joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400ca7d0
Capabilities:
List tcp connections and listeners

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov qword [rbp], 0xfffffffffffffffe
mov edi, edx
mov rsi, rcx
mov dword [rbp - 0xc], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 5
xor eax, eax
mov qword [rbp - 8], rax
lea rbx, [rbp - 0xc]
xor ecx, ecx
mov rdx, rbx
xor r8d, r8d
mov r9d, edi
call qword [sym.imp.iphlpapi.dll_GetExtendedTcpTable]
mov ecx, 1
mov r12d, 0x65
mov r13, qword [sym.imp.iphlpapi.dll_GetExtendedTcpTable]
jmp 0x1400ca889
mov r15d, 1
mov rdx, qword [rbp - 8]
test rdx, rdx
je 0x1400ca85e
mov r8d, 1
mov rcx, qword [rbp - 0x18]
call fcn.1400b32e0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 5
mov rcx, r15
mov rdx, rbx
xor r8d, r8d
mov r9d, edi
call r13
mov rcx, r15
mov qword [rbp - 8], r14
dec r12d
je 0x1400ca904
cmp eax, 0x7a
jne 0x1400ca8c6
mov qword [rbp - 0x18], rcx
mov r14d, dword [rbp - 0xc]
test r14, r14
je 0x1400ca840
movzx eax, byte [0x14033c4a1]
mov edx, 1
mov rcx, r14
call fcn.1400b32d0
test rax, rax
je 0x1400ca93f
mov r15, rax
mov rdx, qword [rbp - 8]
test rdx, rdx
jne 0x1400ca84f
jmp 0x1400ca85e
test eax, eax
jne 0x1400ca8df
mov rax, qword [rbp - 8]
mov qword [rsi], rax
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], 0
jmp 0x1400ca92b
mov byte [rsi + 8], 8
mov dword [rsi + 0xc], eax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
mov rdx, qword [rbp - 8]
test rdx, rdx
je 0x1400ca92b
mov r8d, 1
jmp 0x1400ca926
mov byte [rsi + 8], 7
movabs rax, 0x8000000000000000
mov qword [rsi], rax
test r14d, r14d
je 0x1400ca92b
mov r8d, 1
mov rcx, r15
mov rdx, r14
call fcn.1400b32e0
mov rax, rsi
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov ecx, 1
mov rdx, r14
call fcn.14023db50
ud2
Function at 0x1400ca9a0
Capabilities:
List udp connections and listeners

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov qword [rbp], 0xfffffffffffffffe
mov edi, edx
mov rsi, rcx
mov dword [rbp - 0xc], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 1
xor eax, eax
mov qword [rbp - 8], rax
lea rbx, [rbp - 0xc]
xor ecx, ecx
mov rdx, rbx
xor r8d, r8d
mov r9d, edi
call qword [sym.imp.iphlpapi.dll_GetExtendedUdpTable]
mov ecx, 1
mov r12d, 0x65
mov r13, qword [sym.imp.iphlpapi.dll_GetExtendedUdpTable]
jmp 0x1400caa59
mov r15d, 1
mov rdx, qword [rbp - 8]
test rdx, rdx
je 0x1400caa2e
mov r8d, 1
mov rcx, qword [rbp - 0x18]
call fcn.1400b32e0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 1
mov rcx, r15
mov rdx, rbx
xor r8d, r8d
mov r9d, edi
call r13
mov rcx, r15
mov qword [rbp - 8], r14
dec r12d
je 0x1400caad4
cmp eax, 0x7a
jne 0x1400caa96
mov qword [rbp - 0x18], rcx
mov r14d, dword [rbp - 0xc]
test r14, r14
je 0x1400caa10
movzx eax, byte [0x14033c4a1]
mov edx, 1
mov rcx, r14
call fcn.1400b32d0
test rax, rax
je 0x1400cab0f
mov r15, rax
mov rdx, qword [rbp - 8]
test rdx, rdx
jne 0x1400caa1f
jmp 0x1400caa2e
test eax, eax
jne 0x1400caaaf
mov rax, qword [rbp - 8]
mov qword [rsi], rax
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], 0
jmp 0x1400caafb
mov byte [rsi + 8], 9
mov dword [rsi + 0xc], eax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
mov rdx, qword [rbp - 8]
test rdx, rdx
je 0x1400caafb
mov r8d, 1
jmp 0x1400caaf6
mov byte [rsi + 8], 7
movabs rax, 0x8000000000000000
mov qword [rsi], rax
test r14d, r14d
je 0x1400caafb
mov r8d, 1
mov rcx, r15
mov rdx, r14
call fcn.1400b32e0
mov rax, rsi
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov ecx, 1
mov rdx, r14
call fcn.14023db50
ud2
Function at 0x1400f1d40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
movdqa xmmword [rsp + 0x60], xmm8
movdqa xmmword [rsp + 0x50], xmm7
movaps xmmword [rsp + 0x40], xmm6
mov qword [rsp + 0x28], rcx
mov rax, qword [rdx]
mov qword [rsp + 0x30], rdx
mov r12, qword [rdx + 8]
mov rbp, r12
and rbp, r8
shr r8, 0x39
movd xmm0, r8d
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm6, xmm0, 0
mov qword [rsp + 0x20], rax
lea rsi, [rax - 0x10]
mov rbx, qword [r9]
pcmpeqd xmm7, xmm7
xor eax, eax
nop word cs:[rax + rax]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x20]
movdqu xmm8, xmmword [rax + rbp]
movdqa xmm0, xmm8
pcmpeqb xmm0, xmm6
pmovmskb r15d, xmm0
test r15d, r15d
jne 0x1400f1e0d
pcmpeqb xmm8, xmm7
pmovmskb eax, xmm8
test eax, eax
mov rax, qword [rsp + 0x38]
jne 0x1400f1f07
add rbp, rax
add rbp, 0x10
add rax, 0x10
and rbp, r12
jmp 0x1400f1db0
lea eax, [r15 - 1]
and ax, r15w
mov r15d, eax
je 0x1400f1dd3
tzcnt r13d, r15d
add r13, rbp
and r13, r12
mov rdi, r13
shl rdi, 4
mov rax, rsi
sub rax, rdi
mov r14, qword [rax]
mov rcx, rbx
mov rdx, r14
call fcn.140112b00
test al, al
je 0x1400f1e00
movzx eax, word [rbx + 0x54]
cmp ax, word [r14 + 0x54]
jne 0x1400f1e00
cmp ax, 0x23
jne 0x1400f1e53
movzx eax, word [rbx + 0x56]
cmp ax, word [r14 + 0x56]
jne 0x1400f1e00
movzx eax, word [rbx + 0x50]
cmp ax, word [r14 + 0x50]
jne 0x1400f1e00
cmp ax, 5
jne 0x1400f1e6f
movzx eax, word [rbx + 0x52]
cmp ax, word [r14 + 0x52]
jne 0x1400f1e00
neg r13
shl r13, 4
sar rdi, 4
lea rax, [rdi - 0x10]
and rax, r12
mov rcx, qword [rsp + 0x20]
movdqu xmm0, xmmword [rcx + rax]
pcmpeqd xmm1, xmm1
pcmpeqb xmm0, xmm1
psllw xmm0, 7
pmovmskb edx, xmm0
movdqu xmm0, xmmword [rcx + rdi]
pcmpeqb xmm0, xmm1
pmovmskb ecx, xmm0
test edx, edx
je 0x1400f1eb6
bsr dx, dx
xor edx, 0xf
jmp 0x1400f1eba
mov dx, 0x10
add r13, qword [rsp + 0x20]
or ecx, 0x10000
tzcnt ecx, ecx
add edx, ecx
mov cl, 0x80
cmp dx, 0xf
mov rdx, qword [rsp + 0x30]
ja 0x1400f1ede
inc qword [rdx + 0x10]
mov cl, 0xff
mov r8, qword [rsp + 0x20]
mov byte [r8 + rdi], cl
mov byte [r8 + rax + 0x10], cl
dec qword [rdx + 0x18]
movdqu xmm0, xmmword [r13 - 0x10]
mov rax, qword [rsp + 0x28]
movdqu xmmword [rax + 8], xmm0
mov ecx, 1
jmp 0x1400f1f0e
mov rax, qword [rsp + 0x28]
xor ecx, ecx
mov qword [rax], rcx
movaps xmm6, xmmword [rsp + 0x40]
movaps xmm7, xmmword [rsp + 0x50]
movaps xmm8, xmmword [rsp + 0x60]
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400f6050
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0xc0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x38], 0xfffffffffffffffe
mov rsi, rdx
mov rdi, rcx
add rcx, 0x48
xorps xmm0, xmm0
movaps xmmword [rbp + 0x10], xmm0
movaps xmmword [rbp], xmm0
mov rdx, rbp
mov r8d, 0x20
call fcn.140131aa0
mov qword [rbp + 0x28], rax
test rax, rax
je 0x1400f60c4
mov qword [rbp + 0x30], rdx
mov rax, qword [rdx]
test rax, rax
je 0x1400f60a8
mov rcx, qword [rbp + 0x28]
call rax
mov rax, qword [rbp + 0x30]
mov rdx, qword [rax + 8]
push rax
or byte [rax - 0x7b], cl
invalid
je case.0x1400f6473.355
mov r8, qword [rax + 0x10]
mov rcx, qword [rbp + 0x28]
call fcn.1400b32e0
jmp case.0x1400f6473.355
movaps xmm0, xmmword [rbp]
movaps xmm1, xmmword [rbp + 0x10]
movaps xmmword [rbp - 0x10], xmm1
movaps xmmword [rbp - 0x20], xmm0
lea rcx, [rbp - 0x50]
lea r8, [0x14025323e]
lea rdx, [rbp - 0x20]
mov r9d, 8
call fcn.1401318b0
mov rax, qword [rdi + 0x30]
mov qword [rdi + 0x38], rax
movaps xmm0, xmmword [rbp - 0x50]
mov r8b, 0xf
sub byte [rbp - 0x40], cl
movaps xmm2, xmmword [rbp - 0x30]
movaps xmmword [rdi], xmm0
invalid
movaps xmmword [rdi + 0x10], xmm1
movaps xmmword [rdi + 0x20], xmm2
sub dword [rdi + 0x20], edx
mov qword [rdi + 0x40], 0
mov rax, 0xffffffffffffff00
add rax, qword [rdi + 0x30]
mov qword [rdi + 0x38], rax
mov rcx, rdi
mov edx, 6
mov r8, rsi
add rsp, 0xc0
pop rdi
pop rsi
pop rbp
jmp fcn.14012f3c0
Function at 0x1400f6710
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x88
lea rbp, [rsp + 0x80]
mov qword [rbp], 0xfffffffffffffffe
mov rbx, rdx
mov rsi, rcx
add r9, r8
mov qword [rbp - 0x28], r8
mov qword [rbp - 0x20], r9
mov word [rbp - 0x18], 0
mov dword [rbp - 0x10], 1
lea rcx, [rbp - 0x50]
lea rdx, [rbp - 0x28]
call fcn.1400f98e0
mov dword [rbp - 4], 0x800
mov dword [rbp - 8], 0
movzx eax, byte [0x14033c4a1]
mov ecx, 0x800
mov edx, 1
call fcn.1400b32d0
test rax, rax
je 0x1400f68af
mov r14, rax
mov qword [rbp - 0x30], rsi
mov qword [rbp - 0x28], 0x800
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], 0
mov rdi, qword [rbp - 0x48]
lea r12, [rbp - 4]
lea r15, [rbp - 8]
mov rsi, qword [sym.imp.advapi32.dll_RegQueryValueExW]
mov r13, qword [rbp - 0x28]
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x38], rax
sub r13, rax
nop dword [rax + rax]
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r14
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
mov r9, r15
call rsi
cmp eax, 0xea
jne 0x1400f680b
mov r8d, dword [rbp - 4]
cmp r13, r8
jae 0x1400f67d0
lea rcx, [rbp - 0x28]
mov rdx, qword [rbp - 0x38]
call fcn.14022e730
mov r14, qword [rbp - 0x20]
jmp 0x1400f67b9
test eax, eax
jne 0x1400f682e
mov eax, dword [rbp - 4]
mov qword [rbp - 0x18], rax
mov eax, dword [rbp - 8]
cmp eax, 0xb
mov rdx, qword [rbp - 0x30]
jbe 0x1400f6892
movabs rax, 0xde00000002
jmp 0x1400f683a
shl rax, 0x20
or rax, 2
mov rdx, qword [rbp - 0x30]
mov qword [rdx + 8], rax
movabs rax, 0x8000000000000000
mov qword [rdx], rax
mov rdx, qword [rbp - 0x28]
test rdx, rdx
je 0x1400f6863
mov rcx, qword [rbp - 0x20]
mov r8d, 1
call fcn.1400b32e0
mov rdx, qword [rbp - 0x50]
test rdx, rdx
je 0x1400f687d
add rdx, rdx
mov r8d, 2
mov rcx, rdi
call fcn.1400b32e0
nop
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov rcx, qword [rbp - 0x18]
mov qword [rdx + 0x10], rcx
movups xmm0, xmmword [rbp - 0x28]
movups xmmword [rdx], xmm0
mov byte [rdx + 0x18], al
mov rdx, qword [rbp - 0x50]
test rdx, rdx
jne 0x1400f686c
jmp 0x1400f687d
mov ecx, 1
mov edx, 0x800
call fcn.14023db50
ud2
Function at 0x1400fb850
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0xc0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x38], 0xfffffffffffffffe
mov rsi, rdx
mov rdi, rcx
add rcx, 0x48
xorps xmm0, xmm0
movaps xmmword [rbp + 0x10], xmm0
movaps xmmword [rbp], xmm0
mov rdx, rbp
mov r8d, 0x20
call fcn.140131aa0
mov qword [rbp + 0x28], rax
test rax, rax
je 0x1400fb8c4
mov qword [rbp + 0x30], rdx
mov rax, qword [rdx]
test rax, rax
je 0x1400fb8a8
mov rcx, qword [rbp + 0x28]
call rax
mov rax, qword [rbp + 0x30]
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x1400fb90d
mov r8, qword [rax + 0x10]
mov rcx, qword [rbp + 0x28]
call fcn.1400b32e0
jmp 0x1400fb90d
movaps xmm0, xmmword [rbp]
movaps xmm1, xmmword [rbp + 0x10]
movaps xmmword [rbp - 0x10], xmm1
movaps xmmword [rbp - 0x20], xmm0
lea rcx, [rbp - 0x50]
lea r8, [0x140263093]
lea rdx, [rbp - 0x20]
mov r9d, 8
call fcn.1401318b0
mov rax, qword [rdi + 0x30]
mov qword [rdi + 0x38], rax
movaps xmm0, xmmword [rbp - 0x50]
movaps xmm1, xmmword [rbp - 0x40]
movaps xmm2, xmmword [rbp - 0x30]
movaps xmmword [rdi], xmm0
movaps xmmword [rdi + 0x10], xmm1
movaps xmmword [rdi + 0x20], xmm2
mov qword [rdi + 0x40], 0
mov rax, 0xffffffffffffff00
add rax, qword [rdi + 0x30]
mov qword [rdi + 0x38], rax
mov rcx, rdi
mov edx, 6
mov r8, rsi
add rsp, 0xc0
pop rdi
pop rsi
pop rbp
jmp fcn.14012f3c0
Function at 0x140131cf0
Capabilities:
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
test rdx, rdx
je 0x140131d62
mov rsi, rdx
mov rdi, rcx
mov r14d, 0xffffffff
mov r15, qword [sym.imp.bcrypt.dll_BCryptGenRandom]
mov r12, qword [sym.imp.advapi32.dll_SystemFunction036]
jmp 0x140131d28
add rdi, rbx
sub rsi, rbx
je 0x140131d62
cmp rsi, r14
mov ebx, 0xffffffff
cmovb rbx, rsi
xor ecx, ecx
mov rdx, rdi
mov r8d, ebx
mov r9d, 2
call r15
cmp eax, 0xbfffffff
jbe 0x140131d20
mov ebp, eax
mov rcx, rdi
mov edx, ebx
call r12
test al, al
jne 0x140131d20
and ebp, 0x7fffffff
jmp 0x140131d64
xor ebp, ebp
mov eax, ebp
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x140156e70
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov rax, qword [rcx]
nop word [rax + rax]
mov rdx, rax
xor rdx, 3
lock cmpxchg qword [rcx], rdx
jne 0x140156e80
test al, 1
je 0x140156e9f
test al, 2
jne 0x140156eb7
xor rax, 3
add rsp, 0x28
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x1402aacf8]
mov edx, 0x23
call fcn.14023ded0
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x1402aad38]
mov edx, 0x25
call fcn.14023ded0
int3

Function at 0x1401647b0
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0xf0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x58], 0xfffffffffffffffe
mov rax, qword [rcx]
nop dword [rax + rax]
mov rdx, rax
xor rdx, 3
lock cmpxchg qword [rcx], rdx
jne 0x1401647d0
test al, 1
je 0x140164891
test al, 2
jne 0x1401648a9
test al, 8
mov qword [rbp + 0x38], rcx
jne 0x14016480c
add rcx, 0x20
mov dword [rbp - 0x58], 2
lea rdx, [rbp - 0x58]
call fcn.14015a640
jmp 0x140164828
test al, 0x10
je 0x140164828
mov rcx, qword [rbp + 0x38]
mov rax, qword [rcx + 0x68]
test rax, rax
je 0x14016491f
mov rcx, qword [rcx + 0x70]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x38]
mov rax, qword [rcx + 0x78]
test rax, rax
je 0x14016485a
mov r8, qword [rcx + 0x80]
mov rcx, qword [r8 + 0x10]
dec rcx
and rcx, 0xfffffffffffffff0
add rcx, rax
add rcx, 0x10
lea rdx, [rbp + 0x47]
call qword [r8 + 0x28]
mov rcx, qword [rbp + 0x38]
mov qword [rbp + 0x30], 1
mov rax, 0xffffffffffffffc0
lock xadd qword [rcx], rax
shr rax, 6
cmp rax, qword [rbp + 0x30]
jb 0x1401648c1
jne 0x140164887
mov qword [rbp - 8], rcx
lea rcx, [rbp - 8]
call fcn.140163320
nop
add rsp, 0xf0
pop rbp
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x1402aacf8]
mov edx, 0x23
call fcn.14023ded0
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x1402aad38]
mov edx, 0x25
call fcn.14023ded0
mov qword [rbp + 0x28], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 0x28], rax
lea rax, [fcn.140227ea0]
mov qword [rbp - 0x20], rax
lea rcx, [rbp + 0x30]
mov qword [rbp - 0x18], rcx
mov qword [rbp - 0x10], rax
lea rax, str.current:___sub:_P
mov qword [rbp - 8], rax
mov qword [rbp], 2
mov qword [rbp + 0x18], 0
lea rax, [rbp - 0x28]
mov qword [rbp + 8], rax
mov qword [rbp + 0x10], 2
lea rdx, [0x1402aad80]
lea rcx, [rbp - 8]
call fcn.14023de30
lea rax, str.waker_missing
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], 1
mov qword [rbp - 0x48], 8
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
lea rdx, [0x1402ab878]
lea rcx, [rbp - 0x58]
call fcn.14023de30
ud2
Function at 0x14017ab30
Capabilities:
Connect socket

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rdi, rdx
mov rsi, rcx
mov rcx, rdx
mov edx, 1
call fcn.14017ddf0
mov r10, rdx
test rax, rax
je 0x14017ab6f
mov qword [rsi + 8], r10
mov qword [rsi], 0xffffffffffffffff
jmp 0x14017ac0b
cmp word [rdi], 0
je 0x14017ab94
movups xmm0, xmmword [rdi + 4]
movzx eax, word [rdi + 0x1c]
rol ax, 8
mov ecx, dword [rdi + 0x18]
add rdi, 0x14
mov r8d, 0x1c
mov dx, 0x17
jmp 0x14017abad
movzx eax, word [rdi + 6]
rol ax, 8
add rdi, 2
xorps xmm0, xmm0
mov r8d, 0x10
mov dx, 2
mov r9d, dword [rdi]
mov word [rbp - 0x2c], dx
mov word [rbp - 0x2a], ax
mov dword [rbp - 0x28], r9d
movups xmmword [rbp - 0x24], xmm0
mov dword [rbp - 0x14], ecx
lea rdx, [rbp - 0x2c]
mov qword [rbp - 0x10], r10
mov rcx, r10
call qword [sym.imp.ws2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x14017abfc
call fcn.14020e220
mov edi, eax
shl rdi, 0x20
or rdi, 2
mov rcx, rdi
call fcn.14017d660
cmp al, 0xd
jne 0x14017ac16
mov rcx, rdi
call fcn.140017090
mov rax, qword [rbp - 0x10]
mov qword [rsi], rax
mov qword [rsi + 8], 0
mov rax, rsi
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
mov qword [rsi + 8], rdi
mov qword [rsi], 0xffffffffffffffff
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.ws2_32.dll_closesocket]
jmp 0x14017ac0b

Function at 0x14017ddf0
Capabilities:
Set socket configuration

Disassembly:
push rsi
push rdi
sub rsp, 0x38
cmp word [rcx], 0
mov eax, 2
mov ecx, 0x17
cmove ecx, eax
mov eax, dword [0x14033c4f8]
cmp eax, 4
jne 0x14017de6d
xor r8d, r8d
call qword [sym.imp.ws2_32.dll_socket]
cmp rax, 0xffffffffffffffff
je 0x14017deb4
mov rsi, rax
mov dword [rsp + 0x2c], 1
lea r8, [rsp + 0x2c]
mov rcx, rax
mov edx, 0x8004667e
call qword [sym.imp.ws2_32.dll_ioctlsocket]
test eax, eax
je 0x14017de69
call fcn.14020e220
mov edi, eax
shl rdi, 0x20
or rdi, 2
mov rcx, rsi
call qword [sym.imp.ws2_32.dll_closesocket]
mov eax, 1
mov rsi, rdi
jmp 0x14017dec8
xor eax, eax
jmp 0x14017dec8
mov byte [rsp + 0x2b], 1
lea rax, [rsp + 0x2b]
mov qword [rsp + 0x30], rax
lea rax, [0x14033c4f8]
lea r9, [0x1402b0018]
lea r8, [rsp + 0x30]
mov esi, ecx
mov rcx, rax
mov edi, edx
xor edx, edx
call fcn.1402363b0
mov ecx, esi
mov edx, edi
xor r8d, r8d
call qword [sym.imp.ws2_32.dll_socket]
cmp rax, 0xffffffffffffffff
jne 0x14017de25
call fcn.14020e220
mov esi, eax
shl rsi, 0x20
or rsi, 2
mov eax, 1
mov rdx, rsi
add rsp, 0x38
pop rdi
pop rsi
ret
Function at 0x14019a090
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x50]
movaps xmmword [rbp - 0x10], xmm6
mov qword [rbp - 0x18], 0xfffffffffffffffe
mov r12, r8
mov r14, rdx
mov rsi, rcx
movsd xmm6, qword [r8 + 0x18]
movapd xmm0, xmmword [0x1402b6fc0]
xorpd xmm0, xmm6
movlpd qword [r8 + 0x18], xmm0
mov r15, qword [r8 + 8]
mov rdi, qword [r8 + 0x10]
test rdi, rdi
je 0x14019a10b
mov rax, rdi
shl rax, 4
xor ecx, ecx
movapd xmm0, xmmword [0x1402b6fc0]
nop
movsd xmm1, qword [r15 + rcx + 8]
xorpd xmm1, xmm0
movlpd qword [r15 + rcx + 8], xmm1
add rcx, 0x10
cmp rax, rcx
jne 0x14019a0f0
mov rax, qword [r14]
mov rbx, qword [r14 + 0x10]
sub rax, rbx
cmp rax, rdi
jae 0x14019a144
mov qword [rbp - 0x30], r12
mov qword [rbp - 0x20], r15
mov rcx, r14
mov rdx, rbx
mov r8, rdi
mov qword [rbp - 0x28], r14
call fcn.140232100
mov r14, qword [rbp - 0x28]
mov rbx, qword [r14 + 0x10]
mov r15, qword [rbp - 0x20]
mov r12, qword [rbp - 0x30]
mov rcx, rbx
shl rcx, 4
add rcx, qword [r14 + 8]
mov r8, rdi
shl r8, 4
mov rdx, r15
call sub.VCRUNTIME140.dll_memcpy
add rbx, rdi
mov qword [r14 + 0x10], rbx
mov qword [r12 + 0x10], 0
movsd xmm0, qword [r14 + 0x18]
subsd xmm0, xmm6
movsd qword [r14 + 0x18], xmm0
movups xmm0, xmmword [r14]
movups xmmword [rsi], xmm0
mov rax, qword [r14 + 0x10]
mov qword [rsi + 0x10], rax
mov rax, qword [r14 + 0x18]
mov qword [rsi + 0x18], rax
mov rdx, qword [r12]
test rdx, rdx
je 0x14019a1b0
shl rdx, 4
mov r8d, 8
mov rcx, r15
call fcn.1400b32e0
mov rax, rsi
movaps xmm6, xmmword [rbp - 0x10]
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
Function at 0x14019a250
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rax
mov rcx, qword [rcx]
add qword [rdx + 0x30], 8
add rcx, 0x10
mov qword [rsp], rcx
mov r9, qword [rdx + 0x40]
test r9, r9
je 0x14019a2f1
mov r11d, 8
mov r8d, 8
sub r8, r9
cmp r8, 8
cmovb r11, r8
xor r10d, r10d
xor eax, eax
cmp r8, 4
mov ecx, ecx
cmovae r10, rcx
setae al
shl eax, 2
lea rcx, [rax + 1]
cmp rcx, r11
jae 0x14019a2ba
movzx esi, word [rsp + rax]
lea ecx, [rax*8]
shl rsi, cl
or r10, rsi
or rax, 2
cmp rax, r11
jae 0x14019a2cf
movzx r11d, byte [rsp + rax]
shl eax, 3
mov ecx, eax
shl r11, cl
or r10, r11
lea ecx, [r9*8]
shl r10, cl
or r10, qword [rdx + 0x38]
mov qword [rdx + 0x38], r10
cmp r9, 8
jbe 0x14019a2f6
add r9, 8
jmp 0x14019a436
xor r8d, r8d
jmp 0x14019a34a
mov rax, qword [rdx + 0x18]
xor rax, r10
mov r11, qword [rdx + 0x10]
mov rcx, qword [rdx]
add rcx, r11
mov r9, qword [rdx + 8]
add r9, rax
rol r11, 0xd
xor r11, rcx
rol rax, 0x10
rol rcx, 0x20
xor rax, r9
add r9, r11
rol r11, 0x11
add rcx, rax
xor r11, r9
rol rax, 0x15
mov qword [rdx + 0x10], r11
xor rax, rcx
rol r9, 0x20
mov qword [rdx + 0x18], rax
mov qword [rdx + 8], r9
xor rcx, r10
mov qword [rdx], rcx
mov eax, 8
sub rax, r8
mov r9d, eax
and r9d, 7
and rax, 0xfffffffffffffff8
cmp r8, rax
jae 0x14019a3d2
mov rcx, qword [rdx]
mov r10, qword [rdx + 8]
mov rsi, qword [rdx + 0x18]
mov r11, qword [rdx + 0x10]
nop word cs:[rax + rax]
mov rdi, qword [rsp + r8]
xor rsi, rdi
add rcx, r11
rol r11, 0xd
add r10, rsi
xor r11, rcx
rol rsi, 0x10
xor rsi, r10
rol rcx, 0x20
add r10, r11
add rcx, rsi
rol r11, 0x11
xor r11, r10
rol rsi, 0x15
rol r10, 0x20
xor rsi, rcx
xor rcx, rdi
add r8, 8
cmp r8, rax
jb 0x14019a380
mov qword [rdx + 0x18], rsi
mov qword [rdx + 0x10], r11
mov qword [rdx + 8], r10
mov qword [rdx], rcx
cmp r9d, 4
jb 0x14019a3ef
mov r10d, dword [rsp + r8]
mov eax, 4
mov rcx, rax
or rcx, 1
cmp rcx, r9
jb 0x14019a400
jmp 0x14019a41a
xor r10d, r10d
xor eax, eax
mov rcx, rax
or rcx, 1
cmp rcx, r9
jae 0x14019a41a
lea rcx, [rsp + rax]
movzx r11d, word [r8 + rcx]
lea ecx, [rax*8]
shl r11, cl
or r10, r11
or rax, 2
cmp rax, r9
jae 0x14019a432
add r8, rax
movzx r8d, byte [rsp + r8]
shl eax, 3
mov ecx, eax
shl r8, cl
or r10, r8
mov qword [rdx + 0x38], r10
mov qword [rdx + 0x40], r9
add rsp, 8
pop rdi
pop rsi
ret
Function at 0x14019b1a0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rax
mov rax, rcx
add qword [rcx + 0x30], 8
mov qword [rsp], rdx
mov r10, qword [rcx + 0x40]
test r10, r10
je 0x14019b243
mov esi, 8
mov r9d, 8
sub r9, r10
cmp r9, 8
cmovb rsi, r9
xor r11d, r11d
xor r8d, r8d
cmp r9, 4
mov ecx, edx
cmovae r11, rcx
setae r8b
shl r8d, 2
lea rcx, [r8 + 1]
cmp rcx, rsi
jae 0x14019b20a
movzx edx, word [rsp + r8]
lea ecx, [r8*8]
shl rdx, cl
or r11, rdx
or r8, 2
cmp r8, rsi
jae 0x14019b221
movzx edx, byte [rsp + r8]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r11, rdx
lea ecx, [r10*8]
shl r11, cl
or r11, qword [rax + 0x38]
mov qword [rax + 0x38], r11
cmp r10, 8
jbe 0x14019b248
add r10, 8
jmp 0x14019b386
xor r9d, r9d
jmp 0x14019b29c
mov rcx, qword [rax + 0x18]
xor rcx, r11
mov r10, qword [rax + 0x10]
mov rdx, qword [rax]
add rdx, r10
mov r8, qword [rax + 8]
add r8, rcx
rol r10, 0xd
xor r10, rdx
rol rcx, 0x10
rol rdx, 0x20
xor rcx, r8
add r8, r10
rol r10, 0x11
add rdx, rcx
xor r10, r8
rol rcx, 0x15
mov qword [rax + 0x10], r10
xor rcx, rdx
rol r8, 0x20
mov qword [rax + 0x18], rcx
mov qword [rax + 8], r8
xor rdx, r11
mov qword [rax], rdx
mov ecx, 8
sub rcx, r9
mov r10d, ecx
and r10d, 7
and rcx, 0xfffffffffffffff8
cmp r9, rcx
jae 0x14019b322
mov rdx, qword [rax]
mov r8, qword [rax + 8]
mov rsi, qword [rax + 0x18]
mov r11, qword [rax + 0x10]
nop word cs:[rax + rax]
mov rdi, qword [rsp + r9]
xor rsi, rdi
add rdx, r11
rol r11, 0xd
add r8, rsi
xor r11, rdx
rol rsi, 0x10
xor rsi, r8
rol rdx, 0x20
add r8, r11
add rdx, rsi
rol r11, 0x11
xor r11, r8
rol rsi, 0x15
rol r8, 0x20
xor rsi, rdx
xor rdx, rdi
add r9, 8
cmp r9, rcx
jb 0x14019b2d0
mov qword [rax + 0x18], rsi
mov qword [rax + 0x10], r11
mov qword [rax + 8], r8
mov qword [rax], rdx
cmp r10d, 4
jb 0x14019b33f
mov r8d, dword [rsp + r9]
mov edx, 4
mov rcx, rdx
or rcx, 1
cmp rcx, r10
jb 0x14019b350
jmp 0x14019b36a
xor r8d, r8d
xor edx, edx
mov rcx, rdx
or rcx, 1
cmp rcx, r10
jae 0x14019b36a
lea rcx, [rsp + rdx]
movzx r11d, word [r9 + rcx]
lea ecx, [rdx*8]
shl r11, cl
or r8, r11
or rdx, 2
cmp rdx, r10
jae 0x14019b382
add r9, rdx
movzx r9d, byte [rsp + r9]
shl edx, 3
mov ecx, edx
shl r9, cl
or r8, r9
mov qword [rax + 0x38], r8
mov qword [rax + 0x40], r10
add rsp, 8
pop rdi
pop rsi
ret