joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001c670
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, ecx
call fcn.14001b4a0
mov ecx, dword [0x140020678]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14001c6b0
test ebx, ebx
jle 0x14001c6a0
lock add dword [rax + 0x20], 1
add rsp, 0x20
pop rbx
ret
lock sub dword [rax + 0x20], 1
add rsp, 0x20
pop rbx
ret
call fcn.14001b550
test rax, rax
jne 0x14001c68d
add rsp, 0x20
pop rbx
ret

Function at 0x14001c7a0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x28
call fcn.14001b4a0
mov ecx, dword [0x140020678]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
mov rbx, rax
je 0x14001c818
test byte [rbx + 0x40], 0xc
jne 0x14001c7cf
mov eax, dword [0x140376658]
test eax, eax
jne 0x14001c7e0
add rsp, 0x28
pop rbx
pop rsi
ret
lea rsi, [rbx + 0x38]
mov rcx, rsi
call fcn.14001a720
movzx eax, byte [rbx + 0x40]
test al, 3
je 0x14001c803
mov edx, dword [rbx + 0x44]
test dl, 1
je 0x14001c803
mov ecx, dword [rbx + 0x20]
test ecx, ecx
jle 0x14001c82c
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.14001aa10
call fcn.14001b550
test rax, rax
mov rbx, rax
jne 0x14001c7bf
add rsp, 0x28
pop rbx
pop rsi
ret
mov rcx, qword [rbx + 0x30]
and eax, 0xfffffff3
and edx, 0xfffffffe
or eax, 4
mov dword [rbx + 0x44], edx
mov byte [rbx + 0x40], al
test rcx, rcx
je 0x14001c84a
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, rsi
call fcn.14001aa10
call fcn.14001c6c0
nop
nop dword [rax + rax]
push rdi
push rsi
push rbx
sub rsp, 0x20
test rcx, rcx
je 0x14001c8d0
call fcn.14001d9b0
mov rsi, rax
mov eax, 0xfffffffe
cmp rax, rsi
jb 0x14001c908
call fcn.14001b4a0
mov ecx, dword [0x140020678]
mov edi, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
mov rbx, rax
je 0x14001c960
test esi, esi
je 0x14001c8e6
call fcn.14001c7a0
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x14001c940
mov edx, edi
call fcn.14001da60
call fcn.14001c7a0
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
call fcn.14001b4a0
mov ecx, dword [0x140020678]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14001c950
call fcn.14001c7a0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.14001c7a0
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
call fcn.14001b4a0
mov ecx, dword [0x140020678]
mov edi, 0xffffffff
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
mov rbx, rax
jne 0x14001c8a5
call fcn.14001b550
mov rbx, rax
jmp 0x14001c8a5
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14001c8be
call fcn.14001b550
jmp 0x14001c8e6
call fcn.14001b550
mov rbx, rax
jmp 0x14001c8a1
Function at 0x14001c860
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x28
call fcn.14001b4a0
mov ecx, dword [0x140020678]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
mov rbx, rax
je 0x14001c818
test byte [rbx + 0x40], 0xc
jne 0x14001c7cf
mov eax, dword [0x140376658]
test eax, eax
jne 0x14001c7e0
add rsp, 0x28
pop rbx
pop rsi
ret
lea rsi, [rbx + 0x38]
mov rcx, rsi
call fcn.14001a720
movzx eax, byte [rbx + 0x40]
test al, 3
je 0x14001c803
mov edx, dword [rbx + 0x44]
test dl, 1
je 0x14001c803
mov ecx, dword [rbx + 0x20]
test ecx, ecx
jle 0x14001c82c
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.14001aa10
call fcn.14001b550
test rax, rax
mov rbx, rax
jne 0x14001c7bf
add rsp, 0x28
pop rbx
pop rsi
ret
mov rcx, qword [rbx + 0x30]
and eax, 0xfffffff3
and edx, 0xfffffffe
or eax, 4
mov dword [rbx + 0x44], edx
mov byte [rbx + 0x40], al
test rcx, rcx
je 0x14001c84a
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, rsi
call fcn.14001aa10
call fcn.14001c6c0
nop
nop dword [rax + rax]
push rdi
push rsi
push rbx
sub rsp, 0x20
test rcx, rcx
je 0x14001c8d0
call fcn.14001d9b0
mov rsi, rax
mov eax, 0xfffffffe
cmp rax, rsi
jb 0x14001c908
call fcn.14001b4a0
mov ecx, dword [0x140020678]
mov edi, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
mov rbx, rax
je 0x14001c960
test esi, esi
je 0x14001c8e6
call fcn.14001c7a0
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x14001c940
mov edx, edi
call fcn.14001da60
call fcn.14001c7a0
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
call fcn.14001b4a0
mov ecx, dword [0x140020678]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14001c950
call fcn.14001c7a0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.14001c7a0
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
call fcn.14001b4a0
mov ecx, dword [0x140020678]
mov edi, 0xffffffff
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
mov rbx, rax
jne 0x14001c8a5
call fcn.14001b550
mov rbx, rax
jmp 0x14001c8a5
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14001c8be
call fcn.14001b550
jmp 0x14001c8e6
call fcn.14001b550
mov rbx, rax
jmp 0x14001c8a1

