joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140004a50
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
xor r9d, r9d
mov r14d, r8d
mov rsi, rdx
mov rbp, rcx
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsi + 8], rax
mov rdi, rax
test rax, rax
jne 0x140004ab3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, qword [rsi]
lea edx, [rdi + 1]
mov rcx, rsi
mov ebx, eax
call qword [r8]
mov dword [rsp + 0x30], ebx
call fcn.140066390
mov qword [rsp + 0x38], rax
test ebx, ebx
jne 0x140004bb6
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbp + 0x10], rax
mov qword [rsi + 0x10], rax
cmp qword [rbp + 0x10], 0
jne 0x140004b00
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, qword [rsi]
mov edx, 1
mov rcx, rsi
mov ebx, eax
call qword [r8]
mov dword [rsp + 0x30], ebx
call fcn.140066390
mov qword [rsp + 0x38], rax
test ebx, ebx
jne 0x140004bc8
xor ecx, ecx
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea r8, [0x140004be0]
mov r9, rsi
mov dword [rsp + 0x20], ecx
mov edx, r14d
mov dword [rsp + 0x68], ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 8], rax
test rax, rax
jne 0x140004b75
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, qword [rsi]
mov edx, 1
mov rcx, rsi
mov ebx, eax
call qword [r8]
test rdi, rdi
je 0x140004b54
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x10]
test rcx, rcx
je 0x140004b63
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x30], ebx
call fcn.140066390
mov qword [rsp + 0x38], rax
test ebx, ebx
jne 0x140004ba4
test rdi, rdi
je 0x140004b91
mov edx, 0xffffffff
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
lea rdx, str.thread
lea rcx, [rsp + 0x30]
call fcn.1400043c0
int3
lea rdx, str.thread.entry_event
lea rcx, [rsp + 0x30]
call fcn.1400043c0
int3
lea rdx, str.thread.exit_event
lea rcx, [rsp + 0x30]
call fcn.1400043c0
int3
Function at 0x140005730
Capabilities:
Initialize winsock library

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x230
mov rax, qword [0x1400992c0]
xor rax, rsp
mov qword [rsp + 0x220], rax
mov r14, rcx
mov qword [rsp + 0x38], rcx
mov ecx, 0x38
call fcn.140066550
mov rdi, rax
mov qword [rsp + 0x30], rax
mov rcx, rax
call fcn.140004760
mov ebx, eax
call fcn.140066390
mov dword [rsp + 0x20], ebx
mov qword [rsp + 0x28], rax
test ebx, ebx
jne 0x14000590d
mov qword [rdi + 0x28], r14
xor ebx, ebx
mov qword [rdi + 0x30], rbx
mov qword [r14], rdi
mov eax, 1
lock xadd dword [0x14009dcd8], eax
inc eax
cmp eax, 1
jne 0x1400057cf
lea ecx, [rbx + 2]
lea rdx, [rsp + 0x80]
call qword [sym.imp.WS2_32.dll_WSAStartup]
xchg dword [0x14009dcdc], eax
lock xadd dword [0x14009dcdc], ebx
test ebx, ebx
jne 0x14000591f
mov ecx, 0xa8
call fcn.140066550
mov qword [rsp + 0x30], rax
lea r8d, [rbx - 1]
mov rdx, r14
mov rcx, rax
call fcn.140004cb0
mov r15, rax
mov qword [rsp + 0x30], rax
mov rbp, qword [r14]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x20], xmm0
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.14001d6b0
mov rax, qword [r15 + 0x18]
cmp qword [rbp + 0x28], rax
jne 0x1400058e5
mov qword [rsp + 0x40], rbp
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [rsp + 0x48], 1
mov rbx, qword [rbp + 0x30]
test rbx, rbx
je 0x140005891
mov rdi, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x20]
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x140005868
test rdi, rdi
je 0x140005868
cmp rax, rdi
je 0x1400058f9
