joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401a30f0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0xd0
mov rax, qword [0x1404c39e8]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rsi, rdx
mov rdi, rcx
xor ebx, ebx
mov eax, ebx
lock xadd dword [rcx + 0x30], eax
test eax, eax
jne 0x1401a3149
call fcn.1401a70c0
xorps xmm0, xmm0
mov qword [rsp + 0x30], rbx
movups xmmword [rsi], xmm0
movsd xmm0, qword [rsp + 0x30]
movsd qword [rsi + 0x10], xmm0
xor eax, eax
jmp 0x1401a325c
mov dword [rsp + 0xa0], ebx
lea rcx, [rsp + 0xa8]
call fcn.1403811c0
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x90], xmm0
xor eax, eax
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], rax
lea rax, [rdi + 0x28]
test rdi, rdi
cmove rax, rbx
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rax
mov ecx, dword [0x1404dc774]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0x38]
mov ecx, dword [0x1404dc774]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
mov r9, rsi
lea r8, [rsp + 0x50]
mov edx, 0xffffffff
mov rcx, rdi
call fcn.14017f6b0
test rax, rax
je 0x1401a3219
nop dword [rax]
nop word [rax + rax]
lea rax, [rbx + 1]
cmp rbx, 0xffffffffffffffff
cmove rax, rbx
mov rbx, rax
mov r9, rsi
lea r8, [rsp + 0x50]
mov edx, 0xffffffff
mov rcx, rdi
call fcn.14017f6b0
test rax, rax
jne 0x1401a31f0
mov rdx, qword [rsp + 0x48]
mov ecx, dword [0x1404dc774]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
lea rdi, [rsp + 0x50]
mov esi, 0xa
mov rcx, qword [rdi]
test rcx, rcx
je 0x1401a3242
call fcn.1403831a0
add rdi, 8
sub rsi, 1
jne 0x1401a3235
lea rcx, [rsp + 0xa8]
call fcn.14038124c
mov rax, rbx
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.140382da0
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1401a3b00
Capabilities:
Send data
Send data on socket

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1404c39e8]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, qword [rbp + 0x60]
xor r15d, r15d
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r9d
lea r9, [rbp - 0x18]
mov dword [rbp - 0x18], r15d
call qword [sym.imp.WS2_32.dll_WSASend]
mov esi, eax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov rdx, qword [0x1404bb158]
lea r14, [0x1404bb150]
movabs r12, 0x4d54ee85da812030
mov dword [rbp - 0x2c], r15d
add rdx, r12
mov edi, eax
cmp rdx, 1
jbe 0x1401a3b88
mov rcx, qword [0x1404bb150]
mov edx, eax
mov r8, qword [rcx + 0x30]
mov rcx, r14
call r8
jmp 0x1401a3b8d
test edi, edi
setne al
movzx eax, al
movabs r10, 0x4800144005b3
add rax, 2
mov dword [rbp - 0x30], edi
mov qword [rbp - 0x28], r14
movups xmm0, xmmword [rbp - 0x30]
mov qword [rbp - 0x20], rax
movsd xmm1, qword [rbp - 0x20]
movups xmmword [rbx], xmm0
movsd qword [rbx + 0x10], xmm1
mov r9, qword [rbx + 0x10]
cmp r9, 1
je 0x1401a3bcb
mov eax, dword [rbx]
mov r8d, eax
jmp 0x1401a3bfb
mov rcx, qword [rbx + 8]
mov rax, r10
mov r8d, dword [rbx]
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 0x14
imul rax, rax, 0x1ffff7
sub rcx, rax
imul eax, ecx, 0x3e8
add eax, r8d
cmp eax, 0x40
jne 0x1401a3c3a
mov rcx, qword [0x1404bb158]
add rcx, r12
mov dword [rbp - 0x2c], r15d
cmp rcx, 1
jbe 0x1401a3c2f
mov rax, qword [0x1404bb150]
mov edx, 0x2746
mov rcx, r14
call qword [rax + 0x30]
mov dword [rbp - 0x30], 0x2746
jmp 0x1401a3ca7
mov al, 1
mov dword [rbp - 0x30], 0x2746
jmp 0x1401a3ca7
cmp r9, 1
jne 0x1401a3c6d
mov rcx, qword [rbx + 8]
mov rax, r10
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 0x14
imul rax, rax, 0x1ffff7
sub rcx, rax
imul eax, ecx, 0x3e8
add r8d, eax
cmp r8d, 0x4d2
jne 0x1401a3cc7
mov rcx, qword [0x1404bb158]
add rcx, r12
mov dword [rbp - 0x2c], r15d
cmp rcx, 1
jbe 0x1401a3c9e
mov rax, qword [0x1404bb150]
mov edx, 0x274d
mov rcx, r14
call qword [rax + 0x30]
jmp 0x1401a3ca0
mov al, 1
mov dword [rbp - 0x30], 0x274d
movzx eax, al
mov qword [rbp - 0x28], r14
add rax, 2
movups xmm0, xmmword [rbp - 0x30]
mov qword [rbp - 0x20], rax
movsd xmm1, qword [rbp - 0x20]
movups xmmword [rbx], xmm0
movsd qword [rbx + 0x10], xmm1
test esi, esi
je 0x1401a3cd2
mov eax, 0xffffffff
jmp 0x1401a3ce9
mov eax, dword [rbp - 0x18]
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbp - 0x20], r15
movsd xmm0, qword [rbp - 0x20]
movsd qword [rbx + 0x10], xmm0
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140382da0
add rsp, 0x70
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x1401a6260
Capabilities:
Set socket configuration