Function at 0x14001c970
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov esi, ecx
call fcn.14001b4a0
mov ecx, dword [0x140020678]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
mov rbx, rax
je 0x14001c9e0
test esi, esi
je 0x14001c9c0
call fcn.14001c7a0
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x14001c9f0
mov edx, esi
call fcn.14001da60
call fcn.14001c7a0
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
call fcn.14001c7a0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.14001c7a0
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
call fcn.14001b550
mov rbx, rax
jmp 0x14001c991
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14001c9aa
Function at 0x1400045c0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x490
mov rax, qword [0x1400d41c0]
xor rax, rsp
mov qword [rsp + 0x480], rax
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
xor edx, edx
mov r8d, 0x250
lea rcx, [rsp + 0x20]
call fcn.1400a6f00
xor edx, edx
lea rcx, [rsp + 0x270]
mov r8d, 0x208
call fcn.1400a6f00
lea r8, [0x1400c56d8]
mov rdx, rsi
lea rcx, [rsp + 0x270]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x270]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x140004652
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor al, al
jmp 0x14000470e
test byte [rsp + 0x20], 0x10
lea rcx, [rsp + 0x4c]
je 0x1400046b4
lea rdx, [0x1400c56c0]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x1400046d6
lea rdx, [0x1400c56c4]
lea rcx, [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x1400046d6
lea r8, [rsp + 0x4c]
mov rdx, rsi
lea rcx, [rsp + 0x270]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
mov r8, rdi
lea rcx, [rsp + 0x270]
mov rdx, rbx
call fcn.1400045c0
test al, al
jne 0x14000470c
jmp 0x1400046d6
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x1400046f6
mov rdx, rbx
lea rcx, [rsp + 0x254]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x1400046f6
lea rdx, [rsp + 0x20]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140004652
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor al, al
jmp 0x14000470e
test rdi, rdi
je 0x14000470c
lea r8, [rsp + 0x4c]
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
mov al, 1
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.140073fb0
mov rbx, qword [rsp + 0x4c8]
add rsp, 0x490
pop rdi
pop rsi
pop rbp
ret
Function at 0x140008e40
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x30
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x140008e62
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rdi
je 0x140008edc
mov rdi, r14
mov rcx, rbx
call fcn.14000aa70
test rax, rax
jle 0x140008eb4
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov rax, qword [rbx + 0x38]
mov r8, rbp
mov rdx, qword [rax]
call fcn.1400a6860
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x140008ecc
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + gethostname]
cmp eax, 0xffffffff
je 0x140008ed4
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x140008e76
sub r14, rdi
jmp 0x140008fbf
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x140008ef3
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140008ef5
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140008f27
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.1400a6860
mov rax, qword [rbx + 0x50]
add rsi, rdi
sub rbp, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x140008fbc
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x140008f62
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rbp, 0xfff
jbe 0x140008f9d
nop dword [rax + rax]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.14007fccc
add rsi, rax
sub rbp, rax
cmp rax, 0xfff
jne 0x140008fbc
cmp rbp, rax
ja 0x140008f70
test rbp, rbp
je 0x140008fbc
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.14007fccc
sub rbp, rax
sub r14, rbp
mov rbp, qword [rsp + 0x28]
mov rax, r14
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
Function at 0x140010670
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x1400d41c0]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 7], sil
je 0x1400106b4
mov eax, esi
nop
lea ecx, [rax - 0x71]
xor byte [r8 + rax], cl
inc rax
cmp rax, 6
jb 0x1400106a0
mov byte [r8 + 7], sil
add r8, 6
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.140010250
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x1400106d9
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140020e40
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x14001074c
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010747
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010764
call fcn.140073fd0
mov rax, rdi
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140073fb0
add rsp, 0x60
pop rdi
pop rsi
pop rbx
ret
call fcn.1400804dc
int3

Function at 0x140010770
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x1400d41c0]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 9], sil
je 0x1400107b4
mov eax, esi
nop
lea ecx, [rax - 0x71]
xor byte [r8 + rax], cl
inc rax
cmp rax, 8
jb 0x1400107a0
mov byte [r8 + 9], sil
add r8, 8
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.140010250
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x1400107d9
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140020e40
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x14001084c
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010847
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010864
call fcn.140073fd0
mov rax, rdi
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140073fb0
add rsp, 0x60
pop rdi
pop rsi
pop rbx
ret
call fcn.1400804dc
int3
Function at 0x140010870
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x1400d41c0]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 0xa], sil
je 0x1400108b4
mov eax, esi
nop
lea ecx, [rax - 0x71]
xor byte [r8 + rax], cl
inc rax
cmp rax, 9
jb 0x1400108a0
mov byte [r8 + 0xa], sil
add r8, 9
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.140010250
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x1400108d9
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140020e40
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x14001094c
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010947
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010964
call fcn.140073fd0
mov rax, rdi
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140073fb0
add rsp, 0x60
pop rdi
pop rsi
pop rbx
ret
call fcn.1400804dc
int3

Function at 0x140010970
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x1400d41c0]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 0xc], sil
je 0x1400109b4
mov eax, esi
nop
lea ecx, [rax - 0x71]
xor byte [r8 + rax], cl
inc rax
cmp rax, 0xb
jb 0x1400109a0
mov byte [r8 + 0xc], sil
add r8, 0xb
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.140010250
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x1400109d9
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140020e40
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x140010a4c
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010a47
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010a64
call fcn.140073fd0
mov rax, rdi
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140073fb0
add rsp, 0x60
pop rdi
pop rsi
pop rbx
ret
call fcn.1400804dc
int3

Function at 0x1400188e0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 8], al
je 0x140018903
lea edx, [rax - 0x71]
xor byte [rax + rcx], dl
inc rax
cmp rax, 7
jb 0x1400188f0
mov byte [rcx + 8], 0
lea r8, [rcx + 7]
mov rdx, rcx
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.140010250
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x140018920
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 9], al
je 0x140018943
lea edx, [rax - 0x71]
xor byte [rax + rcx], dl
inc rax
cmp rax, 8
jb 0x140018930
mov byte [rcx + 9], 0
lea r8, [rcx + 8]
mov rdx, rcx
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.140010250
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x140018960
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 0x10], al
je 0x140018983
lea edx, [rax - 0x71]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xf
jb 0x140018970
mov byte [rcx + 0x10], 0
lea r8, [rcx + 0xf]
mov rdx, rcx
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.140010250
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x14001a720
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 5], 0
je 0x14001a743
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x71]
xor byte [rax + rcx], dl
inc rax
cmp rax, 4
jb 0x14001a730
mov byte [rcx + 5], 0
mov rax, rcx
ret

Function at 0x14001a750
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x136], 0
je 0x14001a778
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x71]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x135
jb 0x14001a760
mov byte [rcx + 0x136], 0
mov rax, rcx
ret

Function at 0x14001a780
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x44], 0
je 0x14001a7a3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x71]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x43
jb 0x14001a790
mov byte [rcx + 0x44], 0
mov rax, rcx
ret

Function at 0x14001a7b0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x47], 0
je 0x14001a7d3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x71]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x46
jb 0x14001a7c0
mov byte [rcx + 0x47], 0
mov rax, rcx
ret
Function at 0x140030bb0
Capabilities:
Convert ip address from string