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140005888
test rsi, rsi
je 0x140005888
lea rdx, [rsi + 8]
add rcx, 8
call qword [sym.imp.VCRUNTIME140.dll___std_type_info_compare]
test eax, eax
je 0x1400058f9
mov rbx, qword [rbx + 0x20]
test rbx, rbx
jne 0x140005851
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [r15 + 8], xmm0
mov rdx, qword [rbp + 0x30]
mov qword [r15 + 0x20], rdx
mov qword [rbp + 0x30], r15
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
mov qword [r14 + 0x10], r15
mov rax, r14
mov rcx, qword [rsp + 0x220]
xor rcx, rsp
call fcn.140066410
lea r11, [rsp + 0x230]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
lea rcx, [rsp + 0x50]
call fcn.140004920
nop
mov rcx, rax
call fcn.1400149f0
nop
lea rcx, [rsp + 0x68]
call fcn.1400048d0
nop
mov rcx, rax
call fcn.140014a30
nop
lea rdx, str.mutex
lea rcx, [rsp + 0x20]
call fcn.1400043c0
nop
call fcn.140066390
mov dword [rsp + 0x20], ebx
mov qword [rsp + 0x28], rax
lea rdx, str.winsock
lea rcx, [rsp + 0x20]
call fcn.1400043c0
int3
Function at 0x140005a80
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
mov rbx, rcx
xor edi, edi
mov dword [rsp + 0x20], edi
call fcn.140066390
mov qword [rsp + 0x28], rax
mov rbx, qword [rbx + 0x10]
mov eax, edi
lock xadd dword [rbx + 0x30], eax
test eax, eax
jne 0x140005b20
mov ecx, 1
mov eax, ecx
xchg dword [rbx + 0x34], eax
test eax, eax
jne 0x140005af5
xchg dword [rbx + 0x38], ecx
test ecx, ecx
jne 0x140005af5
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
test eax, eax
jne 0x140005af5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [rsp + 0x40], eax
call fcn.140066390
mov qword [rsp + 0x48], rax
test ebx, ebx
jne 0x140005bf9
mov dword [rsp + 0x40], edi
call fcn.140066390
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x20], xmm0
jmp 0x140005bd6
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
lea rax, [rbx + 0x28]
test rbx, rbx
cmove rax, rdi
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x58], rax
mov ecx, dword [0x14009dce4]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x60], rax
lea rdx, [rsp + 0x50]
mov ecx, dword [0x14009dce4]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
lea r8, [rsp + 0x20]
mov edx, 0xffffffff
mov rcx, rbx
call fcn.140005330
test rax, rax
je 0x140005ba6
nop dword [rax]
lea rax, [rdi + 1]
cmp rdi, 0xffffffffffffffff
cmove rax, rdi
mov rdi, rax
lea r8, [rsp + 0x20]
mov edx, 0xffffffff
mov rcx, rbx
call fcn.140005330
test rax, rax
jne 0x140005b80
mov rdx, qword [rsp + 0x60]
mov ecx, dword [0x14009dce4]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140005bc7
call fcn.140066978
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140005bd6
call fcn.140066978
cmp dword [rsp + 0x20], 0
jne 0x140005bee
mov rax, rdi
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
lea rcx, [rsp + 0x20]
call fcn.140004380
int3
lea rdx, str.pqcs
lea rcx, [rsp + 0x40]
call fcn.1400043c0
int3
mov rcx, qword [rcx + 0x18]
jmp 0x140005a80
Function at 0x1400125c0
Capabilities:
Initialize winsock library

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x1e0
mov rax, qword [0x1400992c0]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
movzx edi, dl
mov rbx, rcx
mov eax, 1
lock xadd dword [0x14009dcd8], eax
inc eax
cmp eax, 1
jne 0x14001260d
lea ecx, [rax + 1]
lea rdx, [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_WSAStartup]
xchg dword [0x14009dcdc], eax
test dil, dil
je 0x140012620
