joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14041d780
Capabilities:
Receive data
Receive data on socket

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x138
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
mov rbx, rcx
xor ecx, ecx
mov r12, r8
mov rsi, r9
mov dword [r9], ecx
mov rcx, qword [rax + 0x98]
xor r9d, r9d
call qword [sym.imp.ws2_32.dll_recv]
movsxd r13, eax
mov rdi, r13
cmp r13d, 0xffffffff
jne 0x14041d80c
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
mov ebp, eax
cmp eax, 0x2733
jne 0x14041d7d7
mov dword [rsi], 0x51
jmp 0x14041d80c
lea rdx, [rsp + 0x30]
mov r8d, 0x100
mov ecx, eax
call fcn.140335b60
mov rcx, qword [rbx + 8]
lea rdx, str.Recv_failure:__s
mov r8, rax
call fcn.140324010
mov rax, qword [rbx + 8]
mov dword [rax + 0xce4], ebp
mov dword [rsi], 0x38
mov eax, dword [rsi]
mov rcx, qword [rbx + 8]
mov dword [rsp + 0x20], edi
mov r9, r12
lea r8, str.nw_in_read_len_zu______d__err_d
mov dword [rsp + 0x28], eax
mov rdx, qword [rbx]
call fcn.140336370
mov rax, r13
add rsp, 0x138
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret

Function at 0x14041f460
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xb8
xor edi, edi
lea rsi, [rsp + 0x20]
mov r9, rcx
lea rbx, [rsp + 0x50]
mov r10, rdx
mov rcx, rsi
lea r11, [rsp + 0x80]
call fcn.140408260
mov rcx, rbx
call fcn.140408260
mov rcx, r11
call fcn.140408260
mov rdx, r10
inc rdi
mov rax, rdi
xor rax, r8
mov rcx, rax
dec rax
not rcx
and rcx, rax
xor eax, eax
sar rcx, 0x3f
mov rbp, qword [rsi + rax*8]
mov r10, qword [rdx + rax*8]
xor r10, rbp
and r10, rcx
xor r10, rbp
mov rbp, qword [rbx + rax*8]
mov qword [rsi + rax*8], r10
mov r10, qword [rdx + rax*8 + 0x30]
xor r10, rbp
and r10, rcx
xor r10, rbp
mov rbp, qword [r11 + rax*8]
mov qword [rbx + rax*8], r10
mov r10, qword [rdx + rax*8 + 0x60]
xor r10, rbp
and r10, rcx
xor r10, rbp
mov qword [r11 + rax*8], r10
inc rax
cmp rax, 6
jne 0x14041f4bb
add rdx, 0x90
cmp rdi, 0x10
jne 0x14041f4a0
mov rdx, rsi
mov rcx, r9
call fcn.140408220
lea rcx, [r9 + 0x30]
mov rdx, rbx
call fcn.140408220
lea rcx, [r9 + 0x60]
mov rdx, r11
call fcn.140408220
nop
add rsp, 0xb8
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x14041faf0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov ebp, dword [rcx + 0x80]
movsxd rdx, edx
mov rbx, rcx
mov rcx, qword [rcx + 0x78]
mov rsi, rdx
imul rdx, rdx, 0x38
call fcn.14046c1a0
mov r8, rax
test rax, rax
jne 0x14041fb26
mov eax, 7
jmp 0x14041fbc2
movsxd rdi, ebp
mov ecx, esi
imul rdi, rdi, 0x38
sub ecx, ebp
movsxd rcx, ecx
imul rcx, rcx, 0x38
lea rdx, [rax + rdi]
xor eax, eax
mov rdi, rdx
rep stosb byte [rdi], al
mov qword [rbx + 0x78], r8
mov rdi, rdx
cmp ebp, esi
jge 0x14041fbc0
mov rax, qword [rbx + 0x50]
mov ecx, dword [rbx + 0x20]
cmp qword [rax], 0
mov dword [rdi + 0x18], ecx
je 0x14041fb67
mov rax, qword [rbx + 0x60]
test rax, rax
jg 0x14041fb6d
mov eax, dword [rbx + 0xb8]
mov qword [rdi], rax
