joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400031ac
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x14000322a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x140003221
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x140003221
mov rax, qword [rbp - 8]
jmp 0x14000323f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x1400031f4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140003da0
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x1401dedc0]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [rcx]
mov rdi, rcx
test rbx, rbx
je 0x140003e74
nop dword [rax + rax]
mov rax, qword [rbx + 0x10]
lea rdx, [rsp + 0x20]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rax, qword [rbx + 8]
mov r9d, 0xffffffff
mov qword [rsp + 0x28], rax
lea ecx, [r8 + 2]
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
lock xadd dword [0x1401e40c8], eax
mov rcx, qword [rbx + 8]
test eax, eax
je 0x140003e20
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
jmp 0x140003e42
mov rdx, rcx
xor r8d, r8d
lea rcx, [0x140003510]
call qword [sym.imp.KERNEL32.dll_QueueUserAPC]
mov rcx, qword [rbx + 8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rbx, qword [rdi]
mov rax, qword [rbx + 0x18]
mov qword [rdi], rax
test rbx, rbx
je 0x140003e68
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0x20
mov rcx, rbx
call fcn.14014ac44
mov rbx, qword [rdi]
test rbx, rbx
jne 0x140003dd0
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14014b190
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret

Function at 0x140004f30
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x1401dedc0]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, r9
mov rsi, r8
mov rbp, rdx
mov rbx, rcx
mov ecx, 0x20
call fcn.14014ac08
mov r9, rax
test rax, rax
je 0x140004f90
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax]
mov qword [r9], rcx
mov rax, qword [rdi]
mov qword [r9 + 8], rax
mov rax, qword [rsi]
mov qword [r9 + 0x10], rax
mov qword [r9 + 0x18], rbp
jmp 0x140004f93
xor r9d, r9d
mov qword [rsp + 0x30], r9
lea rdi, [rbx + 8]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0
lea r8, [0x14000e860]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbx], rax
test rax, rax
je 0x140004fe7
mov rax, rbx
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14014b190
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
mov dword [rdi], 0
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
Function at 0x140021710
Capabilities:
Initialize winsock library

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x200
mov rax, qword [0x1401dedc0]
xor rax, rsp
mov qword [rsp + 0x1f0], rax
movzx ebx, dl
mov rdi, rcx
mov eax, 1
lock xadd dword [0x1401e40e8], eax
inc eax
cmp eax, 1
jne 0x14002175d
lea ecx, [rax + 1]
lea rdx, [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_WSAStartup]
xchg dword [0x1401e40ec], eax
test bl, bl
je 0x140021801
xor ebx, ebx
lock xadd dword [0x1401e40ec], ebx
test ebx, ebx
je 0x140021801
movabs rcx, 0x4d54ee85da812030
mov qword [rsp + 0x210], rsi
