joyce8/EMBER2024-capa huggingface dataset:
Function at 0x485a60
Capabilities:
Hash data using fnv

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48619f
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
movabs rcx, 0xcbf29ce484222325
jmp 0x485a8d
lea rax, [rdx + 0x10]
dec rbx
mov rcx, rsi
test rbx, rbx
jle 0x485d11
mov rdx, rax
mov rsi, qword [rax]
nop dword [rax]
test rsi, rsi
je 0x485d3d
mov edi, dword [rsi + 0x10]
shr edi, 1
mov r8, qword [rax + 8]
and edi, 0x3f
lea rax, [0x00502b20]
jmp qword [rax + rdi*8]
mov rax, rcx
add rsp, 0x10
pop rbp
ret
lea rax, [0x004bce60]
lea rbx, [0x00501430]
call sym.runtime.gopanic
inc rax
cmp rax, r8
jge 0x485d62
mov r9, qword [rsi + rax*8]
xor r10d, r10d
nop
jmp 0x485d97
lea rdi, [0x004bcee0]
mov rsi, rcx
movabs rcx, 0x100000001b3
jmp 0x485a83
movzx r11d, r9b
xor rcx, r11
inc r10
shr r9, 8
movabs r11, 0x100000001b3
imul rcx, r11
cmp r10, 8
jl 0x485d7b
jmp 0x485d50
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp sym.internal_bisect.Hash

Function at 0x486340
Capabilities:
Hash data using fnv

Disassembly:
test byte [rax], al
mov rcx, rbx
and ebx, 0x7f
shl rbx, 5
lea rdx, [rax + rbx]
xor eax, eax
jmp 0x486357
inc rax
cmp rax, 4
jge 0x48636f
lea rbx, [rdx + rax*8]
mov rbx, qword [rbx]
cmp rbx, rcx
jne 0x486354
mov eax, 1
ret
xor eax, eax
movabs rbx, 0xcbf29ce484222325
jmp 0x486380
inc rax
cmp rax, 4
jge 0x48638e
mov rsi, qword [rdx + rax*8]
xor edi, edi
jmp 0x4863b7
and ebx, 3
lea rdx, [rdx + rbx*8]
xchg qword [rdx], rcx
xor eax, eax
ret
movzx r8d, sil
xor rbx, r8
inc rdi
shr rsi, 8
movabs r8, 0x100000001b3
imul rbx, r8
cmp rdi, 8
jl 0x48639b
jmp 0x48637d

Function at 0x489e20
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x489eea
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call sym.internal_bytealg.IndexByteString.abi0
xorps xmm15, xmm15
mov r14, qword [0x005dddf0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x489ecf
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x004bcf60]
xor ebx, ebx
mov rcx, rdx
call sym.runtime.makeslice
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call sym.syscall.encodeWTF16
inc rbx
cmp rcx, rbx
jae 0x489ebe
mov edi, 1
lea rsi, [0x004bcf60]
call sym.runtime.growslice
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x00501538]
lea rsi, [0x00500bf0]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.syscall.UTF16FromString
Function at 0x498920
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4989cc
push rbp
mov rbp, rsp
sub rsp, 0x40
mov byte [rsp + 0x60], cl
mov byte [rsp + 0x61], dil
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], cl
call sym.internal_bytealg.IndexByteString.abi0
xorps xmm15, xmm15
mov r14, qword [0x005dddf0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
je 0x498993
lea rax, [rsp + 0x20]
mov rbx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
call sym.runtime.stringtoslicebyte
movzx edx, byte [rsp + 0x61]
movzx esi, byte [rsp + 0x60]
xor ecx, ecx
jmp 0x4989a6
mov rax, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rbp
ret
inc rcx
cmp rbx, rcx
jle 0x4989b9
movzx edi, byte [rax + rcx]
cmp dil, sil
jne 0x4989a3
mov byte [rax + rcx], dl
jmp 0x4989a3
mov rcx, rbx
mov rbx, rax
xor eax, eax
call sym.runtime.slicebytetostring
add rsp, 0x40
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov byte [rsp + 0x18], cl
mov byte [rsp + 0x19], dil
nop
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
movzx ecx, byte [rsp + 0x18]
movzx edi, byte [rsp + 0x19]
jmp sym.internal_filepathlite.replaceStringByte
Function at 0x4aab30
Capabilities:
Encode data using xor

