joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14005c760
Capabilities:
Set socket configuration

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
add rsp, 0xffffffffffffff80
mov rsi, rcx
mov rdi, rdx
mov rbx, r9
cmp rcx, 0xffffffffffffffff
je 0x14005c7af
test r8b, r8b
je 0x14005c789
movzx eax, byte [rdx]
test al, 8
jne 0x14005c848
mov rbp, qword [sym.imp.WS2_32.dll_closesocket]
mov rcx, rsi
call rbp
test eax, eax
jne 0x14005c7c0
mov dword [rbx], 0
mov qword [rbx + 8], 0
mov qword [rbx + 0x10], 0
sub rsp, 0xffffffffffffff80
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rcx, rbx
lea r12, [rsp + 0x60]
call fcn.140059940
mov edx, 0x2733
mov rcx, r12
call fcn.140416590
mov rdx, r12
mov rcx, rbx
call fcn.140477f40
test al, al
jne 0x14005c80a
lea r12, [rsp + 0x40]
mov edx, 0x4d5
mov rcx, r12
call fcn.140416590
mov rdx, r12
mov rcx, rbx
call fcn.140477f40
test al, al
je 0x14005c7af
mov rcx, rsi
lea r8, [rsp + 0x3c]
mov edx, 0x8004667e
mov dword [rsp + 0x3c], 0
call qword [sym.imp.WS2_32.dll_ioctlsocket]
and byte [rdi], 0xfc
mov rcx, rsi
call rbp
test eax, eax
je 0x14005c799
mov rcx, rbx
call fcn.140059940
jmp 0x14005c7af
or eax, 8
mov dword [rsp + 0x40], 0
lea r9, [rsp + 0x40]
mov r8d, pe_nt_image_headers64
mov byte [rdx], al
mov edx, 0xffff
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x14005c789
lea rcx, [rsp + 0x60]
call fcn.140059940
jmp 0x14005c789

Function at 0x14006c4f0
Capabilities:
Initialize winsock library

Disassembly:
push rbx
sub rsp, 0x1c0
shl r8d, 8
movzx edx, dl
lea rax, [rsp + 0x20]
mov rbx, rcx
or r8d, edx
mov rdx, rax
movzx ecx, r8w
call qword [sym.imp.WS2_32.dll_WSAStartup]
xchg dword [rbx + 4], eax
add rsp, 0x1c0
pop rbx
ret
Function at 0x1400714e0
Capabilities:
Initialize winsock library

Disassembly:
push rbx
sub rsp, 0x1c0
shl r8d, 8
movzx edx, dl
lea rax, [rsp + 0x20]
mov rbx, rcx
or r8d, edx
mov rdx, rax
movzx ecx, r8w
call qword [sym.imp.WS2_32.dll_WSAStartup]
xchg dword [rbx + 4], eax
add rsp, 0x1c0
pop rbx
ret
Function at 0x140074ce0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 0x9f8
mov r11d, 2
movabs r8, 0x5851f42d4c957f2d
mov rax, rcx
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x20]
mov rdx, rax
shr rdx, 0x3e
xor rdx, rax
imul rdx, r8
add rdx, 1
mov qword [rcx + 8], rdx
nop word [rax + rax]
mov r9, rdx
lea r10, [r11 + 1]
lea rax, [r11 + 2]
shr r9, 0x3e
xor r9, rdx
imul r9, r8
add r9, r11
mov rdx, r9
mov qword [rcx + r11*8], r9
shr rdx, 0x3e
xor rdx, r9
imul rdx, r8
add rdx, r10
mov r9, rdx
mov qword [rcx + r10*8], rdx
lea r10, [r11 + 3]
shr r9, 0x3e
xor r9, rdx
imul r9, r8
add r9, rax
mov rdx, r9
mov qword [rcx + rax*8], r9
lea rax, [r11 + 4]
shr rdx, 0x3e
xor rdx, r9
imul rdx, r8
add rdx, r10
mov r9, rdx
mov qword [rcx + r10*8], rdx
lea r10, [r11 + 5]
shr r9, 0x3e
xor r9, rdx
imul r9, r8
add r9, rax
mov rdx, r9
mov qword [rcx + rax*8], r9
lea rax, [r11 + 6]
shr rdx, 0x3e
xor rdx, r9
imul rdx, r8
add rdx, r10
mov r9, rdx
mov qword [rcx + r10*8], rdx
lea r10, [r11 + 7]
shr r9, 0x3e
xor r9, rdx
imul r9, r8
add r9, rax
mov rdx, r9
mov qword [rcx + rax*8], r9
lea rax, [r11 + 8]
shr rdx, 0x3e
xor rdx, r9
imul rdx, r8
add rdx, r10
mov r9, rdx
mov qword [rcx + r10*8], rdx
lea r10, [r11 + 9]
shr r9, 0x3e
add r11, 0xa
xor r9, rdx
imul r9, r8
add r9, rax
mov rdx, r9
mov qword [rcx + rax*8], r9
shr rdx, 0x3e
xor rdx, r9
imul rdx, r8
add rdx, r10
mov qword [rcx + r10*8], rdx
cmp r11, 0x138
jne 0x140074d20
mov qword [rsp + 0x9e0], 0x138
call fcn.14050f430
mov rcx, qword [rsp + 0x9e0]
movabs r11, 0x5555555555555555
movabs r10, 0x71d67fffeda60000
mov rax, qword [rsp + rcx*8 + 0x20]
movabs rcx, 0xfff7eee000000000
mov r8, rax
shr r8, 0x1d
and r8, r11
xor rax, r8
mov r9, rax
shl r9, 0x11
and r9, r10
xor rax, r9
mov rdx, rax
shl rdx, 0x25
and rdx, rcx
xor rax, rdx
mov r8, rax
shr r8, 0x2b
xor rax, r8
add rsp, 0x9f8
ret
Function at 0x140075630
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 0x9f8
call fcn.140510630
lea rcx, [rsp + 0x20]
movabs r8, 0x5851f42d4c957f2d
mov rdx, rax
mov qword [rsp + 0x20], rax
shr rdx, 0x3e
xor rdx, rax
mov eax, 2
imul rdx, r8
add rdx, 1
mov qword [rcx + 8], rdx
nop dword [rax + rax]
mov r9, rdx
lea r10, [rax + 1]
lea r11, [rax + 2]
shr r9, 0x3e
xor r9, rdx
imul r9, r8
add r9, rax
mov rdx, r9
mov qword [rcx + rax*8], r9
shr rdx, 0x3e
xor rdx, r9
imul rdx, r8
add rdx, r10
mov r9, rdx
mov qword [rcx + r10*8], rdx
lea r10, [rax + 3]
shr r9, 0x3e
xor r9, rdx
imul r9, r8
add r9, r11
mov rdx, r9
mov qword [rcx + r11*8], r9
lea r11, [rax + 4]
shr rdx, 0x3e
xor rdx, r9
imul rdx, r8
add rdx, r10
mov r9, rdx
mov qword [rcx + r10*8], rdx
lea r10, [rax + 5]
shr r9, 0x3e
xor r9, rdx
imul r9, r8
add r9, r11
mov rdx, r9
mov qword [rcx + r11*8], r9
lea r11, [rax + 6]
shr rdx, 0x3e
xor rdx, r9
imul rdx, r8
add rdx, r10
mov r9, rdx
mov qword [rcx + r10*8], rdx
lea r10, [rax + 7]
shr r9, 0x3e
xor r9, rdx
imul r9, r8
add r9, r11
mov rdx, r9
mov qword [rcx + r11*8], r9
lea r11, [rax + 8]
shr rdx, 0x3e
xor rdx, r9
imul rdx, r8
add rdx, r10
mov r9, rdx
mov qword [rcx + r10*8], rdx
lea r10, [rax + 9]
shr r9, 0x3e
add rax, 0xa
xor r9, rdx
imul r9, r8
add r9, r11
mov rdx, r9
mov qword [rcx + r11*8], r9
shr rdx, 0x3e
xor rdx, r9
imul rdx, r8
add rdx, r10
mov qword [rcx + r10*8], rdx
cmp rax, 0x138
jne 0x140075670
mov qword [rsp + 0x9e0], 0x138
call fcn.14050f430
mov rcx, qword [rsp + 0x9e0]
movabs r11, 0x5555555555555555
movabs r10, 0x71d67fffeda60000
mov rax, qword [rsp + rcx*8 + 0x20]
movabs rcx, 0xfff7eee000000000
mov r8, rax
shr r8, 0x1d
and r8, r11
xor rax, r8
mov r9, rax
shl r9, 0x11
and r9, r10
xor rax, r9
mov rdx, rax
shl rdx, 0x25
and rdx, rcx
xor rax, rdx
mov r8, rax
shr r8, 0x2b
xor rax, r8
add rsp, 0x9f8
ret
Function at 0x14007cbe0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rax, qword [rcx + 0x10]
mov rbp, qword [rax + 8]
mov rdi, rcx
mov r12, rdx
cmp rdx, 0x7ffffffe
ja 0x14007cd99
mov eax, dword [rax + 4]
mov edx, 0x7ffffffe
mov rcx, rax
shr rcx, 1
sub rdx, rcx
cmp rax, rdx
ja 0x14007cc25
add rax, rcx
cmp r12, rax
cmovb r12, rax
mov rax, qword [rdi]
mov rcx, rax
and rcx, 0xfffffffffffffffc
test rax, rax
lea rax, [0x140548480]
cmove rcx, rax
lea rax, [r12 + r12*4]
cmp r12, 0x12
jbe 0x14007ccb8
lea rax, [r12 + rax*2]
mov r8d, 0x10
lea rdx, [rax*4 + 0x10]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov edx, 0xff
mov dword [rax + 4], r12d
mov r12d, r12d
mov rsi, rax
lea r8, [r12*4]
add r12, r8
lea rcx, [rax + r12*8 + 0x10]
call sub.msvcrt.dll_memset
mov ebx, dword [rsi + 4]
mov r12, qword [rdi + 0x10]
test rbp, rbp
cmove rbp, rsi
mov eax, dword [r12]
mov qword [rsi + 8], rbp
test eax, eax
jne 0x14007ccd8
mov dword [rsi], 0
mov qword [rdi + 0x10], rsi
mov rax, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
lea rdx, [rax*8 + 0x10]
mov rax, qword [rcx]
mov r8d, 0x10
mov ebx, r12d
call qword [rax + 0x10]
mov dword [rax + 4], r12d
mov rsi, rax
jmp 0x14007cc86
lea r8, [rax + rax*4]
lea rdx, [r12 + 0x10]
lea rcx, [rsi + 0x10]
shl r8, 3
call sub.msvcrt.dll_memcpy
mov r12, qword [rdi + 0x10]
mov eax, dword [r12]
mov dword [rsi], eax
mov qword [rdi + 0x10], rsi
cmp ebx, 0x12
jbe 0x14007cca7
mov edx, eax
lea r11d, [rax - 1]
lea rdx, [rdx + rdx*4]
lea r10, [rsi + rdx*8 + 0x10]
test eax, eax
je 0x14007cca7
movabs rdi, 0xcbf29ce484222325
movabs r9, 0x100000001b3
add rdi, rbp
nop dword [rax + rax]
mov rcx, qword [r10 - 0x10]
mov r8d, dword [r10 - 8]
sub r10, 0x28
mov rax, rdi
add r8, rcx
cmp rcx, r8
je 0x14007cd64
nop word [rax + rax]
movsx rdx, byte [rcx]
add rcx, 1
xor rax, rdx
imul rax, r9
cmp r8, rcx
jne 0x14007cd50
xor edx, edx
lea rcx, [rbx + rbx*4]
div rbx
lea rax, [rdx*4]
lea rax, [rax + rcx*8 + 0x10]
add rax, rsi
mov edx, dword [rax]
mov dword [r10 + 0x24], edx
mov dword [rax], r11d
sub r11d, 1
cmp r11d, 0xffffffff
je 0x14007cca7
mov ebx, dword [rsi + 4]
jmp 0x14007cd30
lea rdx, str._aV_
mov ecx, 0xa
call fcn.14007cb00
nop
nop
nop dword [rax]
push r13
push r12
sub rsp, 0x28
mov rax, qword [r8]
mov qword [rcx], rax
lea rax, [0x1406a3a40]
mov r12, rcx
mov qword [rcx + 0x10], rax
mov eax, dword [0x1406a3a44]
mov qword [r8], 0
mov byte [rcx + 8], 7
cmp rdx, rax
ja 0x14007cdf0
add rsp, 0x28
pop r12
pop r13
ret
call fcn.14007cbe0
mov r8d, dword [rax + 4]
mov rdx, rax
test r8d, r8d
je 0x14007cde2
mov rax, qword [r12]
mov rcx, rax
and rcx, 0xfffffffffffffffc
test rax, rax
lea rax, [0x140548480]
cmove rcx, rax
cmp r8d, 0x12
jbe 0x14007ce50
lea rax, [r8 + r8*4]
mov r9d, 0x10
lea r8, [r8 + rax*2]
mov rax, qword [rcx]
lea r8, [r8*4 + 0x10]
call qword [rax + 0x18]
nop
add rsp, 0x28
pop r12
pop r13
ret
mov rax, qword [rcx]
lea r8, [r8 + r8*4]
mov r9d, 0x10
lea r8, [r8*8 + 0x10]
call qword [rax + 0x18]
nop
add rsp, 0x28
pop r12
pop r13
ret
Function at 0x140082570
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov r10d, dword [0x1406a3a44]
mov rax, qword [r8]
mov rbx, qword [rdx + 0x10]
mov qword [r8], 0
lea r8, [0x1406a3a40]
mov rsi, rdx
mov r12, rcx
mov qword [rcx], rax
mov edx, dword [rbx]
mov byte [rcx + 8], 7
mov qword [rcx + 0x10], r8
cmp r10d, dword [rbx]
jb 0x140082778
lea rax, [rdx + rdx*4]
lea rdi, [rbx + rax*8 + 0x10]
add rbx, 0x10
cmp r10d, 0x12
ja 0x140082670
cmp rdi, rbx
je 0x140082638
lea r13, [rsp + 0x28]
jmp 0x140082613
mov eax, dword [r8]
mov rdx, rbx
lea rax, [rax + rax*4]
lea rcx, [r8 + rax*8 + 0x10]
mov r8, r13
call fcn.140082490
mov rcx, qword [rsp + 0x28]
test cl, 1
jne 0x140082650
mov r8, qword [r12 + 0x10]
add rbx, 0x28
add dword [r8], 1
cmp rdi, rbx
je 0x140082638
mov rax, qword [r12]
mov qword [rsp + 0x28], rax
test al, 1
je 0x1400825e0
and rax, 0xfffffffffffffffc
lock add qword [rax + 8], 1
mov r8, qword [r12 + 0x10]
jmp 0x1400825e0
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
and rcx, 0xfffffffffffffffc
lock sub qword [rcx + 8], 1
jne 0x140082601
test rcx, rcx
je 0x140082601
mov rax, qword [rcx]
call qword [rax + 8]
jmp 0x140082601
cmp rdi, rbx
je 0x140082638
movabs rbp, 0xcbf29ce484222325
lea r13, [rsp + 0x28]
movabs rsi, 0x100000001b3
nop
mov rcx, qword [rbx + 0x18]
mov r9d, dword [rbx + 0x20]
mov rax, qword [r8 + 8]
add r9, rcx
add rax, rbp
cmp rcx, r9
je 0x1400826c4
nop word [rax + rax]
movsx rdx, byte [rcx]
add rcx, 1
xor rax, rdx
imul rax, rsi
cmp r9, rcx
jne 0x1400826b0
mov ecx, r10d
xor edx, edx
div rcx
lea r9, [rcx + rcx*4]
lea rax, [rdx*4]
lea r14, [rax + r9*8 + 0x10]
mov rax, qword [r12]
add r14, r8
mov qword [rsp + 0x28], rax
test al, 1
jne 0x140082740
mov eax, dword [r8]
mov rdx, rbx
lea rax, [rax + rax*4]
lea r15, [r8 + rax*8 + 0x10]
mov r8, r13
mov rcx, r15
call fcn.140082490
mov rcx, qword [rsp + 0x28]
test cl, 1
jne 0x140082758
mov eax, dword [r14]
mov r8, qword [r12 + 0x10]
add rbx, 0x28
mov dword [r15 + 0x24], eax
mov eax, dword [r8]
mov dword [r14], eax
add eax, 1
mov dword [r8], eax
cmp rbx, rdi
je 0x140082638
mov r10d, dword [r8 + 4]
jmp 0x140082690
and rax, 0xfffffffffffffffc
lock add qword [rax + 8], 1
mov r8, qword [r12 + 0x10]
jmp 0x1400826ed
and rcx, 0xfffffffffffffffc
lock sub qword [rcx + 8], 1
jne 0x140082711
test rcx, rcx
je 0x140082711
mov rax, qword [rcx]
call qword [rax + 8]
jmp 0x140082711
call fcn.14007cbe0
mov edx, dword [rax + 4]
mov r10, rax
test edx, edx
je 0x1400827c0
mov rax, qword [r12]
mov rcx, rax
and rcx, 0xfffffffffffffffc
test rax, rax
lea rax, [0x140548480]
cmove rcx, rax
cmp edx, 0x12
ja 0x1400827d4
lea rdx, [rdx + rdx*4]
mov rax, qword [rcx]
mov r9d, 0x10
lea r8, [rdx*8 + 0x10]
mov rdx, r10
call qword [rax + 0x18]
mov r8, qword [r12 + 0x10]
mov rbx, qword [rsi + 0x10]
mov r10d, dword [r8 + 4]
mov edx, dword [rbx]
jmp 0x1400825b8
lea rax, [rdx + rdx*4]
mov r9d, 0x10
lea rdx, [rdx + rax*2]
mov rax, qword [rcx]
lea r8, [rdx*4 + 0x10]
jmp 0x1400827ba
Function at 0x14008b6f0
Capabilities:
Create thread
Resume thread

