joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14009e9db
Capabilities:
Set socket configuration

Disassembly:
push rsi
sub rsp, 0x40
mov rax, qword [0x1401ea088]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x34], 0x4020
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x2c], 4
mov eax, dword [0x1401ee028]
cmp eax, 2
je 0x14009eaa6
mov rsi, rcx
test eax, eax
jne 0x14009ea54
mov dword [rsp + 0x20], 3
mov ecx, 6
xor edx, edx
xor r8d, r8d
mov r9d, 2
call fcn.1400a9af8
test al, al
je 0x14009ea4a
mov dword [0x1401ee028], 2
jmp 0x14009eaa6
mov dword [0x1401ee028], 1
lea rax, [rsp + 0x2c]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
mov rcx, rsi
mov edx, 0xffff
mov r8d, 0x1001
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x14009ea85
cmp dword [rsp + 0x30], 0x4020
jg 0x14009eaa6
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x34]
mov rcx, rsi
mov edx, 0xffff
mov r8d, 0x1001
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14015c2e0
nop
add rsp, 0x40
pop rsi
ret

Function at 0x14009fddf
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rsi
push rdi
sub rsp, 0x1b8
mov rax, qword [0x1401ea088]
xor rax, rsp
mov qword [rsp + 0x1b0], rax
mov rax, qword [rdx + 0x20]
mov rax, qword [rax + 0x2e8]
test byte [rax + 0x85], 8
jne 0x14009fefb
mov rsi, rdx
mov rdi, qword [rcx + 0x10]
lea rcx, [rsp + 0xb0]
mov r8d, 0x100
mov dl, 0xaa
call fcn.1401615d0
lea r8, [rsp + 0x2c]
mov dword [r8], 0x80
xorps xmm0, xmm0
lea rdx, [rsp + 0x30]
movaps xmmword [rdx], xmm0
movaps xmmword [rdx + 0x10], xmm0
movaps xmmword [rdx + 0x20], xmm0
movaps xmmword [rdx + 0x30], xmm0
movaps xmmword [rdx + 0x40], xmm0
movaps xmmword [rdx + 0x50], xmm0
movaps xmmword [rdx + 0x60], xmm0
movaps xmmword [rdx + 0x70], xmm0
mov rcx, qword [rdi + 0x98]
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x14009fea1
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
lea rdx, [rsp + 0xb0]
mov r8d, 0x100
mov ecx, eax
call fcn.1400b4690
lea rdx, str.getsockname___failed_with_errno__d:__s
mov rcx, rsi
mov r8d, edi
mov r9, rax
jmp 0x14009fef6
lea r9, [rdi + 0x144]
add rdi, 0x114
mov edx, dword [rsp + 0x2c]
lea rcx, [rsp + 0x30]
mov r8, rdi
call fcn.1400450dc
test al, al
jne 0x14009fefb
call fcn.140174398
mov ecx, dword [rax]
lea rdx, [rsp + 0xb0]
mov r8d, 0x100
call fcn.1400b4690
mov rdi, rax
call fcn.140174398
mov r8d, dword [rax]
lea rdx, str.ssloc_inet_ntop___failed_with_errno__d:__s
mov rcx, rsi
mov r9, rdi
call fcn.140031630
mov rcx, qword [rsp + 0x1b0]
xor rcx, rsp
call fcn.14015c2e0
nop
add rsp, 0x1b8
pop rdi
pop rsi
ret
Function at 0x1400a0af0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x138
mov rdi, r9
mov rsi, r8
mov r14, rcx
mov rax, qword [0x1401ea088]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
mov dword [r9], 0
mov rcx, qword [rax + 0x98]
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recv]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x1400a0b9e
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x1400a0b54
mov dword [rdi], 0x51
jmp 0x1400a0b9e
mov ebp, eax
lea r15, [rsp + 0x30]
mov r8d, 0x100
mov rcx, r15
mov dl, 0xaa
call fcn.1401615d0
mov r8d, 0x100
mov ecx, ebp
mov rdx, r15
call fcn.1400b4690
mov rcx, qword [r14 + 8]
lea rdx, str.Recv_failure:__s
mov r8, rax
call fcn.140031630
mov rax, qword [r14 + 8]
mov dword [rax + 0xcfc], ebp
mov dword [rdi], 0x38
mov rcx, qword [r14 + 8]
test rcx, rcx
je 0x1400a0bda
cmp byte [rcx + 0xa37], 0
je 0x1400a0bda
mov rdx, qword [r14]
test rdx, rdx
je 0x1400a0bda
mov rax, qword [rdx]
cmp dword [rax + 0xc], 0
jle 0x1400a0bda
mov eax, dword [rdi]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ebx
lea r8, str.nw_in_read_len_zu______d__err_d
mov r9, rsi
call fcn.1400317d3
movsxd rsi, ebx
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.14015c2e0
mov rax, rsi
add rsp, 0x138
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x1400a4c84
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov edi, 1
xor r14d, r14d
mov r15, qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov rax, qword [0x1401ea0b0]
mov edx, edi
mov rcx, r14
call qword [case.0x140031f00.0]
test rax, rax
je 0x1400a4ced
mov rbx, rax
mov rcx, rsi
mov rdx, rax
mov r8d, edi
call r15
test eax, eax
je 0x1400a4ce1
cmp eax, edi
je 0x1400a4ce1
cmp eax, 0x8001
jae 0x1400a4ce1
mov r14, rbx
cmp eax, edi
mov edi, eax
jae 0x1400a4ca1
jmp 0x1400a4cff
mov rax, qword [fcn.14017bff0]
mov rcx, rbx
jmp 0x1400a4cf7
mov rax, qword [fcn.14017bff0]
mov rcx, r14
call qword [case.0x140031f00.0]
xor ebx, ebx
mov rax, rbx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1400aa4fc
Capabilities:
Convert ip address from string

Disassembly:
push rsi
push rbx
sub rsp, 0x48
mov rsi, rcx
mov rax, qword [0x1401ea088]
xor rax, rsp
mov qword [rsp + 0x40], rax
lea r8, [rsp + 0x2c]
mov dword [r8], 0xaaaaaaaa
movaps xmm0, xmmword [section..rdata]
movaps xmmword [rsp + 0x30], xmm0
mov ecx, 2
mov rdx, rsi
call qword [sym.imp.WS2_32.dll_inet_pton]
mov bl, 1
test eax, eax
jg 0x1400aa558
lea r8, [rsp + 0x30]
mov ecx, reloc.WS2_32.dll_socket
mov rdx, rsi
call qword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
setg bl
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14015c2e0
mov eax, ebx
add rsp, 0x48
pop rbx
pop rsi
ret
Function at 0x1400ab589
Capabilities:
Resolve dns

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
movaps xmmword [rsp + 0x30], xmm6
mov rsi, r9
mov rax, qword [0x1401ea088]
xor rax, rsp
mov qword [rsp + 0x28], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r9, [rsp + 0x20]
mov qword [r9], rax
mov qword [rsi], 0
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov ebx, eax
test eax, eax
jne 0x1400ab70e
mov r13, qword [rsp + 0x20]
test r13, r13
je 0x1400ab6f9
xor ebp, ebp
xorps xmm6, xmm6
xor edi, edi
mov rcx, qword [r13 + 0x18]
test rcx, rcx
je 0x1400ab604
call fcn.1401812d0
mov rbx, rax
inc rbx
jmp 0x1400ab606
xor ebx, ebx
mov eax, dword [r13 + 4]
cmp eax, 2
je 0x1400ab61c
cmp eax, 0x17
jne 0x1400ab62f
mov r15d, 0x1c
jmp 0x1400ab622
mov r15d, reloc.WS2_32.dll_recv
cmp qword [r13 + 0x20], 0
je 0x1400ab62f
cmp qword [r13 + 0x10], r15
jae 0x1400ab643
mov r14, rbp
mov r13, qword [r13 + 0x28]
mov rbp, r14
test r13, r13
jne 0x1400ab5ee
jmp 0x1400ab6e2
mov rax, qword [fcn.14017d250]
lea rcx, [rbx + r15]
add rcx, 0x30
call qword [case.0x140031f00.0]
test rax, rax
je 0x1400ab733
mov r14, rax
mov eax, dword [r13]
mov dword [r14], eax
mov eax, dword [r13 + 4]
mov dword [r14 + 4], eax
mov eax, dword [r13 + 8]
mov dword [r14 + 8], eax
mov eax, dword [r13 + 0xc]
mov dword [r14 + 0xc], eax
mov dword [r14 + 0x10], r15d
lea r12, [r14 + 0x30]
movups xmmword [r14 + 0x18], xmm6
mov qword [r14 + 0x28], 0
mov qword [r14 + 0x20], r12
mov rdx, qword [r13 + 0x20]
mov rcx, r12
mov r8, r15
call fcn.140160f20
test rbx, rbx
je 0x1400ab6c9
lea rax, [r14 + 0x18]
add r12, r15
mov qword [rax], r12
mov rdx, qword [r13 + 0x18]
mov rcx, r12
mov r8, rbx
call fcn.140160f20
test rdi, rdi
cmove rdi, r14
test rbp, rbp
je 0x1400ab632
mov qword [rbp + 0x28], r14
jmp 0x1400ab632
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x1400ab6f2
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
xor ebx, ebx
test rdi, rdi
jne 0x1400ab70b
mov ebx, 0x2af9
mov ecx, 0x2af9
call qword [sym.imp.WS2_32.dll_WSASetLastError]
xor edi, edi
mov qword [rsi], rdi
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14015c2e0
mov eax, ebx
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x1400ab743
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
mov ebx, 8
test rdi, rdi
je 0x1400ab709
mov r14, qword [rdi + 0x28]
mov rax, qword [fcn.14017bff0]
mov rcx, rdi
call qword [case.0x140031f00.0]
mov rdi, r14
test r14, r14
jne 0x1400ab74d
jmp 0x1400ab709
Function at 0x1400ab991
Capabilities:
Convert ip address from string

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov esi, edx
mov rdi, rcx
mov rax, qword [0x1401ea088]
xor rax, rsp
mov qword [rsp + 0x40], rax
lea r8, [rsp + 0x2c]
mov dword [r8], 0xaaaaaaaa
mov ecx, 2
mov rdx, rdi
call qword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
jle 0x1400ab9d5
lea rdx, [rsp + 0x2c]
mov ecx, 2
jmp 0x1400aba01
movaps xmm0, xmmword [section..rdata]
lea r8, [rsp + 0x30]
movaps xmmword [r8], xmm0
mov ecx, reloc.WS2_32.dll_socket
mov rdx, rdi
call qword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
jle 0x1400aba26
lea rdx, [rsp + 0x30]
mov ecx, reloc.WS2_32.dll_socket
mov r8, rdi
mov r9d, esi
call fcn.1400ab8b5
mov rsi, rax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14015c2e0
mov rax, rsi
add rsp, 0x48
pop rdi
pop rsi
ret
xor esi, esi
jmp 0x1400aba0f

Function at 0x1400ae3d3
Capabilities:
Convert ip address from string

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x70
mov rax, qword [0x1401ea088]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov ebp, socket
cmp r8, 4
jb 0x1400ae50f
mov r14, r8
mov rsi, rdx
mov rdi, rcx
inc rsi
add r14, 0xfffffffffffffffe
lea rdx, str.0123456789abcdefABCDEF:.
mov rcx, rsi
call fcn.140181a00
cmp r14, rax
jne 0x1400ae4b2
movaps xmm0, xmmword [section..rdata]
lea r8, [rsp + 0x50]
movaps xmmword [r8], xmm0
movups xmmword [rsp + 0x3e], xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
mov byte [rsi + r14], 0
mov ecx, reloc.WS2_32.dll_socket
mov rdx, rsi
call qword [sym.imp.WS2_32.dll_inet_pton]
mov ebp, socket
cmp eax, 1
jne 0x1400ae50f
lea rdx, [rsp + 0x50]
lea r8, [rsp + 0x20]
mov r9d, 0x2e
mov ecx, reloc.WS2_32.dll_socket
call sub.WS2_32.dll_inet_ntop
test rax, rax
je 0x1400ae4a9
lea rcx, [rsp + 0x20]
call fcn.1401812d0
cmp rax, r14
jae 0x1400ae4a9
mov rdi, rax
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.140180c20
mov byte [rdi + rsi + 1], 0
mov r14, rdi
mov byte [rsi + r14], 0x5d
xor ebp, ebp
jmp 0x1400ae50f
mov rbx, rax
cmp byte [rsi + rax], 0x25
jne 0x1400ae50f
lea r14, [rbx + rsi]
inc r14
movaps xmm0, xmmword [section..rdata]
movaps xmmword [rsp + 0x20], xmm0
lea rdx, [0x1401ab09d]
mov r8d, 2
mov rcx, r14
call fcn.140181390
test eax, eax
je 0x1400ae529
mov al, byte [r14]
mov ebp, socket
test al, al
je 0x1400ae50f
xor ecx, ecx
cmp al, 0x5d
je 0x1400ae53d
cmp rcx, 0xe
ja 0x1400ae53d
mov byte [rsp + rcx + 0x20], al
mov al, byte [r14 + rcx + 1]
inc rcx
test al, al
jne 0x1400ae4f5
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14015c2e0
mov eax, ebp
add rsp, 0x70
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
movzx eax, byte [r14 + 2]
cmp eax, 0x5d
je 0x1400ae4e7
test eax, eax
je 0x1400ae4e7
add r14, 2
jmp 0x1400ae4ea
test rcx, rcx
je 0x1400ae50f
cmp al, 0x5d
jne 0x1400ae50f
mov byte [rsp + rcx + 0x20], 0
mov rax, qword [fcn.1401781e0]
lea rcx, [rsp + 0x20]
call qword [case.0x140031f00.0]
mov qword [rdi + 0x28], rax
test rax, rax
je 0x1400ae574
mov word [rsi + rbx], 0x5d
mov r14, rbx
jmp 0x1400ae423
mov ebp, 7
jmp 0x1400ae50f
Function at 0x1400af925
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
cmp byte [r8], 0
je 0x1400afaf4
mov rsi, r8
mov ebx, edx
mov rdi, rcx
movzx eax, dl
mov ecx, edx
xor cl, 1
movzx ecx, cl
lea r13, [rcx*4 + 0x1318]
shl rax, 4
lea rbp, [rax + rdi]
add rbp, 0xd88
lea r14, str.Digest
lea r15, str.Basic
movabs r12, 0x100100000201
mov r8d, 6
mov rcx, rsi
mov rdx, r14
call fcn.1400478eb
test eax, eax
je 0x1400afa0c
movzx eax, byte [rsi + 6]
cmp rax, 0x2c
ja 0x1400afa06
bt r12, rax
jae 0x1400afa06
test byte [rbp + 8], 2
jne 0x1400af9dc
call fcn.14000e6b0
test al, al
je 0x1400afab8
or byte [rdi + r13], 2
or byte [rbp + 8], 2
mov rcx, rdi
mov edx, ebx
mov r8, rsi
call fcn.1400438ac
test eax, eax
jne 0x1400afa87
jmp 0x1400afab8
test rdi, rdi
je 0x1400afab8
cmp byte [rdi + 0xa37], 0
je 0x1400afab8
mov rcx, rdi
lea rdx, str.Ignoring_duplicate_digest_auth_header.
call fcn.14003171b
jmp 0x1400afab8
add al, 0xf2
cmp al, 0xfc
jae 0x1400af9a6
mov r8d, 5
mov rcx, rsi
mov rdx, r15
call fcn.1400478eb
test eax, eax
je 0x1400afa48
movzx eax, byte [rsi + 5]
cmp rax, 0x2c
ja 0x1400afa42
bt r12, rax
jae 0x1400afa42
or byte [rdi + r13], 1
or byte [rbp + 8], 1
cmp dword [rbp + 4], 1
jne 0x1400afab8
jmp 0x1400afa80
add al, 0xf2
cmp al, 0xfc
jae 0x1400afa31
mov r8d, 6
mov rcx, rsi
lea rdx, str.Bearer
call fcn.1400478eb
test eax, eax
je 0x1400afab8
movzx eax, byte [rsi + 6]
cmp rax, 0x2c
ja 0x1400afaad
bt r12, rax
jae 0x1400afaad
or byte [rdi + r13], 0x40
or byte [rbp + 8], 0x40
cmp dword [rbp + 4], 0x40
jne 0x1400afab8
mov dword [rbp + 8], 0
test rdi, rdi
je 0x1400afaa4
cmp byte [rdi + 0xa37], 0
je 0x1400afaa4
mov rcx, rdi
lea rdx, str.Authentication_problem._Ignoring_this.
call fcn.14003171b
mov byte [rdi + 0x12e9], 1
jmp 0x1400afab8
add al, 0xf2
cmp al, 0xfc
jb 0x1400afab8
jmp 0x1400afa71
inc rsi
movzx eax, byte [rsi]
test eax, eax
je 0x1400afac4
cmp eax, 0x2c
jne 0x1400afab5
xor ecx, ecx
cmp al, 0x2c
sete cl
add rsi, rcx
movzx eax, byte [rsi]
cmp eax, 9
je 0x1400afae7
cmp eax, 0x20
je 0x1400afae7
test eax, eax
je 0x1400afaf4
lea ecx, [rax - 0xa]
cmp cl, 3
ja 0x1400afaec
inc rsi
jmp 0x1400aface
test al, al
jne 0x1400af981
xor eax, eax
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400b8c78
Capabilities:
Generate random numbers via winapi

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rdx
mov r8d, 4
call fcn.140032782
cmp eax, 4
jne 0x1400b8cb7
mov dword [rsi], 0
xor ecx, ecx
mov rdx, rsi
mov r8d, 4
mov r9d, 2
call sub.bcrypt.dll_BCryptGenRandom
mov ecx, eax
xor eax, eax
test ecx, ecx
setne al
add eax, eax
add rsp, 0x20
pop rsi
ret

Function at 0x1400b9830
Capabilities:
Move file

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x1401ea088]
xor rax, rsp
mov qword [rsp + 0x50], rax
movaps xmm0, xmmword [section..rdata]
lea rcx, [rsp + 0x40]
movaps xmmword [rcx], xmm0
call fcn.140046bd4
mov rcx, rdi
call fcn.1400a4d10
mov rdi, rax
mov rcx, rsi
call fcn.1400a4d10
mov rsi, rax
mov rcx, rdi
mov rdx, rax
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x1400b98ea
lea rbx, [rsp + 0x30]
lea r14, [rsp + 0x20]
mov r15, qword [sym.imp.KERNEL32.dll_Sleep]
mov r12, qword [sym.imp.KERNEL32.dll_MoveFileExW]
mov rcx, rbx
call fcn.140046bd4
movaps xmm0, xmmword [rsp + 0x40]
movaps xmmword [rsp + 0x20], xmm0
mov rcx, rbx
mov rdx, r14
call fcn.140046c72
cmp rax, 0x3e9
jae 0x1400b9923
mov ecx, 1
call r15
mov rcx, rdi
mov rdx, rsi
mov r8d, 1
call r12
test eax, eax
je 0x1400b98aa
test rdi, rdi
je 0x1400b98f7
mov rcx, rdi
call fcn.14017bff0
xor edi, edi
test rsi, rsi
je 0x1400b9906
mov rcx, rsi
call fcn.14017bff0
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14015c2e0
mov eax, edi
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
test rdi, rdi
je 0x1400b9930
mov rcx, rdi
call fcn.14017bff0
mov edi, 1
jmp 0x1400b98f9
Function at 0x1400bc96e
Capabilities:
Create thread

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xa8
mov ebp, r9d
mov r14, r8
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x1401ea088]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov ecx, 0x40
call fcn.14015c21c
mov rbx, rax
lea rcx, [rsp + 0x38]
mov qword [rcx + 0x38], 0
mov rdx, rdi
call fcn.14000e918
lea r15, [rsp + 0x78]
mov rdx, qword [r14]
test rdx, rdx
je 0x1400bc9e8
mov r8, qword [r14 + 8]
xorps xmm0, xmm0
movups xmmword [r15 + 0x10], xmm0
movups xmmword [r15], xmm0
mov rcx, r15
call fcn.140002d20
jmp 0x1400bca03
xorps xmm0, xmm0
movups xmmword [r15], xmm0
mov qword [r15 + 0x10], 0
mov qword [rsp + 0x90], reloc.WS2_32.dll_ntohs
lea r14, [rsp + 0x38]
mov dword [r14 + 0x60], ebp
mov ecx, reloc.WS2_32.dll_WSASetLastError
call fcn.14015c21c
mov r12, rax
lea rax, [0x1401ae990]
mov qword [r12], rax
lea rcx, [r12 + 8]
xor r13d, r13d
mov qword [r12 + 0x40], r13
mov rdx, r14
call fcn.14000e918
movups xmm0, xmmword [r15]
movups xmm1, xmmword [r15 + 0x10]
movups xmmword [r12 + 0x58], xmm1
movups xmmword [r12 + 0x48], xmm0
mov eax, dword [r14 + 0x60]
mov dword [r12 + 0x68], eax
mov qword [rbx + 0x38], r12
mov qword [r14 + 0x50], r13
mov qword [r14 + 0x58], reloc.WS2_32.dll_ntohs
mov byte [r14 + 0x40], 0
mov rcx, qword [r14 + 0x38]
test rcx, rcx
je 0x1400bca88
cmp rcx, r14
setne dl
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
call qword [case.0x140031f00.0]
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], 0x10000
lea r8, [0x1400bcc00]
mov edx, 0x100000
xor ecx, ecx
mov r9, rbx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x1400bcb20
mov cl, byte [rsp + 0x110]
lea rdx, [0x1401ae940]
mov qword [rsi], rdx
mov byte [rsi + 8], 1
mov qword [rsi + 0x10], rax
mov byte [rsi + 0x20], cl
mov rcx, qword [rdi + 0x38]
test rcx, rcx
je 0x1400bcaf9
cmp rcx, rdi
setne dl
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
call qword [case.0x140031f00.0]
mov qword [rdi + 0x38], 0
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.14015c2e0
mov rax, rsi
add rsp, 0xa8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rax, str.CreateThread_failed
mov qword [rsp + 0x20], rax
lea rcx, str....._rtc_baseplatform_thread.cc
lea r8, str.handle
lea r9, [0x1401ae9c0]
mov edx, 0xc3
call fcn.14005f6a5
int3

Function at 0x1400bcf20
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x1400bcf40
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
repz ret
Function at 0x1400bcf80
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x1400bcfa0
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
repz ret

Function at 0x1400bcfe0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x1400bd003
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
repz ret

Function at 0x1400bd060
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x1400bd083
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
repz ret

Function at 0x1400bd0e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
xorps xmm5, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
nop dword [rax]
add rax, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x1400bd109
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
repz ret
Function at 0x1400bd170
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
xorps xmm5, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
nop dword [rax]
add rax, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x1400bd199
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
repz ret

Function at 0x1400bd200
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesenc xmm2, xmm1
lea rcx, [rcx + rax + 0x20]
neg rax
aesenc xmm3, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesenc xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [rcx + rax]
add rax, 0x10
jmp 0x1400bd25f

Function at 0x1400bd250
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
aesenc xmm6, xmm0
aesenc xmm7, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne fcn.1400bd250
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
aesenclast xmm6, xmm0
aesenclast xmm7, xmm0
repz ret

Function at 0x1400bd2e0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesdec xmm2, xmm1
lea rcx, [rcx + rax + 0x20]
neg rax
aesdec xmm3, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesdec xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [rcx + rax]
add rax, 0x10
jmp 0x1400bd33f
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
aesdec xmm6, xmm0
aesdec xmm7, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x1400bd330
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
aesdeclast xmm6, xmm0
aesdeclast xmm7, xmm0
repz ret