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x88
mov rax, qword [0x1400d41c0]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov r13, qword [rcx]
mov ebp, r8d
mov rsi, rcx
lea r8, [rsp + 0x20]
mov ebx, 2
xor r14d, r14d
mov ecx, ebx
mov r15, r9
mov r12, qword [r13 + 0x11b0]
mov rdi, rdx
mov dword [r9], r14d
call qword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
jle 0x140030c1c
mov r9d, ebp
lea rdx, [rsp + 0x20]
mov r8, rdi
mov ecx, ebx
call fcn.14004bc30
jmp 0x140030cfa
mov ebx, reloc.WS2_32.dll_socket
lea r8, [rsp + 0x58]
mov ecx, ebx
mov rdx, rdi
call qword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
jle 0x140030c4c
mov r9d, ebp
lea rdx, [rsp + 0x58]
mov r8, rdi
mov ecx, ebx
call fcn.14004bc30
jmp 0x140030cfa
mov ecx, dword [rsi + 0x440]
sub ecx, 1
je 0x140030c70
cmp ecx, 1
je 0x140030c5f
mov ebx, r14d
call fcn.1400315f0
test al, al
mov eax, 2
cmove ebx, eax
jmp 0x140030c75
mov ebx, 2
cmp dword [rsi + 0xbc], 3
lea r8, [0x1400ad968]
xorps xmm0, xmm0
lea rcx, [rsp + 0x68]
movups xmmword [rsp + 0x28], xmm0
setne r14b
mov dword [rsp + 0x2c], ebx
inc r14d
mov r9d, ebp
mov edx, listen
mov dword [rsp + 0x30], r14d
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
call fcn.14002a300
lea rcx, [rsp + 0x58]
call fcn.140040040
lea r9, [rsp + 0x28]
mov r8d, ebp
mov rdx, rdi
mov rcx, rsi
movups xmm0, xmmword [rax]
movups xmmword [r12], xmm0
call fcn.1400312e0
test al, al
je 0x140030ce9
mov dword [r15], 1
jmp 0x140030cf8
lea rdx, str.getaddrinfo___thread_failed_to_start_n
mov rcx, r13
call fcn.14003b420
xor eax, eax
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140073fb0
add rsp, 0x88
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
jmp 0x140030bb0
Function at 0x14003b790
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, r9
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recv]
movsxd rcx, eax
cmp rcx, 0xffffffffffffffff
jne 0x14003b7cb
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, Ordinal_60
mov edx, 0x51
cmp eax, 0x2733
cmove ecx, edx
mov eax, ecx
add rsp, 0x20
pop rbx
ret
mov qword [rbx], rcx
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x14003b960
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xb8
mov rax, qword [0x1400d41c0]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov r14, qword [rsp + 0x120]
mov rsi, rcx
movsxd rcx, edx
xor r13d, r13d
mov r12, r9
mov r15, r8
mov rax, qword [rsi + 0x430]
mov rbp, qword [rsi + rcx*8 + 0x258]
lea rbx, [rcx + 0x15]
shl rbx, 5
add rbx, rsi
mov rdi, qword [rbx + 8]
sub rdi, qword [rbx + 0x10]
test byte [rax + 0x7c], 3
je 0x14003ba64
lea rax, [0x14003b810]
cmp qword [rsi + rcx*8 + 0x280], rax
jne 0x14003ba64
cmp qword [rbx], r13
je 0x14003b9e8
test rdi, rdi
je 0x14003ba64
mov rdx, 0xffffffffffffffff
xor r9d, r9d
mov r8, rdx
mov rcx, rbp
call fcn.14003ea50
cmp eax, 0xffffffff
je 0x14003ba64
test al, 1
je 0x14003ba64
mov rcx, qword [rbx]
test rcx, rcx
jne 0x14003ba43
mov rax, qword [rsi]
mov ecx, dword [rax + 0xb68]
add ecx, ecx
movsxd rcx, ecx
mov qword [rbx + 8], rcx
call qword [fcn.140080bc0]
mov rdi, qword [rbx + 8]
mov rcx, rax
mov qword [rbx], rax
mov qword [rbx + 0x10], r13
mov qword [rbx + 0x18], r13
test rax, rax
jne 0x14003ba43
mov qword [rbx + 8], r13
jmp 0x14003ba64
mov rdx, qword [rbx + 0x10]
xor r9d, r9d
add rdx, rcx
mov r8d, edi
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_recv]
movsxd rcx, eax
test eax, eax
jle 0x14003ba64
add qword [rbx + 0x10], rcx
xor r9d, r9d
mov r8d, r12d
mov rdx, r15
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_send]
movsxd rdi, eax
mov dword [r14], r13d
cmp rdi, 0xffffffffffffffff
jne 0x14003bad1
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, eax
cmp eax, 0x2733
jne 0x14003ba9d
mov dword [r14], 0x51
mov rax, r13
jmp 0x14003bad4
mov r8d, 0x80
lea rdx, [rsp + 0x20]
mov ecx, ebx
call fcn.1400630d0
mov rcx, qword [rsi]
lea rdx, str.Send_failure:__s
mov r8, rax
call fcn.14003b420
mov rcx, qword [rsi]
mov dword [rcx + 0x1138], ebx
mov dword [r14], Ordinal_60
mov rax, rdi
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.140073fb0
add rsp, 0xb8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x14003c150
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub rsp, 0x28
cmp byte [rcx + 0x2f0], 0
je 0x14003c16d
call fcn.140035570
test eax, eax
je 0x14003c199
mov al, 1
add rsp, 0x28
ret
mov rcx, qword [rcx + 0x258]
cmp rcx, 0xffffffffffffffff
je 0x14003c199
mov r9d, 2
lea rdx, [rsp + 0x30]
lea r8d, [r9 - 1]
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
setne al
add rsp, 0x28
ret
xor al, al
add rsp, 0x28
ret