xor eax, eax
lock xadd dword [0x14009dcdc], eax
test eax, eax
jne 0x140012644
mov rax, rbx
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.140066410
mov rbx, qword [rsp + 0x1f0]
add rsp, 0x1e0
pop rdi
ret
mov dword [rsp + 0x20], eax
call fcn.140066390
lea rdx, str.winsock
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x20]
call fcn.1400043c0
int3
Function at 0x140014a70
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
mov dword [rsp + 0x18], r8d
push rsi
push rdi
push r14
sub rsp, 0x40
xor r14d, r14d
mov rbp, rcx
mov qword [rcx + 8], r14
mov rbx, rdx
mov qword [rcx + 0x10], r14
lea ecx, [r14 + 0x20]
call fcn.140066550
mov rdi, rax
mov qword [rsp + 0x60], rax
lea rax, vtable.boost::asio::detail::win_thread::func_struct_boost::asio::detail::win_iocp_io_context::timer_thread_function_.0
xor r9d, r9d
xor r8d, r8d
lea edx, [r14 + 1]
xor ecx, ecx
mov qword [rdi], rax
mov qword [rdi + 0x18], rbx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rdi + 8], rax
mov rsi, rax
test rax, rax
jne 0x140014aff
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, qword [rdi]
lea edx, [rsi + 1]
mov rcx, rdi
mov ebx, eax
call qword [r8]
mov dword [rsp + 0x30], ebx
call fcn.140066390
mov qword [rsp + 0x38], rax
test ebx, ebx
jne 0x140014c08
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbp + 0x10], rax
mov qword [rdi + 0x10], rax
cmp qword [rbp + 0x10], r14
jne 0x140014b4b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, qword [rdi]
mov edx, 1
mov rcx, rdi
mov ebx, eax
call qword [r8]
mov dword [rsp + 0x30], ebx
call fcn.140066390
mov qword [rsp + 0x38], rax
test ebx, ebx
jne 0x140014c1a
lea rax, [rsp + 0x70]
mov dword [rsp + 0x70], r14d
mov qword [rsp + 0x28], rax
lea r8, [0x140004be0]
mov r9, rdi
mov dword [rsp + 0x20], r14d
mov edx, 0x10000
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 8], rax
test rax, rax
jne 0x140014bc4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, qword [rdi]
mov edx, 1
mov rcx, rdi
mov ebx, eax
call qword [r8]
test rsi, rsi
je 0x140014ba3
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x10]
test rcx, rcx
je 0x140014bb2
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x30], ebx
call fcn.140066390
mov qword [rsp + 0x38], rax
test ebx, ebx
jne 0x140014bf6
test rsi, rsi
je 0x140014be0
mov edx, 0xffffffff
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x68]
mov rax, rbp
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
lea rdx, str.thread
lea rcx, [rsp + 0x30]
call fcn.1400043c0
int3
lea rdx, str.thread.entry_event
lea rcx, [rsp + 0x30]
call fcn.1400043c0
int3
lea rdx, str.thread.exit_event
lea rcx, [rsp + 0x30]
call fcn.1400043c0
int3

Function at 0x14002ada0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
test r8b, r8b
jne 0x14002adcd
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x14002adcd
mov al, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__putenv_s]
mov rbx, qword [rsp + 0x30]
test eax, eax
sete al
add rsp, 0x20
pop rdi
ret
Function at 0x14002ba60
Capabilities:
Create thread

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x38
mov rdi, rcx
xor ebp, ebp
lea rbx, [rcx + 0x28]
mov qword [rsp + 0x70], rbx
mov rcx, rbx
call sub.MSVCP140.dll__Mtx_lock
test eax, eax
jne 0x14002bbba
mov eax, dword [rbx + 0x4c]
cmp eax, 0x7fffffff
je 0x14002bbc5
cmp qword [rdi + 0x78], rbp
je 0x14002baad
mov eax, 3
lock cmpxchg dword [rdi + 0x80], ebp
jmp 0x14002bb3e