add rcx, qword [0x1401da008]
lea rsi, section..data
mov dword [rsp + 0x3c], 0
cmp rcx, 1
jbe 0x1400217b6
mov rax, qword [section..data]
mov edx, ebx
mov rcx, rsi
call qword [rax + 0x30]
jmp 0x1400217b8
mov al, 1
lea rcx, str.E:DThirdParty_boost_1_84_0_boost_asiodetailimplwinsock_init.ipp
movzx eax, al
add rax, 2
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x40], rsi
lea rcx, str.throw_on_error
mov rsi, qword [rsp + 0x210]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], 0x48
mov dword [rsp + 0x34], Ordinal_29
test al, 1
jne 0x140021825
mov rax, rdi
mov rcx, qword [rsp + 0x1f0]
xor rcx, rsp
call fcn.14014b190
mov rbx, qword [rsp + 0x218]
add rsp, 0x200
pop rdi
ret
lea r8, [rsp + 0x20]
lea rdx, str.winsock
lea rcx, [rsp + 0x38]
call fcn.14004d0f0
int3
Function at 0x140030170
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0x90
mov rax, qword [0x1401dedc0]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov rsi, r9
mov rbx, r8
mov r14, rdx
mov qword [rbp + 0x1f], rdx
mov qword [rbp - 0x11], rbx
mov qword [rbp - 9], r9
xor r15d, r15d
mov dword [rbp + 0x1f], r15d
xorps xmm0, xmm0
movups xmmword [rbp - 1], xmm0
mov qword [rbp + 0xf], r15
mov qword [rbp + 0x17], 7
mov word [rbp - 1], r15w
mov r8, r9
cmp qword [r9 + 0x18], 7
jbe 0x1400301d7
mov r8, qword [r9]
mov rdx, rbx
cmp qword [rbx + 0x18], 7
jbe 0x1400301e4
mov rdx, qword [rbx]
lea rax, [rbp + 0x1f]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
mov rcx, 0xffffffff80000002
mov r9d, 2
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov ecx, dword [rbp + 0x1f]
mov r8, qword [rbp + 0xf]
cmp rcx, r8
ja 0x14003022f
mov qword [rbp + 0xf], rcx
lea rax, [rbp - 1]
cmp qword [rbp + 0x17], 7
cmova rax, qword [rbp - 1]
mov word [rax + rcx*2], r15w
jmp 0x140030288
mov rdx, rcx
sub rdx, r8
mov rdi, qword [rbp + 0x17]
mov rax, rdi
sub rax, r8
cmp rdx, rax
ja 0x140030273
mov qword [rbp + 0xf], rcx
lea r9, [rbp - 1]
cmp rdi, 7
cmova r9, qword [rbp - 1]
lea rdi, [r9 + r8*2]
test rdx, rdx
je 0x140030268
movzx eax, r15w
mov rcx, rdx
rep stosw word [rdi], ax
lea rax, [r8 + rdx]
mov word [r9 + rax*2], r15w
jmp 0x140030288
mov word [rsp + 0x20], r15w
mov r9, rdx
xor r8d, r8d
lea rcx, [rbp - 1]
call fcn.14000f530
lea rax, [rbp - 1]
cmp qword [rbp + 0x17], 7
cmova rax, qword [rbp - 1]
mov r8, rsi
cmp qword [rsi + 0x18], 7
jbe 0x1400302a3
mov r8, qword [rsi]
mov rdx, rbx
cmp qword [rbx + 0x18], 7
jbe 0x1400302b0
mov rdx, qword [rbx]
lea rdi, [rbp + 0x1f]
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
mov rcx, 0xffffffff80000002
mov r9d, 2
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
lea rdx, [rbp - 1]
cmp qword [rbp + 0x17], 7
cmova rdx, qword [rbp - 1]
xorps xmm0, xmm0
movups xmmword [r14], xmm0
mov qword [r14 + 0x10], r15
mov qword [r14 + 0x18], r15
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x140030300
mov rcx, r14
call fcn.14000b570
nop
mov rdx, qword [rbp + 0x17]
cmp rdx, 7
jbe 0x140030357
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140030352