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
lea r8, [0x14008ae00]
xor edx, edx
mov r9, qword [rcx]
lea rax, [r9 + 0x20]
mov qword [rsp + 0x28], rax
mov rbx, rcx
xor ecx, ecx
mov dword [rsp + 0x20], 4
call qword [sym.imp.msvcrt.dll__beginthreadex]
mov rsi, rax
xor eax, eax
test rsi, rsi
jne 0x14008b738
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret
mov rax, qword [rbx]
lock add dword [rax + 8], 1
mov rdi, qword [rbx]
mov rcx, qword [rdi + 0x10]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14008b757
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi + 0x10], rsi
mov rax, qword [rbx]
mov rcx, qword [rax + 0x10]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, 1
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret
Function at 0x140093180
Capabilities:
Set thread local storage value

Disassembly:
mov rdx, rcx
cmp rcx, 0xffffffffffffffff
je 0x140093198
lea rcx, [0x1406a3bdc]
jmp fcn.1400981b0
ret
Function at 0x140098150
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [rbx], eax
setne al
movzx eax, al
add rsp, 0x20
pop rbx
ret

Function at 0x140098170
Capabilities:
Get thread local storage value

Disassembly:
push r13
push r12
sub rsp, 0x28
mov r12, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [r12]
mov r13d, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, r13d
mov r12, rax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, r12
add rsp, 0x28
pop r12
pop r13
ret

Function at 0x1400981b0
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [rcx]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
setne al
movzx eax, al
add rsp, 0x28
ret
Function at 0x1400a0270
Capabilities:
Generate random numbers via winapi

Disassembly:
push r13
push r12
push rbx
sub rsp, 0x50
mov edx, 1
mov r12, rcx
call fcn.14009cd30
mov rcx, r12
mov rdx, rax
mov r13, rax
call fcn.14009d240
mov rbx, rax
test rax, rax
je 0x1400a02f0
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x48]
mov r9d, 1
mov dword [rsp + 0x20], 0xf0000040
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x1400a0370
xor r8d, r8d
xor r13d, r13d
mov rcx, r12
mov rdx, r13
call fcn.14009d450
mov rcx, r12
call fcn.14009cce0
test rax, rax
je 0x1400a02f0
add rsp, 0x50
pop rbx
pop r12
pop r13
ret
mov edx, 1
mov rcx, r12
call fcn.14009cd30
mov rcx, r12
mov rdx, rax
mov r13, rax
call fcn.14009d240
mov rbx, rax
test rax, rax
je 0x1400a035b
xor edx, edx
mov dword [rsp + 0x20], 0xf0000040
lea rcx, [rsp + 0x48]
mov r9d, 0x16
lea r8, str.Intel_Hardware_Cryptographic_Service_Provider
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x1400a03c0
xor r8d, r8d
xor r13d, r13d
mov rcx, r12
mov rdx, r13
call fcn.14009d450
mov rcx, r12
call fcn.14009cce0
test rax, rax
jne 0x1400a02e0
mov rcx, r12
call fcn.14009cce0
add rsp, 0x50
pop rbx
pop r12
pop r13
ret
mov rcx, qword [rsp + 0x48]
mov r8, rbx
mov edx, r13d
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
jne 0x1400a03b0
xor r8d, r8d
xor r13d, r13d
mov qword [rsp + 0x38], r8
mov rcx, qword [rsp + 0x48]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov r8, qword [rsp + 0x38]
jmp 0x1400a02c8
lea r8, [r13*8]
jmp 0x1400a038b
mov rcx, qword [rsp + 0x48]
mov r8, rbx
mov edx, r13d
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x1400a0400
lea r8, [r13*8]
mov qword [rsp + 0x38], r8
mov rcx, qword [rsp + 0x48]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov r8, qword [rsp + 0x38]
jmp 0x1400a0343
xor r8d, r8d
xor r13d, r13d
jmp 0x1400a03dd

Function at 0x1400a1ed0
Capabilities:
Get thread local storage value

Disassembly:
lea rcx, [0x1406a3db4]
jmp fcn.140098170

Function at 0x1400a96d0
Capabilities:
Initialize winsock library

Disassembly:
push rdi
sub rsp, 0x20
mov eax, dword [0x1406a3f58]
test eax, eax
je 0x1400a96f0
mov eax, 1
add rsp, 0x20
pop rdi
ret
lea rdx, [0x1406a3dc0]
xor eax, eax
mov ecx, 0x33
mov dword [0x1406a3f58], 1
mov rdi, rdx
rep stosq qword [rdi], rax
mov ecx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x1400a96df
call fcn.1400bf100
lea r8, str.BIO_sock_init
mov edx, 0x99
lea rcx, [0x140582ee0]
call fcn.1400bf220
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea r8, str.calling_wsastartup__
mov ecx, 2
mov edx, eax
call fcn.1400bf330
call fcn.1400bf100
lea r8, str.BIO_sock_init
mov edx, 0x9b
lea rcx, [0x140582ee0]
call fcn.1400bf220
xor r8d, r8d
mov edx, 0x7a
mov ecx, 0x20
call fcn.1400bf330
mov eax, 0xffffffff
jmp 0x1400a96e4
Function at 0x1400a9cb0
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x30
mov dword [rsp + 0x2c], edx
movsxd rcx, ecx
lea r8, [rsp + 0x2c]
mov edx, 0x8004667e
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov ebx, eax
test eax, eax
js 0x1400a9ce0
xor eax, eax
test ebx, ebx
sete al
add rsp, 0x30
pop rbx
ret
call fcn.1400bf100
lea r8, str.BIO_socket_ioctl
mov edx, 0xf7
lea rcx, [0x140582ee0]
call fcn.1400bf220
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea r8, str.calling_ioctlsocket__
mov ecx, 2
mov edx, eax
call fcn.1400bf330
xor eax, eax
test ebx, ebx
sete al
add rsp, 0x30
pop rbx
ret

Function at 0x1400a9e60
Capabilities:
Get socket status

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x250
mov esi, ecx
mov edi, edx
mov rbx, r8
cmp ecx, 0x3f
ja 0x1400a9f00
mov eax, 1
test r8, r8
jne 0x1400a9e90
add rsp, 0x250
pop rbx
pop rsi
pop rdi
ret
xor ecx, ecx
call qword [sym.imp.msvcrt.dll__time64]
mov rdx, rax
xor eax, eax
cmp rbx, rdx
jl 0x1400a9e84
mov eax, esi
sub ebx, edx
mov dword [rsp + 0x40], 1
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x3c], 0
mov dword [rsp + 0x38], ebx
test edi, edi
je 0x1400a9ef0
xor r8d, r8d
lea rdx, [rsp + 0x40]
lea rax, [rsp + 0x38]
lea ecx, [rsi + 1]
xor r9d, r9d
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_select]
add rsp, 0x250
pop rbx
pop rsi
pop rdi
ret
lea r8, [rsp + 0x40]
xor edx, edx
jmp 0x1400a9ecb
mov eax, 0xffffffff
jmp 0x1400a9e84
Function at 0x1400a9fc0
Capabilities:
Connect socket
Set socket configuration