mov eax, ebp
xchg dword [rdi + 0x80], eax
mov ecx, SafeArrayGetElemsize
call fcn.140066550
mov rbx, rax
mov qword [rsp + 0x60], rax
test rax, rax
je 0x14002bb17
mov ecx, 8
call fcn.140066550
test rax, rax
je 0x14002bae0
mov qword [rax], rdi
jmp 0x14002bae3
mov rax, rbp
mov qword [rsp + 0x78], rax
lea rsi, [rbx + 8]
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], ebp
mov r9, rax
lea r8, [0x14002b750]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbx], rax
test rax, rax
je 0x14002bbad
jmp 0x14002bb1a
mov rbx, rbp
mov rcx, qword [rdi + 0x78]
mov qword [rdi + 0x78], rbx
test rcx, rcx
je 0x14002bb3e
cmp dword [rcx + 8], 0
je 0x14002bb34
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
mov edx, SafeArrayGetElemsize
call fcn.140066980
mov eax, dword [rdi + 0x80]
nop
test eax, eax
jne 0x14002bb9b
movabs rsi, 0x7fffffffffffb1df
movabs rbx, 0x7fffffffffffffff
nop dword [rax]
lea rcx, [rsp + 0x68]
call fcn.140002d20
mov rax, qword [rsp + 0x68]
cmp rax, rsi
jge 0x14002bb81
add rax, 0x4e20
mov qword [rsp + 0x60], rax
jmp 0x14002bb86
mov qword [rsp + 0x60], rbx
lea rcx, [rsp + 0x60]
call fcn.14001ae00
mov eax, dword [rdi + 0x80]
nop
test eax, eax
je 0x14002bb60
mov rcx, qword [rsp + 0x70]
add rsp, 0x38
pop rdi
pop rsi
pop rbp
pop rbx
jmp fcn.1400653c8
mov dword [rsi], ebp
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
mov ecx, 5
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
dec eax
mov dword [rbx + 0x4c], eax
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
Function at 0x140038b60
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rdi
sub rsp, 0x28
movabs rax, 0xfffffffffffffff
mov rbp, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x140038d76
lea rax, [rdx - 1]
mov qword [rsp + 0x40], rbx
mov rbx, qword [rbp + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x58], r14
inc ecx
shl rdi, cl
lea rcx, [rbp + 0x18]
lea rdx, [rdi + rdi]
call fcn.140038a10
mov rcx, qword [rbp + 8]
lea rax, [rdi - 1]
mov qword [rbp + 0x30], rax
mov qword [rbp + 0x38], rdi
mov rcx, qword [rcx]
mov rdx, rcx
cmp rcx, rbx
je 0x140038d3f
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], r12
mov r12d, 0xe6546b64
mov qword [rsp + 0x20], r15
movabs r15, 0xc6a4a7935bd1e995
nop word [rax + rax]
mov rdx, qword [rdx]
lea r11, [rcx + 0x18]
lea rdi, [r11 + 0x20]
xor eax, eax
mov r10, r11
cmp r11, rdi
je 0x140038c48
nop word [rax + rax]
mov r8, qword [r10]
add r10, 8
imul r8, r15
mov r9, r8
shr r9, 0x2f
xor r9, r8
imul r9, r15
xor rax, r9
imul rax, r15
add rax, r12
cmp r10, rdi
jne 0x140038c20
and rax, qword [rbp + 0x30]
mov rdi, qword [rbp + 0x18]
shl rax, 4
add rdi, rax
mov r9, qword [rdi]
cmp r9, rbx
jne 0x140038c6b
mov qword [rdi], rcx
mov qword [rdi + 8], rcx
jmp 0x140038d24
mov rax, qword [rdi + 8]
mov rsi, qword [r11]
cmp rsi, qword [rax + 0x18]
jne 0x140038cc5
mov r8, qword [rax + 0x20]
cmp qword [r11 + 8], r8
jne 0x140038cc5
mov r8, qword [rax + 0x28]
cmp qword [r11 + 0x10], r8
jne 0x140038cc5
mov r8, qword [rax + 0x30]
cmp qword [r11 + 0x18], r8
jne 0x140038cc5
mov r10, qword [rax]
cmp r10, rcx
je 0x140038cbf
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
mov qword [rdi + 8], rcx
jmp 0x140038d24
mov r10, rax
cmp r9, rax
je 0x140038d00
nop dword [rax]
mov rax, qword [rax + 8]
mov r10, rax
cmp rsi, qword [rax + 0x18]
jne 0x140038cfb
mov r8, qword [rax + 0x20]
cmp qword [rcx + 0x20], r8
jne 0x140038cfb
mov r8, qword [rax + 0x28]