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140030352
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14014ac44
mov qword [rbp + 0xf], r15
mov qword [rbp + 0x17], 7
mov word [rbp - 1], r15w
mov rcx, rbx
call fcn.14003e3c0
nop
mov rcx, rsi
call fcn.14003e3c0
mov rax, r14
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.14014b190
mov rbx, qword [rsp + 0xc0]
add rsp, 0x90
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140038960
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov dword [rcx + 0x74], 0
mov rbx, rcx
mov edi, 0x7fffffff
movsx ecx, byte [rbx + 0x78]
lea eax, [rcx - 0x30]
cmp al, 9
ja 0x140038a2c
lea r8d, [rcx - 0x30]
cmp r8d, 0xffffffff
je 0x140038a2c
mov r9d, dword [rbx + 0x74]
mov ecx, 0x7fffffff
sub ecx, r8d
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp r9d, edx
jg 0x140038a45
lea eax, [r9 + r9*4]
dec edi
lea ecx, [r8 + rax*2]
mov rax, qword [rbx]
mov dword [rbx + 0x74], ecx
mov rcx, qword [rbx + 0x10]
cmp rax, rcx
je 0x140038a1c
cmp byte [rax], 0x5c
jne 0x140038a16
lea rdx, [rax + 1]
cmp rdx, rcx
je 0x140038a16
mov r8d, dword [rbx + 0x80]
test r8b, 8
jne 0x140038a02
movzx ecx, byte [rdx]
sub cl, 0x28
cmp cl, 1
jbe 0x140038a13
test r8b, 0x10
jne 0x140038a16
movzx ecx, byte [rdx]
sub cl, 0x7b
test cl, 0xfd
jne 0x140038a16
mov rax, rdx
inc rax
mov qword [rbx], rax
mov rcx, rbx
call fcn.14003e430
test edi, edi
jne 0x140038980
mov rbx, qword [rsp + 0x30]
cmp edi, 0x7fffffff
mov rsi, qword [rsp + 0x38]
setne al
add rsp, 0x20
pop rdi
ret
mov edx, esi
mov rcx, rbx
call fcn.14003b2b0
int3
Function at 0x140040f70
Capabilities:
Resolve dns

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rax, qword [rdx + 8]
mov rbx, r9
mov rdi, r8
mov rsi, rcx
test rax, rax
je 0x140040ff0
cmp dword [rax + 8], 0
je 0x140040ff0
test r8, r8
je 0x140040fa2
cmp byte [r8], 0
jne 0x140040fa4
xor edi, edi
test rbx, rbx
je 0x140040faf
cmp byte [r9], 0
jne 0x140040fb1
xor ebx, ebx
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov r9, qword [rsp + 0x78]
mov rdx, rbx
mov r8, qword [rsp + 0x70]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov edx, eax
lea rcx, [rsp + 0x20]
call fcn.140073e10
mov rcx, qword [rsp + 0x80]
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movsd xmm1, qword [rax + 0x10]
jmp 0x14004105b
movabs rcx, 0x4d54ee85da812030
mov dword [rsp + 0x24], 0
add rcx, qword [0x1401da008]
lea rbx, section..data
cmp rcx, 1
jbe 0x14004102a
mov rax, qword [section..data]
mov edx, 0x3e3
mov rcx, rbx
call qword [rax + 0x30]
jmp 0x14004102c
mov al, 1
mov rcx, qword [rsp + 0x80]
movzx eax, al
mov dword [rsp + 0x20], 0x3e3
add rax, 2
mov qword [rsp + 0x28], rbx
movups xmm0, xmmword [rsp + 0x20]
mov qword [rsp + 0x30], rax
movsd xmm1, qword [rsp + 0x30]
movups xmmword [rcx], xmm0
mov rbx, qword [rsp + 0x50]
mov rax, rsi
movsd qword [rcx + 0x10], xmm1
movq xmm1, xmm1
movups xmm0, xmmword [rcx]
movups xmmword [rsi], xmm0
movsd qword [rsi + 0x10], xmm1
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x140043bb0
Capabilities:
Set socket configuration

