joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140110a90
Capabilities:
Enumerate gui resources

Disassembly:
push rbx
sub rsp, 0x70
mov rbx, rcx
call fcn.14010d260
test eax, eax
je 0x140110ac0
mov rdx, qword [rbx + 0x298]
xor ecx, ecx
call qword [sym.imp.USER32.dll_ReleaseDC]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
mov qword [rbx + 0x298], rax
cmp qword [rbx + 0x268], 0
mov qword [rsp + 0x90], rdi
jne 0x140110b62
mov rcx, qword [rbx + 0x290]
call qword [sym.imp.GDI32.dll_SaveDC]
cmp dword [rbx + 0x280], 0
mov edi, eax
je 0x140110afe
lea rcx, [0x140110a20]
mov rdx, rbx
call qword [sym.imp.USER32.dll_EnumWindows]
mov ecx, dword [rbx + 0x258]
mov edx, dword [rbx + 0x254]
mov r8d, dword [rbx + 0x260]
mov rax, qword [rbx + 0x298]
mov r9d, dword [rbx + 0x25c]
mov dword [rsp + 0x40], 0xcc0020
mov dword [rsp + 0x38], ecx
sub r8d, ecx
mov rcx, qword [rbx + 0x290]
mov dword [rsp + 0x30], edx
mov qword [rsp + 0x28], rax
sub r9d, edx
mov dword [rsp + 0x20], r8d
xor edx, edx
xor r8d, r8d
call qword [sym.imp.GDI32.dll_BitBlt]
mov rcx, qword [rbx + 0x290]
mov edx, edi
call qword [sym.imp.GDI32.dll_RestoreDC]
jmp 0x140110b81
lea rcx, [0x1401109e0]
mov rdx, rbx
call qword [sym.imp.USER32.dll_EnumWindows]
mov rcx, qword [rbx + 0x290]
xor edx, edx
call qword [sym.imp.GDI32.dll_SelectClipRgn]
mov rcx, qword [rbx + 0x2a8]
test rcx, rcx
je 0x140110b99
mov rax, qword [rcx]
mov rdx, qword [rbx + 0x290]
call qword [rax]
cmp dword [0x1402e49f0], 0
mov dword [0x1402e49d8], 0x18
je 0x140110cbd
lea rcx, [0x1402e49d8]
call qword [sym.imp.USER32.dll_GetCursorInfo]
test eax, eax
je 0x140110cbd
cmp dword [0x1402e49dc], 1
jne 0x140110cbd
mov rcx, qword [0x1402e49e0]
test rcx, rcx
je 0x140110cbd
mov edi, dword [0x1402e49e8]
mov qword [rsp + 0x80], rbp
lea rdx, [rsp + 0x50]
xor ebp, ebp
mov qword [rsp + 0x88], rsi
mov esi, dword [0x1402e49ec]
mov dword [rsp + 0x50], ebp
call qword [sym.imp.USER32.dll_GetIconInfo]
test eax, eax
je 0x140110c3b
mov rcx, qword [rsp + 0x68]
sub edi, dword [rsp + 0x54]
sub esi, dword [rsp + 0x58]
test rcx, rcx
je 0x140110c2b
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140110c3b
call qword [sym.imp.GDI32.dll_DeleteObject]
movd xmm0, dword [rbx + 0x258]
mov r9, qword [0x1402e49e0]
mov rcx, qword [rbx + 0x290]
mov dword [rsp + 0x40], 3
movd xmm1, esi
movd xmm2, edi
cvtdq2ps xmm0, xmm0
mov qword [rsp + 0x38], rbp
mov dword [rsp + 0x30], ebp
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], ebp
cvtdq2ps xmm1, xmm1
cvtdq2ps xmm2, xmm2
mulss xmm1, dword [rbx + 0x27c]
mulss xmm2, dword [rbx + 0x278]
subss xmm1, xmm0
movd xmm0, dword [rbx + 0x254]
cvtdq2ps xmm0, xmm0
cvttss2si r8d, xmm1
subss xmm2, xmm0
cvttss2si edx, xmm2
call qword [sym.imp.USER32.dll_DrawIconEx]
mov rsi, qword [rsp + 0x88]
mov rbp, qword [rsp + 0x80]
mov rax, qword [rbx + 0x228]
mov rdi, qword [rsp + 0x90]
add rsp, 0x70
pop rbx
ret
Function at 0x140111000
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
mov rcx, qword [rcx + 0x28]
mov dword [rsp + 0x20], r9d
mov r9d, r8d
mov r8d, edx
add rcx, 0x88
mov rdx, rbx
call fcn.140113530
mov rcx, qword [rbx + 0x28]
mov edx, dword [rcx + 0xcc]
mov edi, eax
cmp edx, 1
jne 0x140111057
mov rcx, qword [rcx + 0xd8]
mov r8d, edx
lea rdx, reloc.WS2_32.dll_WSAStartup
xor r9d, r9d
call sub.WS2_32.dll_send
mov eax, edi
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x140111460
Capabilities:
Send data
Send data on socket

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, rcx
test edx, edx
jne 0x1401114d1
cmp qword [rcx + 0x68], 0
jne 0x140111505
mov rax, qword [rcx + 0x20]
mov rcx, qword [rax + 0x98]
call fcn.14000c4b0
mov qword [rbx + 0x68], rax
test rax, rax
je 0x140111558
mov edx, dword [rbx + 0x48]
mov rcx, rax
call fcn.14000c5d0
test eax, eax
jg 0x1401114db
cmp dword [reloc.WS2_32.dll_accept], 3
jg 0x1401114cb
lea r9, str.Cant_set_socket_for_SSL
lea rdx, str....._network_serviceNS_Channel_Ssl.cpp
mov r8d, reloc.OLEAUT32.dll_VarUI4FromDisp
mov ecx, 3
call fcn.1400045f0
or edx, 0xffffffff
mov rcx, rbx
add rsp, 0x40
pop rbx
jmp method.NS_Channel.2.virtual_80
mov r9, qword [rbx + 0x60]
test r9, r9
je 0x140111505
mov rcx, qword [rbx + 0x68]
xor r8d, r8d
lea edx, [r8 + 0x37]
call fcn.14000c5e0
mov rcx, qword [rbx + 0x60]
call fcn.1401e64f8
mov qword [rbx + 0x60], 0
mov rcx, qword [rbx + 0x68]
mov qword [rsp + 0x50], rsi
call fcn.14000c840
mov esi, eax
cmp eax, 1
jne 0x140111591
mov rcx, qword [rbx + 0x28]
mov dword [rbx + 0x50], eax
mov eax, dword [rcx + 0xcc]
cmp eax, esi
jne 0x140111544
mov rcx, qword [rcx + 0xd8]
lea rdx, reloc.WS2_32.dll_WSAStartup
xor r9d, r9d
mov r8d, esi
call sub.WS2_32.dll_send
xor edx, edx
mov rcx, rbx
mov rsi, qword [rsp + 0x50]
add rsp, 0x40
pop rbx
jmp method.NS_Channel.2.virtual_80
cmp dword [reloc.WS2_32.dll_accept], 3
jg 0x14011157f
lea r9, str.Cant_alloc_SSL
lea rdx, str....._network_serviceNS_Channel_Ssl.cpp
mov r8d, 0x125
mov ecx, 3
call fcn.1400045f0
mov edx, 0xfffffffe
mov rcx, rbx
add rsp, 0x40
pop rbx
jmp method.NS_Channel.2.virtual_80
mov rcx, qword [rbx + 0x68]
mov edx, eax
mov qword [rsp + 0x58], rdi
call fcn.14000cdb0
cmp dword [reloc.WS2_32.dll_accept], 0
mov edi, eax
jg 0x1401115dc
mov rcx, qword [rbx + 0x68]
call fcn.14000cdc0
lea r9, str.SSL::Connect__ret___d_err_d_ssl_state0x_X
lea rdx, str....._network_serviceNS_Channel_Ssl.cpp
mov dword [rsp + 0x30], eax
mov r8d, 0x139
xor ecx, ecx
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], esi
call fcn.1400045f0
sub edi, 2
je 0x140111618
cmp edi, 1
je 0x140111602
mov edx, 0xfffffffd
mov rcx, rbx
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x50]
add rsp, 0x40
pop rbx
jmp method.NS_Channel.2.virtual_80
mov rcx, qword [rbx + 0x28]
mov dword [rbx + 0x54], 1
mov eax, dword [rcx + 0xcc]
cmp eax, 1
jmp 0x14011162c
mov rcx, qword [rbx + 0x28]
mov dword [rbx + 0x50], 1
mov eax, dword [rcx + 0xcc]
cmp eax, 1
jne 0x140111648
mov rcx, qword [rcx + 0xd8]
xor r9d, r9d
lea rdx, reloc.WS2_32.dll_WSAStartup
lea r8d, [r9 + 1]
call sub.WS2_32.dll_send
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x50]
add rsp, 0x40
pop rbx
ret
Function at 0x140111660
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x40
xor ebx, ebx
mov esi, r8d
mov r12, rdx
mov rdi, rcx
test r8d, r8d
jle 0x1401117d5
nop
mov rcx, qword [rdi + 0x68]
mov r8d, esi
movsxd rdx, ebx
sub r8d, ebx
add rdx, r12
call fcn.14000cb60
mov ebp, eax
test eax, eax
jle 0x1401116b6
add ebx, eax
cmp ebx, esi
jl 0x140111690
jmp 0x1401117d5
mov rcx, qword [rdi + 0x68]
mov edx, eax
call fcn.14000cdb0
mov esi, eax
mov ecx, eax
test eax, eax
je 0x1401117a5
sub ecx, 1
je 0x1401117a5
sub ecx, 1
je 0x1401117a5
sub ecx, 1
je 0x140111737
cmp ecx, 3
je 0x14011172a
cmp dword [reloc.WS2_32.dll_accept], 3
jg 0x140111722
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r9, str.read_data_n_d__err_d__syserr_d
lea rdx, str....._network_serviceNS_Channel_Ssl.cpp
mov dword [rsp + 0x30], eax
mov r8d, 0x2b1
mov ecx, 3
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], ebp
call fcn.1400045f0
or eax, 0xffffffff
jmp 0x1401117d7
or eax, 0xffffffff
test ebx, ebx
cmovg eax, ebx
jmp 0x1401117d7
cmp dword [reloc.WS2_32.dll_accept], 2
jg 0x14011175e
lea r9, str.Want_write_while_reading_data
lea rdx, str....._network_serviceNS_Channel_Ssl.cpp
mov r8d, 0x2a3
mov ecx, 2
call fcn.1400045f0
mov rcx, qword [rdi + 0x28]
mov dword [rdi + 0x54], 1
mov eax, dword [rcx + 0xcc]
cmp eax, 1
jne 0x14011178d
mov rcx, qword [rcx + 0xd8]
lea rdx, reloc.WS2_32.dll_WSAStartup
xor r9d, r9d
mov r8d, eax
call sub.WS2_32.dll_send
mov rcx, qword [rdi + 0x28]
mov dword [rdi + 0x50], 1
mov r9d, dword [rcx + 0xcc]
cmp r9d, 1
jmp 0x1401117b9
mov rcx, qword [rdi + 0x28]
mov dword [rdi + 0x50], 1
mov eax, dword [rcx + 0xcc]
cmp eax, 1
jne 0x1401117d5
mov rcx, qword [rcx + 0xd8]
xor r9d, r9d
lea rdx, reloc.WS2_32.dll_WSAStartup
lea r8d, [r9 + 1]
call sub.WS2_32.dll_send
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r12
ret
Function at 0x140111800
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rbx, rcx
mov rcx, qword [rcx + 0x68]
mov esi, r8d
call fcn.14000cc70
mov edi, eax
test eax, eax
jg 0x140111922
mov rcx, qword [rbx + 0x68]
mov edx, eax
call fcn.14000cdb0
mov edx, eax
test eax, eax
je 0x1401118e1
sub edx, 1
je 0x1401118e1
sub edx, 1
je 0x1401118b1
sub edx, 1
je 0x1401118e1
cmp edx, 3
je 0x14011189e
cmp dword [reloc.WS2_32.dll_accept], 3
jg 0x140111955
mov dword [rsp + 0x28], eax
lea r9, str.write_data_n_d__err_d
lea rdx, str....._network_serviceNS_Channel_Ssl.cpp
mov r8d, 0x301
mov ecx, 3
mov dword [rsp + 0x20], edi
call fcn.1400045f0
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
or eax, 0xffffffff
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp dword [reloc.WS2_32.dll_accept], 2
jg 0x1401118d8
lea r9, str.Want_read_while_writing_data
lea rdx, str....._network_serviceNS_Channel_Ssl.cpp
mov r8d, 0x2f5
mov ecx, 2
call fcn.1400045f0
mov dword [rbx + 0x50], 1
jmp 0x14011192d
mov rcx, qword [rbx + 0x28]
mov dword [rbx + 0x54], 1
mov eax, dword [rcx + 0xcc]
cmp eax, 1
jne 0x140111910
mov rcx, qword [rcx + 0xd8]
lea rdx, reloc.WS2_32.dll_WSAStartup
xor r9d, r9d
mov r8d, eax
call sub.WS2_32.dll_send
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp eax, esi
jge 0x140111955
mov dword [rbx + 0x54], 1
mov rcx, qword [rbx + 0x28]
mov eax, dword [rcx + 0xcc]
cmp eax, 1
jne 0x140111955
mov rcx, qword [rcx + 0xd8]
lea rdx, reloc.WS2_32.dll_WSAStartup
xor r9d, r9d
mov r8d, eax
call sub.WS2_32.dll_send
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov eax, edi
add rsp, 0x30
pop rdi
ret

