joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14008ee40
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x78
mov rsi, rdx
mov rax, qword [0x14051d038]
xor rax, rsp
mov qword [rsp + 0x70], rax
lea r8, [rsp + 0x38]
mov qword [r8], 0
lea rdx, [0x14008b5d0]
mov ecx, 6
call qword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
cmp eax, 1
jne 0x14008efd2
lea rdi, [rsp + 0x38]
mov rcx, qword [rdi]
lea r8, [0x14049573e]
mov edx, 0x86
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
mov qword [rdi], 0
lea rdx, [0x14008b5d0]
mov ecx, 6
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
cmp eax, 1
jne 0x14008efcf
lea rdi, [rsp + 0x38]
mov rcx, qword [rdi]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r14, rax
mov qword [rdi], 0
lea rdx, [0x14008b5d0]
mov ecx, 6
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
cmp eax, 1
jne 0x14008efd5
mov rcx, qword [rsp + 0x38]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
lea rcx, [0x14048ad72]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], 1
mov ecx, eax
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x30], rcx
test r14, r14
jne 0x14008ef42
test eax, eax
jne 0x14008f004
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.1401535c0
movzx eax, byte [rsp + 0x4f]
test al, al
js 0x14008ef5d
and eax, 0x7f
jmp 0x14008ef67
mov rax, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x38]
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rax
test rax, rax
js 0x14008efd8
test rdi, rdi
jne 0x14008ef84
test rax, rax
jne 0x14008f004
mov dword [rsp + 0x20], 0
lea rdx, [rsp + 0x50]
lea r8, [rsp + 0x60]
mov rcx, rsi
mov r9d, 1
call fcn.140144da0
cmp byte [rsp + 0x4f], 0
jns 0x14008efb5
mov rcx, qword [rsp + 0x38]
call fcn.1402dd16c
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1402ddd70
mov rax, rsi
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r14
ret
int3
int3
int3
lea rax, str.string_view::string_view__CharT___size_t_:_length_does_not_fit_in_difference_type
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude_string_view
lea r9, str.__len___static_cast_size_type__numeric_limits_difference_type_::max___
mov r8d, 0x13a
call fcn.14032ac00
lea rax, str.string_view::string_view__CharT___size_t_:_received_nullptr
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude_string_view
lea r9, str.__len__0____s___nullptr
mov r8d, 0x13c
call fcn.14032ac00
int3
Function at 0x14008f330
Capabilities:
Create process on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x160
movaps xmmword [rsp + 0x150], xmm6
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x14051d038]
xor rax, rsp
mov qword [rsp + 0x148], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0xe0], xmm0
movups xmmword [rsp + 0x130], xmm0
movups xmmword [rsp + 0x120], xmm0
movups xmmword [rsp + 0x110], xmm0
movups xmmword [rsp + 0x100], xmm0
movups xmmword [rsp + 0xf0], xmm0
mov qword [rsp + 0x140], 0
movabs rax, 0x4000000070
mov qword [rsp + 0xd8], rax
lea rax, str.runas
mov qword [rsp + 0xe8], rax
movabs r15, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0xd0], r15
movaps xmm6, xmmword [0x14047fb40]
movaps xmmword [rsp + 0xc0], xmm6
lea r14, [rsp + 0x60]
mov rcx, r8
mov rdx, r14
call fcn.140160900
cmp byte [r14 + 0x17], 0
js 0x14008f431
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0xd0], rax
movups xmm0, xmmword [rsp + 0x60]
movaps xmmword [rsp + 0xc0], xmm0
lea rcx, [rsp + 0x60]
call fcn.14026e190
cmp byte [rsp + 0xd7], 0
jns 0x14008f44a
mov rax, qword [rsp + 0xc0]
jmp 0x14008f452
mov rdx, qword [rsp + 0x60]
mov r8, qword [rsp + 0x68]
lea rcx, [rsp + 0xc0]
call fcn.14013b6d0
jmp 0x14008f413
lea rax, [rsp + 0xc0]
mov qword [rsp + 0xf0], rax
lea r14, [rsp + 0xa0]
mov qword [r14 + 0x10], r15
movaps xmmword [r14], xmm6
mov rcx, rbx
mov rdx, r14
call fcn.140161e70
cmp byte [r14 + 0x17], 0
jns 0x14008f484
mov r14, qword [rsp + 0xa0]
lea rbx, [rsp + 0xd8]
mov qword [rbx + 0x20], r14
mov dword [rbx + 0x30], 5
lea r14, [rsp + 0x60]
movaps xmmword [r14 + 0x30], xmm6
movaps xmmword [r14 + 0x20], xmm6
movaps xmmword [r14 + 0x10], xmm6
movaps xmmword [r14], xmm6
lea rdx, str.RunElevatedProcess
lea r8, str.....operadesktopwindowsos_operationsos_operations_impl.cc
lea r15, [rsp + 0x40]
mov rcx, r15
mov r9d, 0x17d
call fcn.14026d510
mov rcx, r14
mov rdx, r15
xor r8d, r8d
call fcn.14025d230
mov rcx, rbx
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x14008f57f
mov rdx, qword [rsp + 0x140]
lea rbx, [rsp + 0x30]
mov rcx, rbx
call fcn.1401459f0
mov rax, qword [rdi]
mov rax, qword [rax + 0xc0]
mov rcx, rdi
mov rdx, rsi
mov r8, rbx
call qword [case.0x14012d181.0]
lea rcx, [rsp + 0x60]
call fcn.14025d470
cmp byte [rsp + 0xb7], 0
jns 0x14008f53e
mov rcx, qword [rsp + 0xa0]
call fcn.1402dd16c
cmp byte [rsp + 0xd7], 0
jns 0x14008f555
mov rcx, qword [rsp + 0xc0]
call fcn.1402dd16c
mov rcx, qword [rsp + 0x148]
xor rcx, rsp
call fcn.1402ddd70
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x150]
add rsp, 0x160
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
lea rbx, [rsp + 0x20]
mov rcx, rbx
xor edx, edx
jmp 0x14008f4ff

Function at 0x14008fba0
Capabilities:
Check if file exists
Delete directory
Delete file

Disassembly:
mov rcx, rdx
test r8b, r8b
je fcn.140149290
jmp fcn.140149530

Function at 0x14008fbd0
Capabilities:
Move file

Disassembly:
mov rcx, rdx
mov rdx, r8
jmp fcn.14037b350
Function at 0x14008fdf0
Capabilities:
Query or enumerate registry value

Disassembly:
add rcx, 0x18
cmp byte [rdx + 0x17], 0
jns 0x140141b90
mov rdx, qword [rdx]
jmp 0x140141b90
sub rsp, 0x38
mov rcx, qword [rcx]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
sete al
add rsp, 0x38
ret

Function at 0x1400900e0
Capabilities:
Query or enumerate registry key

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x14051d038]
xor rax, rsp
mov qword [rsp + 0x80], rax
lea r14, [rsp + 0x64]
mov dword [r14], 0x104
lea rbx, [rcx + 0x30]
mov edx, 0x104
mov rcx, rbx
call fcn.140144740
mov edx, dword [rdi + 0x78]
mov rcx, qword [rdi + 0x48]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x20], xmm0
mov r8, rax
mov r9, r14
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
inc dword [rdi + 0x78]
test eax, eax
je 0x140090181
add rdi, 0x60
mov rcx, rdi
call fcn.140377960
mov qword [rsi], 0
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1402ddd70
mov rax, rsi
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
lea rdx, [rdi + 0x10]
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r14, [rsp + 0x40]
mov qword [r14 + 0x10], rax
movaps xmm0, xmmword [0x14047fb40]
movaps xmmword [r14], xmm0
lea r8, [0x140495954]
mov rcx, r14
call fcn.14003c250
movzx eax, byte [r14 + 0x17]
mov rcx, r14
test al, al
jns 0x1400901c8
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
mov word [rcx + rax*2], 0
movzx r8d, byte [rdi + 0x47]
test r8b, r8b
js 0x1400901de
and r8d, 0x7f
jmp 0x1400901e6
mov r8, qword [rdi + 0x38]
mov rbx, qword [rdi + 0x30]
mov rcx, r14
mov rdx, rbx
call fcn.14013baa0
cmp byte [rsp + 0x57], 0
jns 0x1400901fd
mov r14, qword [rsp + 0x40]
mov ecx, 0x50
call fcn.1402dd130
mov rbx, rax
mov ebp, dword [rdi + 0x28]
lea r15, [rsp + 0x68]
mov rcx, r15
mov rdx, r14
call fcn.14031d9e0
mov rdi, qword [rdi + 8]
lea rax, fcn.14008fd30
mov qword [rbx], rax
mov qword [rbx + 8], rdi
mov dword [rbx + 0x10], ebp
lea r14, [rbx + 0x18]
mov rcx, r14
call fcn.1401419c0
mov rcx, rbx
add rcx, 0x30
cmp byte [r15 + 0x17], 0
js 0x14009029f
mov rax, qword [rsp + 0x78]
mov qword [rcx + 0x10], rax
movups xmm0, xmmword [rsp + 0x68]
movups xmmword [rcx], xmm0
mov rcx, r14
mov rdx, rdi
mov r8, r15
mov r9d, ebp
call fcn.140141ac0
mov dword [rbx + 0x48], eax
cmp byte [rsp + 0x7f], 0
jns 0x140090282
mov rcx, qword [rsp + 0x68]
call fcn.1402dd16c
mov qword [rsi], rbx
cmp byte [rsp + 0x57], 0
jns 0x14009015e
mov rcx, qword [rsp + 0x40]
call fcn.1402dd16c
jmp 0x14009015e
mov rdx, qword [rsp + 0x68]
mov r8, qword [rsp + 0x70]
call fcn.14013b6d0
cmp byte [rsp + 0x7f], 0
jns 0x1400902bc
mov r15, qword [rsp + 0x68]
jmp 0x14009025d
lea r15, [rsp + 0x68]
jmp 0x14009025d
Function at 0x1400a6900
Capabilities:
Delete directory

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x188
mov rsi, rcx
mov rax, qword [0x14051d038]
xor rax, rsp
mov qword [rsp + 0x180], rax
lea rax, [0x140483f70]
mov qword [rcx], rax
cmp byte [rcx + 0x38], 0
je 0x1400a69a3
lea rcx, str.....operadesktopwindowsinstaller_transactionsdelete_file_operation.cc
mov edx, VarR8FromUI1
call fcn.14026ce00
test eax, eax
jg 0x1400a6a67
lea rdi, [rsi + 0x20]
mov rcx, rdi
call fcn.140149530
test al, al
jne 0x1400a6962
mov rcx, rdi
call fcn.14037a440
cmp byte [rsi + 0x3a], 0
je 0x1400a6a13
lea rcx, [rsi + 8]
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x40]
mov qword [rdi + 0x10], rax
movaps xmm0, xmmword [0x14047fb40]
movaps xmmword [rdi], xmm0
mov rdx, rdi
call fcn.14026e9d0
mov r14, qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea rbx, [rsp + 0x28]
jmp 0x1400a69fd
cmp qword [rsi + 0x40], 0
je 0x1400a6a13
lea rdi, [rsi + 0x40]
mov rcx, qword [0x14053b8f8]
test rcx, rcx
jne 0x1400a69c9
call fcn.140088f90
mov rcx, rax
mov qword [0x14053b8f8], rax
mov rdx, rdi
call fcn.140089f30
jmp 0x1400a6a13
mov rcx, qword [rsp + 0x40]
call r14
test eax, eax
je 0x1400a6a09
mov rcx, rdi
mov rdx, rbx
call fcn.14026e9d0
mov rcx, rdi
mov rdx, rbx
call fcn.14026e210
mov rcx, rbx
call fcn.14026e190
cmp byte [rsp + 0x57], 0
mov rcx, rdi
jns 0x1400a69d8
jmp 0x1400a69d3
lea rcx, [rsp + 0x40]
call fcn.14026e190
mov rdi, qword [rsi + 0x40]
mov qword [rsi + 0x40], 0
test rdi, rdi
je 0x1400a6a34
mov rcx, rdi
call fcn.14008af70
mov rcx, rdi
call fcn.1402dd16c
lea rcx, [rsi + 0x20]
call fcn.14026e190
add rsi, 8
mov rcx, rsi
call fcn.14026e190
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.1402ddd70
nop
add rsp, 0x188
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rdx, str.....operadesktopwindowsinstaller_transactionsdelete_file_operation.cc
lea rdi, [rsp + 0x40]
mov rcx, rdi
mov r8d, 0x25
mov r9d, 0xffffffff
call fcn.14015a460
lea rcx, [rsp + 0x50]
lea rdx, str.Actual_removal_of
mov r8d, reloc.WS2_32.dll_select
call fcn.14031d7c0
lea rdx, [rsi + 0x20]
mov rcx, rax
call fcn.140153670
mov rcx, rdi
call fcn.14015aab0
jmp 0x1400a694a
Function at 0x1400a9200
Capabilities:
Delete directory

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x68
mov rsi, rcx
mov rax, qword [0x14051d038]
xor rax, rsp
mov qword [rsp + 0x60], rax
lea rax, [0x140483fb0]
mov qword [rcx], rax
cmp byte [rcx + 0x40], 0
je 0x1400a92a2
lea rcx, [rsi + 0x10]
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x40]
mov qword [rdi + 0x10], rax
movaps xmm0, xmmword [0x14047fb40]
movaps xmmword [rdi], xmm0
mov rdx, rdi
call fcn.14026e9d0
mov r14, qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea rbx, [rsp + 0x28]
jmp 0x1400a928c
mov rcx, qword [rsp + 0x40]
call r14
test eax, eax
je 0x1400a9298
mov rcx, rdi
mov rdx, rbx
call fcn.14026e9d0
mov rcx, rdi
mov rdx, rbx
call fcn.14026e210
mov rcx, rbx
call fcn.14026e190
cmp byte [rsp + 0x57], 0
mov rcx, rdi
jns 0x1400a9267
jmp 0x1400a9262
lea rcx, [rsp + 0x40]
call fcn.14026e190
lea rcx, [rsi + 0x28]
call fcn.14026e190
lea rcx, [rsi + 0x10]
call fcn.14026e190
mov rcx, qword [rsi + 8]
movabs rax, 0xfffffffc00000000
and rax, rcx
cmp rax, qword [0x14051e188]
jne 0x1400a92d3
call fcn.140221f80
mov qword [rsi + 8], 0
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1402ddd70
nop
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x1400df280
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rsi, rcx
mov rax, qword [0x14051d038]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov eax, dword [0x14053bd98]
mov ecx, dword [0x14052f0f0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400df2fa
mov rax, qword [0x14053bd90]
mov qword [rsi], rax
test rax, rax
je 0x1400df2e0
mov ecx, 1
lock xadd dword [rax], ecx
cmp ecx, 0x7fffffff
je 0x1400df3dc
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1402ddd70
mov rax, rsi
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, [0x14053bd98]
call fcn.1402dd290
cmp dword [0x14053bd98], 0xffffffff
jne 0x1400df2bc
mov eax, dword [0x14053bdb8]
mov ecx, dword [0x14052f0f0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400df3df
lea rdi, [0x14053bda0]
mov edx, 0xc4
mov rcx, rdi
call fcn.14024faa0
xor ebx, ebx
lea r14, [0x14049b510]
mov dl, byte [rbx + r14]
xor dl, 0x55
mov rcx, rdi
call fcn.14024fd80
inc rbx
cmp rbx, 0xc4
jne 0x1400df351
xorps xmm0, xmm0
lea rdx, [rsp + 0x30]
movaps xmmword [rdx], xmm0
mov qword [rdx + 0x10], 0
lea rcx, [0x14053bda0]
call fcn.140392c50
test al, al
je 0x1400df415
lea rcx, [rsp + 0x28]
lea rdi, [rsp + 0x30]
movabs r8, 0x100000002
mov rdx, rdi
call fcn.1400b9ec0
cmp byte [rdi + 0x17], 0
jns 0x1400df3bf
mov rcx, qword [rsp + 0x30]
call fcn.1402dd16c
mov rax, qword [rsp + 0x28]
mov qword [0x14053bd90], rax
lea rcx, [0x14053bd98]
call fcn.1402dd328
jmp 0x1400df2bc
int3
lea rcx, [0x14053bdb8]
call fcn.1402dd290
cmp dword [0x14053bdb8], 0xffffffff
jne 0x1400df334
lea rcx, [0x1400df890]
call fcn.1402dd620
lea rcx, [0x14053bdb8]
call fcn.1402dd328
jmp 0x1400df334
int3
Function at 0x1400e0000
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rsi, rcx
mov rax, qword [0x14051d038]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov eax, dword [0x14053bdc8]
mov ecx, dword [0x14052f0f0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400e007a
mov rax, qword [0x14053bdc0]
mov qword [rsi], rax
test rax, rax
je 0x1400e0060
mov ecx, 1
lock xadd dword [rax], ecx
cmp ecx, 0x7fffffff
je 0x1400e015c
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1402ddd70
mov rax, rsi
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, [0x14053bdc8]
call fcn.1402dd290
cmp dword [0x14053bdc8], 0xffffffff
jne 0x1400e003c
mov eax, dword [0x14053bde8]
mov ecx, dword [0x14052f0f0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400e015f
lea rdi, [0x14053bdd0]
mov edx, 0x2659
mov rcx, rdi
call fcn.14024faa0
xor ebx, ebx
lea r14, [0x14049b910]
mov dl, byte [rbx + r14]
xor dl, 0x55
mov rcx, rdi
call fcn.14024fd80
inc rbx
cmp rbx, 0x2659
jne 0x1400e00d1
xorps xmm0, xmm0
lea rdx, [rsp + 0x30]
movaps xmmword [rdx], xmm0
mov qword [rdx + 0x10], 0
lea rcx, [0x14053bdd0]
call fcn.140392c50
test al, al
je 0x1400e0195
lea rcx, [rsp + 0x28]
lea rdi, [rsp + 0x30]
movabs r8, 0x100000671
mov rdx, rdi
call fcn.1400b9ec0
cmp byte [rdi + 0x17], 0
jns 0x1400e013f
mov rcx, qword [rsp + 0x30]
call fcn.1402dd16c
mov rax, qword [rsp + 0x28]
mov qword [0x14053bdc0], rax
lea rcx, [0x14053bdc8]
call fcn.1402dd328
jmp 0x1400e003c
int3
lea rcx, [0x14053bde8]
call fcn.1402dd290
cmp dword [0x14053bde8], 0xffffffff
jne 0x1400e00b4
lea rcx, [0x1400e01d0]
call fcn.1402dd620
lea rcx, [0x14053bde8]
call fcn.1402dd328
jmp 0x1400e00b4
int3
Function at 0x1400ed970
Capabilities:
Set socket configuration

Disassembly:
push rsi
sub rsp, 0x40
mov rax, qword [0x14051d038]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x34], 0x4020
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x2c], 4
mov eax, dword [0x14053be28]
cmp eax, 2
je 0x1400eda3b
mov rsi, rcx
test eax, eax
jne 0x1400ed9e9
mov dword [rsp + 0x20], 3
mov ecx, 6
xor edx, edx
xor r8d, r8d
mov r9d, 2
call fcn.140127f00
test al, al
je 0x1400ed9df
mov dword [0x14053be28], 2
jmp 0x1400eda3b
mov dword [0x14053be28], 1
lea rax, [rsp + 0x2c]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
mov rcx, rsi
mov edx, 0xffff
mov r8d, 0x1001
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x1400eda1a
cmp dword [rsp + 0x30], 0x4020
jg 0x1400eda3b
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x34]
mov rcx, rsi
mov edx, 0xffff
mov r8d, 0x1001
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1402ddd70
nop
add rsp, 0x40
pop rsi
ret

Function at 0x1400ef120
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rsi
push rdi
sub rsp, 0x1b8
mov rax, qword [0x14051d038]
xor rax, rsp
mov qword [rsp + 0x1b0], rax
mov rax, qword [rdx + 0x20]
mov rax, qword [rax + 0x2e8]
test byte [rax + 0x85], 8
jne 0x1400ef1e5
mov rsi, rdx
mov rdi, qword [rcx + 0x10]
lea rcx, [rsp + 0xb0]
mov r8d, 0x100
mov dl, 0xaa
call fcn.1402e0d10
lea r8, [rsp + 0x2c]
mov dword [r8], 0x80
xorps xmm0, xmm0
lea rdx, [rsp + 0x30]
movaps xmmword [rdx], xmm0
movaps xmmword [rdx + 0x10], xmm0
movaps xmmword [rdx + 0x20], xmm0
movaps xmmword [rdx + 0x30], xmm0
movaps xmmword [rdx + 0x40], xmm0
movaps xmmword [rdx + 0x50], xmm0
movaps xmmword [rdx + 0x60], xmm0
movaps xmmword [rdx + 0x70], xmm0
mov rcx, qword [rdi + 0x98]
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x1400ef200
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
lea rdx, [rsp + 0xb0]
mov r8d, 0x100
mov ecx, eax
call fcn.14011ad80
lea rdx, str.getsockname___failed_with_errno__d:__s
mov rcx, rsi
mov r8d, edi
mov r9, rax
call fcn.1400f8040
mov rcx, qword [rsp + 0x1b0]
xor rcx, rsp
call fcn.1402ddd70
nop
add rsp, 0x1b8
pop rdi
pop rsi
ret
lea r9, [rdi + 0x144]
add rdi, 0x114
mov edx, dword [rsp + 0x2c]
lea rcx, [rsp + 0x30]
mov r8, rdi
call fcn.1400f1be0
test al, al
jne 0x1400ef1e5
call fcn.1402f47d8
mov ecx, dword [rax]
lea rdx, [rsp + 0xb0]
mov r8d, 0x100
call fcn.14011ad80
mov rdi, rax
call fcn.1402f47d8
mov r8d, dword [rax]
lea rdx, str.ssloc_inet_ntop___failed_with_errno__d:__s
mov rcx, rsi
mov r9, rdi
jmp 0x1400ef1e0
Function at 0x1400efd70
Capabilities:
Receive data
Receive data on socket

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x138
mov rdi, r9
mov rsi, r8
mov r14, rcx
mov rax, qword [0x14051d038]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
mov dword [r9], 0
mov rcx, qword [rax + 0x98]
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recv]
mov ebx, eax
cmp eax, 0xffffffff
je 0x1400efe21
mov rcx, qword [r14 + 8]
test rcx, rcx
je 0x1400efdfb
cmp byte [rcx + 0xa2f], 0
je 0x1400efdfb
mov rdx, qword [r14]
test rdx, rdx
je 0x1400efdfb
mov rax, qword [rdx]
cmp dword [rax + 0xc], 0
jle 0x1400efdfb
mov eax, dword [rdi]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ebx
lea r8, str.nw_in_read_len_zu______d__err_d
mov r9, rsi
call fcn.1400f8200
movsxd rsi, ebx
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1402ddd70
mov rax, rsi
add rsp, 0x138
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x1400efe36
mov dword [rdi], 0x51
jmp 0x1400efdbf
mov ebp, eax
lea r15, [rsp + 0x30]
mov r8d, 0x100
mov rcx, r15
mov dl, 0xaa
call fcn.1402e0d10
mov r8d, 0x100
mov ecx, ebp
mov rdx, r15
call fcn.14011ad80
mov rcx, qword [r14 + 8]
lea rdx, str.Recv_failure:__s
mov r8, rax
call fcn.1400f8040
mov rax, qword [r14 + 8]
mov dword [rax + 0xcf4], ebp
mov dword [rdi], 0x38
jmp 0x1400efdbf

Function at 0x1400f5b80
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
test rcx, rcx
je 0x1400f5b98
mov rsi, rcx
call fcn.1400fcf70
test al, al
je 0x1400f5ba9
xor eax, eax
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
mov eax, 5
jmp 0x1400f5b9a
mov rcx, rsi
call fcn.140303550
mov rdi, rax
mov rcx, rsi
mov edx, 0x2e
mov r8, rax
call fcn.1400f75e0
test rax, rax
je 0x1400f5bec
sub rax, rsi
mov rcx, rsi
mov edx, 0x2e
mov r8, rax
call fcn.1400f75e0
test rax, rax
je 0x1400f5bec
inc rax
add rdi, rsi
sub rdi, rax
jmp 0x1400f5bee
xor eax, eax
test rax, rax
cmovne rsi, rax
test rdi, rdi
jle 0x1400f5ba2
add rdi, rsi
mov eax, 0x1505
mov rbx, rax
shl rbx, 5
add rbx, rax
mov cl, byte [rsi]
inc rsi
call fcn.14011a690
movzx eax, al
xor rax, rbx
cmp rsi, rdi
jb 0x1400f5c02
movzx eax, al
jmp 0x1400f5b9a
Function at 0x1400f6f00
Capabilities:
Resolve dns

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
movaps xmmword [rsp + 0x30], xmm6
mov rsi, r9
mov rax, qword [0x14051d038]
xor rax, rsp
mov qword [rsp + 0x28], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r9, [rsp + 0x20]
mov qword [r9], rax
mov qword [rsi], 0
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov ebx, eax
test eax, eax
je 0x1400f6f71
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1402ddd70
mov eax, ebx
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r13, qword [rsp + 0x20]
test r13, r13
je 0x1400f6f9e
xor ebp, ebp
xorps xmm6, xmm6
xor edi, edi
jmp 0x1400f7077
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x1400f6f97
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
xor ebx, ebx
test rdi, rdi
jne 0x1400f6fb0
mov ebx, 0x2af9
mov ecx, 0x2af9
call qword [sym.imp.WS2_32.dll_WSASetLastError]
xor edi, edi
mov qword [rsi], rdi
jmp 0x1400f6f4c
mov rax, qword [fcn.140225e50]
lea rcx, [rbx + r15]
add rcx, 0x30
call qword [case.0x14012d181.0]
test rax, rax
je 0x1400f70a5
mov r14, rax
mov eax, dword [r13]
mov dword [r14], eax
mov eax, dword [r13 + 4]
mov dword [r14 + 4], eax
mov eax, dword [r13 + 8]
mov dword [r14 + 8], eax
mov eax, dword [r13 + 0xc]
mov dword [r14 + 0xc], eax
mov dword [r14 + 0x10], r15d
lea r12, [r14 + 0x30]
movups xmmword [r14 + 0x18], xmm6
mov qword [r14 + 0x28], 0
mov qword [r14 + 0x20], r12
mov rdx, qword [r13 + 0x20]
mov rcx, r12
mov r8, r15
call fcn.1402e0660
test rbx, rbx
je 0x1400f703b
lea rax, [r14 + 0x18]
add r12, r15
mov qword [rax], r12
mov rdx, qword [r13 + 0x18]
mov rcx, r12
mov r8, rbx
call fcn.1402e0660
test rdi, rdi
cmove rdi, r14
test rbp, rbp
je 0x1400f7067
mov qword [rbp + 0x28], r14
jmp 0x1400f7067
mov r15d, reloc.WS2_32.dll_recv
cmp qword [r13 + 0x20], 0
je 0x1400f7064
cmp qword [r13 + 0x10], r15
jae 0x1400f6fb5
mov r14, rbp
mov r13, qword [r13 + 0x28]
mov rbp, r14
test r13, r13
je 0x1400f6f87
mov rcx, qword [r13 + 0x18]
test rcx, rcx
je 0x1400f70a1
call fcn.140303550
mov rbx, rax
inc rbx
mov eax, dword [r13 + 4]
cmp eax, 2
je 0x1400f704d
cmp eax, 0x17
jne 0x1400f7064
mov r15d, 0x1c
jmp 0x1400f7053
xor ebx, ebx
jmp 0x1400f708b
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x1400f70b5
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
mov ebx, 8
test rdi, rdi
je 0x1400f6fae
mov r14, qword [rdi + 0x28]
mov rax, qword [fcn.140225eb0]
mov rcx, rdi
call qword [case.0x14012d181.0]
mov rdi, r14
test r14, r14
jne 0x1400f70c3
jmp 0x1400f6fae