Disassembly:
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x1401dedc0]
xor rax, rsp
mov qword [rbp - 0x18], rax
xor r12d, r12d
mov r15, r9
mov r14, rdx
mov rdi, rcx
cmp rcx, 0xffffffffffffffff
je 0x140043d9d
mov qword [rsp + 0xc0], rbx
test r8b, r8b
je 0x140043c2e
movzx eax, byte [rdx]
test al, 8
je 0x140043c2e
or al, 8
mov dword [rbp - 0x20], r12d
mov byte [rdx], al
lea r9, [rbp - 0x20]
mov edx, 0xffff
mov dword [rsp + 0x20], 4
mov r8d, 0x80
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
lea rcx, [rbp - 0x38]
setne dl
call fcn.14004e6e0
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
test eax, eax
mov rcx, r15
mov ebx, eax
setne dl
call fcn.14004e6e0
test ebx, ebx
je 0x140043d99
mov qword [rsp + 0x78], rsi
movabs rcx, 0x4d54ee85da812030
mov rsi, qword [0x1401da008]
add rcx, rsi
mov qword [rsp + 0x70], r13
mov dword [rbp - 0x4c], r12d
lea r13, section..data
cmp rcx, 1
jbe 0x140043c98
mov rax, qword [section..data]
mov edx, 0x2733
mov rcx, r13
call qword [rax + 0x30]
mov rsi, qword [0x1401da008]
jmp 0x140043c9a
mov al, 1
movzx eax, al
lea rdx, [rbp - 0x38]
add rax, 2
mov dword [rbp - 0x50], 0x2733
mov qword [rbp - 0x40], rax
mov rcx, r15
movsd xmm1, qword [rbp - 0x40]
mov qword [rbp - 0x48], r13
movups xmm0, xmmword [rbp - 0x50]
movsd qword [rbp - 0x28], xmm1
movups xmmword [rbp - 0x38], xmm0
call fcn.14002b890
test al, al
jne 0x140043d37
movabs rax, 0x4d54ee85da812030
mov dword [rbp - 0x4c], r12d
add rax, rsi
cmp rax, 1
jbe 0x140043cfd
mov rax, qword [section..data]
mov edx, 0x4d5
mov rcx, r13
call qword [rax + 0x30]
jmp 0x140043cff
mov al, 1
movzx eax, al
lea rdx, [rbp - 0x38]
add rax, 2
mov dword [rbp - 0x50], 0x4d5
mov qword [rbp - 0x40], rax
mov rcx, r15
movsd xmm1, qword [rbp - 0x40]
mov qword [rbp - 0x48], r13
movups xmm0, xmmword [rbp - 0x50]
movsd qword [rbp - 0x28], xmm1
movups xmmword [rbp - 0x38], xmm0
call fcn.14002b890
test al, al
je 0x140043d69
lea r8, [rbp - 0x20]
mov dword [rbp - 0x20], r12d
mov edx, 0x8004667e
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_ioctlsocket]
and byte [r14], 0xfc
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
test eax, eax
mov rcx, r15
mov ebx, eax
setne dl
call fcn.14004e6e0
mov rsi, qword [rsp + 0x78]
mov eax, ebx
mov r13, qword [rsp + 0x70]
mov rbx, qword [rsp + 0xc0]
mov rcx, qword [rbp - 0x18]
xor rcx, rsp
call fcn.14014b190
add rsp, 0x80
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
mov eax, ebx
jmp 0x140043d75
mov eax, r12d
jmp 0x140043d7d
Function at 0x1400447e0
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
cmp qword [rdx + 0x10], 1
mov rbx, rdx
mov rdi, rcx
je 0x14004480c
mov edx, dword [rdx]
jmp 0x14004483f
mov rcx, qword [rdx + 8]
movabs rax, 0x4800144005b3
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 0x14
imul rax, rax, 0x1ffff7
sub rcx, rax
imul edx, ecx, 0x3e8
add edx, dword [rbx]
xor r14d, r14d
lea rsi, section..data
movabs r15, 0x4d54ee85da812030
sub edx, 0x79
je 0x14004492a
sub edx, 0x450
je 0x1400448f0
sub edx, 6
je 0x1400448b6
cmp edx, 1
jne 0x14004497b