Function at 0x140111970
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x48]
mov esi, r8d
cmp rcx, 0xffffffffffffffff
jne 0x140111997
or eax, ecx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
xor r9d, r9d
mov qword [rsp + 0x30], rdi
call sub.WS2_32.dll_send
mov edi, eax
test eax, eax
jns 0x1401119fb
call sub.WS2_32.dll_WSAGetLastError
cmp eax, 0x2733
jne 0x140111a45
mov rcx, qword [rbx + 0x28]
mov dword [rbx + 0x54], 1
mov eax, dword [rcx + 0xcc]
cmp eax, 1
jne 0x1401119e9
mov rcx, qword [rcx + 0xd8]
lea rdx, reloc.WS2_32.dll_WSAStartup
xor r9d, r9d
mov r8d, eax
call sub.WS2_32.dll_send
xor eax, eax
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
test eax, eax
jne 0x140111a12
or eax, 0xffffffff
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
cmp eax, esi
jge 0x140111a45
mov rcx, qword [rbx + 0x28]
mov dword [rbx + 0x54], 1
mov eax, dword [rcx + 0xcc]
cmp eax, 1
jne 0x140111a45
mov rcx, qword [rcx + 0xd8]
lea rdx, reloc.WS2_32.dll_WSAStartup
xor r9d, r9d
mov r8d, eax
call sub.WS2_32.dll_send
mov rbx, qword [rsp + 0x38]
mov eax, edi
mov rdi, qword [rsp + 0x30]
add rsp, 0x20
pop rsi
ret
Function at 0x140111a60
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x48]
mov esi, r8d
cmp rcx, 0xffffffffffffffff
jne 0x140111a87
or eax, ecx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
xor r9d, r9d
mov qword [rsp + 0x30], rdi
call sub.WS2_32.dll_recv
mov edi, eax
test eax, eax
jns 0x140111aeb
call sub.WS2_32.dll_WSAGetLastError
cmp eax, 0x2733
jne 0x140111b35
mov rcx, qword [rbx + 0x28]
mov dword [rbx + 0x50], 1
mov eax, dword [rcx + 0xcc]
cmp eax, 1
jne 0x140111ad9
mov rcx, qword [rcx + 0xd8]
lea rdx, reloc.WS2_32.dll_WSAStartup
xor r9d, r9d
mov r8d, eax
call sub.WS2_32.dll_send
xor eax, eax
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
test eax, eax
jne 0x140111b02
or eax, 0xffffffff
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
cmp eax, esi
jge 0x140111b35
mov rcx, qword [rbx + 0x28]
mov dword [rbx + 0x50], 1
mov eax, dword [rcx + 0xcc]
cmp eax, 1
jne 0x140111b35
mov rcx, qword [rcx + 0xd8]
lea rdx, reloc.WS2_32.dll_WSAStartup
xor r9d, r9d
mov r8d, eax
call sub.WS2_32.dll_send
mov rbx, qword [rsp + 0x38]
mov eax, edi
mov rdi, qword [rsp + 0x30]
add rsp, 0x20
pop rsi
ret
Function at 0x140112690
Capabilities:
Send data
Send data on socket

Disassembly:
push rbx
sub rsp, 0x20
mov rdx, qword [r8 + 0x10]
mov rbx, rcx
mov rcx, qword [r8 + 8]
call qword [r8]
movsxd rdx, eax
mov qword [rbx + 0x48], rdx
cmp rdx, 0xffffffffffffffff
jne 0x1401126ba
or eax, 0xffffffff
add rsp, 0x20
pop rbx
ret
mov rcx, qword [rbx + 0x20]
mov rdx, rbx
mov qword [rsp + 0x30], rdi
add rcx, 0x40
call fcn.1401149f0
mov edi, eax
test eax, eax
je 0x1401126de
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx + 0x60]
mov rcx, qword [rbx + 0x28]
mov dword [rbx + 0x30], 3
mov dword [rbx + 0x50], 1
mov edx, dword [rcx + 0xcc]
cmp edx, 1
jne 0x140112714
mov rcx, qword [rcx + 0xd8]
mov r8d, edx
lea rdx, reloc.WS2_32.dll_WSAStartup
xor r9d, r9d
call sub.WS2_32.dll_send
mov eax, edi
mov rdi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret

Function at 0x140112730
Capabilities:
Send data
Send data on socket

Disassembly:
sub rsp, 0x28
mov dword [rcx + 0x54], 1
mov rcx, qword [rcx + 0x28]
mov eax, dword [rcx + 0xcc]
cmp eax, 1
jne 0x140112763
mov rcx, qword [rcx + 0xd8]
lea rdx, reloc.WS2_32.dll_WSAStartup
xor r9d, r9d
mov r8d, eax
call sub.WS2_32.dll_send
mov eax, 3
add rsp, 0x28
ret

Function at 0x140112770
Capabilities:
Send data
Send data on socket

Disassembly:
sub rsp, 0x28
mov dword [rcx + 0x50], 1
mov rcx, qword [rcx + 0x28]
mov eax, dword [rcx + 0xcc]
cmp eax, 1
jne 0x1401127a3
mov rcx, qword [rcx + 0xd8]
lea rdx, reloc.WS2_32.dll_WSAStartup
xor r9d, r9d
mov r8d, eax
call sub.WS2_32.dll_send
mov eax, 3
add rsp, 0x28
ret

Function at 0x140113a20
Capabilities:
Create thread
Set socket configuration

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov esi, edx
mov edx, 1
lea r9, [rcx + 0xd0]
mov rbx, rcx
xor r8d, r8d
mov ecx, edx
call fcn.140008420
test rax, rax
jns 0x140113a91
cmp dword [reloc.WS2_32.dll_accept], 3
jg 0x140113a7f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, 0x5c
lea r9, str.IO_thread_was_not_initialized_successfully.err_u
lea ecx, [r8 - 0x59]
lea rdx, str....._network_serviceThreadIO.cpp
mov dword [rsp + 0x20], eax
call fcn.1400045f0
xor eax, eax
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rbx + 0xd0]
lea r8, [rsp + 0x40]
mov edx, 0x8004667e
mov dword [rsp + 0x40], 1
call sub.WS2_32.dll_ioctlsocket
mov rcx, qword [rbx + 0xd8]
lea r8, [rsp + 0x40]
mov edx, 0x8004667e
mov dword [rsp + 0x40], 1
call sub.WS2_32.dll_ioctlsocket
lea rcx, [rbx + 0x20]
call fcn.140112f60
mov edx, esi
mov rcx, rbx
mov r8d, dword [rax + 0x18]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
jmp fcn.1400010a0
Function at 0x140113b00
Capabilities:
Send data
Send data on socket

