joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400633f0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 9], 0
je 0x140063413
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x15]
xor byte [rcx + rax], dl
inc rax
cmp rax, 8
jb 0x140063400
mov byte [rcx + 9], 0
mov rax, rcx
ret

Function at 0x140063420
Capabilities:
Encode data using xor

Disassembly:
push r14
push r15
sub rsp, 0x48
mov rax, qword [0x14067e680]
xor rax, rsp
mov qword [rsp + 0x38], rax
movsxd rdx, dword [rcx + 0x3c]
xor r9d, r9d
add rdx, rcx
mov r14, rcx
movzx eax, word [rdx + 0x14]
movzx r11d, word [rdx + 6]
lea r15, [rax + rdx]
test r11, r11
je 0x140063551
mov qword [rsp + 0x68], rbx
lea r10, [r15 + 0x18]
movzx ebx, byte [reloc.WS2_32.dll_WSACleanup]
mov qword [rsp + 0x70], rbp
xor bl, 0xec
movzx ebp, byte [reloc.WS2_32.dll_WSACleanup]
mov qword [rsp + 0x78], rsi
movzx esi, byte [0x1406511af]
mov qword [rsp + 0x40], rdi
xor sil, 0xee
movzx edi, byte [0x1406511ae]
xor dil, 0xed
xor bpl, 0xef
nop dword [rax]
mov byte [rsp + 0x20], Ordinal_200
xor eax, eax
mov byte [rsp + 0x21], bl
mov byte [rsp + 0x22], dil
mov byte [rsp + 0x23], sil
mov byte [rsp + 0x24], bpl
mov word [rsp + 0x25], 0x100
nop dword [rax]
nop word [rax + rax]
lea ecx, [rax - 0x15]
xor byte [rsp + rax + 0x20], cl
inc rax
cmp rax, 5
jb 0x1400634d0
lea r8, [rsp + 0x20]
mov byte [rsp + 0x26], 0
sub r8, r10
mov rax, r10
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140063503
inc rax
test ecx, ecx
jne 0x1400634f0
test edx, edx
je 0x140063515
inc r9
add r10, 0x28
cmp r9, r11
jb 0x1400634a0
jmp 0x14006353d
lea rax, [r9 + r9*4]
xorps xmm0, xmm0
mov ecx, dword [r15 + rax*8 + 0x24]
lea r8, [rsp + 0x28]
mov edx, dword [r15 + rax*8 + 0x20]
add rcx, r14
movups xmmword [rsp + 0x28], xmm0
call fcn.14005ed80
lea rax, [rsp + 0x28]
mov rsi, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14025efe0
add rsp, 0x48
pop r15
pop r14
ret

Function at 0x1400636f0
Capabilities:
Allocate or change rwx memory
Enumerate process modules
Execute shellcode via indirect call
Read file via mapping

Disassembly:
push r12
sub rsp, 0x4d0
mov rax, qword [0x14067e680]
xor rax, rsp
mov qword [rsp + 0x4a8], rax
lea rcx, [0x1406511b4]
jmp 0x14092d9c3
Function at 0x14006e960
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov eax, 0x5a4d
xor edi, edi
mov rbx, r8
mov rsi, rcx
cmp word [rdx], ax
je 0x14006e9a1
mov qword [rcx], rdi
mov qword [rcx + 8], rdi
mov rdx, qword [r8 + 0x18]
cmp rdx, 0xf
jbe 0x14006ea5e
mov rcx, qword [r8]
jmp 0x14006ea35
movsxd rcx, dword [rdx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
je 0x14006e9b9
mov qword [rsi], rdi
mov qword [rsi + 8], rdi
jmp 0x14006e98b
movzx r14d, word [rcx + 0x14]
movzx r9d, di
movzx r11d, word [rcx + 6]
add r14, rcx
cmp di, r11w
jae 0x14006ea21
mov rbp, qword [r8 + 0x18]
mov r8, rbx
cmp rbp, 0xf
jbe 0x14006e9e0
mov r8, qword [rbx]
movzx eax, r9w
lea rcx, [rax + rax*4]
lea r10, [rcx*8]
lea rax, [r14 + 0x18]
add rax, r10
sub r8, rax
nop word [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x14006ea13
inc rax
test ecx, ecx
jne 0x14006ea00
test edx, edx
je 0x14006ea83
inc r9w
cmp r9w, r11w
jb 0x14006e9d4
mov qword [rsi], rdi
mov qword [rsi + 8], rdi
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x14006ea5e