Disassembly:
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x20]
test rdx, 0xf
jne 0x4aabaa
mov rax, 0
nop word [rax + rax]
nop dword [rax]
movdqu xmm0, xmmword [rsi + rax]
movdqu xmm1, xmmword [rcx + rax]
pxor xmm0, xmm1
movdqu xmmword [rbx + rax], xmm0
add rax, 0x10
cmp rdx, rax
jne 0x4aab60
ret
sub rdx, 1
mov dil, byte [rsi + rdx]
mov al, byte [rcx + rdx]
xor dil, al
mov byte [rbx + rdx], dil
test rdx, 7
jne 0x4aab80
cmp rdx, 0
je 0x4aabcc
test rdx, 0xf
je 0x4aab4d
test rdx, 7
jne 0x4aab80
sub rdx, 8
mov rdi, qword [rsi + rdx]
mov rax, qword [rcx + rdx]
xor rdi, rax
mov qword [rbx + rdx], rdi
cmp rdx, 0x10
jge 0x4aab4d
ret
Function at 0x4ad3c0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rbx]
add rax, 0x10
pxor xmm0, xmm1
sub rcx, 0xc
je 0x4ad3ff
jb 0x4ad414
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x20]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x30]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x40]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x50]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x60]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x70]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x80]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x90]
aesenclast xmm0, xmm1
movups xmmword [rdx], xmm0
ret
Function at 0x4ad480
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push rbp
mov rbp, rsp
mov rcx, qword [rsp + 0x10]
mov rax, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
add rbx, 0x10
pxor xmm4, xmm4
cmp ecx, 0xc
je 0x4ad554
jb 0x4ad5b3
movups xmm2, xmmword [rax + 0x10]
movups xmmword [rbx], xmm2
add rbx, 0x10
aeskeygenassist xmm1, xmm2, 1
call sym._expand_key_256a
aeskeygenassist xmm1, xmm0, 1
call sym._expand_key_256b
aeskeygenassist xmm1, xmm2, 2
call sym._expand_key_256a
aeskeygenassist xmm1, xmm0, 2
call sym._expand_key_256b
aeskeygenassist xmm1, xmm2, 4
call sym._expand_key_256a
aeskeygenassist xmm1, xmm0, 4
call sym._expand_key_256b
aeskeygenassist xmm1, xmm2, 8
call sym._expand_key_256a
aeskeygenassist xmm1, xmm0, 8
call sym._expand_key_256b
aeskeygenassist xmm1, xmm2, 0x10
call sym._expand_key_256a
aeskeygenassist xmm1, xmm0, 0x10
call sym._expand_key_256b
aeskeygenassist xmm1, xmm2, 0x20
call sym._expand_key_256a
aeskeygenassist xmm1, xmm0, 0x20
call sym._expand_key_256b
aeskeygenassist xmm1, xmm2, 0x40
call sym._expand_key_256a
jmp 0x4ad621
movq xmm2, qword [rax + 0x10]
aeskeygenassist xmm1, xmm2, 1
call sym._expand_key_192a
aeskeygenassist xmm1, xmm2, 2
call sym._expand_key_192b
aeskeygenassist xmm1, xmm2, 4
call sym._expand_key_192a
aeskeygenassist xmm1, xmm2, 8
call sym._expand_key_192b
aeskeygenassist xmm1, xmm2, 0x10
call sym._expand_key_192a
aeskeygenassist xmm1, xmm2, 0x20
call sym._expand_key_192b
aeskeygenassist xmm1, xmm2, 0x40
call sym._expand_key_192a
aeskeygenassist xmm1, xmm2, 0x80
call sym._expand_key_192b
jmp 0x4ad621
aeskeygenassist xmm1, xmm0, 1
call sym._expand_key_128
aeskeygenassist xmm1, xmm0, 2
call sym._expand_key_128
aeskeygenassist xmm1, xmm0, 4
call sym._expand_key_128
aeskeygenassist xmm1, xmm0, 8
call sym._expand_key_128
aeskeygenassist xmm1, xmm0, 0x10
call sym._expand_key_128
aeskeygenassist xmm1, xmm0, 0x20
call sym._expand_key_128
aeskeygenassist xmm1, xmm0, 0x40
call sym._expand_key_128
aeskeygenassist xmm1, xmm0, 0x80
call sym._expand_key_128
aeskeygenassist xmm1, xmm0, 0x1b
call sym._expand_key_128
aeskeygenassist xmm1, xmm0, 0x36
call sym._expand_key_128
sub rbx, 0x10
movups xmm1, xmmword [rbx]
movups xmmword [rdx], xmm1
dec rcx
movups xmm1, xmmword [rbx - 0x10]
aesimc xmm0, xmm1
movups xmmword [rdx + 0x10], xmm0
sub rbx, 0x10
add rdx, 0x10
dec rcx
jne 0x4ad62e
movups xmm0, xmmword [rbx - 0x10]
movups xmmword [rdx + 0x10], xmm0
pop rbp
ret
Function at 0x4ad760
Capabilities:
Encode data using xor
Encrypt data using aes via x86 extensions

Disassembly:
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
shr rdx, 2
dec rdx
movdqu xmm15, xmmword [0x00500d60]
movdqu xmm14, xmmword [0x00500d70]
movdqu xmm0, xmmword [rsi]
movdqu xmm11, xmmword [rsi + 0x10]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0x20]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0x30]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0x40]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0x50]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0x60]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0x70]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0x80]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0x90]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0xa0]
cmp rdx, 0xc
jb 0x4ad84b
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0xb0]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0xc0]
je 0x4ad84b
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0xd0]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0xe0]
aesenclast xmm0, xmm11
pshufb xmm0, xmm15
pshufd xmm11, xmm0, 0xff
movdqu xmm12, xmm0
psrad xmm11, 0x1f
pand xmm11, xmm14
psrld xmm12, 0x1f
pslldq xmm12, 4
pslld xmm0, 1
pxor xmm0, xmm11
pxor xmm0, xmm12
movdqu xmmword [rdi + 0xe0], xmm0
pshufd xmm1, xmm0, 0x4e
pxor xmm1, xmm0
movdqu xmmword [rdi + 0xf0], xmm1
movdqu xmm2, xmm0
movdqu xmm3, xmm1
mov rax, 7
movdqu xmm11, xmm2
movdqu xmm12, xmm2
movdqu xmm13, xmm3
pclmulqdq xmm11, xmm0, 0
pclmulqdq xmm12, xmm0, 0x11
pclmulqdq xmm13, xmm1, 0
pxor xmm13, xmm11
pxor xmm13, xmm12
movdqu xmm4, xmm13
pslldq xmm4, 8
psrldq xmm13, 8
pxor xmm11, xmm4
pxor xmm12, xmm13
movdqu xmm2, xmm14
pclmulqdq xmm2, xmm11, 1
pshufd xmm11, xmm11, 0x4e
pxor xmm11, xmm2
movdqu xmm2, xmm14
pclmulqdq xmm2, xmm11, 1
pshufd xmm11, xmm11, 0x4e
pxor xmm2, xmm11
pxor xmm2, xmm12
movdqu xmmword [rdi + 0xc0], xmm2
pshufd xmm3, xmm2, 0x4e
pxor xmm3, xmm2
movdqu xmmword [rdi + 0xd0], xmm3
dec rax
lea rdi, [rdi - 0x20]
jne 0x4ad8b0
ret
Function at 0x140001010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x1401728c0]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x1401728d0]
mov dword [rax], 1
mov rax, qword [0x1401728e0]
mov dword [rax], 1
mov rax, qword [0x1401728b0]
mov dword [rax], 1
mov rax, qword [0x1401726f0]
cmp word [rax], 0x5a4d
jne 0x140001067
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400010d0
mov rax, qword [0x1401728a0]
mov dword [0x1401a5020], ecx
mov eax, dword [rax]
test eax, eax
je 0x1400010c0
mov ecx, 2
call sym.__set_app_type
call dbg.__p__fmode
mov rdx, qword [0x140172800]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg.__p__commode
mov rdx, qword [0x1401727e0]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x140171b40]
cmp dword [rax], 1
je 0x140001108
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x140001084
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x140001120
cmp dx, 0x20b
jne 0x140001067
cmp dword [rax + 0x84], 0xe
jbe 0x140001067
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x140001067
lea rcx, [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x140001067
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x140001067
Function at 0x140005b70
Capabilities:
Encode data using base64

Disassembly:
push r12
push rbx
mov rax, qword [r9 + 0xa0]
mov rbx, rcx
mov r10, rdx
cmp qword [r9 + 0xa8], rax
jbe 0x140005da5
mov rax, qword [r9 + 0x98]
xor r12d, r12d
lea r11, [0x140158ec0]
jmp 0x140005c90
cmp r10, 1
jbe 0x140005ca7
mov edx, 0xa0d
sub r10, 2
lea rcx, [rbx + 2]
add r12, 2
mov word [rbx], dx
mov qword [r9 + 0x98], 0
cmp r10, 3
jbe 0x140005ca7
mov rdx, qword [r9 + 0xa0]
mov rax, qword [r9 + 0xa8]
sub rax, rdx
cmp rax, 2
jbe 0x140005cc0
movsx eax, byte [r9 + rdx + 0xb0]
add r12, 4
sub r10, 4
movzx ebx, byte [r9 + rdx + 0xb1]
shl eax, 8
movzx eax, ax
or eax, ebx
lea rbx, [rdx + 3]
mov qword [r9 + 0xa0], rbx
shl eax, 8
movzx edx, byte [r9 + rdx + 0xb2]
mov ebx, eax
or edx, eax
shr eax, 0xc
and eax, 0x3f
shr ebx, 0x12
movzx eax, byte [r11 + rax]
movzx ebx, byte [r11 + rbx]
mov byte [rcx + 1], al
mov eax, edx
and edx, 0x3f
sar eax, 6
mov byte [rcx], bl
lea rbx, [rcx + 4]
and eax, 0x3f
movzx eax, byte [r11 + rax]
mov byte [rcx + 2], al
movzx eax, byte [r11 + rdx]
mov byte [rcx + 3], al
mov rax, qword [r9 + 0x98]
mov rcx, qword [r9 + 0xa8]
add rax, 4
mov qword [r9 + 0x98], rax
cmp qword [r9 + 0xa0], rcx
jae 0x140005d78
cmp rax, 0x48
ja 0x140005ba8
mov rcx, rbx
cmp r10, 3
ja 0x140005bdb
test r12, r12
je 0x140005d97
mov rax, r12
pop rbx
pop r12
ret
test r8b, r8b
je 0x140005cb0
mov eax, 0x3d3d
mov word [rcx + 2], ax
mov rax, qword [r9 + 0xa8]
mov r8, qword [r9 + 0xa0]
cmp rax, r8
je 0x140005cb0
sub rax, r8
xor edx, edx
cmp rax, 2
jne 0x140005cfb
movsx edx, byte [r9 + r8 + 0xb1]
shl edx, 8
movzx edx, dx
movsx eax, byte [r9 + r8 + 0xb0]
lea r8, [0x140158ec0]
shl eax, 0x10
and eax, 0xff0000
or edx, eax
shr eax, 0x12
movzx eax, byte [r8 + rax]
mov byte [rcx], al
mov eax, edx
sar eax, 0xc
and eax, 0x3f
movzx eax, byte [r8 + rax]
mov byte [rcx + 1], al
mov rax, qword [r9 + 0xa0]
add rax, 1
mov qword [r9 + 0xa0], rax
cmp rax, qword [r9 + 0xa8]
je 0x140005d60
sar edx, 6
and edx, 0x3c
movzx eax, byte [r8 + rdx]
mov byte [rcx + 2], al
add qword [r9 + 0xa0], 1
add qword [r9 + 0x98], 4
add r12, 4
mov rax, r12
pop rbx
pop r12
ret
test r8b, r8b
je 0x140005cb0
mov rcx, rbx
cmp r10, 3
ja 0x140005cc5
test r12, r12
jne 0x140005cb0
mov r12, 0xfffffffffffffffe
mov rax, r12
pop rbx
pop r12
ret
xor r12d, r12d
test r8b, r8b
je 0x140005cb0
cmp rdx, 3
ja 0x140005cc5
jmp 0x140005d97

Function at 0x1400061e0
Capabilities:
Read file on windows

Disassembly:
push r13
push r12
push rbx
sub rsp, 0x30
mov r12, rcx
mov r13, rdx
mov rbx, r9
test r8, r8
je 0x140006250
mov r9, qword [r9 + 0x40]
test r9, r9
je 0x140006218
mov rdx, r13
mov rcx, r12
add rsp, 0x30
pop rbx
pop r12
pop r13
jmp sym.fread
mov rcx, qword [rbx + 0x18]
lea rdx, [0x1401587a1]
mov qword [rsp + 0x28], r8
call sym.curlx_win32_fopen
mov r8, qword [rsp + 0x28]
test rax, rax
mov qword [rbx + 0x40], rax
mov r9, rax
jne 0x140006200
mov rax, 0xffffffffffffffff
jmp 0x140006257
mov rax, 0xfffffffffffffffe
add rsp, 0x30
pop rbx
pop r12
pop r13
ret
Function at 0x14000e7b0
Capabilities:
Write file on windows

Disassembly:
push r13
push r12
sub rsp, 0x28
mov r12, rcx
mov r13, rdx
call sym.Curl_pollset_reset
cmp qword [r12 + 0x18], 0
je case.0x14000e7e8.0
mov r8d, dword [r12 + 0x60]
cmp r8d, 0x11
ja case.default.0x14000e7e8
lea rdx, [0x1401593cc]
movsxd rax, dword [rdx + r8*4]
add rax, rdx
jmp rax
lea r8, [sym.doing_getsock]
mov rdx, r13
mov rcx, r12
call sym.Curl_pollset_add_socks
mov rdx, r13
mov rcx, r12
call sym.Curl_conn_adjust_pollset
mov edx, dword [r13 + 0x28]
test edx, edx
jne case.0x14000e7e8.0
lea rcx, [r12 + 0xd78]
call sym.Curl_llist_count
test rax, rax
jne case.0x14000e7e8.0
mov rcx, r12
call sym.Curl_cwriter_is_paused
test al, al
je 0x14000e8b8
add rsp, 0x28
pop r12
pop r13
ret
lea r8, [sym.perform_getsock]
jmp 0x14000e7f7
lea r8, [sym.connecting_getsock]
jmp 0x14000e7f7
lea r8, [sym.protocol_getsock]
jmp 0x14000e7f7
lea r8, [sym.Curl_resolv_getsock]
mov rdx, r13
mov rcx, r12
add rsp, 0x28
pop r12
pop r13
jmp sym.Curl_pollset_add_socks
lea r8, [sym.domore_getsock]
jmp 0x14000e7f7
lea rdx, str.multi_getsock:_unexpected_multi_state__d
mov rcx, r12
add rsp, 0x28
pop r12
pop r13
jmp sym.Curl_failf
mov rcx, r12
call sym.Curl_creader_is_paused
test al, al
jne case.0x14000e7e8.0
xor edx, edx
mov rcx, r12
call sym.Curl_conn_is_ip_connected
test al, al
je case.0x14000e7e8.0
test byte [r12 + 0xa47], 0x10
je case.0x14000e7e8.0
mov rax, qword [r12 + 0x1270]
test rax, rax
je 0x14000e901
mov eax, dword [rax + 8]
test eax, eax
jle case.0x14000e7e8.0
lea rdx, str.WARNING:_no_socket_in_pollset_or_timer__transfer_may_stall_
mov rcx, r12
add rsp, 0x28
pop r12
pop r13
jmp sym.Curl_infof
Function at 0x140017a30
Capabilities:
Create new key via cryptacquirecontext
Generate random numbers via winapi

Disassembly:
push rsi
push rbx
sub rsp, 0x48
mov r8, rdx
mov rbx, rdx
xor edx, edx
mov rsi, rcx
call sym.memset
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x38], 0
mov r9d, 1
mov dword [rsp + 0x20], 0xf0000040
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x140017aa6
mov rcx, qword [rsp + 0x38]
mov edx, ebx
mov r8, rsi
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov rcx, qword [rsp + 0x38]
xor edx, edx
test eax, eax
je 0x140017aa0
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
add rsp, 0x48
pop rbx
pop rsi
ret
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, 2
add rsp, 0x48
pop rbx
pop rsi
ret