mov rcx, qword [0x1401da008]
add rcx, r15
mov dword [rbp - 0x1c], r14d
cmp rcx, 1
jbe 0x1400448a8
mov rax, qword [section..data]
mov edx, 0x2751
mov rcx, rsi
call qword [rax + 0x30]
mov dword [rbp - 0x20], 0x2751
jmp 0x14004495b
mov al, 1
mov dword [rbp - 0x20], 0x2751
jmp 0x14004495b
mov rcx, qword [0x1401da008]
add rcx, r15
mov dword [rbp - 0x1c], r14d
cmp rcx, 1
jbe 0x1400448e5
mov rax, qword [section..data]
mov edx, 0x2743
mov rcx, rsi
call qword [rax + 0x30]
mov dword [rbp - 0x20], 0x2743
jmp 0x14004495b
mov al, 1
mov dword [rbp - 0x20], 0x2743
jmp 0x14004495b
mov rcx, qword [0x1401da008]
add rcx, r15
mov dword [rbp - 0x1c], r14d
cmp rcx, 1
jbe 0x14004491f
mov rax, qword [section..data]
mov edx, 0x274d
mov rcx, rsi
call qword [rax + 0x30]
mov dword [rbp - 0x20], 0x274d
jmp 0x14004495b
mov al, 1
mov dword [rbp - 0x20], 0x274d
jmp 0x14004495b
mov rcx, qword [0x1401da008]
add rcx, r15
mov dword [rbp - 0x1c], r14d
cmp rcx, 1
jbe 0x140044952
mov rax, qword [section..data]
mov edx, 0x274c
mov rcx, rsi
call qword [rax + 0x30]
jmp 0x140044954
mov al, 1
mov dword [rbp - 0x20], 0x274c
movzx eax, al
mov qword [rbp - 0x18], rsi
add rax, 2
movups xmm0, xmmword [rbp - 0x20]
mov qword [rbp - 0x10], rax
movsd xmm1, qword [rbp - 0x10]
movups xmmword [rbx], xmm0
movsd qword [rbx + 0x10], xmm1
mov rax, qword [rbx + 0x10]
test al, 1
je 0x140044996
cmp rax, 1
jne 0x140044a18
cmp dword [rbx], r14d
jne 0x140044a18
cmp rdi, 0xffffffffffffffff
jne 0x1400449ef
mov rcx, qword [0x1401da008]
add rcx, r15
mov dword [rbp - 0x1c], r14d
cmp rcx, 1
jbe 0x1400449c4
mov rax, qword [section..data]
mov edx, 0x2719
mov rcx, rsi
call qword [rax + 0x30]
jmp 0x1400449c6
mov al, 1
movzx eax, al
mov dword [rbp - 0x20], 0x2719
add rax, 2
mov qword [rbp - 0x18], rsi
movups xmm0, xmmword [rbp - 0x20]
mov qword [rbp - 0x10], rax
movsd xmm1, qword [rbp - 0x10]
movups xmmword [rbx], xmm0
movsd qword [rbx + 0x10], xmm1
jmp 0x140044a18
xor r9d, r9d
mov dword [rsp + 0x20], r14d
mov edx, 0xffff
mov r8d, 0x7010
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
mov rcx, rbx
setne dl
call fcn.14004e6e0
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
add rsp, 0x50
pop r15
pop r14
pop rbp
ret
Function at 0x140044fe0
Capabilities:
Connect socket

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, r9
cmp rcx, 0xffffffffffffffff
jne 0x14004506b
movabs rcx, 0x4d54ee85da812030
mov dword [rsp + 0x24], 0
add rcx, qword [0x1401da008]
lea rbx, section..data
cmp rcx, 1
jbe 0x14004502d
mov rax, qword [section..data]
mov edx, 0x2719
mov rcx, rbx
call qword [rax + 0x30]
jmp 0x14004502f
mov al, 1
movzx eax, al
add rax, 2
mov dword [rsp + 0x20], 0x2719
mov qword [rsp + 0x30], rax
mov eax, 0xffffffff
movsd xmm1, qword [rsp + 0x30]
mov qword [rsp + 0x28], rbx
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rdi], xmm0
movsd qword [rdi + 0x10], xmm1
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
call qword [sym.imp.WS2_32.dll_connect]
test eax, eax
mov rcx, rdi
mov ebx, eax
setne dl
call fcn.14004e6e0