mov eax, dword [rbx + 0x3c]
mov dword [rdi + 0x1c], eax
call fcn.140444310
mov dword [rdi + 0x20], 1
mov qword [rdi + 0x10], rax
test rax, rax
je 0x14041fb1c
mov rax, qword [rbx + 0x128]
test rax, rax
je 0x14041fbb2
mov edx, dword [rax + 0x58]
mov dword [rdi + 0x24], edx
mov edx, dword [rax + 0x60]
mov dword [rdi + 0x28], edx
mov edx, dword [rax + 0x64]
mov dword [rdi + 0x2c], edx
mov eax, dword [rax + 0x88]
mov dword [rdi + 0x30], eax
inc ebp
add rdi, 0x38
mov dword [rbx + 0x80], ebp
jmp 0x14041fb4a
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
cmp dword [rcx + 0x80], edx
jge 0x140463873
cmp byte [rcx + 0xa], 0
je 0x140463873
jmp 0x14041faf0
xor eax, eax
ret

Function at 0x14042bc90
Capabilities:
Reference sql statements

Disassembly:
push r12
push rbp
push rdi
push rsi
sub rsp, 0x58
mov r12d, dword [rsp + 0xa0]
mov byte [rcx + 0x1c], 1
mov ebp, r8d
mov rsi, rdx
mov rdi, r9
mov qword [rsp + 0x28], r9
mov r9, rdx
mov dword [rsp + 0x20], r8d
mov r8, rdx
lea rdx, str.SELECT_1_FROM___w_.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name___d___Q___d_NULL
mov dword [rsp + 0x30], r12d
mov qword [rsp + 0x48], rcx
call fcn.140462c50
test ebp, ebp
mov rcx, qword [rsp + 0x48]
jne 0x14042bd00
mov r9, rdi
mov r8, rsi
lea rdx, str.SELECT_1_FROM_temp.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name__1___Q___d_NULL
mov dword [rsp + 0xa0], r12d
add rsp, 0x58
pop rsi
pop rdi
pop rbp
pop r12
jmp fcn.140462c50
add rsp, 0x58
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x14042c630
Capabilities:
Send data
Send data on socket

Disassembly:
sub rsp, 0x48
mov r8d, 0x1008
mov edx, 0xffff
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x50], rcx
lea r9, [rsp + 0x38]
mov dword [rsp + 0x3c], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ws2_32.dll_getsockopt]
test eax, eax
jne 0x14042c680
cmp dword [rsp + 0x38], 1
mov rcx, qword [rsp + 0x50]
jne 0x14042c680
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ws2_32.dll_send]
nop
add rsp, 0x48
ret
Function at 0x1404304c0
Capabilities:
Encode data using xor

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
mov r10, rcx
mov rbx, r8
cmp edx, 0x80
je 0x140430556
mov eax, 1
cmp edx, 0x100
jne 0x140430776
lea rdi, [rsp + 0x20]
mov rdx, rcx
lea rbp, [rsp + 0x30]
mov dword [r8 + 0xf0], 0xe
mov rcx, rdi
mov esi, 2
lea r12, [rsp + 0x40]
lea r13, [0x14062f060]
call fcn.1403bb220
mov r8d, 0x10
mov rcx, rbx
mov rdx, rdi
call fcn.140353140
lea rdx, [r10 + 0x10]
mov rcx, rbp
call fcn.1403bb220
lea rcx, [rbx + 0x10]
mov rdx, rbp
add rbx, 0x20
mov r8d, 0x10
call fcn.140353140
jmp 0x14043064a
lea rdi, [rsp + 0x30]
mov rdx, rcx
lea rsi, [rbx + 0x10]
mov dword [r8 + 0xf0], 0xa
mov rcx, rdi
lea rbp, [0x14062f060]
lea r12, [rsp + 0x40]
call fcn.1403bb220
mov rcx, rbx
mov r8d, 0x10
mov rdx, rdi
call fcn.140353140
add rbx, 0xb0
mov rdx, rdi
mov rcx, r12
inc rbp
call fcn.1403bb6f0
mov r8b, byte [rbp - 1]