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x1404c39e8]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, r9
mov dword [rsp + 0x28], 1
xor r9d, r9d
mov dword [rsp + 0x20], 0
mov esi, ecx
call qword [sym.imp.WS2_32.dll_WSASocketW]
cmp rax, 0xffffffffffffffff
mov rcx, rbx
mov rdi, rax
sete dl
call fcn.140181890
cmp rdi, 0xffffffffffffffff
jne 0x1401a62b2
mov rax, rdi
jmp 0x1401a62df
cmp esi, 0x17
jne 0x1401a62dc
lea r9, [rsp + 0x30]
mov dword [rsp + 0x30], 0
lea edx, [rsi + 0x12]
mov dword [rsp + 0x20], 4
lea r8d, [rsi + 4]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rax, rdi
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140382da0
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x1401a68b0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
push rdi
sub rsp, 0x58
mov rax, qword [0x1404c39e8]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbx, qword [rsp + 0xa0]
mov r11, r9
mov rax, qword [rcx + 8]
mov r10, r8
mov rdi, rcx
lock inc dword [rax + 0x30]
cmp byte [rsp + 0x98], 0
je 0x1401a6900
mov rcx, qword [rcx + 8]
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
call fcn.140194d80
jmp 0x1401a69b1
mov rcx, qword [rdx]
cmp rcx, 0xffffffffffffffff
jne 0x1401a6923
mov rcx, qword [rdi + 8]
xor r9d, r9d
mov r8d, 0x2719
mov rdx, rbx
call fcn.140194d80
jmp 0x1401a69b1
mov eax, dword [rsp + 0x90]
lea r9, [rsp + 0x40]
xor edx, edx
mov dword [rsp + 0x44], eax
mov qword [rsp + 0x30], rdx
lea rax, [rsp + 0x44]
mov dword [rsp + 0x40], edx
mov r8d, r11d
mov qword [rsp + 0x28], rbx
mov rdx, r10
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x50], rsi
call qword [sym.imp.WS2_32.dll_WSARecv]
mov esi, eax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x40
jne 0x1401a6972
mov eax, 0x2746
jmp 0x1401a697f
cmp eax, 0x4d2
mov ecx, 0x274d
cmove eax, ecx
test esi, esi
mov rsi, qword [rsp + 0x50]
je 0x1401a69a5
cmp eax, 0x3e5
je 0x1401a69a5
mov r9d, dword [rsp + 0x40]
mov r8d, eax
mov rcx, qword [rdi + 8]
mov rdx, rbx
call fcn.140194d80
jmp 0x1401a69b1
mov rcx, qword [rdi + 8]
mov rdx, rbx
call fcn.140195150
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140382da0
add rsp, 0x58
pop rdi
pop rbx
ret
Function at 0x1401a6b70
Capabilities:
Send data
Send data on socket

Disassembly:
push rsi
push rdi
sub rsp, 0x58
mov rax, qword [0x1404c39e8]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rdi, qword [rsp + 0xa0]
mov r11, r9
mov rax, qword [rcx + 8]
mov r10, r8
mov rsi, rcx
lock inc dword [rax + 0x30]
cmp byte [rsp + 0x98], 0
je 0x1401a6bc0
mov rcx, qword [rcx + 8]
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
call fcn.140194d80
jmp 0x1401a6c58
mov rcx, qword [rdx]
cmp rcx, 0xffffffffffffffff
jne 0x1401a6be0
mov rcx, qword [rsi + 8]
xor r9d, r9d
mov r8d, 0x2719
mov rdx, rdi
call fcn.140194d80
jmp 0x1401a6c58
xor eax, eax
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x40]
mov dword [rsp + 0x40], eax
mov r8d, r11d
mov eax, dword [rsp + 0x90]
mov rdx, r10
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], eax
call qword [sym.imp.WS2_32.dll_WSASend]
mov ebx, eax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x4d2
mov ecx, 0x274d
cmove eax, ecx
test ebx, ebx
mov rbx, qword [rsp + 0x50]
je 0x1401a6c4c
cmp eax, 0x3e5
je 0x1401a6c4c
mov r9d, dword [rsp + 0x40]
mov r8d, eax
mov rcx, qword [rsi + 8]
mov rdx, rdi
call fcn.140194d80
jmp 0x1401a6c58
mov rcx, qword [rsi + 8]
mov rdx, rdi
call fcn.140195150
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140382da0
add rsp, 0x58
pop rdi
pop rsi
ret