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x14004c6c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x14004c6f4
movabs r10, 0x100000001b3
nop
movzx ecx, byte [rdx + r9]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x14004c6e0
ret
Function at 0x14005eb90
Capabilities:
Terminate thread

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x1401dedc0]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rax, qword [rcx + 0x10]
lea rdx, [rsp + 0x20]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rax, qword [rcx + 8]
mov rbx, rcx
mov r9d, 0xffffffff
mov qword [rsp + 0x28], rax
lea ecx, [r8 + 2]
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
lock xadd dword [0x1401e40c8], eax
mov rcx, qword [rbx + 8]
test eax, eax
je 0x14005ec09
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14014b190
add rsp, 0x40
pop rbx
ret
mov rdx, rcx
xor r8d, r8d
lea rcx, [0x140003510]
call qword [sym.imp.KERNEL32.dll_QueueUserAPC]
mov rcx, qword [rbx + 8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14014b190
add rsp, 0x40
pop rbx
ret

Function at 0x140060e10
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x18
cmp qword [r8 + 0x18], 0xf
mov r10, r8
mov dword [rsp], r9d
jbe 0x140060e25
mov r10, qword [r8]
cmp qword [rdx + 0x18], 0xf
mov rax, qword [rdx + 0x10]
jbe 0x140060e38
add rax, qword [rdx]
mov rdx, qword [rdx]
jmp 0x140060e3b
add rax, rdx
xor r8d, r8d
cmp rdx, rax
je 0x140060e6a
sub r10, rdx
nop word [rax + rax]
movzx ecx, byte [rsp + r8]
xor cl, byte [rdx]
inc r8
mov byte [r10 + rdx], cl
and r8d, 3
inc rdx
cmp rdx, rax
jne 0x140060e50
add rsp, 0x18
ret
Function at 0x140068d50
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
cmp byte [rcx + 0x19], 0
mov r12, r9
mov rdi, r8
mov r11, rdx
mov rbp, rcx
jge 0x140068dd9
mov rbx, qword [rcx + 0x80]
xor r10d, r10d
mov r8, qword [rbx + 0x10]
mov dword [rsp + 0x60], r8d
test rdi, rdi
je 0x140068dae
mov rax, r10
and eax, 3
movzx eax, byte [rsp + rax + 0x60]
xor byte [rdx + r10], al
inc r10
cmp r10, rdi
jb 0x140068d90
mov rbx, qword [rcx + 0x80]
mov rdx, rdi
and edx, 3
je 0x140068dd5
mov rax, r8
lea rdx, [rdx*8]
mov ecx, 0x40
sub rcx, rdx
shl rax, cl
mov rcx, rdx
shr r8, cl
or r8, rax
mov qword [rbx + 0x10], r8
mov rax, qword [rbp + 0x80]
mov r8, rdi
mov rdx, r11
mov rbx, qword [rax]
add rbx, 0x50
mov r15, qword [rbx + 0x10]
lea r14, [rbx + 0x10]
mov rcx, rbx
call fcn.14003f0c0
mov r10, qword [rbp + 0x80]
mov rax, qword [r10]
cmp dword [rax + 0x70], 1
jne 0x140068e9a
cmp qword [rbx + 0x18], 0xf
jbe 0x140068e23
mov rdx, qword [rbx]
mov rbx, rdx
add rdx, qword [r14]
jmp 0x140068e29
mov rdx, qword [r14]
add rdx, rbx
lea rax, [r15 + rbx]
cmp rax, rdx
je 0x140068e9a
lea rbx, [0x14015a9f0]
nop dword [rax]
cmp dword [r10 + 0x18], 0
movzx r8d, byte [rax]
mov r9d, r8d
movzx r11d, byte [r8 + rbx]
je 0x140068e63
mov ecx, dword [r10 + 0x1c]
and r9d, 0x3f
shl ecx, 6
or r9d, ecx
jmp 0x140068e72
mov r8d, 0xff
mov ecx, r11d
sar r8d, cl
and r9d, r8d
mov dword [r10 + 0x1c], r9d
mov ecx, dword [r10 + 0x18]
add ecx, 0x10
shl ecx, 4
