0x20]
xor byte [rdi], cl
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14033bfd0
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1401a4c40
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
lea rsi, [rcx - 1]
movsxd rdi, r9d
not rcx
shr rsi, 0x3f
shr rcx, 0x3f
mov r11, rdx
and rsi, rcx
mov r10, r8
mov ecx, dword [rdx + 8]
dec rsi
xor ecx, dword [r8 + 8]
and ecx, esi
xor dword [rdx + 8], ecx
xor dword [r8 + 8], ecx
movq xmm4, rsi
mov ecx, dword [rdx + 0x10]
xor ecx, dword [r8 + 0x10]
and ecx, esi
punpcklqdq xmm4, xmm4
xor dword [rdx + 0x10], ecx
xor dword [r8 + 0x10], ecx
mov edx, dword [rdx + 0x14]
mov ecx, edx
mov eax, dword [r8 + 0x14]
xor rcx, rax
and ecx, 4
and rcx, rsi
mov eax, ecx
xor eax, edx
mov dword [r11 + 0x14], eax
xor dword [r8 + 0x14], ecx
xor ecx, ecx
mov edx, ecx
test r9d, r9d
jle 0x1401a4d59
cmp edi, 2
jb 0x1401a4d59
mov r9, qword [r8]
lea rax, [rdi - 1]
mov r8, qword [r11]
lea rbx, [rdi - 1]
lea rbx, [r9 + rbx*8]
lea rax, [r8 + rax*8]
cmp r9, rax
ja 0x1401a4cea
cmp rbx, r8
jae 0x1401a4d59
cmp r9, r10
ja 0x1401a4cf4
cmp rbx, r10
jae 0x1401a4d59
cmp r9, r11
ja 0x1401a4cfe
cmp rbx, r11
jae 0x1401a4d59
cmp r8, r10
ja 0x1401a4d08
cmp rax, r10
jae 0x1401a4d59
cmp r8, r11
ja 0x1401a4d12
cmp rax, r11
jae 0x1401a4d59
mov eax, edi
and eax, 0xfffffffe
nop word [rax + rax]
movdqu xmm2, xmmword [rcx + r9]
add edx, 2
movdqu xmm1, xmmword [rcx + r8]
lea rcx, [rcx + 0x10]
movdqa xmm3, xmm2
xorps xmm3, xmm1
andps xmm3, xmm4
movdqa xmm0, xmm3
xorps xmm3, xmm2
xorps xmm0, xmm1
movdqu xmmword [rcx + r8 - 0x10], xmm0
movdqu xmmword [rcx + r9 - 0x10], xmm3
cmp edx, eax
jl 0x1401a4d20
movsxd rax, edx
cmp rax, rdi
jge 0x1401a4d8e
mov rcx, qword [r11]
mov rdx, qword [rcx + rax*8]
lea r8, [rcx + rax*8]
mov rcx, qword [r10]
mov r9, rdx
xor r9, qword [rcx + rax*8]
and r9, rsi
xor rdx, r9
mov qword [r8], rdx
mov rcx, qword [r10]
xor qword [rcx + rax*8], r9
inc rax
cmp rax, rdi
jl 0x1401a4d61
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
Function at 0x1401a5920
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x40
call fcn.14033cab0
sub rsp, rax
xor r13d, r13d
mov r12d, r9d
mov r15d, r13d
mov edi, r13d
mov ebp, r13d
mov ebx, r8d
mov r14, rdx
mov rsi, rcx
call fcn.1401a5180
mov r8d, eax
add eax, 7
cdq
and edx, 7
add eax, edx
sar eax, 3
cmp dword [rsp + 0x90], r13d
jne 0x1401a599f
mov edi, dword [rsi + 0x10]
mov ecx, edi
neg ecx
lea ecx, [rax*8]
sbb r15d, r15d
movzx r15d, r15b
cmp ecx, r8d
jne 0x1401a599d
test edi, edi
sete bpl
jmp 0x1401a599f
mov ebp, edi
add eax, ebp
cmp ebx, 0xffffffff
jne 0x1401a59d3
mov ebx, eax
mov eax, dword [rsi + 0xc]
shl eax, 3
movsxd rdx, eax
test eax, eax
jne 0x1401a5a4e
test ebx, ebx
je 0x1401a5ae5
movsxd r8, ebx
xor edx, edx
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
jmp 0x1401a5ae5
cmp ebx, eax
jge 0x1401a59a8
movups xmm2, xmmword [rsi]
movsxd rax, dword [rsi + 8]
movsd xmm0, qword [rsi + 0x10]
movsd qword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x20], xmm2
test eax, eax
jle 0x1401a5a14
movq rcx, xmm2
lea r8, [rcx + rax*8]
nop dword [rax + rax]
cmp qword [r8 - 8], r13
lea r8, [r8 - 8]
jne 0x1401a5a10
dec eax
test eax, eax
jg 0x1401a5a00
mov dword [rsp + 0x28], eax
mov ecx, dword [rsp + 0x30]
test eax, eax
cmove ecx, r13d
mov dword [rsp + 0x30], ecx
lea rcx, [rsp + 0x20]
call fcn.1401a5180
add eax, 7
cdq
and edx, 7
add eax, edx
sar eax, 3
add eax, ebp
cmp ebx, eax
jge 0x1401a59a8
mov rax, 0xffffffffffffffff
jmp 0x1401a5ae7
cmp r12d, 1
je 0x1401a5a5d
lea eax, [rbx - 1]
movsxd rcx, eax
add r14, rcx
mov r11d, 1
movsxd rbp, ebx
cmp r12d, r11d
mov rax, 0xffffffffffffffff
lea r12, [rdx - 1]
cmovne r11, rax
mov eax, dword [rsi + 8]
shl eax, 3
xor r9d, r9d
xor r10d, r10d
movsxd r13, eax
test ebx, ebx
je 0x1401a5ae5
nop dword [rax + rax]
mov rcx, qword [rsi]
movzx eax, r9b
and al, 7
mov rdx, r9
shl al, 3
shr rdx, 3
mov r8, qword [rcx + rdx*8]
movzx ecx, al
shr r8, cl
mov rax, r10
sub rax, r13
shr rax, 0x3f
neg al
and r8b, al
xor r8b, r15b
lea eax, [r8 + rdi]
cmp r8b, al
mov byte [r14], al
mov rax, r9
seta dil
sub rax, r12
shr rax, 0x3f
add r14, r11
add r9, rax
inc r10
cmp r10, rbp
jb 0x1401a5a90
mov eax, ebx
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1401c6fe0
Capabilities:
Set thread local storage value

Disassembly:
mov eax, Ordinal_41
call fcn.14033cab0
sub rsp, rax
mov ecx, dword [rcx]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
add rsp, 0x28
ret

Function at 0x1401cc820
Capabilities:
Encode data using add xor sub operations

Disassembly:
xor eax, eax
mov r10, rcx
test rcx, rcx
je 0x1401cc88c
movzx ecx, byte [rcx]
test cl, cl
je 0x1401cc88c
mov r11d, 0x100
nop word [rax + rax]
movsx r9d, cl
lea r10, [r10 + 1]
or r9d, r11d
mov r8d, eax
mov edx, r9d
mov ecx, 0x20
shr edx, 2
add r11d, 0x100
xor edx, r9d
imul r9d, r9d
and edx, 0xf
sub ecx, edx
shr r8, cl
mov ecx, edx
mov edx, eax
mov eax, r8d
shl edx, cl
movzx ecx, byte [r10]
or eax, edx
xor eax, r9d
test cl, cl
jne 0x1401cc840
mov ecx, eax
shr ecx, 0x10
xor eax, ecx
ret

Function at 0x1401cc890
Capabilities:
Encode data using add xor sub operations

Disassembly:
xor eax, eax
mov r10, rcx
test rcx, rcx
je 0x1401cc900
movzx ecx, byte [rcx]
test cl, cl
je 0x1401cc900
mov r11d, 0x100
nop word [rax + rax]
movsx r9d, cl
lea r10, [r10 + 1]
mov r8d, eax
and r9d, 0xffffffdf
or r9d, r11d
mov ecx, 0x20
mov edx, r9d
add r11d, 0x100
shr edx, 2
xor edx, r9d
imul r9d, r9d
and edx, 0xf
sub ecx, edx
shr r8, cl
mov ecx, edx
mov edx, eax
mov eax, r8d
shl edx, cl
movzx ecx, byte [r10]
or eax, edx
xor eax, r9d
test cl, cl
jne 0x1401cc8b0
mov ecx, eax
shr ecx, 0x10
xor eax, ecx
ret

Function at 0x1401d8d70
Capabilities:
Get thread local storage value

Disassembly:
mov eax, Ordinal_41
call fcn.14033cab0
sub rsp, rax
lea rcx, [0x14049aaa8]
add rsp, 0x28
jmp fcn.1401c6e70

Function at 0x1401deb70
Capabilities:
Encode data using xor

Disassembly:
xor r9b, r9b
mov r10, rdx
test r8, r8
je 0x1401deb97
sub r10, rcx
nop
movzx edx, byte [r10 + rcx]
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
xor dl, al
or r9b, dl
sub r8, 1
jne 0x1401deb80
movzx eax, r9b
ret
Function at 0x1401f4310
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
mov eax, 0x280
call fcn.14033cab0
sub rsp, rax
mov rax, qword [0x140462680]
xor rax, rsp
mov qword [rsp + 0x270], rax
cmp dword [0x14049ad0c], 0
lea rax, [0x1401f3c90]
mov qword [rsp + 0x28], rax
lea rbx, [0x14038acf8]
lea rax, str.getnameinfo
movzx ebp, cx
mov qword [rsp + 0x30], rax
lea rax, [0x1401f40d0]
mov qword [rsp + 0x38], rax
lea rax, [0x14038ad18]
mov qword [rsp + 0x40], rax
lea rax, [0x1401f3c30]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x20], rbx
jne 0x1401f44e9
mov edx, 0x104
lea rcx, [rsp + 0x160]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x1401f44df
lea r8, [rsp + 0x160]
mov qword [rsp + 0x290], rsi
mov edx, 0x10c
lea rcx, [rsp + 0x50]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcpy_s
lea r8, str.ws2_32
mov edx, 0x10c
lea rcx, [rsp + 0x50]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcat_s
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x1401f440a
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x1401f446a
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea r8, [rsp + 0x160]
mov edx, 0x10c
lea rcx, [rsp + 0x50]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcpy_s
lea r8, str.wship6
mov edx, 0x10c
lea rcx, [rsp + 0x50]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcat_s
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x1401f44d7
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x1401f446a
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x1401f44d7
mov qword [rsp + 0x298], rdi
lea rbx, [rsp + 0x28]
xor edi, edi
nop dword [rax]
mov rdx, qword [rbx - 8]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx], rax
test rax, rax
je 0x1401f44c6
inc edi
add rbx, 0x10
cmp edi, 3
jl 0x1401f4480
mov rax, qword [rsp + 0x28]
mov qword [0x14045fe88], rax
mov rax, qword [rsp + 0x38]
mov qword [0x14045fe98], rax
mov rax, qword [rsp + 0x48]
mov qword [0x14045fea8], rax
jmp 0x1401f44cf
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rdi, qword [rsp + 0x298]
mov rsi, qword [rsp + 0x290]
mov dword [0x14049ad0c], 1
mov rax, rbp
lea rcx, [0x14045fe80]
add rax, rax
mov rax, qword [rcx + rax*8 + 8]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.14033bfd0
mov rbx, qword [rsp + 0x2a0]
add rsp, 0x280
pop rbp
ret