Disassembly:
push rbx
sub rsp, 0x30
cmp dword [rcx + 0xc8], 0
mov rbx, rcx
je 0x140113b1a
xor eax, eax
add rsp, 0x30
pop rbx
ret
mov eax, dword [rcx + 0xcc]
mov dword [rcx + 0xc8], 1
cmp eax, 1
jne 0x140113b48
mov rcx, qword [rcx + 0xd8]
lea rdx, reloc.WS2_32.dll_WSAStartup
xor r9d, r9d
mov r8d, eax
call sub.WS2_32.dll_send
mov edx, 0x1388
mov rcx, rbx
call fcn.140001180
cmp dword [reloc.WS2_32.dll_accept], 0
mov ebx, eax
jg 0x140113b7f
lea r9, str.Stop_IO_thread._wait_return_d
lea rdx, str....._network_serviceThreadIO.cpp
mov r8d, 0x198
xor ecx, ecx
mov dword [rsp + 0x20], eax
call fcn.1400045f0
xor eax, eax
cmp ebx, 1
sete al
add rsp, 0x30
pop rbx
ret
Function at 0x140114540
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x10], rdx
push rsi
push rdi
push r12
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x78], rbp
mov rbp, rdx
mov rsi, rcx
test rdx, rdx
je 0x1401146da
add rcx, 0x20
call fcn.140112f60
mov rdi, rax
lea rbx, [rsi + 0x60]
mov qword [rsp + 0x70], rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
mov r12, qword [rsi + 0x58]
movsxd rax, dword [rdi]
cmp r12, rax
jb 0x1401145aa
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
jmp 0x1401146df
mov rdx, rsi
mov rcx, rbp
call fcn.140111090
mov r11, qword [rbp + 0x10]
movsxd rax, dword [r11 + 4]
lea rcx, [rax + rbp + 0x10]
mov rax, qword [rcx]
call qword [rax]
cmp qword [rbp + 0x38], 0
jne 0x14011461d
mov rax, qword [rbp]
mov rcx, rbp
call qword [rax + 0x58]
mov eax, dword [rbp + 0x30]
cmp eax, 2
je 0x140114618
cmp qword [rbp + 0x38], 0
jne 0x140114618
mov rax, qword [rsp + 0x68]
mov qword [rax + 0x48], 0xffffffffffffffff
mov eax, dword [rbp + 0x30]
test eax, eax
je 0x140114606
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
call qword [rax]
nop
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
jmp 0x1401146df
mov rbp, qword [rsp + 0x68]
mov ebx, 4
mov r8, qword [rsi + 0x58]
lea rdx, [r8 + 1]
mov rcx, qword [rsi + 0x50]
cmp rdx, rcx
jbe 0x140114663
lea rax, [rcx + 4]
cmp rdx, rax
jbe 0x140114645
mov rbx, r8
sub rbx, rcx
inc rbx
lea rdx, [rcx + rbx]
shl rdx, 3
mov rcx, qword [rsi + 0x48]
call fcn.1401e78d4
test rax, rax
je 0x140114673
mov qword [rsi + 0x48], rax
add qword [rsi + 0x50], rbx
mov rcx, qword [rsi + 0x58]
mov rax, qword [rsi + 0x48]
mov qword [rax + rcx*8], rbp
inc qword [rsi + 0x58]
mov eax, dword [rsi + 0xcc]
cmp eax, 1
jne 0x140114697
xor r9d, r9d
mov r8d, eax
lea rdx, reloc.WS2_32.dll_WSAStartup
mov rcx, qword [rsi + 0xd8]
call sub.WS2_32.dll_send
cmp dword [reloc.WS2_32.dll_accept], 1
jg 0x1401146c8
lea rcx, [r12 + 1]
mov qword [rsp + 0x20], rcx
lea r9, str.AddChannel_OK__count_u
mov r8d, 0x4f
lea rdx, str....._network_serviceThreadIO.cpp
lea ecx, [r8 - 0x4e]
call fcn.1400045f0
nop
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 1
jmp 0x1401146df
mov eax, 1
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r12
pop rdi
pop rsi
ret
Function at 0x14011fc10
Capabilities:
Encode data using xor