add ecx, r11d
movzx r8d, byte [rcx + rbx]
mov dword [r10 + 0x18], r8d
cmp r8d, 1
je 0x140068eb8
inc rax
cmp rax, rdx
jne 0x140068e40
sub qword [rbp + 0x30], rdi
mov rax, rdi
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
mov dword [rsp + 0x20], select
call fcn.14004f790
mov qword [rsp + 0x28], rax
xor eax, eax
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [r12], xmm0
jmp 0x140068ea1
Function at 0x14006f0e0
Capabilities:
Send data
Send data on socket

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1401dedc0]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, qword [rbp + 0x60]
xor r15d, r15d
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r9d
lea r9, [rbp - 0x18]
mov dword [rbp - 0x18], r15d
call qword [sym.imp.WS2_32.dll_WSASend]
mov esi, eax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov rdx, qword [0x1401da008]
lea r14, section..data
movabs r12, 0x4d54ee85da812030
mov dword [rbp - 0x2c], r15d
add rdx, r12
mov edi, eax
cmp rdx, 1
jbe 0x14006f168
mov rcx, qword [section..data]
mov edx, eax
mov r8, qword [rcx + 0x30]
mov rcx, r14
call r8
jmp 0x14006f16d
test edi, edi
setne al
movzx eax, al
movabs r10, 0x4800144005b3
add rax, 2
mov dword [rbp - 0x30], edi
mov qword [rbp - 0x28], r14
movups xmm0, xmmword [rbp - 0x30]
mov qword [rbp - 0x20], rax
movsd xmm1, qword [rbp - 0x20]
movups xmmword [rbx], xmm0
movsd qword [rbx + 0x10], xmm1
mov r9, qword [rbx + 0x10]
cmp r9, 1
je 0x14006f1ab
mov eax, dword [rbx]
mov r8d, eax
jmp 0x14006f1db
mov rcx, qword [rbx + 8]
mov rax, r10
mov r8d, dword [rbx]
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 0x14
imul rax, rax, 0x1ffff7
sub rcx, rax
imul eax, ecx, 0x3e8
add eax, r8d
cmp eax, 0x40
jne 0x14006f21a
mov rcx, qword [0x1401da008]
add rcx, r12
mov dword [rbp - 0x2c], r15d
cmp rcx, 1
jbe 0x14006f20f
mov rax, qword [section..data]
mov edx, 0x2746
mov rcx, r14
call qword [rax + 0x30]
mov dword [rbp - 0x30], 0x2746
jmp 0x14006f287
mov al, 1
mov dword [rbp - 0x30], 0x2746
jmp 0x14006f287
cmp r9, 1
jne 0x14006f24d
mov rcx, qword [rbx + 8]
mov rax, r10
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 0x14
imul rax, rax, 0x1ffff7
sub rcx, rax
imul eax, ecx, 0x3e8
add r8d, eax
cmp r8d, 0x4d2
jne 0x14006f2a7
mov rcx, qword [0x1401da008]
add rcx, r12
mov dword [rbp - 0x2c], r15d
cmp rcx, 1
jbe 0x14006f27e
mov rax, qword [section..data]
mov edx, 0x274d
mov rcx, r14
call qword [rax + 0x30]
jmp 0x14006f280
mov al, 1
mov dword [rbp - 0x30], 0x274d
movzx eax, al
mov qword [rbp - 0x28], r14
add rax, 2
movups xmm0, xmmword [rbp - 0x30]
mov qword [rbp - 0x20], rax
movsd xmm1, qword [rbp - 0x20]
movups xmmword [rbx], xmm0
movsd qword [rbx + 0x10], xmm1
test esi, esi
je 0x14006f2b2
mov eax, 0xffffffff
jmp 0x14006f2c9
mov eax, dword [rbp - 0x18]
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbp - 0x20], r15
movsd xmm0, qword [rbp - 0x20]
movsd qword [rbx + 0x10], xmm0
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14014b190
add rsp, 0x70
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret