joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400c9c2c
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.1400c9a9c

Function at 0x1400d3898
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x1401112b0]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.1400cd6c8
xor ebx, ebx
cmp qword [0x1401159c8], rbx
mov rdi, rax
jne 0x1400d39ab
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x1400d3a82
lea rdx, [0x1400e19e0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400d3a82
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x1401159c8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x1401159d0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x1401159d8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x1401159e8], rax
test rax, rax
je 0x1400d39a2
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x1401159e0], rax
jmp 0x1400d39b2
mov rax, qword [0x1401159e0]
jmp 0x1400d39b9
mov rax, qword [0x1401159e0]
mov r11, qword [0x1401159e8]
cmp rax, rdi
je 0x1400d3a20
cmp r11, rdi
je 0x1400d3a20
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x1401159e8]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x1400d3a20
test rax, rax
je 0x1400d3a20
call rsi
test rax, rax
je 0x1400d3a1a
lea rcx, [rsp + 0x30]
mov r9d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x1400d3a1a
test byte [rsp + 0x40], 1
jne 0x1400d3a20
bts ebp, 0x15
jmp 0x1400d3a60
mov rcx, qword [0x1401159d0]
cmp rcx, rdi
je 0x1400d3a60
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x1400d3a60
call rax
mov rbx, rax
test rax, rax
je 0x1400d3a60
mov rcx, qword [0x1401159d8]
cmp rcx, rdi
je 0x1400d3a60
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x1400d3a60
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x1401159c8]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x1400d3a82
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x1400d3a84
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400d0e80
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400d5bef
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x1401112b0]
jne 0x1400d0e9a
rol rcx, 0x10
test cx, 0xffff
jne 0x1400d0e96
repz ret
ror rcx, 0x10
jmp 0x1400d5b48
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x140115b10]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x140115c08]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x1400d5bcd
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x140115b10]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x1400d5bef
mov rax, qword [rsp + 0x88]
mov qword [0x140115c08], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x140115ba8], rax
mov rax, qword [0x140115c08]
mov qword [0x140115a80], rax
mov rax, qword [rsp + 0x90]
mov qword [0x140115b90], rax
mov dword [0x140115a70], 0xc0000409
mov dword [0x140115a74], 1
mov rax, qword [0x1401112b0]
mov qword [rsp + 0x68], rax
mov rax, qword [0x1401112b8]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x140115b08], eax
mov ecx, 1
call fcn.1400d35b8
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x1400e23b0]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x140115b08], 0
jne 0x1400d5c76
mov ecx, 1
call fcn.1400d35b8
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x140003610
Capabilities:
Terminate thread

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x14008f080]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rax, qword [rcx + 0x10]
lea rdx, [rsp + 0x20]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rax, qword [rcx + 8]
mov rbx, rcx
mov r9d, 0xffffffff
mov qword [rsp + 0x28], rax
lea ecx, [r8 + 2]
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
lock xadd dword [0x140090738], eax
mov rcx, qword [rbx + 8]
test eax, eax
je 0x140003689
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14006fa90
add rsp, 0x40
pop rbx
ret
mov rdx, rcx
xor r8d, r8d
lea rcx, [fcn.1400034b0]
call qword [sym.imp.KERNEL32.dll_QueueUserAPC]
mov rcx, qword [rbx + 8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14006fa90
add rsp, 0x40
pop rbx
ret
Function at 0x140004e90
Capabilities:
Set socket configuration

Disassembly:
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xa0
mov rax, qword [0x14008f080]
xor rax, rsp
mov qword [rbp + 0x17], rax
xor r12d, r12d
mov r15, r9
mov r14, rdx
mov rdi, rcx
cmp rcx, 0xffffffffffffffff
je 0x14000508b
mov qword [rsp + 0xe0], rbx
test r8b, r8b
je 0x140004f10
movzx eax, byte [rdx]
test al, 8
je 0x140004f10
or al, 8
mov dword [rbp + 0xf], r12d
mov byte [rdx], al
lea r9, [rbp + 0xf]
mov edx, 0xffff
mov dword [rsp + 0x20], 4
mov r8d, 0x80
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
lea rcx, [rbp - 0x21]
setne dl
call fcn.140004dd0
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
test eax, eax
mov rcx, r15
mov ebx, eax
setne dl
call fcn.140004dd0
test ebx, ebx
je 0x140005087
mov qword [rsp + 0x98], rsi
movabs rcx, 0x4d54ee85da812030
mov rsi, qword [0x14008f180]
add rcx, rsi
mov qword [rsp + 0x90], r13
mov dword [rbp - 0x35], r12d
lea r13, str.8_b_
cmp rcx, 1
jbe 0x140004f80
mov rax, qword [str.8_b_]
mov edx, 0x2733
mov rcx, r13
call qword [rax + Ordinal_50]
mov rsi, qword [0x14008f180]
jmp 0x140004f82
mov al, 1
movzx eax, al
lea rdx, [rbp - 9]
add rax, 2
mov dword [rbp - 0x39], 0x2733
mov qword [rbp - 0x29], rax
mov rcx, r15
movsd xmm1, qword [rbp - 0x29]
mov qword [rbp - 0x31], r13
movups xmm0, xmmword [rbp - 0x39]
movsd qword [rbp + 7], xmm1
movups xmmword [rbp - 9], xmm0
call fcn.140002610
test al, al
jne 0x14000501f
movabs rax, 0x4d54ee85da812030
mov dword [rbp - 0x35], r12d
add rax, rsi
cmp rax, 1
jbe 0x140004fe5
mov rax, qword [str.8_b_]
mov edx, 0x4d5
mov rcx, r13
call qword [rax + Ordinal_50]
jmp 0x140004fe7
mov al, 1
movzx eax, al
lea rdx, [rbp - 0x21]
add rax, 2
mov dword [rbp - 0x39], 0x4d5
mov qword [rbp - 0x29], rax
mov rcx, r15
movsd xmm1, qword [rbp - 0x29]
mov qword [rbp - 0x31], r13
movups xmm0, xmmword [rbp - 0x39]
movsd qword [rbp - 0x11], xmm1
movups xmmword [rbp - 0x21], xmm0
call fcn.140002610
test al, al
je 0x140005051
lea r8, [rbp + 0xf]
mov dword [rbp + 0xf], r12d
mov edx, 0x8004667e
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_ioctlsocket]
and byte [r14], 0xfc
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
test eax, eax
mov rcx, r15
mov ebx, eax
setne dl
call fcn.140004dd0
mov rsi, qword [rsp + 0x98]
mov eax, ebx
mov r13, qword [rsp + 0x90]
mov rbx, qword [rsp + 0xe0]
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.14006fa90
add rsp, 0xa0
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
mov eax, ebx
jmp 0x140005063
mov eax, r12d
jmp 0x14000506b
Function at 0x140005920
Capabilities:
Send data
Send data on socket

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x14008f080]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, qword [rbp + 0x60]
lea r9, [rbp - 0x18]
xor r15d, r15d
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
mov dword [rbp - 0x18], r15d
call qword [sym.imp.WS2_32.dll_WSASend]
mov esi, eax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov rdx, qword [0x14008f180]
lea r14, str.8_b_
movabs r12, 0x4d54ee85da812030
mov dword [rbp - 0x2c], r15d
add rdx, r12
mov edi, eax
cmp rdx, 1
jbe 0x1400059a8
mov rcx, qword [str.8_b_]
mov edx, eax
mov r8, qword [rcx + 0x30]
mov rcx, r14
call r8
jmp 0x1400059ad
test edi, edi
setne al
movzx eax, al
movabs r10, 0x4800144005b3
add rax, 2
mov dword [rbp - 0x30], edi
mov qword [rbp - 0x28], r14
movups xmm0, xmmword [rbp - 0x30]
mov qword [rbp - 0x20], rax
movsd xmm1, qword [rbp - 0x20]
movups xmmword [rbx], xmm0
movsd qword [rbx + 0x10], xmm1
mov r9, qword [rbx + 0x10]
cmp r9, 1
je 0x1400059eb
mov eax, dword [rbx]
mov r8d, eax
jmp 0x140005a1b
mov rcx, qword [rbx + 8]
mov rax, r10
mov r8d, dword [rbx]
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 0x14
imul rax, rax, 0x1ffff7
sub rcx, rax
imul eax, ecx, 0x3e8
add eax, r8d
cmp eax, 0x40
jne 0x140005a5a
mov rcx, qword [0x14008f180]
add rcx, r12
mov dword [rbp - 0x2c], r15d
cmp rcx, 1
jbe 0x140005a4f
mov rax, qword [str.8_b_]
mov edx, 0x2746
mov rcx, r14
call qword [rax + Ordinal_50]
mov dword [rbp - 0x30], 0x2746
jmp 0x140005ac7
mov al, 1
mov dword [rbp - 0x30], 0x2746
jmp 0x140005ac7
cmp r9, 1
jne 0x140005a8d
mov rcx, qword [rbx + 8]
mov rax, r10
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 0x14
imul rax, rax, 0x1ffff7
sub rcx, rax
imul eax, ecx, 0x3e8
add r8d, eax
cmp r8d, 0x4d2
jne 0x140005ae7
mov rcx, qword [0x14008f180]
add rcx, r12
mov dword [rbp - 0x2c], r15d
cmp rcx, 1
jbe 0x140005abe
mov rax, qword [str.8_b_]
mov edx, 0x274d
mov rcx, r14
call qword [rax + Ordinal_50]
jmp 0x140005ac0
mov al, 1
mov dword [rbp - 0x30], 0x274d
movzx eax, al
mov qword [rbp - 0x28], r14
add rax, 2
movups xmm0, xmmword [rbp - 0x30]
mov qword [rbp - 0x20], rax
movsd xmm1, qword [rbp - 0x20]
movups xmmword [rbx], xmm0
movsd qword [rbx + 0x10], xmm1
test esi, esi
je 0x140005af2
mov eax, 0xffffffff
jmp 0x140005b09
mov eax, dword [rbp - 0x18]
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbp - 0x20], r15
movsd xmm0, qword [rbp - 0x20]
movsd qword [rbx + 0x10], xmm0
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14006fa90
add rsp, 0x70
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140005b30
Capabilities:
Get socket status

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1b0]
sub rsp, 0x2b0
mov rax, qword [0x14008f080]
xor rax, rsp
mov qword [rbp + 0x1a0], rax
mov rdi, qword [rbp + 0x220]
mov rax, r8
mov qword [rsp + 0x50], rax
movzx r13d, dl
mov qword [rsp + 0x48], r9
mov r12, rcx
cmp rcx, 0xffffffffffffffff
jne 0x140005bed
mov rcx, qword [0x14008f180]
lea r14, str.8_b_
xor esi, esi
movabs r15, 0x4d54ee85da812030
add rcx, r15
mov dword [rsp + 0x34], esi
cmp rcx, 1
jbe 0x140005bb8
mov rax, qword [str.8_b_]
mov edx, 0x2719
mov rcx, r14
call qword [rax + Ordinal_50]
jmp 0x140005bba
mov al, 1
movzx eax, al
add rax, 2
mov dword [rsp + 0x30], 0x2719
mov qword [rsp + 0x40], rax
xor eax, eax
movsd xmm1, qword [rsp + 0x40]
mov qword [rsp + 0x38], r14
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rdi], xmm0
movsd qword [rdi + 0x10], xmm1
jmp 0x140005d96
cmp byte [rbp + 0x218], 0
je 0x140005c1b
test r13b, 0x10
je 0x140005c1b
xorps xmm0, xmm0
xor esi, esi
movups xmmword [rdi], xmm0
mov qword [rsp + 0x68], rsi
xor eax, eax
movsd xmm0, qword [rsp + 0x68]
movsd qword [rdi + 0x10], xmm0
jmp 0x140005d96
mov r8, r9
mov qword [rsp + 0x2f8], rbx
mov rdx, rax
mov qword [rsp + 0x20], rdi
call fcn.140005920
test eax, eax
jns 0x140005d8c
and r13b, 1
lea r14, str.8_b_
xor esi, esi
movabs r15, 0x4d54ee85da812030
test r13b, r13b
jne 0x140005db8
mov rbx, qword [0x14008f180]
mov dword [rsp + 0x34], esi
lea rax, [rbx + r15]
cmp rax, 1
jbe 0x140005c8b
mov rax, qword [str.8_b_]
mov edx, 0x2733
mov rcx, r14
call qword [rax + Ordinal_50]
mov rbx, qword [0x14008f180]
jmp 0x140005c8d
mov al, 1
movzx eax, al
lea rdx, [rsp + 0x70]
add rax, 2
mov dword [rsp + 0x30], 0x2733
mov qword [rsp + 0x40], rax
mov rcx, rdi
movsd xmm1, qword [rsp + 0x40]
mov qword [rsp + 0x38], r14
movups xmm0, xmmword [rsp + 0x30]
movsd qword [rbp - 0x80], xmm1
movups xmmword [rsp + 0x70], xmm0
call fcn.140002610
test al, al
jne 0x140005d34
lea rax, [rbx + r15]
mov dword [rsp + 0x34], esi
cmp rax, 1
jbe 0x140005cee
mov rax, qword [str.8_b_]
mov edx, 0x4d5
mov rcx, r14
call qword [rax + Ordinal_50]
jmp 0x140005cf0
mov al, 1
movzx eax, al
lea rdx, [rsp + 0x58]
add rax, 2
mov dword [rsp + 0x30], 0x4d5
mov qword [rsp + 0x40], rax
mov rcx, rdi
movsd xmm1, qword [rsp + 0x40]
mov qword [rsp + 0x38], r14
movups xmm0, xmmword [rsp + 0x30]
movsd qword [rsp + 0x68], xmm1
movups xmmword [rsp + 0x58], xmm0
call fcn.140002610
test al, al
je 0x140005db8
lea ecx, [r12 + 1]
mov qword [rbp - 0x68], r12
xor r9d, r9d
mov dword [rbp - 0x70], 1
lea r8, [rbp - 0x70]
mov qword [rsp + 0x20], rsi
xor edx, edx
call qword [sym.imp.WS2_32.dll_select]
mov edx, eax
mov rcx, rdi
shr edx, 0x1f
mov ebx, eax
call fcn.140004dd0
test ebx, ebx
je 0x140005d6d
js 0x140005db8
mov r8, qword [rsp + 0x48]
mov rcx, r12
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x20], rdi
call fcn.140005920
test eax, eax
js 0x140005c52
mov eax, eax
mov rbx, qword [rsp + 0x2f8]
mov rcx, qword [rbp + 0x1a0]
xor rcx, rsp
call fcn.14006fa90
add rsp, 0x2b0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
xor eax, eax
jmp 0x140005d8e
Function at 0x14000b910
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x70
movaps xmmword [rsp + 0x60], xmm6
mov rdi, r9
mov rbx, r8
mov rsi, rcx
call fcn.140010870
nop
lea rcx, [rsi + 0x20]
mov rdx, rbx
call fcn.140010870
nop
lea rcx, [rsi + 0x40]
mov rdx, rdi
call fcn.140010870
nop
lea rcx, [rsi + 0x60]
mov rdx, qword [rsp + 0xa0]
call fcn.140010870
nop
movups xmm0, xmmword [str.ABGK]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [0x140080ef0]
movups xmmword [rsp + 0x40], xmm1
mov eax, dword [0x140080f00]
mov dword [rsp + 0x50], eax
xor r10d, r10d
mov ecx, r10d
cmp dword [reloc.WS2_32.dll_accept], 2
jl 0x14000bad2
movdqa xmm5, xmmword [0x140082b40]
movdqa xmm4, xmmword [0x140082be0]
movdqa xmm6, xmmword [0x140082b90]
movdqa xmm0, xmmword [0x140082bd0]
movdqa xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x34]
mov r8d, dword [rsp + 0x20]
nop dword [rax]
movd xmm2, ecx
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x140082bc0]
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 4]
xorps xmm2, xmm0
movd dword [rdx - 4], xmm2
lea eax, [rcx + 4]
movd xmm3, eax
pshufd xmm3, xmm3, 0
paddd xmm3, xmm5
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x140082bc0]
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx]
xorps xmm2, xmm0
movd dword [rdx], xmm2
add ecx, 8
lea rdx, [rdx + 8]
cmp ecx, 0x20
jl 0x14000b9d0
cmp ecx, 0x24
jge 0x14000bb0c
movsxd rax, ecx
lea r8, [rsp + 0x30]
add r8, rax
nop dword [rax]
mov eax, 0x4bda12f7
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x36
movzx eax, cl
sub al, dl
add al, 0x34
xor byte [r8], al
inc ecx
lea r8, [r8 + 1]
cmp ecx, 0x24
jl 0x14000bae0
xorps xmm0, xmm0
movups xmmword [rsi + 0x80], xmm0
mov qword [rsi + 0x90], r10
mov qword [rsi + 0x98], r10
lea rax, [rsp + 0x30]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], r10b
jne 0x14000bb30
lea rdx, [rsp + 0x30]
lea rcx, [rsi + 0x80]
call fcn.140012c30
nop
mov rax, rsi
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
movaps xmm6, xmmword [rsp + 0x60]
mov rsp, r11
pop rdi
ret
Function at 0x14000e500
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0xa0
movaps xmmword [r11 - 0x18], xmm6
mov rax, qword [0x14008f080]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov rdi, rdx
mov rsi, rcx
mov qword [rsp + 0x80], rcx
mov qword [r11 - 0x28], rdx
xor ebx, ebx
mov rdx, qword [rdx]
mov r8, qword [rdi + 8]
cmp rdx, r8
jne 0x14000e6e2
lea rdx, [r11 - 0x48]
call fcn.14000e790
mov r9, rax
cmp byte [rax + 0x1d], bl
je 0x14000e76d
cmp dword [reloc.WS2_32.dll_accept], 2
jl 0x14000e6a6
movdqa xmm5, xmmword [0x140082b40]
movdqa xmm4, xmmword [0x140082be0]
movdqa xmm6, xmmword [0x140082b90]
movdqa xmm0, xmmword [0x140082bd0]
movdqa xmmword [rsp + 0x30], xmm0
mov rcx, rax
mov edx, dword [rsp + 0x30]
nop dword [rax]
movd xmm2, ebx
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x140082bc0]
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx]
xorps xmm2, xmm0
movd dword [rcx], xmm2
lea eax, [rbx + 4]
movd xmm3, eax
pshufd xmm3, xmm3, 0
paddd xmm3, xmm5
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x140082bc0]
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx + 4]
xorps xmm2, xmm0
movd dword [rcx + 4], xmm2
add ebx, 8
mov eax, ebx
lea rcx, [rcx + 8]
cmp ebx, 0x18
jl 0x14000e5a0
cmp eax, 0x1e
jge 0x14000e76d
movsxd r8, ebx
add r8, r9
nop dword [rax]
mov eax, 0x4bda12f7
imul ebx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x36
movzx eax, bl
sub al, cl
add al, 0x34
xor byte [r8], al
inc ebx
lea r8, [r8 + 1]
cmp ebx, 0x1e
jge 0x14000e76d
jmp 0x14000e6b0
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], rbx
mov qword [rcx + 0x18], rbx
sub r8, rdx
call fcn.140012c30
nop
mov rcx, qword [rdi]
test rcx, rcx
je 0x14000e739
mov rdx, qword [rdi + 0x10]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x14000e729
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000e766
mov rcx, r8
call fcn.14006fab0
mov qword [rdi], rbx
mov qword [rdi + 8], rbx
mov qword [rdi + 0x10], rbx
mov rax, rsi
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.14006fa90
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov rdx, r9
lea rcx, [rsp + 0x40]
call fcn.140010830
lea rcx, [rsp + 0x40]
call fcn.140007060
int3
Function at 0x140010600
Capabilities:
Initialize winsock library

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x200
mov rax, qword [0x14008f080]
xor rax, rsp
mov qword [rsp + 0x1f0], rax
movzx ebx, dl
mov rdi, rcx
mov eax, 1
lock xadd dword [0x1400907a8], eax
inc eax
cmp eax, 1
jne 0x14001064d
lea ecx, [rax + 1]
lea rdx, [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_WSAStartup]
xchg dword [0x1400907ac], eax
test bl, bl
je 0x1400106f1
xor ebx, ebx
lock xadd dword [0x1400907ac], ebx
test ebx, ebx
je 0x1400106f1
movabs rcx, 0x4d54ee85da812030
mov qword [rsp + 0x210], rsi
add rcx, qword [0x14008f180]
lea rsi, str.8_b_
mov dword [rsp + 0x3c], 0
cmp rcx, 1
jbe 0x1400106a6
mov rax, qword [str.8_b_]
mov edx, ebx
mov rcx, rsi
call qword [rax + Ordinal_50]
jmp 0x1400106a8
mov al, 1
lea rcx, str.C:UsersAdminDesktop_aceid_assets_boost.asio_boost_asiodetailimplwinsock_init.ipp
movzx eax, al
add rax, 2
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x40], rsi
lea rcx, str.throw_on_error
mov rsi, qword [rsp + 0x210]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], Ordinal_79
mov dword [rsp + 0x34], reloc.WLDAP32.dll_Ordinal_26
test al, 1
jne 0x140010715
mov rax, rdi
mov rcx, qword [rsp + 0x1f0]
xor rcx, rsp
call fcn.14006fa90
mov rbx, qword [rsp + 0x218]
add rsp, 0x200
pop rdi
ret
lea r8, [rsp + 0x20]
lea rdx, str.winsock
lea rcx, [rsp + 0x38]
call fcn.1400031a0
int3