Disassembly:
push r13
push r12
push rsi
push rbx
sub rsp, 0x48
movsxd r12, ecx
mov dword [rsp + 0x3c], 1
mov r13, rdx
mov esi, r8d
cmp r12d, 0xffffffff
je 0x1400aa110
mov edx, r8d
mov ecx, r12d
shr edx, 3
and edx, 1
call fcn.1400a9cb0
test eax, eax
je 0x1400aa0fe
test sil, 4
jne 0x1400aa070
and esi, 0x10
je 0x1400aa032
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x3c]
mov edx, 6
mov rcx, r12
mov r8d, 1
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jne 0x1400aa1d0
mov rcx, r13
call fcn.1401fb090
mov rcx, r13
mov ebx, eax
call fcn.1401fb070
mov rcx, r12
mov r8d, ebx
mov r12d, 1
mov rdx, rax
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x1400aa150
mov eax, r12d
add rsp, 0x48
pop rbx
pop rsi
pop r12
pop r13
ret
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x3c]
mov edx, 0xffff
mov rcx, r12
mov r8d, 8
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x1400aa004
call fcn.1400bf100
lea r8, str.BIO_connect
mov edx, 0x60
lea rcx, str.crypto_bio_bio_sock2.c
call fcn.1400bf220
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea r8, [0x140582fe8]
mov ecx, 2
mov edx, eax
call fcn.1400bf330
call fcn.1400bf100
lea r8, str.BIO_connect
mov edx, 0x62
lea rcx, str.crypto_bio_bio_sock2.c
call fcn.1400bf220
xor r8d, r8d
mov edx, 0x89
mov ecx, 0x20
call fcn.1400bf330
xor r12d, r12d
mov eax, r12d
add rsp, 0x48
pop rbx
pop rsi
pop r12
pop r13
ret
call fcn.1400bf100
lea r8, str.BIO_connect
mov edx, 0x56
xor r12d, r12d
lea rcx, str.crypto_bio_bio_sock2.c
call fcn.1400bf220
xor r8d, r8d
mov edx, 0x87
mov ecx, 0x20
call fcn.1400bf330
mov eax, r12d
add rsp, 0x48
pop rbx
pop rsi
pop r12
pop r13
ret
mov ecx, 0xffffffff
call fcn.1400aad80
mov r12d, eax
test eax, eax
jne 0x1400aa0fe
call fcn.1400bf100
lea r8, str.BIO_connect
mov edx, 0xb2
lea rcx, str.crypto_bio_bio_sock2.c
call fcn.1400bf220
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea r8, str.calling_connect__
mov ecx, 2
mov edx, eax
call fcn.1400bf330
call fcn.1400bf100
lea r8, str.BIO_connect
mov edx, 0xb4
lea rcx, str.crypto_bio_bio_sock2.c
call fcn.1400bf220
xor r8d, r8d
mov edx, 0x67
mov ecx, 0x20
call fcn.1400bf330
jmp 0x1400aa062
call fcn.1400bf100
lea r8, str.BIO_connect
mov edx, 0x6a
xor r12d, r12d
lea rcx, str.crypto_bio_bio_sock2.c
call fcn.1400bf220
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea r8, [0x140582fe8]
mov ecx, 2
mov edx, eax
call fcn.1400bf330
call fcn.1400bf100
lea r8, str.BIO_connect
mov edx, 0x6c
lea rcx, str.crypto_bio_bio_sock2.c
call fcn.1400bf220
xor r8d, r8d
mov edx, 0x8a
mov ecx, 0x20
call fcn.1400bf330
jmp 0x1400aa062
Function at 0x1400ac0e0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov r13, rdx
mov rsi, rcx
mov r14d, r8d
mov ebp, r9d
call fcn.1400abf50
mov edx, eax
lea r12d, [rax + 0xe]
add edx, 7
cmovns r12d, edx
mov edx, dword [rsp + 0xb0]
sar r12d, 3
test edx, edx
jne 0x1400ac140
mov ebx, dword [rsi + 0x10]
lea edx, [r12*8]
test ebx, ebx
setne dil
neg edi
cmp edx, eax
je 0x1400ac320
add r12d, ebx
mov r15d, ebx
jmp 0x1400ac147
xor edi, edi
xor r15d, r15d
xor ebx, ebx
cmp r14d, 0xffffffff
je 0x1400ac159
cmp r14d, r12d
jl 0x1400ac208
mov r12d, r14d
mov eax, dword [rsi + 0xc]
lea r10d, [rax*8]
movsxd r10, r10d
test r10, r10
je 0x1400ac300
movsxd r11, r12d
cmp ebp, 1
je 0x1400ac280
mov eax, dword [rsi + 8]
mov rbp, r11
lea r9, [r13 + r11 - 1]
sub r10, 1
xor edx, edx
shl eax, 3
cdqe
mov r8, rax
sub rbp, rax
neg r8
test r11, r11
je 0x1400ac338
mov r11, qword [rsi]
mov rax, rdx
mov ecx, edx
and rax, 0xfffffffffffffff8
and ecx, 7
mov rax, qword [r11 + rax]
shl ecx, 3
shr rax, cl
mov rcx, r8
sar rcx, 0x3f
and eax, ecx
xor eax, edi
add al, bl
mov byte [r9], al
mov rax, rdx
setb bl
add r8, 1
sub rax, r10
movzx ebx, bl
sub r9, 1
shr rax, 0x3f
add rdx, rax
cmp rbp, r8
jne 0x1400ac1a4
mov eax, r12d
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword [rsi + 0x10]
movdqu xmm0, xmmword [rsi]
mov qword [rsp + 0x30], rax
movups xmmword [rsp + 0x20], xmm0
mov eax, dword [rsp + 0x28]
test eax, eax
jle 0x1400ac243
mov rcx, qword [rsp + 0x20]
movsxd rdx, eax
lea rdx, [rcx + rdx*8]
nop
sub rdx, 8
cmp qword [rdx], 0
jne 0x1400ac23f
sub eax, 1
jne 0x1400ac230
mov dword [rsp + 0x28], eax
test eax, eax
jne 0x1400ac24f
mov dword [rsp + 0x30], 0
lea rcx, [rsp + 0x20]
call fcn.1400abf50
mov edx, eax
lea eax, [rax + 0xe]
add edx, 7
cmovns eax, edx
sar eax, 3
add eax, r15d
cmp eax, r14d
jle 0x1400ac156
mov r12d, 0xffffffff
jmp 0x1400ac1ed
mov eax, dword [rsi + 8]
sub r10, 1
shl eax, 3
cdqe
test r11, r11
je 0x1400ac338
mov r9, rax
sub r11, rax
xor r8d, r8d
add r13, rax
neg r9
nop dword [rax]
mov rdx, qword [rsi]
mov rax, r8
mov ecx, r8d
and rax, 0xfffffffffffffff8
and ecx, 7
mov rdx, qword [rdx + rax]
shl ecx, 3
mov rax, rdx
mov rdx, r9
shr rax, cl
sar rdx, 0x3f
and eax, edx
xor eax, edi
add al, bl
mov byte [r13 + r9], al
mov rax, r8
setb bl
add r9, 1
sub rax, r10
movzx ebx, bl
shr rax, 0x3f
add r8, rax
cmp r11, r9
jne 0x1400ac2a8
jmp 0x1400ac1ed
test r12d, r12d
je 0x1400ac1ed
movsxd r8, r12d
xor edx, edx
mov rcx, r13
call sub.msvcrt.dll_memset
jmp 0x1400ac1ed
xor r15d, r15d
test ebx, ebx
sete r15b
add r12d, r15d
jmp 0x1400ac147
xor r12d, r12d
jmp 0x1400ac1ed