Function at 0x140017d10
Capabilities:
Move file

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
movaps xmmword [rsp + 0x40], xmm6
lea rbx, [rsp + 0x30]
mov r13, rcx
lea rdi, [rsp + 0x20]
mov r12, rdx
mov rcx, rbx
call sym.Curl_now
mov rcx, r13
movdqu xmm6, xmmword [rsp + 0x30]
call sym.strdup
mov rcx, r12
mov r13, rax
call sym.strdup
mov rsi, qword [sym.imp.KERNEL32.dll_MoveFileExA]
mov rbp, qword [sym.imp.KERNEL32.dll_Sleep]
mov r12, rax
jmp 0x140017d8f
mov rcx, rbx
call sym.Curl_now
mov rdx, rdi
mov rcx, rbx
movaps xmmword [rsp + 0x20], xmm6
call sym.Curl_timediff
cmp rax, 0x3e8
ja 0x140017dd0
mov ecx, 1
call rbp
mov r8d, 1
mov rdx, r12
mov rcx, r13
call rsi
test eax, eax
je 0x140017d68
test r13, r13
je 0x140017dae
mov rcx, r13
call sym.free
test r12, r12
je 0x140017df8
mov rcx, r12
call sym.free
xor eax, eax
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
test r13, r13
je 0x140017ddd
mov rcx, r13
call sym.free
test r12, r12
je 0x140017df1
mov rcx, r12
call sym.free
mov eax, 1
jmp 0x140017dbd
mov eax, 1
jmp 0x140017dbd
xor eax, eax
jmp 0x140017dbd
Function at 0x140019210
Capabilities:
Get socket status

Disassembly:
push r12
sub rsp, 0x20
mov r9d, edx
test rcx, rcx
je 0x140019258
test edx, edx
je 0x140019258
lea edx, [rdx - 1]
mov rax, rcx
shl rdx, 4
lea rdx, [rcx + rdx + 0x10]
jmp 0x140019241
add rax, 0x10
cmp rax, rdx
je 0x140019258
cmp qword [rax], 0xffffffffffffffff
je 0x140019238
mov edx, r9d
add rsp, 0x20
pop r12
jmp sym.Curl_poll.part.0
xor r12d, r12d
test r8, r8
je 0x140019274
js 0x14001927e
mov ecx, 0xfffffffe
cmp r8, rcx
cmovle rcx, r8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, r12d
add rsp, 0x20
pop r12
ret
mov ecx, 0x2726
mov r12d, 0xffffffff
call qword [sym.imp.WS2_32.dll_WSASetLastError]
jmp 0x140019274

Function at 0x140022410
Capabilities:
Get common file path

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rbx
sub rsp, 0x28
mov r13, rcx
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r12, rax
test rax, rax
je 0x140022560
lea rdx, str.LoadLibraryExA
mov rcx, rax
mov rsi, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rsi
lea rdx, [0x14015dfe8]
mov rcx, r13
mov rbx, rax
call sym.strpbrk
mov r14, rax
test rax, rax
je 0x140022490
test rbx, rbx
je 0x1400224b0
mov r8d, 8
xor edx, edx
mov rcx, r13
mov rax, rbx
add rsp, 0x28
pop rbx
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp rax
test rbx, rbx
je 0x1400224d0
lea rdx, str.AddDllDirectory
mov rcx, r12
call rsi
test rax, rax
je 0x1400224d0
mov r8d, 0x800
jmp 0x140022472
mov rcx, r13
add rsp, 0x28
pop rbx
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
xor edx, edx
xor ecx, ecx
call rsi
mov r12d, eax
test eax, eax
je 0x140022560
mov rcx, r13
call sym.strlen
lea ecx, [r12 + 1]
add rcx, rax
mov rax, qword [0x1401719a0]
call qword [rax]
mov r15, rax
test rax, rax
je 0x140022540
mov edx, r12d
mov rcx, rax
call rsi
test eax, eax
je 0x140022540
mov rcx, r15
call sym.strlen
mov rdx, r13
mov byte [r15 + rax], 0x5c
lea rcx, [r15 + rax + 1]
call sym.strcpy
test rbx, rbx
je 0x140022565
mov r8d, 8
xor edx, edx
mov rcx, r15
call rbx
mov r14, rax
mov rax, qword [0x1401718c0]
mov rcx, r15
call qword [rax]
mov rax, r14
add rsp, 0x28
pop rbx
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xor r14d, r14d
jmp 0x14002254c
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r14, rax
jmp 0x140022540
Function at 0x140022580
Capabilities:
Initialize winsock library

Disassembly:
push r12
sub rsp, 0x1d0
and ecx, 2
je 0x1400225c1
lea rdx, [rsp + 0x30]
mov ecx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x14002265e
movzx eax, word [rsp + 0x30]
cmp al, 2
jne 0x140022658
shr ax, 8
cmp ax, 2
jne 0x140022658
call sym.Curl_sspi_global_init
mov r12d, eax
test eax, eax
je 0x1400225e0
mov eax, r12d
add rsp, 0x1d0
pop r12
ret
lea rcx, str.iphlpapi.dll
call sym.Curl_load_library
mov qword [0x1401a5078], rax
mov rcx, rax
test rax, rax
je 0x140022614
lea rdx, str.if_nametoindex
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140022614
mov qword [0x1401a5060], rax
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov ecx, 6
mov dword [rsp + 0x20], 3
call sym.curlx_verify_windows_version
lea rcx, [0x1401a5070]
mov byte [0x1401a5068], al
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov eax, r12d
add rsp, 0x1d0
pop r12
ret
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov r12d, 2
mov eax, r12d
add rsp, 0x1d0
pop r12
ret

Function at 0x14002c740
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
call sym.read
cdqe
add rsp, 0x28
ret
Function at 0x140035850
Capabilities:
Send data
Send data on socket

Disassembly:
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x30
lea r8, [0x1401602e0]
mov edx, 0xc
mov r9d, dword [rcx + 0xc]
mov r12, qword [rcx + 0x70]
lea r13, [rsp + 0x24]
mov rbx, rcx
mov rcx, r13
call sym.curl_msnprintf
mov rcx, qword [rbx + 0x10]
lea r9, [rbx + 0x38]
mov rdx, r13
lea r8, [rbx + 0x40]
call sym.Curl_getaddrinfo_ex
mov esi, eax
test eax, eax
jne 0x140035980
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [rbx + 8]
test eax, eax
jne 0x140035900
mov rcx, qword [rbx + 0x28]
cmp rcx, 0xffffffffffffffff
jne 0x1400358d8
mov rcx, qword [rbx]
mov dword [rbx + 8], 1
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret
xor r9d, r9d
mov byte [rsp + 0x23], 1
lea rdx, [rsp + 0x23]
mov r8d, 1
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x1400358b7
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [rbx + 0x30], eax
jmp 0x1400358b7
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rbx]
mov rsi, qword [0x1401718c0]
test rcx, rcx
je 0x140035923
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov rcx, qword [rbx]
call qword [rsi]
mov rcx, qword [rbx + 0x10]
call qword [rsi]
mov rcx, qword [rbx + 0x38]
test rcx, rcx
je 0x140035937
call sym.Curl_freeaddrinfo
mov rcx, qword [rbx + 0x28]
cmp rcx, 0xffffffffffffffff
jne 0x140035998
lea rdi, [rbx + 8]
mov qword [rbx], 0
xor eax, eax
and rdi, 0xfffffffffffffff8
mov qword [rbx + 0x70], 0
sub rbx, rdi
lea ecx, [rbx + 0x78]
shr ecx, 3
rep stosq qword [rdi], rax
mov rcx, r12
call qword [rsi]
xor eax, eax
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret
mov rdi, qword [sym.imp.WS2_32.dll_WSAGetLastError]
call rdi
test eax, eax
jne 0x1400359a0
mov dword [rbx + 0x30], esi
jmp 0x14003589d
call qword [sym.imp.WS2_32.dll_closesocket]
jmp 0x140035941
call rdi
test eax, eax
jne 0x1400359b2
mov dword [rbx + 0x30], 8
jmp 0x14003589d
mov dword [rbx + 0x30], eax
jmp 0x14003589d