Function at 0x1401aaf70
Capabilities:
Allocate thread local storage

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x1404c39e8]
xor rax, rsp
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov edi, eax
cmp eax, 0xffffffff
jne 0x1401ab03a
mov qword [rsp + 0x70], rsi
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, qword [0x1404bb158]
lea rsi, [0x1404bb150]
mov ebx, eax
mov dword [rsp + 0x3c], 0
movabs rax, 0x4d54ee85da812030
add rdx, rax
cmp rdx, 1
jbe 0x1401aafe5
mov rcx, qword [0x1404bb150]
mov edx, ebx
mov r8, qword [rcx + 0x30]
mov rcx, rsi
call r8
jmp 0x1401aafea
test ebx, ebx
setne al
lea rcx, str.C:_vcpkg_masterinstalledx64_windows_staticinclude_boost_asiodetailimplwin_tss_ptr.ipp
movzx eax, al
add rax, 2
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x40], rsi
lea rcx, str.win_tss_ptr_create
mov rsi, qword [rsp + 0x70]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], gethostbyname
mov dword [rsp + 0x34], 0x1a
test al, 1
je 0x1401ab03a
cmp rax, 1
jne 0x1401ab054
test ebx, ebx
jne 0x1401ab054
mov eax, edi
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140382da0
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
lea r8, [rsp + 0x20]
lea rdx, [0x1403c51dc]
lea rcx, [rsp + 0x38]
call fcn.1401800f0
int3
Function at 0x1401ae5b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x30
movsxd rdi, dword [rsp + 0x80]
xor ebp, ebp
mov qword [rsp + 0x28], rcx
mov r11d, ebp
mov qword [rsp + 0x28], rdx
mov r10d, ebp
mov qword [rsp + 0x28], r8
mov rsi, r8
mov rbx, rdx
movsxd r14, r9d
mov r15, rcx
nop dword [rax + rax]
mov r9, rbp
test rdi, rdi
jle 0x1401ae626
lea rax, [r14 + r14*2]
shl rax, 5
mov rcx, qword [rbx]
lea rax, [rax + 0x18]
mov rdx, qword [rcx + r10]
mov rcx, qword [rsi]
lea r8, [rdx + r9*4]
inc r9
mov rdx, qword [rcx + rax - 0x18]
mov ecx, dword [rdx + r11]
xor dword [r8], ecx
cmp r9, rdi
jl 0x1401ae600
add r10, 0x18
add r11, 4
cmp r10, 0x60
jl 0x1401ae5f0
mov r9, qword [rbx + 0x10]
mov rcx, rbx
mov qword [rbx + 0x10], rbp
mov r8, qword [rbx + 8]
mov qword [rbx + 8], rbp
mov rdx, qword [rbx]
mov qword [rbx], rbp
mov qword [r15], rdx
mov qword [r15 + 8], r8
mov qword [r15 + 0x10], r9
call fcn.1401ae520
mov rcx, rsi
call fcn.1401ae520
mov rbx, qword [rsp + 0x78]
mov rax, r15
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1401b2c00
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov ebp, r8d
mov rbx, rdx
mov qword [rsp + 0x40], rdx
xor r12d, r12d
mov ecx, dword [0x1404df3d8]
mov rax, qword gs:[0x58]
mov r14, qword [rax + rcx*8]
mov eax, 0x13a8
mov eax, dword [rax + r14]
cmp dword [0x1404dc928], eax
jg 0x1401b2de8
mov r15d, 0x1398
mov eax, dword [r15 + r14]
mov r13d, reloc.WS2_32.dll_recv
test al, 1
jne 0x1401b2cb8
or eax, 1
mov dword [r15 + r14], eax
mov edi, r13d
add rdi, r14
call fcn.14037f6b4
mov ecx, eax
mov dword [rdi + 0x1384], 0xffffffff
mov dword [rdi + 4], eax
mov edx, 1
lea r8, [rdi + 8]
nop dword [rax + rax]
mov eax, ecx
shr eax, 0x1e
xor eax, ecx
imul ecx, eax, 0x6c078965
add ecx, edx
mov dword [r8], ecx
inc rdx
lea r8, [r8 + 4]
cmp rdx, 0x270
jb 0x1401b2c90
mov dword [rdi], 0x270
mov eax, dword [r15 + r14]
mov esi, 0x13a0
test al, 2
jne 0x1401b2cdd
or eax, 2
mov dword [r15 + r14], eax
mov dword [rsi + r14], r12d
mov eax, dword [0x1404bbf28]
dec eax
mov dword [rsi + r14 + 4], eax
mov eax, 0x20
test ebp, ebp
cmovne eax, ebp
movsxd rdx, eax
xor r8d, r8d
mov rcx, rbx
call fcn.14012c030
mov rcx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x1401b2d07
mov rcx, qword [rbx]
mov rdx, rcx
jmp 0x1401b2d0a
mov rdx, rbx
mov rdi, rcx
mov rbp, qword [rbx + 0x10]
add rbp, rdx
cmp rcx, rbp
je 0x1401b2dcd
lea r15, [r14 + rsi]
mov eax, r13d
add r14, rax
mov r12d, 0x80000000
lea r13, [0x1404bbf18]
mov edx, dword [r15 + 4]
mov ecx, dword [r15]
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x30], 0x20
mov dword [rsp + 0x38], 0xffffffff
lea eax, [rcx - 0x80000000]
lea esi, [rcx + r12]
cmp ecx, r12d
cmovae esi, eax
lea eax, [rdx - 0x80000000]
lea ecx, [rdx + r12]
cmp edx, r12d
cmovae ecx, eax
sub ecx, esi
cmp ecx, 0xffffffff
jne 0x1401b2d84
lea rcx, [rsp + 0x28]
call fcn.1401353a0
jmp 0x1401b2d91
lea edx, [rcx + 1]
lea rcx, [rsp + 0x28]
call fcn.140134650
lea ecx, [rsi + rax]
lea eax, [rcx - 0x80000000]
lea r8d, [rcx + r12]
cmp ecx, r12d
cmovae r8d, eax
mov rdx, r13
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
cmovae rdx, qword [0x1404bbf18]
movsxd rcx, r8d
movzx edx, byte [rcx + rdx]
mov byte [rdi], dl
inc rdi
cmp rdi, rbp
jne 0x1401b2d34
mov rax, rbx
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rcx, [0x1404dc928]
call fcn.140382f50
cmp dword [0x1404dc928], 0xffffffff
jne 0x1401b2c4a
mov edx, gethostbyname
lea rcx, [0x1404bbf18]
call fcn.140129fc0
mov rdx, rax
mov qword [0x1404bbf18], rax
mov qword [0x1404bbf28], 0x2a
mov qword [reloc.WS2_32.dll_ntohs], 0x2f
movups xmm0, xmmword [str.ABCDFGHJKLMNPQRSTVWXZabcdfghjklmnpqrstvwxz]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x1403c19c8]
movups xmmword [rax + 0x10], xmm1
movsd xmm0, qword [0x1403c19d8]
movsd qword [rax + 0x20], xmm0
movzx eax, word [0x1403c19e0]
mov word [rdx + 0x28], ax
mov byte [rdx + 0x2a], 0
lea rcx, [0x1403bf010]
call fcn.1403829b4
nop
lea rcx, [0x1404dc928]
call fcn.140382ef0
jmp 0x1401b2c4a
Function at 0x1401ff170
Capabilities:
Set thread local storage value