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x14006ea59
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14006ea96
mov rcx, r8
call fcn.14025f000
mov rbp, qword [rsp + 0x58]
mov rax, rsi
mov byte [rbx], dil
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov qword [rbx + 0x10], rdi
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
mov eax, dword [r10 + r14 + 0x20]
mov qword [rsi], rax
mov eax, dword [r10 + r14 + 0x24]
mov qword [rsi + 8], rax
jmp 0x14006ea28
call fcn.14026ebe4
int3
Function at 0x14006fb90
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rax, qword [0x14067e680]
xor rax, rsp
mov qword [rsp + 0x28], rax
xor ebp, ebp
mov esi, ecx
mov edi, 0x100
mov dword [rsp + 0x20], ebp
mov edx, edi
lea ecx, [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rax, rax
je 0x14006fc19
lea r9, [rsp + 0x20]
mov r8d, edi
mov rdx, rbx
mov ecx, esi
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x14006fc3d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov edi, dword [rsp + 0x20]
mov ecx, 0x40
add edi, 0x100
mov dword [rsp + 0x20], ebp
mov edx, edi
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rax, rax
jne 0x14006fbd3
xor eax, eax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14025efe0
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
test eax, eax
jns 0x14006fc51
test rbx, rbx
je 0x14006fc19
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x14006fc19
mov rax, rbx
jmp 0x14006fc1b
Function at 0x140070b70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x20
mov r10, qword [0x1406883b0]
lea r13, str.memcpy
mov r15, r9
mov r12, rdx
test r10, r10
je 0x140070c5a
cmp qword [0x140688408], 0
je 0x140070c5a
mov eax, dword [r10 + 0x3c]
mov r11d, dword [rax + r10 + 0x88]
mov r14d, dword [rax + r10 + 0x8c]
test r11d, r11d
je 0x140070c5a
mov r8d, dword [r10 + r11 + 0x1c]
lea rax, [r10 + r11]
test r8d, r8d
je 0x140070c5a
mov ecx, dword [rax + 0x24]
test ecx, ecx
je 0x140070c5a
mov edx, dword [rax + 0x20]
test edx, edx
je 0x140070c5a
mov ebx, dword [rax + 0x18]
lea rsi, [r10 + r8]
xor r8d, r8d
lea rbp, [r10 + rcx]
lea r9, [r10 + rdx]
test ebx, ebx
je 0x140070c5a
nop dword [rax + rax]
mov edx, dword [r9]
add rdx, r10
xor eax, eax
nop dword [rax + rax]
movzx ecx, byte [rdx + rax]
inc rax
cmp cl, byte [rax + r13 - 1]
jne 0x140070c96
cmp rax, 7
jne 0x140070c20
movzx ecx, word [rbp + r8*2]
mov edx, dword [rsi + rcx*4]
test edx, edx
je 0x140070c5a
cmp edx, r11d
jbe 0x140070c4e
lea eax, [r14 + r11]
cmp edx, eax
jb 0x140070c5a
mov rax, rdx
add rax, qword [0x140688408]
jne 0x140070c80
mov r8d, 2
lea rdx, [0x140651724]
mov rcx, r13
call fcn.140270920
test eax, eax
jne 0x140070ca8
mov rcx, r13
call fcn.14006fc60
test rax, rax
je 0x140070ca8
mov r9, r15
mov r8d, 3
mov rdx, r12
mov rcx, rax
call fcn.1400706f0
jmp 0x140070caa
inc r8d
add r9, 4
cmp r8d, ebx
jb 0x140070c10
jmp 0x140070c5a
xor al, al
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov r12, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r13
ret
Function at 0x140071750
Capabilities:
Contain obfuscated stackstrings
Delete service
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xb0
mov rax, qword [0x14067e680]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov dword [rbp - 0x39], 0x3ad63aa8
mov dword [rbp - 0x35], 0x3ab93ab1
mov dword [rbp - 0x31], 0x3a9e3a86
mov dword [rbp - 0x2d], 0x3a9d3a95
mov dword [rbp - 0x29], 0x3a873a84
mov dword [rbp - 0x25], 0x3aa53aa9
mov dword [rbp - 0x21], 0x3a8b3a8e
mov dword [rbp - 0x1d], 0x3a9f3a8d
mov dword [rbp - 0x19], 0x3acf3a96
mov dword [rbp - 0x15], 0x3aa23acf
mov dword [rbp - 0x11], 0x3b723a9b
mov dword [rbp - 0xd], 0x3b743b68
mov dword [rbp - 9], 0x3b763b66
mov dword [rbp - 5], 0x3b5a3b76
mov dword [rbp - 1], 0x3b6d3b53
mov dword [rbp + 3], 0x3b473b7a
mov dword [rbp + 7], 0x3b623b64
mov dword [rbp + 0xb], 0x3b3a3b3b
mov dword [rbp + 0xf], 0x3b633b21
mov dword [rbp + 0x13], 0x3b613b68
xor eax, eax
mov word [rbp + 0x17], ax
mov byte [rbp + 0x19], 1
mov edx, 0x3aeb
nop dword [rax + rax]
lea ecx, [rdx + rax]
xor word [rbp + rax*2 - 0x39], cx
inc rax
cmp rax, 0x28
jb 0x140071810
mov byte [rbp + 0x19], 0
lea rdx, [rbp - 0x39]
lea rcx, [rbp + 0x27]
call fcn.1400b1d50
nop
lea rcx, [rbp + 0x27]
cmp qword [rbp + 0x3f], 7
cmova rcx, qword [rbp + 0x27]
call fcn.14027e76c
lea rcx, [rbp + 0x27]
call fcn.14006e320
test al, al
je 0x140071927
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 2]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov qword [0x1406885e8], rax
test rax, rax
je 0x140071927
call fcn.14006e600
test al, al
jne 0x1400718da
mov rbx, qword [0x1406885e0]
test rbx, rbx
je 0x1400718ba
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x1400718a4
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x430
jne 0x1400718ad
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [0x1406885e0]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea rcx, [rbp + 0x27]
cmp qword [rbp + 0x3f], 7
cmova rcx, qword [rbp + 0x27]
call fcn.14027e76c
mov rcx, qword [0x1406885e8]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rbx, qword [0x1406885e0]
test rbx, rbx
je 0x140071916
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x140071900
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x430
jne 0x140071909
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [0x1406885e0]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [0x1406885e8]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov bl, 1
jmp 0x140071929
xor bl, bl
mov rdx, qword [rbp + 0x3f]
cmp rdx, 7
jbe 0x140071965
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x27]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140071960
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140071985
call fcn.14025f000
movzx eax, bl
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.14025efe0
mov rbx, qword [rsp + 0xc0]
add rsp, 0xb0
pop rbp
ret
call fcn.14026ebe4
int3
Function at 0x1400afb00
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x30
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x1400afb22
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rdi
je 0x1400afb9c
mov rdi, r14
mov rcx, rbx
call fcn.1400b3990
test rax, rax
jle 0x1400afb74
mov rdx, qword [rbx + 0x38]
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov r8, rbp
mov rdx, qword [rdx]
call fcn.1402a0a80
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x1400afb8c
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + gethostname]
cmp eax, 0xffffffff
je 0x1400afb94
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x1400afb36
sub r14, rdi
jmp 0x1400afc7f
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x1400afbb3
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x1400afbb5
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x1400afbe7
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.1402a0a80
mov rax, qword [rbx + 0x50]
add rsi, rdi
sub rbp, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x1400afc7c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x1400afc22
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rbp, 0xfff
jbe 0x1400afc5d
nop dword [rax + rax]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.1402774bc
add rsi, rax
sub rbp, rax
cmp rax, 0xfff
jne 0x1400afc7c
cmp rbp, rax
ja 0x1400afc30
test rbp, rbp
je 0x1400afc7c
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.1402774bc
sub rbp, rax
sub r14, rbp
mov rbp, qword [rsp + 0x28]
mov rax, r14
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
Function at 0x1400beac0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x1400beb21
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x1400beae0
mov ecx, dword [r9]
jmp 0x1400bec0b
cmp ecx, 0x4e0
jb 0x1400bec0b
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
add r10, 4
mov edx, r11d
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x634]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x1400beb40
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
mov edx, eax
xor edx, r11d
add r10, 4
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 - 0xd4c]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x1400beb90
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x1400ebde0
Capabilities:
Convert ip address from string

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x88
mov rax, qword [0x14067e680]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov r13, qword [rcx]
mov ebp, r8d
mov rsi, rcx
lea r8, [rsp + 0x20]
mov ebx, 2
xor r14d, r14d
mov ecx, ebx
mov r15, r9
mov r12, qword [r13 + 0x11b0]
mov rdi, rdx
mov dword [r9], r14d
call qword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
jle 0x1400ebe4c
mov r9d, ebp
lea rdx, [rsp + 0x20]
mov r8, rdi
mov ecx, ebx
call fcn.14010aa50
jmp 0x1400ebf2a
mov ebx, reloc.WS2_32.dll_socket
lea r8, [rsp + 0x58]
mov ecx, ebx
mov rdx, rdi
call qword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
jle 0x1400ebe7c
mov r9d, ebp
lea rdx, [rsp + 0x58]
mov r8, rdi
mov ecx, ebx
call fcn.14010aa50
jmp 0x1400ebf2a
mov ecx, dword [rsi + 0x440]
sub ecx, 1
je 0x1400ebea0
cmp ecx, 1
je 0x1400ebe8f
mov ebx, r14d
call fcn.1400ec910
test al, al
mov eax, 2
cmove ebx, eax
jmp 0x1400ebea5
mov ebx, 2
cmp dword [rsi + 0xbc], 3
lea r8, [0x1403432b4]
xorps xmm0, xmm0
lea rcx, [rsp + 0x68]
movups xmmword [rsp + 0x28], xmm0
setne r14b
mov dword [rsp + 0x2c], ebx
inc r14d
mov r9d, ebp
mov edx, ntohs
mov dword [rsp + 0x30], r14d
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
call fcn.1400fbdc0
lea rcx, [rsp + 0x58]
call fcn.1400ebc70
lea r9, [rsp + 0x28]
mov r8d, ebp
mov rdx, rdi
mov rcx, rsi
movups xmm0, xmmword [rax]
movups xmmword [r12], xmm0
call fcn.1400ec570
test al, al
je 0x1400ebf19
mov dword [r15], 1
jmp 0x1400ebf28
lea rdx, str.getaddrinfo___thread_failed_to_start_n
mov rcx, r13
call fcn.1400f7e80
xor eax, eax
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14025efe0
add rsp, 0x88
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
jmp 0x1400ebde0
Function at 0x1400fb690
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp byte [0x140683460], 0
mov esi, r8d
mov rdi, qword [rsp + 0x68]
je 0x1400fb73f
test rdi, rdi
je 0x1400fb73f
mov eax, dword [0x140683464]
test eax, eax
jne 0x1400fb737
mov r8d, dword [rsp + 0x60]
lea rsi, str.recv
mov r9, rsi
lea rcx, str.LIMIT__s:_d__s_reached_memlimit_n
mov rdx, rdi
call fcn.1400fb3e0
mov ecx, 2
call fcn.14026f944
mov r9d, dword [rsp + 0x60]
lea rdx, str.LIMIT__s:_d__s_reached_memlimit_n
mov rcx, rax
mov qword [rsp + 0x20], rsi
mov r8, rdi
call fcn.1400fbd90
mov rcx, qword [0x140683458]
call fcn.14026fd9c
call fcn.14027ff5c
mov dword [rax], ntohs
mov eax, 0xffffffff
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
dec eax
mov dword [0x140683464], eax
call qword [sym.imp.WS2_32.dll_recv]
mov ebx, eax
test rdi, rdi
je 0x1400fb767
mov r8d, dword [rsp + 0x60]
lea rcx, str.RECV__s:_d_recv__lu____ld_n
mov r9d, esi
mov dword [rsp + 0x20], eax
mov rdx, rdi
call fcn.1400fb3e0
mov rsi, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x1400fb7e0
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp byte [0x140683460], 0
mov esi, r8d
mov rdi, qword [rsp + 0x68]
je 0x1400fb88f
test rdi, rdi
je 0x1400fb88f
mov eax, dword [0x140683464]
test eax, eax
jne 0x1400fb887
mov r8d, dword [rsp + 0x60]
lea rsi, str.send
mov r9, rsi
lea rcx, str.LIMIT__s:_d__s_reached_memlimit_n
mov rdx, rdi
call fcn.1400fb3e0
mov ecx, 2
call fcn.14026f944
mov r9d, dword [rsp + 0x60]
lea rdx, str.LIMIT__s:_d__s_reached_memlimit_n
mov rcx, rax
mov qword [rsp + 0x20], rsi
mov r8, rdi
call fcn.1400fbd90
mov rcx, qword [0x140683458]
call fcn.14026fd9c
call fcn.14027ff5c
mov dword [rax], ntohs
mov eax, 0xffffffff
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
dec eax
mov dword [0x140683464], eax
call qword [sym.imp.WS2_32.dll_send]
mov ebx, eax
test rdi, rdi
je 0x1400fb8b7
mov r8d, dword [rsp + 0x60]
lea rcx, str.SEND__s:_d_send__lu____ld_n
mov r9d, esi
mov dword [rsp + 0x20], eax
mov rdx, rdi
call fcn.1400fb3e0
mov rsi, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x14010add0
Capabilities:
Convert ip address from string

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x88
mov rax, qword [0x14067e680]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov r13, qword [rcx]
mov ebp, r8d
mov rsi, rcx
lea r8, [rsp + 0x20]
mov ebx, 2
xor r14d, r14d
mov ecx, ebx
mov r15, r9
mov r12, qword [r13 + 0x11b0]
mov rdi, rdx
mov dword [r9], r14d
call qword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
jle 0x1400ebe4c
mov r9d, ebp
lea rdx, [rsp + 0x20]
mov r8, rdi
mov ecx, ebx
call fcn.14010aa50
jmp 0x1400ebf2a
mov ebx, reloc.WS2_32.dll_socket
lea r8, [rsp + 0x58]
mov ecx, ebx
mov rdx, rdi
call qword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
jle 0x1400ebe7c
mov r9d, ebp
lea rdx, [rsp + 0x58]
mov r8, rdi
mov ecx, ebx
call fcn.14010aa50
jmp 0x1400ebf2a
mov ecx, dword [rsi + 0x440]
sub ecx, 1
je 0x1400ebea0
cmp ecx, 1
je 0x1400ebe8f
mov ebx, r14d
call fcn.1400ec910
test al, al
mov eax, 2
cmove ebx, eax
jmp 0x1400ebea5
mov ebx, 2
cmp dword [rsi + 0xbc], 3
lea r8, [0x1403432b4]
xorps xmm0, xmm0
lea rcx, [rsp + 0x68]
movups xmmword [rsp + 0x28], xmm0
setne r14b
mov dword [rsp + 0x2c], ebx
inc r14d
mov r9d, ebp
mov edx, ntohs
mov dword [rsp + 0x30], r14d
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
call fcn.1400fbdc0
lea rcx, [rsp + 0x58]
call fcn.1400ebc70
lea r9, [rsp + 0x28]
mov r8d, ebp
mov rdx, rdi
mov rcx, rsi
movups xmm0, xmmword [rax]
movups xmmword [r12], xmm0
call fcn.1400ec570
test al, al
je 0x1400ebf19
mov dword [r15], 1
jmp 0x1400ebf28
lea rdx, str.getaddrinfo___thread_failed_to_start_n
mov rcx, r13
call fcn.1400f7e80
xor eax, eax
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14025efe0
add rsp, 0x88
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
jmp 0x1400ebde0
Function at 0x14010ec10
Capabilities:
Encode data using xor

Disassembly:
push r14
push r15
sub rsp, 0x1f8
mov rax, qword [0x14067e680]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
cmp byte [0x140683720], 0
mov r14, rcx
jne 0x14010ec49
call fcn.140147c30
test eax, eax
je 0x14010ec67
mov byte [0x140683720], 1
xor eax, eax
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.14025efe0
add rsp, 0x1f8
pop r15
pop r14
ret
mov rcx, qword [r14 + 0xcf8]
test rcx, rcx
je 0x14010ec86
mov edx, 0x400
call fcn.140148cd0
call fcn.140147c30
test eax, eax
jne 0x14010ec49
mov qword [rsp + 0x218], rbx
xor r15d, r15d
mov qword [rsp + 0x220], rbp
mov qword [rsp + 0x228], rsi
mov qword [rsp + 0x1f0], rdi
movaps xmmword [rsp + 0x1e0], xmm6
movaps xmmword [rsp + 0x1d0], xmm7
movsd xmm7, qword [0x1402b2658]
nop dword [rax]
nop word [rax + rax]
mov rsi, r15
lea rbp, [rsp + 0x80]
nop dword [rax + rax]
lea rcx, [rsp + 0x30]
call fcn.1400ebc70
mov ecx, 1
movups xmm6, xmmword [rax]
movups xmmword [rsp + 0x20], xmm6
call fcn.1400f7d70
lea rcx, [rsp + 0x40]
lea rdi, [rsi + 3]
call fcn.1400ebc70
lea rcx, [rsp + 0x50]
movsxd rbx, dword [rax + 8]
call fcn.1400ebc70
mov rdx, rbx
lea rcx, [rdi - 2]
add rdx, qword [rax]
movq rax, xmm6
imul rdx, rdi
imul rcx, rax
shl rdx, 8
xor rdx, rcx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x20], rdx
call fcn.1400ebc70
lea rcx, [rsp + 0x70]
mov rbx, rax
call fcn.1400ebc70
mov ecx, dword [rbx + 8]
lea rbp, [rbp + 0x10]
add ecx, dword [rax]
lea eax, [rsi + 4]
imul ecx, eax
lea eax, [rsi + 2]
imul eax, dword [rsp + 0x28]
inc rsi
shl ecx, 0x10
xor ecx, eax
mov dword [rsp + 0x28], ecx
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rbp - 0x10], xmm0
cmp rsi, 4
jb 0x14010ece0
movaps xmm2, xmm7
lea rcx, [rsp + 0x80]
mov edx, 0x40
call fcn.140147960
call fcn.140147c30
test eax, eax
je 0x14010ecd0
mov edx, 0x100
mov byte [rsp + 0xc0], r15b
lea rcx, [rsp + 0xc0]
call fcn.140148a60
movaps xmm7, xmmword [rsp + 0x1d0]
movaps xmm6, xmmword [rsp + 0x1e0]
mov rdi, qword [rsp + 0x1f0]
mov rsi, qword [rsp + 0x228]
mov rbp, qword [rsp + 0x220]
mov rbx, qword [rsp + 0x218]
cmp byte [rsp + 0xc0], r15b
je 0x14010ee1d
mov edx, 0x400
lea rcx, [rsp + 0xc0]
call fcn.140148cd0
call fcn.140147c30
test eax, eax
jne 0x14010ec49
lea rdx, str.libcurl_is_now_using_a_weak_random_seed__n
mov rcx, r14
call fcn.1400f8000
call fcn.140147c30
test eax, eax
mov ecx, reloc.WLDAP32.dll_Ordinal_35
cmovne ecx, r15d
mov eax, ecx
jmp 0x14010ec4b