mov rcx, qword [rsp + 0x40]
call fcn.1403bb620
mov rdx, r8
shr r8, 4
and edx, 0xf
shr rax, 0x30
xor rax, qword [rsp + 0x30]
and r8d, 0xf
xor rax, rdx
mov rdx, rax
mov rcx, rax
shl rcx, 0x10
shl rdx, 0x20
xor rdx, rcx
mov rcx, qword [rsp + 0x48]
xor rdx, rax
shl rax, 0x30
xor rax, rdx
mov qword [rsp + 0x30], rax
call fcn.1403bb620
shr rax, 0x30
xor rax, qword [rsp + 0x38]
xor rax, r8
mov r8d, 0x10
mov rdx, rax
mov rcx, rax
shl rcx, 0x20
shl rdx, 0x10
xor rdx, rcx
mov rcx, rsi
add rsi, 0x10
xor rdx, rax
shl rax, 0x30
xor rax, rdx
mov rdx, rdi
mov qword [rsp + 0x38], rax
call fcn.140353140
cmp rbx, rsi
jne 0x140430599
xor eax, eax
jmp 0x140430776
mov rdx, rbp
mov rcx, r12
lea r14, [rbx + 0x20]
call fcn.1403bb6f0
mov rax, rsi
mov rcx, qword [rsp + 0x40]
shr rax, 1
mov r8b, byte [r13 + rax - 1]
call fcn.1403bb620
mov rdx, r8
shr rax, 0x30
xor rax, qword [rsp + 0x20]
and edx, 0xf
shr r8, 4
xor rax, rdx
and r8d, 0xf
mov rdx, rax
mov rcx, rax
shl rcx, 0x10
shl rdx, 0x20
xor rdx, rcx
mov rcx, qword [rsp + 0x48]
xor rdx, rax
shl rax, 0x30
xor rax, rdx
mov qword [rsp + 0x20], rax
call fcn.1403bb620
shr rax, 0x30
xor rax, qword [rsp + 0x28]
xor rax, r8
mov r8d, 0x10
mov rdx, rax
mov rcx, rax
shl rcx, 0x20
shl rdx, 0x10
xor rdx, rcx
mov rcx, rbx
xor rdx, rax
shl rax, 0x30
xor rax, rdx
mov rdx, rdi
mov qword [rsp + 0x28], rax
call fcn.140353140
cmp rsi, 0xe
je 0x140430643
mov rdx, rdi
mov rcx, r12
add rsi, 2
call fcn.1403bb6f0
movzx eax, word [rsp + 0x46]
xor rax, qword [rsp + 0x30]
mov r8d, 0x10
mov rdx, rax
mov rcx, rax
shl rcx, 0x20
shl rdx, 0x10
xor rdx, rcx
xor rdx, rax
shl rax, 0x30
xor rax, rdx
mov qword [rsp + 0x30], rax
movzx eax, word [rsp + 0x4e]
xor rax, qword [rsp + 0x38]
mov rdx, rax
mov rcx, rax
shl rcx, 0x20
shl rdx, 0x10
xor rdx, rcx
lea rcx, [rbx + 0x10]
mov rbx, r14
xor rdx, rax
shl rax, 0x30
xor rax, rdx
mov rdx, rbp
mov qword [rsp + 0x38], rax
call fcn.140353140
jmp 0x14043064a
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
Function at 0x140430790
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov ebx, 1
mov r9d, 0x40
xor eax, eax
mov r8d, 1
shl rbx, 0x3f
mov rdx, r8
mov r11, rcx
shr rax, 1
and edx, 1
neg rdx
and r11, rdx
and rdx, rbx
mov r10, r11
add rax, rdx
xor r10, r8
and r8, r11
shr r10, 1
add r8, r10
dec r9
jne 0x1404307a8
pop rbx
ret

Function at 0x1404315e0
Capabilities:
Encrypt data using curve25519

Disassembly:
mov al, byte [rcx + 0x1f]
and byte [rcx], 0xf8
and eax, 0x7f
or eax, 0x40
mov byte [rcx + 0x1f], al
ret
Function at 0x1404344e0
Capabilities:
Reference sql statements

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
lea rax, str.SELECT_parentnode_FROM__Q._q_parent_WHERE_nodeno_1
movsxd r12, edx
mov qword [rsp + 0x40], rax
mov rbx, rcx
mov rsi, r8
lea rax, str.SELECT_nodeno_FROM__Q._q_rowid_WHERE_rowid_1
cmp qword [rcx + r12*8 + 0x28], 0
mov rbp, r12
mov rdi, r9
mov qword [rsp + 0x48], rax
lea r13, [r12 + 4]
jne 0x140434537
mov rdx, qword [rsp + r12*8 + 0x40]
mov r9, qword [rcx + 0x10]
mov r8, qword [rcx + 8]
call fcn.140434930
mov qword [rbx + r13*8 + 8], rax
cmp dword [rbx + 0x40], 0
jne 0x1404345f0
mov r12, qword [rbx + r12*8 + 0x28]
mov r8, rsi
mov edx, 1
mov rcx, r12
call fcn.140486620
mov rcx, r12
call fcn.14048bdb0
cmp eax, 0x65
jne 0x140434593
test ebp, ebp
lea rdx, str.__rowid
mov r9, rdi
mov r8, rsi
lea rax, str.__parent
mov rcx, rbx
cmovne rax, rdx
lea rdx, str.Mapping___lld_____lld__missing_from__s_table
mov qword [rsp + 0x20], rax
call fcn.1404343e0
jmp 0x1404345df
cmp eax, 0x64
jne 0x1404345df
xor edx, edx
mov rcx, r12
call fcn.140487430
mov r9, rax
cmp rdi, rax
je 0x1404345df
lea rdx, str.__rowid
test ebp, ebp
mov r8, rsi
mov rcx, rbx
lea rax, str.__parent
mov qword [rsp + 0x30], rdi
cmovne rax, rdx
mov qword [rsp + 0x28], rsi
lea rdx, str.Found___lld_____lld__in__s_table__expected___lld_____lld_
mov qword [rsp + 0x20], rax
call fcn.1404343e0
mov rcx, r12
call fcn.14048b080
cmp dword [rbx + 0x40], 0
jne 0x1404345f0
mov dword [rbx + 0x40], eax
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
Function at 0x14043ea10
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x1c8
mov rax, qword [rdx + 0x20]
mov rax, qword [rax + 0x2d0]
mov eax, dword [rax + 0x84]
mov rsi, rcx
mov rbx, rdx
and eax, 0x800
jne 0x14043eaf4
lea rbp, [rsp + 0x40]
mov ecx, 0x20
lea r8, [rsp + 0x3c]
mov dword [rsp + 0x3c], pe_nt_image_headers64
mov rdi, rbp
mov rdx, rbp
rep stosd dword [rdi], eax
mov rcx, qword [rsi + 0x98]
call qword [sym.imp.ws2_32.dll_getsockname]
test eax, eax
je 0x14043ea99
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
lea rdx, [rsp + 0xc0]
mov r8d, 0x100
mov ecx, eax
mov esi, eax
call fcn.140335b60
mov r8d, esi
lea rdx, str.getsockname___failed_with_errno__d:__s
mov r9, rax
jmp 0x14043eaeb
mov edx, dword [rsp + 0x3c]
lea r9, [rsi + 0x144]
lea r8, [rsi + 0x114]
mov rcx, rbp
call fcn.140317630
test al, al
jne 0x14043eaf4
mov rsi, qword [sym.imp.msvcrt.dll__errno]
call rsi
lea rdx, [rsp + 0xc0]
mov r8d, 0x100
mov ecx, dword [rax]
call fcn.140335b60
mov qword [rsp + 0x28], rax
call rsi
mov r9, qword [rsp + 0x28]
lea rdx, str.ssloc_inet_ntop___failed_with_errno__d:__s
mov r8d, dword [rax]
mov rcx, rbx
call fcn.140324010
nop
add rsp, 0x1c8
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x14043f400
Capabilities:
Parse credit card information

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov eax, dword [rcx + 0x10]
and eax, 3
mov rbx, rcx
mov rdi, rdx
mov rsi, r8
cmp eax, 1
je 0x14043f432
cmp eax, 2
je 0x14043f45a
test eax, eax
jne 0x14043f440
call fcn.140423610
test eax, eax
jne 0x14043f4d8
mov eax, dword [rbx + 0x10]
and eax, 0xfffffffc
or eax, 2
mov dword [rbx + 0x10], eax
jmp 0x14043f45a
mov r8d, 0x283
lea rdx, str.nghttp2_lib_sfparse.c
lea rcx, [0x140616907]
call qword [sym.imp.msvcrt.dll__assert]
mov rax, qword [rbx]
mov rbp, qword [rbx + 8]
cmp rax, rbp
je 0x14043f46b
cmp byte [rax], 0x3b
je 0x14043f476
or dword [rbx + 0x10], 3
mov eax, 0xfffffffe
jmp 0x14043f4d8
inc rax
mov rcx, rbx
mov qword [rbx], rax
call fcn.1404233d0
cmp rbp, qword [rbx]
jne 0x14043f48e
or eax, 0xffffffff
jmp 0x14043f4d8
mov rdx, rdi
call fcn.1404233f0
test eax, eax
jne 0x14043f4d8
mov rdx, qword [rbx]
cmp rbp, rdx
je 0x14043f4a7
cmp byte [rdx], 0x3d
je 0x14043f4ba
test rsi, rsi
je 0x14043f4d8
xor edx, edx
mov dword [rsi + 8], 1
mov qword [rsi], rdx
jmp 0x14043f4d8
inc rdx
mov qword [rbx], rdx
cmp rdx, rbp
je 0x14043f489
mov rdx, rsi
mov rcx, rbx
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp fcn.140423000
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x14045bd20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
mov eax, ecx
mov r8d, edx
cmp ecx, 0x7f
jg 0x14045bd3f
lea edx, [rcx - 0x41]
cmp edx, 0x19
ja 0x14045bde0
add eax, 0x20
jmp 0x14045bde0
cmp ecx, 0xffff
jg 0x14045bdd2
or rdx, 0xffffffffffffffff
xor r10d, r10d
mov r11d, 0xa2
lea r9, [0x14062ba20]
lea ecx, [r11 + r10]
sar ecx, 1
movsxd rbx, ecx
movzx ebx, word [r9 + rbx*4]
cmp eax, ebx
jl 0x14045bd7a
lea r10d, [rcx + 1]
movsxd rdx, ecx
jmp 0x14045bd7e
lea r11d, [rcx - 1]
cmp r11d, r10d
jge 0x14045bd5f
movzx ecx, word [r9 + rdx*4]
movzx r10d, byte [r9 + rdx*4 + 3]
add r10d, ecx
cmp eax, r10d
jge 0x14045bdbc
mov dl, byte [r9 + rdx*4 + 2]
xor ecx, eax
mov r9d, edx
and r9d, 1
test r9d, ecx
jne 0x14045bdbc
shr dl, 1
lea rcx, [0x14062f180]
and edx, 0x7f
add ax, word [rcx + rdx*2]
movzx eax, ax
test r8d, r8d
je 0x14045bde0
xor edx, edx
cmp r8d, 2
mov ecx, eax
sete dl
pop rbx
jmp fcn.14042a260
lea edx, [rcx - 0x10400]
cmp edx, 0x27
ja 0x14045bde0
add eax, 0x28
pop rbx
ret

Function at 0x140463860
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov ebp, dword [rcx + 0x80]
movsxd rdx, edx
mov rbx, rcx
mov rcx, qword [rcx + 0x78]
mov rsi, rdx
imul rdx, rdx, 0x38
call fcn.14046c1a0
mov r8, rax
test rax, rax
jne 0x14041fb26
mov eax, 7
jmp 0x14041fbc2
movsxd rdi, ebp
mov ecx, esi
imul rdi, rdi, 0x38
sub ecx, ebp
movsxd rcx, ecx
imul rcx, rcx, 0x38
lea rdx, [rax + rdi]
xor eax, eax
mov rdi, rdx
rep stosb byte [rdi], al
mov qword [rbx + 0x78], r8
mov rdi, rdx
cmp ebp, esi
jge 0x14041fbc0
mov rax, qword [rbx + 0x50]
mov ecx, dword [rbx + 0x20]
cmp qword [rax], 0
mov dword [rdi + 0x18], ecx
je 0x14041fb67
mov rax, qword [rbx + 0x60]
test rax, rax
jg 0x14041fb6d
mov eax, dword [rbx + 0xb8]
mov qword [rdi], rax
mov eax, dword [rbx + 0x3c]
mov dword [rdi + 0x1c], eax
call fcn.140444310
mov dword [rdi + 0x20], 1
mov qword [rdi + 0x10], rax
test rax, rax
je 0x14041fb1c
mov rax, qword [rbx + 0x128]
test rax, rax
je 0x14041fbb2
mov edx, dword [rax + 0x58]
mov dword [rdi + 0x24], edx
mov edx, dword [rax + 0x60]
mov dword [rdi + 0x28], edx
mov edx, dword [rax + 0x64]
mov dword [rdi + 0x2c], edx
mov eax, dword [rax + 0x88]
mov dword [rdi + 0x30], eax
inc ebp
add rdi, 0x38
mov dword [rbx + 0x80], ebp
jmp 0x14041fb4a
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
cmp dword [rcx + 0x80], edx
jge 0x140463873
cmp byte [rcx + 0xa], 0
je 0x140463873
jmp 0x14041faf0
xor eax, eax
ret
Function at 0x140492c80
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x178
movsx r10, r8b
mov eax, r8d
mov r9d, r8d
mov rsi, rcx
mov rbx, r10
lea rdi, [rsp + 0x99]
mov ecx, 0x5f
mov r8d, 1
sar rbx, 0x3f
and eax, ebx
add eax, eax
sub r9d, eax
xor eax, eax
rep stosb byte [rdi], al
mov rax, r10
dec r10
movzx r9d, r9b
not rax
and rax, r10
lea r10, [rsp + 0x98]
sar rax, 0x3f
and eax, 1
mov byte [rsp + 0x98], al
mov byte [rsp + 0xb8], al
movsxd rax, edx
lea rdx, [0x1406605c0]
imul rax, rax, 0x300
add rax, rdx
mov rcx, r9
xor rcx, r8
mov rdx, rcx
dec rcx
not rdx
and rdx, rcx
xor ecx, ecx
sar rdx, 0x3f
mov r11b, byte [rax + rcx]
and r11d, edx
xor byte [r10 + rcx], r11b
inc rcx
cmp rcx, 0x60
jne 0x140492d1e
inc r8
add rax, 0x60
cmp r8, 9
jne 0x140492d06
lea rbp, [rsp + 0x20]
mov rdx, r10
lea r13, [rsp + 0x48]
neg rbx
mov rcx, rbp
lea r15, [rsp + 0x70]
lea r12, [rsi + 0x28]
call fcn.1403dad10
mov rcx, r13
lea rdx, [rsp + 0xb8]
lea rdi, [rsi + 0x50]
call fcn.1403dad10
lea rdx, [rsp + 0xd8]
mov rcx, r15
lea r14, [rsp + 0xf8]
call fcn.1403dad10
mov rdx, rbp
mov rcx, rsi
call fcn.1403da460
mov rdx, r13
mov rcx, r12
call fcn.1403da460
mov rdx, r15
mov rcx, rdi
call fcn.1403da460
mov rdx, r13
mov rcx, r14
lea r13, [rsp + 0x120]
call fcn.1403da460
mov rdx, rbp
mov rcx, r13
lea rbp, [rsp + 0x148]
call fcn.1403da460
mov rdx, r15
mov rcx, rbp
call fcn.1403daec0
mov r8, rbx
mov rdx, r14
mov rcx, rsi
call fcn.1403da380
mov r8, rbx
mov rdx, r13
mov rcx, r12
call fcn.1403da380
mov r8, rbx
mov rdx, rbp
mov rcx, rdi
call fcn.1403da380
nop
add rsp, 0x178
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x140492e20
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x140
mov r8d, 1
mov rbx, rcx
mov dword [rsp + 0x3c], 1
mov rcx, rdx
lea r9, [rsp + 0x3c]
mov dword [rsp + 0x20], 4
mov edx, 6
call qword [sym.imp.ws2_32.dll_setsockopt]
test eax, eax
jns 0x140492e83
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
lea rdx, [rsp + 0x40]
mov r8d, 0x100
mov ecx, eax
call fcn.140335b60
lea rdx, str.Could_not_set_TCP_NODELAY:__s
mov rcx, rbx
mov r8, rax
call fcn.14032c350
nop
add rsp, 0x140
pop rbx
ret
Function at 0x140497440
Capabilities:
Create thread

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
xor edi, edi
xor esi, esi
movzx r12d, byte [rcx + 0x5b]
dec r12d
mov byte [rcx + 0x58], 1
mov rbx, rcx
cmp esi, r12d
jge 0x140497533
movzx eax, byte [rbx + 0x5a]
lea eax, [rsi + rax + 1]
cdq
idiv r12d
movsxd rbp, edx
imul rax, rbp, 0x68
cmp dword [rbx + rax + 0x68], 0
lea rdi, [rbx + rax + 0x60]
jne 0x140497495
imul rbp, rbp, 0x68
cmp qword [rbx + rbp + 0x60], 0
je 0x1404974a6
inc esi
jmp 0x14049745d
mov rcx, rdi
call fcn.1404975d0
test eax, eax
je 0x140497485
jmp 0x140497558
lea rdx, [rbx + 0x60]
mov rax, rdi
mov rcx, qword [rdi + 0x28]
movups xmm0, xmmword [rbx + 0x38]
sub rax, rdx
movabs rdx, 0x4ec4ec4ec4ec4ec5
sar rax, 3
imul rax, rdx
xor edx, edx
mov byte [rbx + 0x5a], al
mov rax, qword [rbx + 0x48]
movups xmmword [rdi + 0x20], xmm0
mov qword [rdi + 0x30], rax
xor eax, eax
mov qword [rbx + 0x38], rax
mov dword [rbx + 0x48], edx
test rcx, rcx
je 0x1404974f7
mov qword [rbx + 0x40], rcx
call fcn.140462700
mov dword [rbx + 0x54], eax
jmp 0x140497510
cmp qword [rbx + 0x40], 0
je 0x140497510
movsxd rcx, dword [rbx + 0x54]
call fcn.1404625a0
mov qword [rbx + 0x40], rax
test rax, rax
je 0x14049752c
mov r8, rdi
lea rdx, [0x140497570]
mov rcx, rdi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp fcn.140472ca0
mov eax, 7
jmp 0x140497558
jne 0x1404974a6
movsxd rsi, esi
lea rdx, [rbx + 0x38]
imul rsi, rsi, 0x68
lea rcx, [rbx + rsi + 0x60]
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp fcn.140497640
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x1404a2ff0
Capabilities:
Encode data using xor

Disassembly:
push rbx
xor r9d, r9d
xor r11d, r11d
movsxd rax, dword [rcx + 0xc]
lea r10d, [rax + 1]
add rax, qword [rcx]
mov bl, byte [rdx + r9]
xor byte [rax], bl
movsxd rax, r10d
cmp dword [rcx + 8], r10d
cmovle rax, r11
inc r9
cmp r8d, r9d
jg 0x1404a2ffb
add dword [rcx + 0x10], r8d
mov dword [rcx + 0xc], eax
pop rbx
ret
Function at 0x140034e30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov r11, rdx
mov r14, qword [rsp + 0x90]
mov r15, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x80]
mov ebp, ecx
shr ebp, 8
lea r8, [r11 + r8*2]
xor eax, eax
mov rdi, r11
movzx esi, byte [r11 + 1]
add r11, 2
lea r10, [rax + rsi]
cmp byte [rdi], bpl
jne 0x140034eb0
cmp r10, rax
jb 0x140034f24
cmp r10, rdx
ja 0x140034f38
add rax, r9
xor edi, edi
nop
cmp rsi, rdi
je 0x140034eb2
lea rbx, [rdi + 1]
cmp byte [rax + rdi], cl
mov rdi, rbx
jne 0x140034e90
jmp 0x140034f13
ja 0x140034eba
mov rax, r10
cmp r11, r8
jne 0x140034e62
add r14, r15
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea rbx, [r15 + 1]
movzx edx, byte [r15]
test dl, dl
js 0x140034ef0
mov r15, rbx
sub ecx, edx
jns 0x140034f0a
jmp 0x140034f15
cmp rbx, r14
je 0x140034f49
movzx ebp, byte [r15 + 1]
add r15, 2
and edx, 0x7f
shl edx, 8
or edx, ebp
sub ecx, edx
js 0x140034f15
xor al, 1
cmp r15, r14
jne 0x140034ed0
jmp 0x140034f15
xor eax, eax
and al, 1
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, rax
mov rdx, r10
call fcn.14029e9d0
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.14029e740
ud2
lea rcx, [0x1403990f0]
lea r8, str.librarycore_srcunicodeprintable.rs
mov edx, 0x2b
call fcn.14029e750
ud2
Function at 0x1401626aa
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xc8
mov rbx, rcx
mov eax, dword [0x1403c6728]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movzx eax, byte [rax + 0x140]
test rax, rax
je 0x1401626eb
cmp eax, 1
je 0x140162718
xor esi, esi
jmp 0x1401628b4
mov eax, dword [0x1403c6728]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
lea rsi, [rax + 0xd8]
lea rdx, [0x1401628cb]
mov rcx, rsi
call fcn.14013e550
mov byte [rsi + 0x68], 1
test rbx, rbx
je 0x1401627e2
lea rax, [rsp + 0x60]
mov ecx, 0xd
mov rdi, rax
mov rsi, rbx
rep movsq qword [rdi], qword [rsi]
mov qword [rbx], 0
cmp dword [rax], 1
jne 0x1401627d8
mov r15, qword [rsp + 0x68]
mov r14, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x30], rax
mov r13, qword [rsp + 0x88]
movups xmm0, xmmword [rsp + 0x90]
movaps xmmword [rsp + 0x40], xmm0
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x50], rax
mov r9, qword [rsp + 0xa8]
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x38], rax
mov ebx, dword [rsp + 0xb8]
mov edx, dword [rsp + 0xbc]
mov r11b, byte [rsp + 0xc0]
mov al, byte [rsp + 0xc1]
mov byte [rsp + 0x27], al
mov r10b, byte [rsp + 0xc2]
mov eax, dword [rsp + 0xc3]
mov dword [rsp + 0x28], eax
mov al, byte [rsp + 0xc7]
mov byte [rsp + 0x2c], al
jmp 0x140162814
lea rcx, [rsp + 0x60]
call fcn.14016653a
call fcn.140162cc7
mov rbx, rax
shr rbx, 0x20
test eax, eax
mov edx, 1
cmovne edx, eax
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov r9d, 2
mov r10b, 2
xor r11d, r11d
xor r13d, r13d
xor ebp, ebp
xor r15d, r15d
mov eax, dword [0x1403c6728]
mov rcx, qword gs:[0x58]
mov r12, qword [rcx + rax*8]
lea rax, [r12 + 0xd8]
lea r8, [rsp + 0x60]
mov ecx, 0xd
mov rsi, rax
mov rdi, r8
rep movsq qword [rdi], qword [rsi]
mov qword [rax], 1
mov qword [rax + 8], r15
lea rsi, [r12 + 0xe0]
mov qword [rsi + 8], r14
mov qword [rsi + 0x10], rbp
mov rax, qword [rsp + 0x30]
mov qword [rsi + 0x18], rax
mov qword [rsi + 0x20], r13
mov rax, qword [rsp + 0x50]
mov qword [rsi + 0x38], rax
movaps xmm0, xmmword [rsp + 0x40]
movups xmmword [rsi + 0x28], xmm0
mov qword [rsi + 0x40], r9
mov rax, qword [rsp + 0x38]
mov qword [rsi + 0x48], rax
mov dword [rsi + 0x50], ebx
mov dword [rsi + 0x54], edx
mov byte [rsi + 0x58], r11b
mov al, byte [rsp + 0x27]
mov byte [rsi + 0x59], al
mov byte [rsi + 0x5a], r10b
mov eax, dword [rsp + 0x28]
mov dword [rsi + 0x5b], eax
mov al, byte [rsp + 0x2c]
mov byte [rsi + 0x5f], al
mov rcx, r8
call fcn.14016653a
mov rax, rsi
add rsp, 0xc8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x1401693a1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp qword [rcx], 0
je 0x1401693b6
add rcx, 8
xor r8d, r8d
xor r9d, r9d
jmp fcn.1401691a7
add rcx, 8
xor r8d, r8d
jmp fcn.140168a05
Function at 0x14029d5e4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [0x1402a5338]
test rax, rax
je 0x14029d62e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14029d62e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14029d62e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14029d62e
cmp dword [rcx + 0x84], 0xe
jbe 0x14029d62e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14029d630
xor al, al
add rsp, 0x28
ret