Disassembly:
movsx eax, byte [rcx + 0x11]
mov r8, rcx
mov edx, 2
and eax, 0x7f
cmp eax, 0x7e
jne 0x14011fc29
lea edx, [rax - 0x7a]
jmp 0x14011fc34
mov ecx, 0xa
cmp eax, 0x7f
cmove edx, ecx
mov rax, qword [r8 + 0x20]
mov r10d, dword [rax + 0x10]
mov rcx, qword [rax + 8]
mov eax, edx
lea r9, [rax + r8 + 0x10]
mov eax, r10d
and r10d, 3
shr eax, 2
test eax, eax
je 0x14011fc5a
mov edx, dword [r9]
jmp 0x14011fc5e
mov edx, dword [rsp + 8]
test eax, eax
je 0x14011fc6e
xor dword [rcx], edx
add rcx, 4
sub rax, 1
jne 0x14011fc62
test r10d, r10d
je 0x14011fc9a
xor edx, edx
mov r8d, r10d
nop dword [rax + rax]
mov rax, rdx
inc rcx
inc rdx
and eax, 3
movzx eax, byte [rax + r9]
xor byte [rcx - 1], al
sub r8, 1
jne 0x14011fc80
repz ret
Function at 0x14013e640
Capabilities:
Encode data using xor

Disassembly:
sub rdx, r8
sub rcx, r8
mov r10, r9
shr r9, 4
je 0x14013e681
nop
movdqu xmm0, xmmword [rdx + r8]
pxor xmm0, xmmword [r8]
movdqu xmmword [rcx + r8], xmm0
movdqa xmmword [r8], xmm0
lea r8, [r8 + 0x10]
dec r9
jne 0x14013e654
and r10, 0xf
je 0x14013e6b9
mov r9d, reloc.WS2_32.dll_recv
sub r9, r10
xor eax, eax
mov al, byte [rdx + r8]
xor al, byte [r8]
mov byte [rcx + r8], al
mov byte [r8], al
lea r8, [r8 + 1]
dec r10
jne 0x14013e68c
xor eax, eax
mov byte [r8], al
lea r8, [r8 + 1]
dec r9
jne 0x14013e6a9
mov rax, r8
repz ret

Function at 0x14013e6c0
Capabilities:
Encode data using xor

Disassembly:
sub rdx, r8
sub rcx, r8
mov r10, r9
shr r9, 4
je 0x14013e709
nop
movdqu xmm0, xmmword [rdx + r8]
movdqa xmm1, xmmword [r8]
pxor xmm1, xmm0
movdqu xmmword [rcx + r8], xmm1
movdqa xmmword [r8], xmm0
lea r8, [r8 + 0x10]
dec r9
jne 0x14013e6d4
pxor xmm1, xmm1
and r10, 0xf
je 0x14013e747
mov r9d, reloc.WS2_32.dll_recv
sub r9, r10
xor eax, eax
xor r11, r11
mov r11b, byte [rdx + r8]
mov al, byte [r8]
xor al, r11b
mov byte [rcx + r8], al
mov byte [r8], r11b
lea r8, [r8 + 1]
dec r10
jne 0x14013e717
xor eax, eax
mov byte [r8], al
lea r8, [r8 + 1]
dec r9
jne 0x14013e737
mov rax, r8
repz ret
Function at 0x1401430a0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x1401430c0
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
repz ret

Function at 0x140143100
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x140143120
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
repz ret

Function at 0x140143160
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x140143183
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
repz ret

Function at 0x1401431e0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x140143203
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
repz ret

Function at 0x140143260
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
xorps xmm5, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
nop dword [rax]
add rax, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x140143289
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
repz ret