joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14016a540
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xc0
mov rax, qword [0x14048bd00]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rsi, qword [rcx + 0x20]
lea r8, [rsp + 0x20]
mov rdi, rcx
lea rdx, [rsp + 0x30]
mov rbx, qword [rsi + 0x228]
mov rcx, rbx
mov qword [rsp + 0x28], 0xffffffffffffffff
mov dword [rsp + 0x20], 0x80
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x14016a5bc
lea r8, [rsp + 0x20]
mov dword [rsp + 0x20], 0x80
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_accept]
mov qword [rsp + 0x28], rax
jmp 0x14016a5c1
mov rax, qword [rsp + 0x28]
mov rcx, rdi
cmp rax, 0xffffffffffffffff
jne 0x14016a5e0
lea rdx, [0x1403a5450]
call fcn.14013e600
mov eax, reloc.WLDAP32.dll_Ordinal_30
jmp 0x14016a67a
lea rdx, [0x1403a5478]
call fcn.14013e6f0
mov byte [rsi + 0x3ad], 0
mov edx, 1
mov rcx, qword [rsp + 0x28]
call fcn.14017bf80
lea r9, [rsp + 0x28]
mov r8d, 1
mov rdx, rsi
mov rcx, rdi
call fcn.1401459d0
mov ebx, eax
test eax, eax
je 0x14016a62d
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.WS2_32.dll_closesocket]
mov eax, ebx
jmp 0x14016a67a
cmp qword [rdi + 0x280], 0
je 0x14016a678
mov dl, 1
mov rcx, rdi
call fcn.140130450
mov rdx, qword [rsp + 0x28]
mov r8d, 1
mov rcx, qword [rdi + 0x288]
call qword [rdi + 0x280]
xor edx, edx
mov rcx, rdi
mov ebx, eax
call fcn.140130450
test ebx, ebx
je 0x14016a678
mov rcx, rdi
call fcn.14016ad70
mov eax, Ordinal_45
jmp 0x14016a67a
xor eax, eax
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.140397b20
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x14016c560
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rax, qword [rcx + 0x1b8]
mov rbx, rcx
mov rdi, qword [rcx + 0x20]
cmp dword [rax + 0x10], 0
je 0x14016c5d3
movzx eax, byte [rdi + 0x78e]
cmp al, 0xd
je 0x14016c5b5
test rdi, rdi
je 0x14016c59b
lea r8, [0x1403a5050]
mov r8, qword [r8 + rax*8]
jmp 0x14016c5a2
lea r8, [0x1403a5418]
lea r9, [0x1403a5338]
lea rdx, [0x1403a5420]
call fcn.14013e8b0
mov r8b, reloc.WS2_32.dll_listen
mov byte [rdi + 0x78e], 0xd
mov dl, 1
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.14016c720
cmp byte [rcx + 0xa4e], 0
je 0x14016c5ed
xor edx, edx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.14016d400
cmp byte [rcx + 0xa51], 0
je 0x14016c670
mov r9, qword [rdi + 0x738]
lea rdx, [rdi + 0x680]
test r9, r9
jne 0x14016c637
mov r9, qword [rcx + 0x7f8]
test r9, r9
jne 0x14016c62e
cmp byte [rcx + 0x12b1], 0
lea rax, [0x1403a58e0]
lea r9, [0x1403a45a4]
cmovne r9, rax
lea r8, [0x1403a58e8]
jmp 0x14016c64e
cmp byte [rcx + 0x12b5], 0
lea r8, [0x1403a58f0]
jne 0x14016c64e
lea r8, [0x1403a5900]
call fcn.140180360
mov edi, eax
test eax, eax
jne 0x14016c663
mov dl, Ordinal_30
mov rcx, rbx
call fcn.14016ad10
mov eax, edi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rdx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.14016d320
Function at 0x14016c9c0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx + 0x1b8]
add rdx, 0x680
mov rbx, rcx
cmp dword [rax + 0x10], 0
je 0x14016ca18
cmp qword [rdx + 0xb8], 0
je 0x14016ca18
xor r9d, r9d
mov qword [rsp + 0x30], rdi
lea r8, [0x1403a5910]
call fcn.140180360
mov edi, eax
test eax, eax
jne 0x14016ca0d
mov dl, reloc.WLDAP32.dll_Ordinal_26
mov rcx, rbx
call fcn.14016ad10
mov eax, edi
mov rdi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret
add rsp, 0x20
pop rbx
jmp fcn.14016c560

Function at 0x14016ced0
Capabilities:
Check http status code

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x30
mov rbp, qword [rcx + 0x20]
lea eax, [rdx - 0xc8]
xor edi, edi
movzx esi, r8b
mov rbx, rcx
cmp eax, 0x64
jb 0x14016cf12
lea rdx, [0x1403a5bf8]
call fcn.14013e600
mov eax, reloc.WS2_32.dll_recvfrom
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
cmp edx, 0xc8
je 0x14016cf29
mov r8d, edx
lea rdx, [0x1403a5c18]
call fcn.14013e6f0
cmp sil, 0x13
jne 0x14016cf46
mov rdx, rbp
mov rcx, rbx
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
jmp fcn.14016cbe0
cmp sil, 0x14
jne 0x14016d08a
cmp byte [rbx + 0x6f0], 2
mov qword [rsp + 0x58], r14
mov r14, qword [rbx + 0x20]
jne 0x14016cfcd
mov rax, qword [rbx + 0x1b8]
mov rcx, qword [rax]
test rcx, rcx
je 0x14016cfcd
xor r9d, r9d
mov qword [rsp + 0x50], rdi
lea r8, [rsp + 0x50]
mov dword [rsp + 0x20], 3
xor edx, edx
call fcn.140148180
mov esi, eax
test eax, eax
jne 0x14016d076
mov rcx, qword [rsp + 0x50]
mov edx, Ordinal_50
call sub.VCRUNTIME140.dll_strrchr
test rax, rax
je 0x14016cfc2
mov rdi, qword [rsp + 0x50]
mov ecx, 1
sub rax, rdi
cmovne rcx, rax
mov byte [rcx + rdi], sil
jmp 0x14016cfcd
mov rcx, qword [rsp + 0x50]
call qword [fcn.140398b06]
mov rdx, qword [rbx + 0x7f8]
test rdx, rdx
jne 0x14016cff2
cmp byte [rbx + 0x12b1], 0
lea rax, [0x1403a58e0]
lea rdx, [0x1403a45a4]
cmovne rdx, rax
lea r8, [0x14045ffd5]
test rdi, rdi
mov r9, r8
lea rax, [0x14039bcdc]
cmovne r9, rdi
lea rcx, [0x14039c114]
cmovne r8, rax
call fcn.1401489a0
mov rcx, rdi
mov rbp, rax
call qword [fcn.140398b06]
test rbp, rbp
jne 0x14016d044
mov r14, qword [rsp + 0x58]
mov esi, reloc.WLDAP32.dll_Ordinal_27
mov eax, esi
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
lea rdx, [r14 + 0x680]
mov r9, rbp
lea r8, [0x14039ac48]
mov rcx, rbx
call fcn.140180360
mov rcx, rbp
mov esi, eax
call qword [fcn.140398b06]
test esi, esi
jne 0x14016d076
mov dl, Ordinal_32
mov rcx, rbx
call fcn.14016ad10
mov r14, qword [rsp + 0x58]
mov eax, esi
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
cmp sil, 0x15
jne 0x14016d095
mov r8b, reloc.WS2_32.dll_listen
jmp 0x14016d09e
cmp sil, 0x16
jne 0x14016d0aa
mov r8b, ntohs
mov dl, 1
mov rcx, rbx
call fcn.14016c720
mov edi, eax
mov rbx, qword [rsp + 0x60]
mov eax, edi
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
Function at 0x1401772c0
Capabilities:
Check http status code

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov rbp, r8
mov rdi, rdx
mov r15, rcx
lea rdx, [0x14039eab0]
mov r8d, reloc.WS2_32.dll_recvfrom
mov rcx, r9
mov rbx, r9
call fcn.140144790
test eax, eax
je 0x14017730d
mov r14d, dword [rdi + 0x13c]
cmp r14d, 0x191
je 0x140177336
mov r8d, reloc.WS2_32.dll_send
lea rdx, [0x14039ea00]
mov rcx, rbx
call fcn.140144790
test eax, eax
je 0x140177394
mov r14d, dword [rdi + 0x13c]
cmp r14d, 0x197
jne 0x140177394
mov rcx, rbx
call fcn.14014d260
mov rsi, rax
test rax, rax
jne 0x140177350
mov eax, reloc.WLDAP32.dll_Ordinal_27
jmp 0x14017755f
mov r9, rbx
lea r8, [0x1403a7298]
mov rdx, r15
mov rcx, rdi
call fcn.14013e740
cmp r14d, 0x197
mov r8, rsi
mov rcx, rdi
sete dl
call fcn.14014e8f0
mov rcx, rsi
mov ebx, eax
call qword [fcn.140398b06]
test ebx, ebx
je 0x14017755d
mov eax, ebx
jmp 0x14017755f
mov r8d, reloc.WS2_32.dll_ntohs
lea rdx, [0x14039e308]
mov rcx, rbx
call fcn.140144790
test eax, eax
je 0x1401773f1
mov r8d, dword [rdi + 0x13c]
lea eax, [r8 - 0xc8]
cmp eax, 0x64
jae 0x1401773d4
lea rdx, [0x1403a72b8]
mov rcx, rdi
call fcn.14013e6f0
jmp 0x14017755d
lea r9, [rbp + 0xa0]
xor edx, edx
lea rcx, [rbx + 0xf]
mov r8d, 0xa
call fcn.140154ff0
jmp 0x14017755d
lea r9, [0x14039cba4]
mov qword [rsp + 0x20], 5
mov r8d, reloc.WS2_32.dll_inet_addr
lea rdx, [0x14039e318]
mov rcx, rbx
call fcn.14014d180
test al, al
jne 0x140177556
mov r8d, reloc.WS2_32.dll_select
lea rdx, [0x14039e328]
mov rcx, rbx
call fcn.140144790
test eax, eax
je 0x1401774b5
mov r8d, dword [rdi + 0x13c]
lea eax, [r8 - 0xc8]
cmp eax, 0x64
jae 0x14017745e
lea rdx, [0x1403a72f0]
mov rcx, rdi
call fcn.14013e6f0
jmp 0x14017755d
lea r9, [0x14039dab8]
mov qword [rsp + 0x20], 7
mov r8d, reloc.WS2_32.dll_select
lea rdx, [0x14039e328]
mov rcx, rbx
call fcn.14014d180
test al, al
je 0x14017755d
lea rdx, [0x1403a7328]
mov rcx, rdi
call fcn.14013e6f0
lea rdx, [rbp + 0x50]
mov byte [rbp + 0xac], 1
mov r8b, 1
mov rcx, rdi
call fcn.14017c420
jmp 0x14017755d
lea r9, [0x14039cba4]
mov qword [rsp + 0x20], 5
mov r8d, reloc.WS2_32.dll_recvfrom
lea rdx, [0x14039e990]
mov rcx, rbx
call fcn.14014d180
test al, al
jne 0x140177556
mov r8d, 7
lea rdx, [0x1403a7348]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
jne 0x14017755d
movzx eax, byte [rbx + 7]
sub al, 0x30
cmp al, 1
ja 0x14017755d
cmp byte [rbx + 8], 0x20
jne 0x14017755d
movsx ecx, byte [rbx + 9]
lea eax, [rcx - 0x30]
cmp al, 9
ja 0x14017755d
movsx edx, byte [rbx + 0xa]
lea eax, [rdx - 0x30]
cmp al, 9
ja 0x14017755d
movsx r8d, byte [rbx + 0xb]
lea eax, [r8 - 0x30]
cmp al, 9
ja 0x14017755d
movzx eax, byte [rbx + 0xc]
sub al, 0x30
cmp al, 9
jbe 0x14017755d
lea ecx, [rcx + rcx*4]
lea ecx, [rdx + rcx*2]
lea ecx, [rcx + rcx*4]
lea ecx, [rcx - 0xa68]
lea ecx, [r8 + rcx*2]
mov dword [rdi + 0x13c], ecx
mov dword [rdi + 0x12c4], ecx
jmp 0x14017755d
mov byte [rbp + 0xad], 1
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x1401817e0
Capabilities:
Get hostname

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
movsxd rbx, edx
mov rdi, rcx
mov edx, ebx
mov byte [rcx], 0
call qword [sym.imp.WS2_32.dll_gethostname]
mov byte [rbx + rdi - 1], 0
test eax, eax
jne 0x14018181b
mov edx, reloc.WLDAP32.dll_Ordinal_46
mov rcx, rdi
call sub.VCRUNTIME140.dll_strchr
test rax, rax
je 0x140181819
mov byte [rax], 0
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140182cd0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push r15
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbp, rcx
mov ecx, dword [rcx + 0x20]
mov rsi, rdx
add rcx, 0x18
mov r15d, r8d
lea r9d, [rax + rax]
add rcx, r9
call qword [section..data]
mov rbx, rax
test rax, rax
jne 0x140182d13
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop rsi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbp
mov qword [rax + 8], rcx
mov eax, dword [rbp + 0x18]
add rax, rcx
mov qword [rsp + 0x48], rdi
mov qword [rbx + 0x10], rax
lea rdi, [rbp + 8]
mov qword [rsp + 0x50], r14
cmp r15d, dword [rbp + 0x1c]
jbe 0x140182d60
call qword [rbp]
mov rcx, qword [rbx + 8]
mov r8d, r15d
mov rdx, rsi
call qword [rdi]
mov esi, dword [rbp + 0x18]
add rsi, qword [rbx + 0x10]
mov rdx, qword [rbx + 8]
mov rcx, rsi
call qword [rbp + reloc.WS2_32.dll_recv]
mov r15d, dword [rbp + 0x20]
mov rcx, qword [rbx + 8]
call qword [rbp]
mov rcx, qword [rbx + 0x10]
call qword [rbp]
xor r14d, r14d
test r15, r15
je 0x140182dc2
mov r14, r15
nop dword [rax]
movzx eax, byte [rsi]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rbx + 8]
call qword [rdi]
movzx eax, byte [rsi]
lea rdx, [rsp + 0x40]
xor al, 0x5c
lea rsi, [rsi + 1]
mov byte [rsp + 0x40], al
mov r8d, 1
mov rcx, qword [rbx + 0x10]
call qword [rdi]
sub r15, 1
jne 0x140182d80
lea rdi, [rbp + 8]
mov eax, dword [rbp + 0x1c]
cmp r14, rax
jae 0x140182e01
nop word [rax + rax]
mov rcx, qword [rbx + 8]
lea rdx, [0x1403a9289]
mov r8d, 1
call qword [rdi]
mov rcx, qword [rbx + 0x10]
lea rdx, [0x1403a928a]
mov r8d, 1
call qword [rdi]
mov eax, dword [rbp + 0x1c]
inc r14
cmp r14, rax
jb 0x140182dd0
mov r14, qword [rsp + 0x50]
mov rax, rbx
mov rbx, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rsi
pop rbp
ret
Function at 0x140183c40
Capabilities:
Hash data using md4
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x14048bd00]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rsi, r8
mov dword [rsp + 0x20], 0xf0000040
mov rdi, rdx
mov rbx, rcx
xor ebp, ebp
lea rcx, [rsp + 0x38]
xor r8d, r8d
mov qword [rsp + 0x38], rbp
xor edx, edx
mov qword [rsp + 0x40], rbp
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x140183cc3
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x8002
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x140183ce5
mov rcx, qword [rsp + 0x38]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, 2
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140397b20
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
mov rcx, rsi
call fcn.140142700
mov rcx, qword [rsp + 0x40]
xor r9d, r9d
mov r8d, eax
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
mov rcx, qword [rsp + 0x40]
lea r9, [rsp + 0x30]
xor r8d, r8d
mov dword [rsp + 0x30], ebp
mov edx, 2
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
cmp dword [rsp + 0x30], 0x10
jne 0x140183d44
mov rcx, qword [rsp + 0x40]
lea r9, [rsp + 0x30]
mov r8, rbx
mov dword [rsp + 0x20], ebp
mov edx, 2
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140183d54
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140183d66
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
jmp 0x140183cc8
Function at 0x1401d2c40
Capabilities:
Get socket status

Disassembly:
push rbx
push rsi
push rdi
mov eax, 0x690
call fcn.1403983a0
sub rsp, rax
mov rax, qword [0x14048bd00]
xor rax, rsp
mov qword [rsp + 0x670], rax
mov rsi, qword [rsp + 0x6d8]
mov eax, edx
xor edx, edx
mov r10d, ecx
mov dword [rsp + 0x460], 0
mov dword [rsp + 0x250], 0
mov dword [rsp + 0x40], edx
cmp ecx, 0xffffffff
je 0x1401d2ca8
test eax, eax
je 0x1401d2ca8
mov qword [rsp + 0x468], r10
mov dword [rsp + 0x460], 1
cmp r8d, 0xffffffff
je 0x1401d2cc9
test r9d, r9d
je 0x1401d2cc9
mov eax, r8d
mov qword [rsp + 0x258], rax
mov dword [rsp + 0x250], 1
cmp r10d, 0xffffffff
je 0x1401d2cdd
mov edx, 1
mov qword [rsp + 0x48], r10
mov dword [rsp + 0x40], edx
cmp r8d, 0xffffffff
je 0x1401d2d12
xor eax, eax
test edx, edx
je 0x1401d2cfd
mov r9d, r8d
nop dword [rax]
cmp qword [rsp + rax*8 + 0x48], r9
je 0x1401d2cfd
inc eax
cmp eax, edx
jb 0x1401d2cf0
cmp eax, edx
jne 0x1401d2d12
cmp edx, 0x40
jae 0x1401d2d12
mov edx, r8d
mov qword [rsp + rax*8 + 0x48], rdx
inc dword [rsp + 0x40]
mov rbx, qword [rsp + 0x6d0]
cmp r8d, r10d
mov edi, r8d
cmovle edi, r10d
cmp r10d, 0xffffffff
jne 0x1401d2d3c
cmp r8d, r10d
jne 0x1401d2d3c
cmp rbx, 0xffffffffffffffff
jb 0x1401d2d3c
xor eax, eax
jmp 0x1401d2e72
mov qword [rsp + 0x6b8], rbp
mov qword [rsp + 0x688], r12
mov qword [rsp + 0x680], r15
test rsi, rsi
je 0x1401d2d61
mov rcx, rsi
call fcn.14024f450
lea ebp, [rdi + 1]
movabs r15, 0x12e0be826d694b2f
movabs r12, 0x624dd2f1a9fbe77
nop dword [rax + rax]
cmp rbx, 0xffffffffffffffff
jae 0x1401d2e0a
call fcn.140238ae0
cmp rax, rbx
jbe 0x1401d2d9b
mov ecx, 0x3e7
jmp 0x1401d2dbf
mov rcx, rbx
sub rcx, rax
mov rax, rcx
not rax
cmp rax, 0x3e7
jae 0x1401d2db8
mov rcx, 0xffffffffffffffff
jmp 0x1401d2dbf
add rcx, 0x3e7
mov r8, rcx
mov rax, r15
mul rcx
sub r8, rdx
shr r8, 1
add r8, rdx
shr r8, 0x1d
imul rax, r8, 0x3b9aca00
sub rcx, rax
mov rax, r12
mul rcx
mov eax, r8d
sub rcx, rdx
shr rcx, 1
add rdx, rcx
shr rdx, 9
mov edx, edx
shl rdx, 0x20
or rdx, rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x30], rdx
jmp 0x1401d2e0c
xor eax, eax
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x250]
mov ecx, ebp
lea rdx, [rsp + 0x460]
call qword [sym.imp.WS2_32.dll_select]
mov edi, eax
cmp eax, 0xffffffff
jne 0x1401d2e46
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2714
je 0x1401d2d80
mov r15, qword [rsp + 0x680]
mov r12, qword [rsp + 0x688]
mov rbp, qword [rsp + 0x6b8]
test rsi, rsi
je 0x1401d2e6b
mov rcx, rsi
call fcn.14024f3e0
not edi
shr edi, 0x1f
mov eax, edi
mov rcx, qword [rsp + 0x670]
xor rcx, rsp
call fcn.140397b20
add rsp, 0x690
pop rdi
pop rsi
pop rbx
ret
Function at 0x1401e1de0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
mov eax, gethostbyname
call fcn.1403983a0
sub rsp, rax
mov rax, qword [0x14048bd00]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rbx, qword [rdx + 0x18]
lea r9, [rsp + 0x20]
mov rdi, qword [rdx]
mov r8, qword [rdx + 0x10]
mov rdx, qword [rdx + 8]
call fcn.1401e1730
test eax, eax
je 0x1401e1e65
movzx ecx, byte [rdi]
shr cl, 3
not cl
and cl, 0x10
or cl, 0xf
and cl, byte [rsp + 0x20]
xor cl, byte [rdi]
mov byte [rdi], cl
and cl, 3
add cl, 1
je 0x1401e1e60
lea rdx, [rsp + 0x21]
movzx ecx, cl
sub rdx, rbx
nop dword [rax + rax]
movzx eax, byte [rbx + rdx]
xor byte [rbx], al
lea rbx, [rbx + 1]
sub rcx, 1
jne 0x1401e1e50
mov eax, 1
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140397b20
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x1401e1e80
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
mov eax, gethostbyname
call fcn.1403983a0
sub rsp, rax
mov rax, qword [0x14048bd00]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rbx, qword [rdx + 0x18]
lea r9, [rsp + 0x20]
mov rdi, qword [rdx]
mov r8, qword [rdx + 0x10]
mov rdx, qword [rdx + 8]
call fcn.1401e1730
test eax, eax
je 0x1401e1f09
movzx eax, byte [rdi]
and al, 3
add al, 1
je 0x1401e1ef0
lea rdx, [rsp + 0x21]
movzx ecx, al
sub rdx, rbx
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rbx + rdx]
xor byte [rbx], al
lea rbx, [rbx + 1]
sub rcx, 1
jne 0x1401e1ee0
movzx ecx, byte [rdi]
mov eax, 1
shr cl, 3
not cl
and cl, 0x10
or cl, 0xf
and cl, byte [rsp + 0x20]
xor byte [rdi], cl
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140397b20
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1401feeb0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
lea rsi, [rcx - 1]
movsxd rdi, r9d
not rcx
shr rsi, 0x3f
shr rcx, 0x3f
mov r11, rdx
and rsi, rcx
mov r10, r8
mov ecx, dword [rdx + 8]
dec rsi
xor ecx, dword [r8 + 8]
and ecx, esi
xor dword [rdx + 8], ecx
xor dword [r8 + 8], ecx
movq xmm4, rsi
mov ecx, dword [rdx + 0x10]
xor ecx, dword [r8 + 0x10]
and ecx, esi
punpcklqdq xmm4, xmm4
xor dword [rdx + 0x10], ecx
xor dword [r8 + 0x10], ecx
mov edx, dword [rdx + 0x14]
mov ecx, edx
mov eax, dword [r8 + 0x14]
xor rcx, rax
and ecx, 4
and rcx, rsi
mov eax, ecx
xor eax, edx
mov dword [r11 + 0x14], eax
xor dword [r8 + 0x14], ecx
xor ecx, ecx
mov edx, ecx
test r9d, r9d
jle 0x1401fefc9
cmp edi, 2
jb 0x1401fefc9
mov r9, qword [r8]
lea rax, [rdi - 1]
mov r8, qword [r11]
lea rbx, [rdi - 1]
lea rbx, [r9 + rbx*8]
lea rax, [r8 + rax*8]
cmp r9, rax
ja 0x1401fef5a
cmp rbx, r8
jae 0x1401fefc9
cmp r9, r10
ja 0x1401fef64
cmp rbx, r10
jae 0x1401fefc9
cmp r9, r11
ja 0x1401fef6e
cmp rbx, r11
jae 0x1401fefc9
cmp r8, r10
ja 0x1401fef78
cmp rax, r10
jae 0x1401fefc9
cmp r8, r11
ja 0x1401fef82
cmp rax, r11
jae 0x1401fefc9
mov eax, edi
and eax, 0xfffffffe
nop word [rax + rax]
movdqu xmm2, xmmword [rcx + r9]
add edx, 2
movdqu xmm1, xmmword [r8 + rcx]
lea rcx, [rcx + 0x10]
movdqa xmm3, xmm2
xorps xmm3, xmm1
andps xmm3, xmm4
movdqa xmm0, xmm3
xorps xmm3, xmm2
xorps xmm0, xmm1
movdqu xmmword [r8 + rcx - 0x10], xmm0
movdqu xmmword [rcx + r9 - 0x10], xmm3
cmp edx, eax
jl 0x1401fef90
movsxd rax, edx
cmp rax, rdi
jge 0x1401feffe
mov rcx, qword [r11]
mov rdx, qword [rcx + rax*8]
lea r8, [rcx + rax*8]
mov rcx, qword [r10]
mov r9, rdx
xor r9, qword [rcx + rax*8]
and r9, rsi
xor rdx, r9
mov qword [r8], rdx
mov rcx, qword [r10]
xor qword [rcx + rax*8], r9
inc rax
cmp rax, rdi
jl 0x1401fefd1
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
Function at 0x1401ff880
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
test byte [rcx + 0x14], 4
lea rax, [rcx + 8]
mov r11, qword [rcx]
lea rsi, [rdx + 8]
mov rbx, qword [rdx]
je 0x1401ff97d
mov ecx, dword [rsi]
cmp dword [rax], ecx
jne 0x1401ff97d
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rdi
xor edi, edi
mov ebp, edi
test ecx, ecx
jle 0x1401ff96a
sub r11, rbx
nop dword [rax]
nop word [rax + rax]
mov r8, qword [rbx + r11]
inc ebp
mov rdx, qword [rbx]
lea rbx, [rbx + 8]
mov rcx, r8
shr rdx, 0x3f
sub r8, qword [rbx - 8]
shr r8, 0x3f
xor r8d, edx
shr rcx, 0x3f
xor edx, ecx
or r8d, edx
xor r8d, ecx
neg r8d
mov dword [rsp + 0x10], r8d
not r8d
mov r10d, dword [rsp + 0x10]
mov dword [rsp + 0x10], r8d
mov r9d, dword [rsp + 0x10]
and edi, r9d
mov r8, qword [rbx - 8]
or edi, r10d
mov rdx, qword [rbx + r11 - 8]
mov rcx, r8
sub r8, qword [rbx + r11 - 8]
shr r8, 0x3f
shr rdx, 0x3f
xor r8d, edx
shr rcx, 0x3f
xor edx, ecx
or r8d, edx
xor r8d, ecx
neg r8d
mov dword [rsp + 0x10], r8d
not r8d
mov edx, dword [rsp + 0x10]
and edx, 1
mov dword [rsp + 0x10], r8d
mov ecx, dword [rsp + 0x10]
and edi, ecx
or edi, edx
cmp ebp, dword [rsi]
jl 0x1401ff8d0
mov rbp, qword [rsp + 0x18]
mov eax, edi
mov rdi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x28]
pop rsi
ret
mov ecx, dword [rax]
mov eax, ecx
sub eax, dword [rsi]
jne 0x1401ff9ab
lea eax, [rcx - 1]
movsxd rcx, eax
test eax, eax
js 0x1401ff9a9
lea rax, [rbx + rcx*8]
sub r11, rbx
mov rdx, qword [rax + r11]
cmp rdx, qword [rax]
jne 0x1401ff9b2
sub rax, 8
sub rcx, 1
jns 0x1401ff996
xor eax, eax
mov rbx, qword [rsp + 0x28]
pop rsi
ret
mov rbx, qword [rsp + 0x28]
mov eax, 0xffffffff
mov ecx, 1
cmova eax, ecx
pop rsi
ret
Function at 0x1401ffcb0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x40
call fcn.1403983a0
sub rsp, rax
xor r13d, r13d
mov r12d, r9d
mov r15d, r13d
mov edi, r13d
mov ebp, r13d
mov ebx, r8d
mov r14, rdx
mov rsi, rcx
call fcn.1401ff410
mov r8d, eax
add eax, 7
cdq
and edx, 7
add eax, edx
sar eax, 3
cmp dword [rsp + 0x90], r13d
jne 0x1401ffd2f
mov edi, dword [rsi + 0x10]
mov ecx, edi
neg ecx
lea ecx, [rax*8]
sbb r15d, r15d
movzx r15d, r15b
cmp ecx, r8d
jne 0x1401ffd2d
test edi, edi
sete bpl
jmp 0x1401ffd2f
mov ebp, edi
add eax, ebp
cmp ebx, 0xffffffff
jne 0x1401ffd63
mov ebx, eax
mov eax, dword [rsi + 0xc]
shl eax, 3
movsxd rdx, eax
test eax, eax
jne 0x1401ffdde
test ebx, ebx
je 0x1401ffe75
movsxd r8, ebx
xor edx, edx
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
jmp 0x1401ffe75
cmp ebx, eax
jge 0x1401ffd38
movups xmm2, xmmword [rsi]
movsxd rax, dword [rsi + 8]
movsd xmm0, qword [rsi + 0x10]
movsd qword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x20], xmm2
test eax, eax
jle 0x1401ffda4
movq rcx, xmm2
lea r8, [rcx + rax*8]
nop dword [rax + rax]
cmp qword [r8 - 8], r13
lea r8, [r8 - 8]
jne 0x1401ffda0
dec eax
test eax, eax
jg 0x1401ffd90
mov dword [rsp + 0x28], eax
mov ecx, dword [rsp + 0x30]
test eax, eax
cmove ecx, r13d
mov dword [rsp + 0x30], ecx
lea rcx, [rsp + 0x20]
call fcn.1401ff410
add eax, 7
cdq
and edx, 7
add eax, edx
sar eax, 3
add eax, ebp
cmp ebx, eax
jge 0x1401ffd38
mov rax, 0xffffffffffffffff
jmp 0x1401ffe77
cmp r12d, 1
je 0x1401ffded
lea eax, [rbx - 1]
movsxd rcx, eax
add r14, rcx
mov r11d, 1
movsxd rbp, ebx
cmp r12d, r11d
mov rax, 0xffffffffffffffff
lea r12, [rdx - 1]
cmovne r11, rax
mov eax, dword [rsi + 8]
shl eax, 3
xor r9d, r9d
xor r10d, r10d
movsxd r13, eax
test ebx, ebx
je 0x1401ffe75
nop dword [rax + rax]
mov rcx, qword [rsi]
movzx eax, r9b
and al, 7
mov rdx, r9
shl al, 3
shr rdx, 3
mov r8, qword [rcx + rdx*8]
movzx ecx, al
shr r8, cl
mov rax, r10
sub rax, r13
shr rax, 0x3f
neg al
and r8b, al
xor r8b, r15b
lea eax, [r8 + rdi]
cmp r8b, al
mov byte [r14], al
mov rax, r9
seta dil
sub rax, r12
shr rax, 0x3f
add r14, r11
add r9, rax
inc r10
cmp r10, rbp
jb 0x1401ffe20
mov eax, ebx
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x140220b10
Capabilities:
Set thread local storage value

Disassembly:
mov eax, Ordinal_41
call fcn.1403983a0
sub rsp, rax
mov ecx, dword [rcx]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
add rsp, 0x28
ret