cmp qword [rcx + 0x28], r8
jne 0x140038cfb
mov r8, qword [rax + 0x30]
cmp qword [rcx + 0x30], r8
je 0x140038d50
cmp r9, rax
jne 0x140038cd0
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
mov qword [rdi], rcx
mov rcx, rdx
cmp rdx, rbx
jne 0x140038c00
mov r15, qword [rsp + 0x20]
mov r12, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov r14, qword [rsp + 0x58]
add rsp, 0x28
pop rdi
pop rbp
ret
mov r10, qword [rax]
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
jmp 0x140038d24
lea rcx, str.invalid_hash_bucket_count
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_
int3
Function at 0x140038d90
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rdi
sub rsp, 0x28
movabs rax, 0xfffffffffffffff
mov rbp, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x140038fa6
lea rax, [rdx - 1]
mov qword [rsp + 0x40], rbx
mov rbx, qword [rbp + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x58], r14
inc ecx
shl rdi, cl
lea rcx, [rbp + 0x18]
lea rdx, [rdi + rdi]
call fcn.140038a10
mov rcx, qword [rbp + 8]
lea rax, [rdi - 1]
mov qword [rbp + 0x30], rax
mov qword [rbp + 0x38], rdi
mov rcx, qword [rcx]
mov rdx, rcx
cmp rcx, rbx
je 0x140038f6f
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], r12
mov r12d, 0xe6546b64
mov qword [rsp + 0x20], r15
movabs r15, 0xc6a4a7935bd1e995
nop word [rax + rax]
mov rdx, qword [rdx]
lea r11, [rcx + 0x18]
lea rdi, [r11 + 0x20]
xor r9d, r9d
mov r10, r11
cmp r11, rdi
je 0x140038e78
nop word [rax + rax]
mov rax, qword [r10]
add r10, 8
imul rax, r15
mov r8, rax
shr r8, 0x2f
xor r8, rax
imul r8, r15
xor r9, r8
imul r9, r15
add r9, r12
cmp r10, rdi
jne 0x140038e50
mov rdi, qword [rbp + 0x30]
and rdi, r9
shl rdi, 4
add rdi, qword [rbp + 0x18]
mov r9, qword [rdi]
cmp r9, rbx
jne 0x140038e9b
mov qword [rdi], rcx
mov qword [rdi + 8], rcx
jmp 0x140038f54
mov rax, qword [rdi + 8]
mov rsi, qword [r11]
cmp rsi, qword [rax + 0x18]
jne 0x140038ef5
mov r8, qword [rax + 0x20]
cmp qword [r11 + 8], r8
jne 0x140038ef5
mov r8, qword [rax + 0x28]
cmp qword [r11 + 0x10], r8
jne 0x140038ef5
mov r8, qword [rax + 0x30]
cmp qword [r11 + 0x18], r8
jne 0x140038ef5
mov r10, qword [rax]
cmp r10, rcx
je 0x140038eef
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
mov qword [rdi + 8], rcx
jmp 0x140038f54
mov r10, rax
cmp r9, rax
je 0x140038f30
nop dword [rax]
mov rax, qword [rax + 8]
mov r10, rax
cmp rsi, qword [rax + 0x18]
jne 0x140038f2b
mov r8, qword [rax + 0x20]
cmp qword [rcx + 0x20], r8
jne 0x140038f2b
mov r8, qword [rax + 0x28]
cmp qword [rcx + 0x28], r8
jne 0x140038f2b
mov r8, qword [rax + 0x30]
cmp qword [rcx + 0x30], r8
je 0x140038f80
cmp r9, rax
jne 0x140038f00
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
mov qword [rdi], rcx
mov rcx, rdx
cmp rdx, rbx
jne 0x140038e30
mov r15, qword [rsp + 0x20]
mov r12, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov r14, qword [rsp + 0x58]
add rsp, 0x28
pop rdi
pop rbp
ret
mov r10, qword [rax]
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
jmp 0x140038f54
lea rcx, str.invalid_hash_bucket_count
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_
int3
Function at 0x14003be50
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x80
mov r14, qword [rsp + 0xc0]
mov rbx, rdx
mov rsi, rcx
mov r15d, r9d
mov ecx, 0xa8
mov rbp, r8
lea rdx, [r14 + 0x40]
call fcn.140004650
xor r12d, r12d
mov rdi, rax
mov rax, qword [rbx + 0x18]
mov r8d, r12d
mov edx, r12d
test rax, rax
je 0x14003beb3
mov rdx, qword [rbx + 0x10]
mov r8, rax
lock inc dword [rax + 0xc]
mov qword [rdi + 0x20], r12
lea rax, [0x1400435b0]
mov qword [rdi + 0x28], rax
mov qword [rdi], r12
mov qword [rdi + 8], r12
mov qword [rdi + 0x10], r12
mov qword [rdi + 0x18], r12
mov dword [rdi + 0x30], r12d
mov qword [rdi + 0x38], r12
mov qword [rdi + 0x40], r12
test r8, r8
je 0x14003beef
mov qword [rdi + 0x38], rdx
mov qword [rdi + 0x40], r8
lock inc dword [r8 + 0xc]
movups xmm0, xmmword [rbp]
movups xmmword [rdi + 0x48], xmm0
mov rax, qword [r14]
mov qword [rdi + 0x58], rax
movups xmm0, xmmword [r14 + 8]
movups xmmword [rdi + 0x60], xmm0
movsd xmm1, qword [r14 + 0x18]
movsd qword [rdi + 0x70], xmm1
mov eax, dword [r14 + 0x20]
mov dword [rdi + 0x78], eax
mov rax, qword [r14 + 0x28]
mov qword [rdi + 0x80], rax
mov rax, qword [r14 + 0x30]
mov qword [rdi + 0x88], rax
movups xmm0, xmmword [r14 + 0x40]
movups xmmword [rdi + 0x98], xmm0
test r8, r8
je 0x14003bf59
mov eax, 0xffffffff
lock xadd dword [r8 + 0xc], eax
cmp eax, 1
jne 0x14003bf59
mov rax, qword [r8]
mov rcx, r8
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test byte [rbx + 8], 0x10
movups xmm0, xmmword [rbp]
mov rax, qword [rbp + 8]
mov qword [rsp + 0x70], rax
movups xmmword [rsp + 0x50], xmm0
movq qword [rsp + 0x68], xmm0
movq xmm0, qword [rbp + 8]
movd dword [rsp + 0x60], xmm0
je 0x14003bfa6
test rax, rax
jne 0x14003bfa6
mov rax, qword [rsi + 8]
lock inc dword [rax + 0x30]
mov rcx, qword [rsi + 8]
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
call fcn.140044460
jmp 0x14003c043
mov rax, qword [rsi + 8]
lock inc dword [rax + 0x30]
mov rcx, qword [rbx]
cmp rcx, 0xffffffffffffffff
jne 0x14003bfce
mov rcx, qword [rsi + 8]
xor r9d, r9d
mov r8d, 0x2719
mov rdx, rdi
call fcn.140044460
jmp 0x14003c043
mov qword [rsp + 0x30], r12
lea r9, [rsp + 0xc0]
mov qword [rsp + 0x28], rdi
lea rdx, [rsp + 0x60]
mov r8d, 1
mov dword [rsp + 0x20], r15d
mov dword [rsp + 0xc0], r12d
call qword [sym.imp.WS2_32.dll_WSASend]
mov ebx, eax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x4d2
mov ecx, 0x274d
cmove eax, ecx
test ebx, ebx
je 0x14003c037
cmp eax, 0x3e5
je 0x14003c037
mov r9d, dword [rsp + 0xc0]
mov r8d, eax
mov rcx, qword [rsi + 8]
mov rdx, rdi
call fcn.140044460
jmp 0x14003c043
mov rcx, qword [rsi + 8]
mov rdx, rdi
call fcn.140044510
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x14003ee70
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x20
cmp qword [rcx], 0xffffffffffffffff
mov rbx, rcx
je 0x14003ef40
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x40], rsi
call fcn.140066390
mov rdi, qword [rbx]
cmp rdi, 0xffffffffffffffff
je 0x14003ef2c
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
mov ebx, eax
call fcn.140066390
mov rbp, rax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
test ebx, ebx
je 0x14003ef2c
call fcn.140066390
cmp rbp, rax
jne 0x14003eedd
cmp esi, 0x2733
je 0x14003eeef
call fcn.140066390
cmp rbp, rax
jne 0x14003ef31
cmp esi, 0x4d5
jne 0x14003ef31
lea r8, [rsp + 0x30]
mov dword [rsp + 0x30], 0
mov edx, 0x8004667e
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_ioctlsocket]
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
mov ebx, eax
call fcn.140066390
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
test ebx, ebx
jne 0x14003ef31
call fcn.140066390
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop rbx
ret