Disassembly:
mov eax, 0x28
call fcn.1403831c0
sub rsp, rax
mov ecx, dword [rcx]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
add rsp, 0x28
ret

Function at 0x140203f90
Capabilities:
Encode data using add xor sub operations

Disassembly:
xor eax, eax
mov r10, rcx
test rcx, rcx
je 0x140203ffc
movzx ecx, byte [rcx]
test cl, cl
je 0x140203ffc
mov r11d, 0x100
nop word [rax + rax]
movsx r9d, cl
lea r10, [r10 + 1]
or r9d, r11d
mov r8d, eax
mov edx, r9d
mov ecx, 0x20
shr edx, 2
add r11d, 0x100
xor edx, r9d
imul r9d, r9d
and edx, 0xf
sub ecx, edx
shr r8, cl
mov ecx, edx
mov edx, eax
mov eax, r8d
shl edx, cl
movzx ecx, byte [r10]
or eax, edx
xor eax, r9d
test cl, cl
jne 0x140203fb0
mov ecx, eax
shr ecx, 0x10
xor eax, ecx
ret

Function at 0x140204000
Capabilities:
Encode data using add xor sub operations

Disassembly:
xor eax, eax
mov r10, rcx
test rcx, rcx
je 0x140204070
movzx ecx, byte [rcx]
test cl, cl
je 0x140204070
mov r11d, 0x100
nop word [rax + rax]
movsx r9d, cl
lea r10, [r10 + 1]
mov r8d, eax
and r9d, 0xffffffdf
or r9d, r11d
mov ecx, 0x20
mov edx, r9d
add r11d, 0x100
shr edx, 2
xor edx, r9d
imul r9d, r9d
and edx, 0xf
sub ecx, edx
shr r8, cl
mov ecx, edx
mov edx, eax
mov eax, r8d
shl edx, cl
movzx ecx, byte [r10]
or eax, edx
xor eax, r9d
test cl, cl
jne 0x140204020
mov ecx, eax
shr ecx, 0x10
xor eax, ecx
ret

Function at 0x140219430
Capabilities:
Get thread local storage value

Disassembly:
mov eax, 0x28
call fcn.1403831c0
sub rsp, rax
lea rcx, [0x1404dcb30]
add rsp, 0x28
jmp fcn.1401feff0
Function at 0x140230060
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
lea rsi, [rcx - 1]
movsxd rdi, r9d
not rcx
shr rsi, 0x3f
shr rcx, 0x3f
mov r11, rdx
and rsi, rcx
mov r10, r8
mov ecx, dword [rdx + 8]
dec rsi
xor ecx, dword [r8 + 8]
and ecx, esi
xor dword [rdx + 8], ecx
xor dword [r8 + 8], ecx
movq xmm4, rsi
mov ecx, dword [rdx + 0x10]
xor ecx, dword [r8 + 0x10]
and ecx, esi
punpcklqdq xmm4, xmm4
xor dword [rdx + 0x10], ecx
xor dword [r8 + 0x10], ecx
mov edx, dword [rdx + 0x14]
mov ecx, edx
mov eax, dword [r8 + 0x14]
xor rcx, rax
and ecx, 4
and rcx, rsi
mov eax, ecx
xor eax, edx
mov dword [r11 + 0x14], eax
xor dword [r8 + 0x14], ecx
xor ecx, ecx
mov edx, ecx
test r9d, r9d
jle 0x14023017d
cmp edi, 2
jb 0x14023017d
mov r9, qword [r8]
lea rax, [rdi - 1]
mov r8, qword [r11]
lea rbx, [rdi - 1]
lea rbx, [r9 + rbx*8]
lea rax, [r8 + rax*8]
cmp r9, rax
ja 0x14023010a
cmp rbx, r8
jae 0x14023017d
cmp r9, r10
ja 0x140230114
cmp rbx, r10
jae 0x14023017d
cmp r9, r11
ja 0x14023011e
cmp rbx, r11
jae 0x14023017d
cmp r8, r10
ja 0x140230128
cmp rax, r10
jae 0x14023017d
cmp r8, r11
ja 0x140230132
cmp rax, r11
jae 0x14023017d
mov eax, edi
and eax, 0xfffffffe
nop word [rax + rax]
movdqu xmm2, xmmword [rcx + r9]
add edx, 2
movdqu xmm1, xmmword [rcx + r8]
lea rcx, [rcx + 0x10]
movdqa xmm3, xmm2
pxor xmm3, xmm1
pand xmm3, xmm4
movdqa xmm0, xmm3
pxor xmm3, xmm2
pxor xmm0, xmm1
movdqu xmmword [rcx + r8 - 0x10], xmm0
movdqu xmmword [rcx + r9 - 0x10], xmm3
cmp edx, eax
jl 0x140230140
movsxd rax, edx
cmp rax, rdi
jge 0x1402301bd
nop word [rax + rax]
mov rcx, qword [r11]
mov rdx, qword [rcx + rax*8]
lea r8, [rcx + rax*8]
mov rcx, qword [r10]
mov r9, rdx
xor r9, qword [rcx + rax*8]
and r9, rsi
xor rdx, r9
mov qword [r8], rdx
mov rcx, qword [r10]
xor qword [rcx + rax*8], r9
inc rax
cmp rax, rdi
jl 0x140230190
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
Function at 0x1402485e0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
mov eax, 0x280
call fcn.1403831c0
sub rsp, rax
mov rax, qword [0x1404c39e8]
xor rax, rsp
mov qword [rsp + 0x270], rax
cmp dword [0x1404dce28], 0
lea rax, [0x140247f60]
mov qword [rsp + 0x28], rax
lea rbx, [0x1403fabc0]
lea rax, str.getnameinfo
movzx ebp, cx
mov qword [rsp + 0x30], rax
lea rax, [0x1402483a0]
mov qword [rsp + 0x38], rax
lea rax, [0x1403fabe0]
mov qword [rsp + 0x40], rax
lea rax, [0x140247f00]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x20], rbx
jne 0x1402487b9
mov edx, 0x104
lea rcx, [rsp + 0x160]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x1402487af
lea r8, [rsp + 0x160]
mov qword [rsp + 0x290], rsi
mov edx, 0x10c
lea rcx, [rsp + 0x50]
call fcn.14039e528
lea r8, str.ws2_32
mov edx, 0x10c
lea rcx, [rsp + 0x50]
call fcn.14039e588
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x1402486da
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x14024873a
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea r8, [rsp + 0x160]
mov edx, 0x10c
lea rcx, [rsp + 0x50]
call fcn.14039e528
lea r8, str.wship6
mov edx, 0x10c
lea rcx, [rsp + 0x50]
call fcn.14039e588
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x1402487a7
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x14024873a
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x1402487a7
mov qword [rsp + 0x298], rdi
lea rbx, [rsp + 0x28]
xor edi, edi
nop dword [rax]
mov rdx, qword [rbx - 8]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx], rax
test rax, rax
je 0x140248796
inc edi
add rbx, 0x10
cmp edi, 3
jl 0x140248750
mov rax, qword [rsp + 0x28]
mov qword [0x1404c02b0], rax
mov rax, qword [rsp + 0x38]
mov qword [0x1404c02c0], rax
mov rax, qword [rsp + 0x48]
mov qword [0x1404c02d0], rax
jmp 0x14024879f
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rdi, qword [rsp + 0x298]
mov rsi, qword [rsp + 0x290]
mov dword [0x1404dce28], 1
mov rax, rbp
lea rcx, [0x1404c02a8]
add rax, rax
mov rax, qword [rcx + rax*8 + 8]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140382da0
mov rbx, qword [rsp + 0x2a0]
add rsp, 0x280
pop rbp
ret
Function at 0x1402487f0
Capabilities:
Resolve dns

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x870
call fcn.1403831c0
sub rsp, rax
mov rax, qword [0x1404c39e8]
xor rax, rsp
mov qword [rsp + 0x860], rax
mov r13, qword [rsp + 0x8c8]
mov r14, rcx
mov dword [rsp + 0x24], r8d
xor ebp, ebp
mov dword [rsp + 0x28], edx
mov r8d, 0x401
mov qword [rsp + 0x38], rcx
xor edx, edx
lea rcx, [rsp + 0x40]
mov word [rsp + 0x20], r9w
mov r12d, ebp
call fcn.1403850b0
xor edx, edx
lea rcx, [rsp + 0x450]
mov r8d, 0x401
call fcn.1403850b0
mov r9d, 0x400
lea rbx, [rsp + 0x40]
mov r8, r14
mov qword [rsp + 0x30], rbx
lea rcx, [rsp + 0x40]
lea rdi, [rsp + 0x450]
lea edx, [r9 + 1]
call fcn.14039e5f4
lea r15, [rbp - 1]
nop
mov rcx, r14
mov qword [r13], rbp
mov rsi, r13
mov byte [rdi], bpl
call qword [sym.imp.WS2_32.dll_gethostbyname]
mov r14, rax
test rax, rax
je 0x1402489ee
cmp word [rax + 0x10], 2
jne 0x140248917
cmp word [rax + 0x12], 4
jne 0x140248917
mov rbx, qword [rax + 0x18]
mov rax, qword [rbx]
test rax, rax
je 0x140248912
nop dword [rax]
mov r9d, dword [rax]
movzx r8d, word [rsp + 0x20]
mov edx, dword [rsp + 0x24]
mov ecx, dword [rsp + 0x28]
call fcn.140248a50
mov qword [rsi], rax
test rax, rax
je 0x1402489e7
add rbx, 8
lea rsi, [rax + 0x28]
mov rax, qword [rbx]
test rax, rax
jne 0x1402488e0
mov rbx, qword [rsp + 0x30]
mov r8, qword [r14]
mov r9d, 0x400
mov rcx, rdi
lea edx, [r9 + 1]
call fcn.14039e5f4
cmp qword [r13], rbp
jne 0x140248990
mov rax, r15
inc rax
cmp byte [rdi + rax], bpl
jne 0x140248935
test rax, rax
je 0x140248a08
mov r8, rdi
mov rax, rbx
sub r8, rbx
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140248963
inc rax
test ecx, ecx
jne 0x140248950
test edx, edx
je 0x140248a08
inc r12d
cmp r12d, 0x10
je 0x140248a08
mov r14, qword [rsp + 0x38]
mov rax, rbx
mov rbx, rdi
mov rdi, rax
mov qword [rsp + 0x30], rbx
jmp 0x1402488a0
cmp dword [rsp + 0x8c0], ebp
je 0x140248a1b
nop dword [rax]
cmp byte [rdi + r15 + 1], bpl
lea r15, [r15 + 1]
jne 0x1402489a0
lea rdx, [r15 + 1]
mov ecx, 1
call fcn.140390df8
mov rbx, rax
test rax, rax
jne 0x1402489c6
mov rbx, rbp
jmp 0x1402489d5
mov r8, rdi
lea rdx, [r15 + 1]
mov rcx, rax
call fcn.14039e528
mov rax, qword [r13]
mov qword [rax + 0x18], rbx
mov rax, qword [r13]
cmp qword [rax + 0x18], rbp
jne 0x140248a1b
mov ebp, 8
jmp 0x140248a1b
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
sub ecx, 0x2af9
je 0x140248a16
sub ecx, 1
je 0x140248a0f
sub ecx, 1
jne 0x140248a16
mov ebp, 0x2afb
jmp 0x140248a1b
mov ebp, 0x2afa
jmp 0x140248a1b
mov ebp, 0x2af9
mov eax, ebp
mov rcx, qword [rsp + 0x860]
xor rcx, rsp
call fcn.140382da0
lea r11, [rsp + 0x870]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret