joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401a8590
Capabilities:
Hash data using ripemd320
Hash data using sha1

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor eax, eax
mov dword [rcx + 0x54], 0x67452301
mov dword [rcx + 0x50], eax
mov rdi, r9
mov qword [rcx + 8], rax
mov rbx, rcx
mov dword [rcx + 0x58], 0xefcdab89
mov dword [rcx + 0x5c], 0x98badcfe
mov dword [rcx + 0x60], 0x10325476
mov dword [rcx + 0x64], 0xc3d2e1f0
mov dword [rcx + 0x68], 0x76543210
mov dword [rcx + 0x6c], 0xfedcba98
mov dword [rcx + 0x70], 0x89abcdef
mov dword [rcx + 0x74], 0x1234567
mov dword [rcx + 0x78], 0x3c2d1e0f
call fcn.1401a84a0
mov rdx, rdi
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1401a82a0

Function at 0x1401a8610
Capabilities:
Hash data with md5

Disassembly:
lea rax, vtable._ckMd4.0
mov dword [rcx + 8], 0x67452301
mov qword [rcx], rax
xor eax, eax
mov qword [rcx + 0x18], rax
mov rax, rcx
mov dword [rcx + 0xc], 0xefcdab89
mov dword [rcx + 0x10], 0x98badcfe
mov dword [rcx + 0x14], 0x10325476
ret

Function at 0x1401a8680
Capabilities:
Hash data with md5

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x48
mov rax, qword [0x1403721e8]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov r13, qword [rsp + 0xb0]
mov r14, r9
mov rbp, qword [rsp + 0xb8]
mov rsi, r8
mov r15, rdx
mov rdi, rcx
test r13, r13
je 0x1401a87c0
mov dword [rcx + 8], 0x67452301
xor r12d, r12d
mov qword [rcx + 0x18], r12
mov dword [rcx + 0xc], 0xefcdab89
mov dword [rcx + 0x10], 0x98badcfe
mov dword [rcx + 0x14], 0x10325476
mov ecx, 0x4e28
call fcn.1400b71c0
mov rbx, rax
test rax, rax
je 0x1401a87c0
mov dword [rsp + 0x30], r12d
mov rcx, r15
mov r12b, 1
call fcn.14018b400
test al, al
jne 0x1401a87a7
nop word [rax + rax]
mov qword [rsp + 0x28], r14
lea r9, [rsp + 0x30]
mov r8d, 0x4e20
mov qword [rsp + 0x20], rsi
mov rdx, rbx
mov rcx, r15
call fcn.14018b650
test al, al
je 0x1401a87a7
mov r8d, dword [rsp + 0x30]
test r8d, r8d
je 0x1401a8786
test rbp, rbp
je 0x1401a8763
mov rdx, rbx
mov rcx, rbp
call fcn.1400e2720
mov r8d, dword [rsp + 0x30]
mov rdx, rbx
mov rcx, rdi
call fcn.1401a8fd0
test rsi, rsi
je 0x1401a8786
mov edx, dword [rsp + 0x30]
mov r8, r14
mov rcx, rsi
call fcn.1401663c0
test al, al
jne 0x1401a8794
mov rcx, r15
call fcn.14018b400
test al, al
je 0x1401a8720
jmp 0x1401a87a7
mov rax, qword [r14]
lea rdx, str.MD4_aborted_by_application
mov rcx, r14
call qword [rax + 0x28]
xor r12b, r12b
mov rcx, rbx
call fcn.1402545d0
mov rdx, r13
mov rcx, rdi
call fcn.1401a87e0
movzx eax, r12b
jmp 0x1401a87c2
xor al, al
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1402545b0
add rsp, 0x48
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1401a8900
Capabilities:
Hash data with md5

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x1403721e8]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x20]
call fcn.1400e20a0
nop
lea r8, [rsp + 0x20]
xor edx, edx
mov rcx, rbx
call fcn.1400ad040
xor eax, eax
mov qword [rdi + 0x18], rax
mov dword [rdi + 8], 0x67452301
mov dword [rdi + 0xc], 0xefcdab89
mov dword [rdi + 0x10], 0x98badcfe
mov dword [rdi + 0x14], 0x10325476
lea rcx, [rsp + 0x20]
call fcn.1400e6bc0
mov ebx, eax
lea rcx, [rsp + 0x20]
call fcn.1400e6890
mov rdx, rax
mov r8d, ebx
mov rcx, rdi
call fcn.1401a8fd0
lea rdx, [rsp + 0x50]
mov rcx, rdi
call fcn.1401a87e0
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.1400e2720
nop
lea rcx, [rsp + 0x20]
call fcn.1400e2250
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1402545b0
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x1401a9310
Capabilities:
Hash data using sha1
Hash data using sha224
Hash data using sha256
Resolve function by parsing pe exports

Disassembly:
cmp dword [rcx + 0x10], 0x100
jle fcn.1401abd90
jmp fcn.1401adee0

Function at 0x1401a9330
Capabilities:
Hash data using sha1
Hash data using sha224
Hash data using sha256

Disassembly:
mov edx, dword [rcx + 0x10]
xor r8d, r8d
sub edx, 0xa0
je 0x1401a94c0
sub edx, 0x40
je 0x1401a93d2
sub edx, 0x20
je 0x1401a9480
sub edx, 0x80
je 0x1401a9410
cmp edx, 0x80
jne 0x1401a94e7
mov rax, qword [0x14043e0c0]
mov qword [rcx + 0x40], rax
mov rax, qword [0x14043e0c8]
mov qword [rcx + 0x48], rax
mov rax, qword [0x14043e0d0]
mov qword [rcx + 0x50], rax
mov rax, qword [0x14043e0d8]
mov qword [rcx + 0x58], rax
mov rax, qword [0x14043e0e0]
mov qword [rcx + 0x60], rax
mov rax, qword [0x14043e0e8]
mov qword [rcx + 0x68], rax
mov rax, qword [0x14043e0f0]
mov qword [rcx + 0x70], rax
mov rax, qword [0x14043e0f8]
mov qword [rcx + 0x78], rax
mov qword [rcx + 0x80], r8
mov qword [rcx + 0x88], r8
mov dword [rcx + 0x14], 0xc1059ed8
mov dword [rcx + 0x18], 0x367cd507
mov dword [rcx + 0x1c], 0x3070dd17
mov dword [rcx + 0x20], 0xf70e5939
mov dword [rcx + 0x24], 0xffc00b31
mov dword [rcx + 0x28], 0x68581511
mov dword [rcx + 0x2c], 0x64f98fa7
mov dword [rcx + 0x30], 0xbefa4fa4
mov qword [rcx + 0x34], r8
ret
mov rax, qword [0x14043de00]
mov qword [rcx + 0x40], rax
mov rax, qword [0x14043de08]
mov qword [rcx + 0x48], rax
mov rax, qword [0x14043de10]
mov qword [rcx + 0x50], rax
mov rax, qword [0x14043de18]
mov qword [rcx + 0x58], rax
mov rax, qword [0x14043de20]
mov qword [rcx + 0x60], rax
mov rax, qword [0x14043de28]
mov qword [rcx + 0x68], rax
mov rax, qword [0x14043de30]
mov qword [rcx + 0x70], rax
mov rax, qword [0x14043de38]
mov qword [rcx + 0x78], rax
mov qword [rcx + 0x80], r8
mov qword [rcx + 0x88], r8
ret
mov dword [rcx + 0x14], 0x6a09e667
mov dword [rcx + 0x18], 0xbb67ae85
mov dword [rcx + 0x1c], 0x3c6ef372
mov dword [rcx + 0x20], 0xa54ff53a
mov dword [rcx + 0x24], 0x510e527f
mov dword [rcx + 0x28], 0x9b05688c
mov dword [rcx + 0x2c], 0x1f83d9ab
mov dword [rcx + 0x30], 0x5be0cd19
mov qword [rcx + 0x34], r8
ret
mov dword [rcx + 0x14], 0x67452301
mov dword [rcx + 0x18], 0xefcdab89
mov dword [rcx + 0x1c], 0x98badcfe
mov dword [rcx + 0x20], 0x10325476
mov dword [rcx + 0x24], 0xc3d2e1f0
mov qword [rcx + 0x34], r8
ret
Function at 0x1401ab2f0
Capabilities:
Hash data using sha1
Hash data using sha224
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov edi, ecx
xor esi, esi
mov qword [rsp + 0x38], rsi
mov ecx, 0x110
call fcn.1402548a0
mov rbx, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1401ab4fc
mov rcx, rax
call fcn.1400d3c30
nop
lea rax, vtable._ckSha2.0
mov qword [rbx], rax
call fcn.1400b7170
mov byte [0x14036ffc0], al
call fcn.1401aae00
test edi, edi
jle 0x1401ab4f7
mov ecx, edi
sub ecx, 0xa0
je 0x1401ab4d0
sub ecx, 0x40
je 0x1401ab490
sub ecx, 0x20
je 0x1401ab450
sub ecx, 0x80
je 0x1401ab3e0
cmp ecx, 0x80
jne 0x1401ab4f7
mov rax, qword [0x14043e0c0]
mov qword [rbx + 0x40], rax
mov rax, qword [0x14043e0c8]
mov qword [rbx + 0x48], rax
mov rax, qword [0x14043e0d0]
mov qword [rbx + 0x50], rax
mov rax, qword [0x14043e0d8]
mov qword [rbx + 0x58], rax
mov rax, qword [0x14043e0e0]
mov qword [rbx + 0x60], rax
mov rax, qword [0x14043e0e8]
mov qword [rbx + 0x68], rax
mov rax, qword [0x14043e0f0]
mov qword [rbx + 0x70], rax
mov rax, qword [0x14043e0f8]
jmp 0x1401ab434
mov rax, qword [0x14043de00]
mov qword [rbx + 0x40], rax
mov rax, qword [0x14043de08]
mov qword [rbx + 0x48], rax
mov rax, qword [0x14043de10]
mov qword [rbx + 0x50], rax
mov rax, qword [0x14043de18]
mov qword [rbx + 0x58], rax
mov rax, qword [0x14043de20]
mov qword [rbx + 0x60], rax
mov rax, qword [0x14043de28]
mov qword [rbx + 0x68], rax
mov rax, qword [0x14043de30]
mov qword [rbx + 0x70], rax
mov rax, qword [0x14043de38]
mov qword [rbx + 0x78], rax
mov qword [rbx + 0x80], rsi
mov qword [rbx + 0x88], rsi
jmp 0x1401ab4f7
mov dword [rbx + 0x14], 0x6a09e667
mov dword [rbx + 0x18], 0xbb67ae85
mov dword [rbx + 0x1c], 0x3c6ef372
mov dword [rbx + 0x20], 0xa54ff53a
mov dword [rbx + 0x24], 0x510e527f
mov dword [rbx + 0x28], 0x9b05688c
mov dword [rbx + 0x2c], 0x1f83d9ab
mov dword [rbx + 0x30], 0x5be0cd19
jmp 0x1401ab4f3
mov dword [rbx + 0x14], 0xc1059ed8
mov dword [rbx + 0x18], 0x367cd507
mov dword [rbx + 0x1c], 0x3070dd17
mov dword [rbx + 0x20], 0xf70e5939
mov dword [rbx + 0x24], 0xffc00b31
mov dword [rbx + 0x28], 0x68581511
mov dword [rbx + 0x2c], 0x64f98fa7
mov dword [rbx + 0x30], 0xbefa4fa4
jmp 0x1401ab4f3
mov dword [rbx + 0x14], 0x67452301
mov dword [rbx + 0x18], 0xefcdab89
mov dword [rbx + 0x1c], 0x98badcfe
mov dword [rbx + 0x20], 0x10325476
mov dword [rbx + 0x24], 0xc3d2e1f0
mov qword [rbx + 0x34], rsi
mov dword [rbx + 0x10], edi
jmp 0x1401ab4ff
mov rbx, rsi
mov qword [rsp + 0x38], rbx
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x1401ab530
Capabilities:
Hash data using sha1
Hash data using sha224
Hash data using sha256

Disassembly:
mov ecx, 0x100
jmp fcn.1401ab2f0
Function at 0x1401b17d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x1e0
mov rax, qword [0x1403721e8]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
mov rsi, r8
mov edi, edx
mov rbx, rcx
test r8, r8
jne 0x1401b1808
xor al, al
jmp 0x1401b18e0
lea rcx, [rsp + 0x20]
call fcn.1401b0d10
test edi, edi
je 0x1401b182e
test rbx, rbx
je 0x1401b182e
mov r9b, reloc.WS2_32.dll_select
lea rcx, [rsp + 0x20]
mov r8d, edi
mov rdx, rbx
call fcn.1401b20c0
movzx eax, byte [rsp + 0x1c0]
mov byte [rsp + 0x187], 0
mov byte [rsp + rax + 0xf8], 6
movzx edx, byte [rsp + 0x1c0]
or byte [rsp + 0x187], 0x80
inc dl
cmp dl, 0x8f
jae 0x1401b187d
movzx eax, dl
lea rcx, [rsp + 0xf8]
add rcx, rax
mov eax, 0x8f
sub al, dl
xor edx, edx
movzx r8d, al
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x30]
mov edx, reloc.WS2_32.dll_select
nop word [rax + rax]
mov rcx, qword [rax + 0xc8]
xor qword [rax], rcx
lea rax, [rax + 8]
sub rdx, 1
jne 0x1401b1890
lea rcx, [rsp + 0x30]
call fcn.1401b0e10
mov eax, dword [rsp + 0x48]
lea rcx, [rsp + 0x20]
movaps xmm0, xmmword [rsp + 0x30]
movsd xmm1, qword [rsp + 0x40]
movups xmmword [rsi], xmm0
movsd qword [rsi + 0x10], xmm1
mov dword [rsi + 0x18], eax
lea rax, vtable._ckSha3.0
mov qword [rsp + 0x20], rax
call fcn.1400d3d40
mov al, 1
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.1402545b0
lea r11, [rsp + 0x1e0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x1401b1950
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x1e0
mov rax, qword [0x1403721e8]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
mov rsi, r8
mov edi, edx
mov rbx, rcx
test r8, r8
jne 0x1401b1988
xor al, al
jmp 0x1401b1a57
lea rcx, [rsp + 0x20]
call fcn.1401b0d10
test edi, edi
je 0x1401b19ae
test rbx, rbx
je 0x1401b19ae
mov r9b, send
lea rcx, [rsp + 0x20]
mov r8d, edi
mov rdx, rbx
call fcn.1401b20c0
movzx eax, byte [rsp + 0x1c0]
mov byte [rsp + 0x17f], 0
mov byte [rsp + rax + 0xf8], 6
movzx edx, byte [rsp + 0x1c0]
or byte [rsp + 0x17f], 0x80
inc dl
cmp dl, 0x87
jae 0x1401b19fd
movzx eax, dl
lea rcx, [rsp + 0xf8]
add rcx, rax
mov eax, 0x87
sub al, dl
xor edx, edx
movzx r8d, al
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x30]
mov edx, send
nop word [rax + rax]
mov rcx, qword [rax + 0xc8]
xor qword [rax], rcx
lea rax, [rax + 8]
sub rdx, 1
jne 0x1401b1a10
lea rcx, [rsp + 0x30]
call fcn.1401b0e10
movaps xmm0, xmmword [rsp + 0x30]
lea rax, vtable._ckSha3.0
movaps xmm1, xmmword [rsp + 0x40]
lea rcx, [rsp + 0x20]
movups xmmword [rsi], xmm0
mov qword [rsp + 0x20], rax
movups xmmword [rsi + 0x10], xmm1
call fcn.1400d3d40
mov al, 1
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.1402545b0
lea r11, [rsp + 0x1e0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1401b1ac0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x1e0
mov rax, qword [0x1403721e8]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
mov rsi, r8
mov edi, edx
mov rbx, rcx
test r8, r8
jne 0x1401b1af8
xor al, al
jmp 0x1401b1bd0
lea rcx, [rsp + 0x20]
call fcn.1401b0d10
test edi, edi
je 0x1401b1b1e
test rbx, rbx
je 0x1401b1b1e
mov r9b, ntohs
lea rcx, [rsp + 0x20]
mov r8d, edi
mov rdx, rbx
call fcn.1401b20c0
movzx eax, byte [rsp + 0x1c0]
mov byte [rsp + 0x15f], 0
mov byte [rsp + rax + 0xf8], 6
movzx edx, byte [rsp + 0x1c0]
or byte [rsp + 0x15f], 0x80
inc dl
cmp dl, 0x67
jae 0x1401b1b6d
movzx eax, dl
lea rcx, [rsp + 0xf8]
add rcx, rax
mov eax, 0x67
sub al, dl
xor edx, edx
movzx r8d, al
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x30]
mov edx, ntohs
nop word [rax + rax]
mov rcx, qword [rax + 0xc8]
xor qword [rax], rcx
lea rax, [rax + 8]
sub rdx, 1
jne 0x1401b1b80
lea rcx, [rsp + 0x30]
call fcn.1401b0e10
movaps xmm0, xmmword [rsp + 0x30]
lea rax, vtable._ckSha3.0
movaps xmm1, xmmword [rsp + 0x40]
lea rcx, [rsp + 0x20]
movups xmmword [rsi], xmm0
mov qword [rsp + 0x20], rax
movaps xmm0, xmmword [rsp + 0x50]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi + 0x20], xmm0
call fcn.1400d3d40
mov al, 1
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.1402545b0
lea r11, [rsp + 0x1e0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x1401b1c40
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x1e0
mov rax, qword [0x1403721e8]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
mov rsi, r8
mov edi, edx
mov rbx, rcx
test r8, r8
jne 0x1401b1c78
xor al, al
jmp 0x1401b1d59
lea rcx, [rsp + 0x20]
call fcn.1401b0d10
test edi, edi
je 0x1401b1c9e
test rbx, rbx
je 0x1401b1c9e
mov r9b, 9
lea rcx, [rsp + 0x20]
mov r8d, edi
mov rdx, rbx
call fcn.1401b20c0
movzx eax, byte [rsp + 0x1c0]
mov byte [rsp + 0x13f], 0
mov byte [rsp + rax + 0xf8], 6
movzx edx, byte [rsp + 0x1c0]
or byte [rsp + 0x13f], 0x80
inc dl
cmp dl, 0x47
jae 0x1401b1ced
movzx eax, dl
lea rcx, [rsp + 0xf8]
add rcx, rax
mov eax, 0x47
sub al, dl
xor edx, edx
movzx r8d, al
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x30]
mov edx, 9
nop word [rax + rax]
mov rcx, qword [rax + 0xc8]
xor qword [rax], rcx
lea rax, [rax + 8]
sub rdx, 1
jne 0x1401b1d00
lea rcx, [rsp + 0x30]
call fcn.1401b0e10
movaps xmm0, xmmword [rsp + 0x30]
lea rax, vtable._ckSha3.0
movaps xmm1, xmmword [rsp + 0x40]
lea rcx, [rsp + 0x20]
movups xmmword [rsi], xmm0
mov qword [rsp + 0x20], rax
movaps xmm0, xmmword [rsp + 0x50]
movups xmmword [rsi + 0x10], xmm1
movaps xmm1, xmmword [rsp + 0x60]
movups xmmword [rsi + 0x20], xmm0
movups xmmword [rsi + 0x30], xmm1
call fcn.1400d3d40
mov al, 1
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.1402545b0
lea r11, [rsp + 0x1e0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1401b1ff0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
movzx eax, r8b
lea rdi, [rcx + 0x10]
mov rbx, rdx
movzx esi, r9b
mov rdx, rcx
lea eax, [rax*8]
mov byte [rax + rcx + 0xd7], 0
lea r11d, [rax - 1]
mov r10d, eax
movzx eax, byte [rcx + 0x1a0]
mov byte [rax + rcx + 0xd8], 6
or byte [r10 + rcx + 0xd7], 0x80
movzx ecx, byte [rcx + 0x1a0]
inc cl
movzx eax, cl
cmp eax, r11d
jge 0x1401b2065
movzx eax, cl
inc cl
mov byte [rax + rdx + 0xd8], 0
movzx eax, cl
cmp eax, r11d
jl 0x1401b2050
test r8b, r8b
je 0x1401b2085
mov rax, rdi
movzx edx, r8b
mov rcx, qword [rax + 0xc8]
xor qword [rax], rcx
lea rax, [rax + 8]
sub rdx, 1
jne 0x1401b2071
mov rcx, rdi
call fcn.1401b0e10
test sil, sil
je 0x1401b20b0
sub rdi, rbx
mov rcx, rsi
nop dword [rax + rax]
movzx eax, byte [rdi + rbx]
mov byte [rbx], al
lea rbx, [rbx + 1]
sub rcx, 1
jne 0x1401b20a0
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x1401b20c0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov qword [rsp + 0x40], rbp
movzx ecx, byte [rcx + 0x1a0]
mov esi, r8d
mov qword [rsp + 0x50], r14
mov rdi, rdx
movzx r14d, r9b
test cl, cl
je 0x1401b2187
movzx eax, r14b
movzx r9d, sil
shl al, 3
sub al, cl
movzx r8d, al
cmp r8d, esi
cmovbe r9d, r8d
xor dl, dl
lea r8, [rbx + rcx]
test r9b, r9b
je 0x1401b2127
movzx ecx, dl
inc dl
movzx eax, byte [rcx + rdi]
mov byte [rcx + r8 + 0xd8], al
cmp dl, r9b
jb 0x1401b2111
add byte [rbx + 0x1a0], dl
movzx ecx, byte [rbx + 0x1a0]
movzx eax, dl
add rdi, rax
movzx eax, dl
sub esi, eax
mov eax, r14d
shl eax, 3
cmp ecx, eax
jne 0x1401b2187
test r14b, r14b
je 0x1401b2174
lea rcx, [rbx + 0x10]
mov rdx, r14
nop word [rax + rax]
mov rax, qword [rcx + 0xc8]
xor qword [rcx], rax
lea rcx, [rcx + 8]
sub rdx, 1
jne 0x1401b2160
mov rcx, rbx
add rcx, 0x10
call fcn.1401b0e10
mov byte [rbx + 0x1a0], 0
mov ebp, r14d
shl ebp, 3
cmp esi, ebp
jb 0x1401b21ee
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x58], r15
mov r12d, ebp
nop
test r14b, r14b
je 0x1401b21d2
mov r8, rdi
lea rax, [rbx + 0x10]
sub r8, rbx
mov rdx, r14
nop dword [rax]
nop word [rax + rax]
mov rcx, qword [r8 + rax - 0x10]
xor qword [rax], rcx
lea rax, [rax + 8]
sub rdx, 1
jne 0x1401b21c0
lea rcx, [rbx + 0x10]
call fcn.1401b0e10
sub esi, ebp
add rdi, r12
cmp esi, ebp
jae 0x1401b21a0
mov r15, qword [rsp + 0x58]
mov r12, qword [rsp + 0x48]
mov r14, qword [rsp + 0x50]
xor dl, dl
mov rbp, qword [rsp + 0x40]
test esi, esi
je 0x1401b2217
nop
movzx ecx, dl
inc dl
movzx eax, byte [rcx + rdi]
mov byte [rcx + rbx + 0xd8], al
movzx eax, dl
cmp eax, esi
jb 0x1401b2200
add byte [rbx + 0x1a0], dl
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret
Function at 0x1401b4d50
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp dword [rcx + 0xcc], 0xc64d29ea
mov rdi, r8
movzx esi, dl
mov rbx, rcx
jne 0x14016d219
mov rax, qword [rcx + 0xed8]
test rax, rax
je 0x14016d24b
cmp dword [rax + 0x3c], 0xc64d29ea
je 0x14016d265
xor ecx, ecx
call fcn.1400b09c0
cmp dword [rbx + 0xee8], 2
mov r8, rdi
movzx edx, sil
jne 0x14016d283
lea rcx, [rbx + 0x220]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x140218440
cmp dword [rcx + 0xee8], 2
jne 0x14016d220
add rcx, 0x220
call fcn.1402196c0
test rax, rax
je 0x14016d220
mov r8, rdi
movzx edx, sil
mov rcx, rax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x140228550
lea rcx, [rbx + 0xb48]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x1401b6ab0
mov rcx, qword [rcx + 0x60]
test rcx, rcx
jne 0x1401b4d5c
mov al, 1
ret
jmp 0x14016d1e0
push rbx
sub rsp, 0x80
mov rax, qword [0x1403721e8]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rbx, rcx
mov rcx, qword [rcx + 0x298]
cmp rcx, 0xffffffffffffffff
jne 0x1401b6adf
xor al, al
jmp 0x1401b6b70
xor r8d, r8d
mov dword [rsp + 0x54], 1
mov dword [rsp + 0x58], r8d
test dl, dl
je 0x1401b6b50
mov qword [rsp + 0x40], r8
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], r8
lea r9d, [r8 + 0xc]
mov qword [rsp + 0x30], rax
mov edx, 0x98000004
mov dword [rsp + 0x28], r8d
mov qword [rsp + 0x20], r8
mov dword [rsp + 0x50], r8d
lea r8, [rsp + 0x60]
mov dword [rsp + 0x60], 1
mov dword [rsp + 0x68], 0x7148
mov dword [rsp + 0x64], 0x1d0d8
call qword [sym.imp.WS2_32.dll_WSAIoctl]
mov rcx, qword [rbx + 0x298]
lea r9, [rsp + 0x54]
jmp 0x1401b6b55
lea r9, [rsp + 0x58]
mov r8d, 8
mov dword [rsp + 0x20], 4
mov edx, 0xffff
call qword [sym.imp.WS2_32.dll_setsockopt]
mov al, 1
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1402545b0
add rsp, 0x80
pop rbx
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, r8
movzx ebp, dl
mov rbx, rcx
xor dil, dil
call fcn.1400b2a40
mov rcx, qword [rbx + 0x78]
test rcx, rcx
je 0x14021769c
mov r8, rsi
movzx edx, bpl
call 0x1401b6ab0
jmp 0x1402176b1
mov rcx, qword [rbx + 0x70]
test rcx, rcx
je 0x1402176b4
mov r8, rsi
movzx edx, bpl
call 0x14016d1e0
movzx edi, al
mov rcx, rbx
call fcn.1400b29c0
mov rbx, qword [rsp + 0x30]
movzx eax, dil
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
add rcx, 0x18
jmp 0x140217660
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x1403721e8]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rsi, r8
movzx edi, dl
mov rbx, rcx
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rax
mov rdx, rcx
lea rcx, [rsp + 0x20]
call fcn.1400d4190
nop
lea rcx, [rbx + 0xb18]
mov r8, rsi
movzx edx, dil
call 0x140217660
movzx ebx, al
lea rcx, [rsp + 0x20]
call fcn.1400d4260
movzx eax, bl
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1402545b0
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x1401b6290
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
cmp dword [rcx + 0x2a0], 2
je fcn.1401b71e0
jmp fcn.1401b72f0
Function at 0x1401b6ab0
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp dword [rcx + 0xcc], 0xc64d29ea
mov rdi, r8
movzx esi, dl
mov rbx, rcx
jne 0x14016d219
mov rax, qword [rcx + 0xed8]
test rax, rax
je 0x14016d24b
cmp dword [rax + 0x3c], 0xc64d29ea
je 0x14016d265
xor ecx, ecx
call fcn.1400b09c0
cmp dword [rbx + 0xee8], 2
mov r8, rdi
movzx edx, sil
jne 0x14016d283
lea rcx, [rbx + 0x220]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x140218440
cmp dword [rcx + 0xee8], 2
jne 0x14016d220
add rcx, 0x220
call fcn.1402196c0
test rax, rax
je 0x14016d220
mov r8, rdi
movzx edx, sil
mov rcx, rax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x140228550
lea rcx, [rbx + 0xb48]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x1401b6ab0
mov rcx, qword [rcx + 0x60]
test rcx, rcx
jne 0x1401b4d5c
mov al, 1
ret
jmp 0x14016d1e0
push rbx
sub rsp, 0x80
mov rax, qword [0x1403721e8]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rbx, rcx
mov rcx, qword [rcx + 0x298]
cmp rcx, 0xffffffffffffffff
jne 0x1401b6adf
xor al, al
jmp 0x1401b6b70
xor r8d, r8d
mov dword [rsp + 0x54], 1
mov dword [rsp + 0x58], r8d
test dl, dl
je 0x1401b6b50
mov qword [rsp + 0x40], r8
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], r8
lea r9d, [r8 + 0xc]
mov qword [rsp + 0x30], rax
mov edx, 0x98000004
mov dword [rsp + 0x28], r8d
mov qword [rsp + 0x20], r8
mov dword [rsp + 0x50], r8d
lea r8, [rsp + 0x60]
mov dword [rsp + 0x60], 1
mov dword [rsp + 0x68], 0x7148
mov dword [rsp + 0x64], 0x1d0d8
call qword [sym.imp.WS2_32.dll_WSAIoctl]
mov rcx, qword [rbx + 0x298]
lea r9, [rsp + 0x54]
jmp 0x1401b6b55
lea r9, [rsp + 0x58]
mov r8d, 8
mov dword [rsp + 0x20], 4
mov edx, 0xffff
call qword [sym.imp.WS2_32.dll_setsockopt]
mov al, 1
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1402545b0
add rsp, 0x80
pop rbx
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, r8
movzx ebp, dl
mov rbx, rcx
xor dil, dil
call fcn.1400b2a40
mov rcx, qword [rbx + 0x78]
test rcx, rcx
je 0x14021769c
mov r8, rsi
movzx edx, bpl
call 0x1401b6ab0
jmp 0x1402176b1
mov rcx, qword [rbx + 0x70]
test rcx, rcx
je 0x1402176b4
mov r8, rsi
movzx edx, bpl
call 0x14016d1e0
movzx edi, al
mov rcx, rbx
call fcn.1400b29c0
mov rbx, qword [rsp + 0x30]
movzx eax, dil
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
add rcx, 0x18
jmp 0x140217660
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x1403721e8]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rsi, r8
movzx edi, dl
mov rbx, rcx
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rax
mov rdx, rcx
lea rcx, [rsp + 0x20]
call fcn.1400d4190
nop
lea rcx, [rbx + 0xb18]
mov r8, rsi
movzx edx, dil
call 0x140217660
movzx ebx, al
lea rcx, [rsp + 0x20]
call fcn.1400d4260
movzx eax, bl
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1402545b0
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret