joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400298c8
Capabilities:
Encode data using base64

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov qword [rax + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rdi, rdx
mov rbx, rcx
xor r13d, r13d
mov dword [rax - 0x38], r13d
mov qword [rcx], r13
mov qword [rcx + 0x10], r13
mov qword [rcx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rcx], r13b
mov dword [rax - 0x38], 1
lea r15, [rdx + 0x10]
cmp qword [r15], 0xf
jbe 0x140029927
mov r8b, r13b
mov rdx, qword [r15]
call fcn.14000796c
mov qword [rbx + 0x10], r13
mov esi, r13d
mov r14d, 0xfffffffa
cmp qword [rdi + 0x18], 0x10
jb 0x140029942
mov rbp, qword [rdi]
mov rcx, rbp
mov rdi, rbp
jmp 0x140029948
mov rbp, rdi
mov rcx, rdi
mov r12, qword [r15]
add r12, rcx
cmp rdi, r12
je 0x140029a77
lea r8, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
shl esi, 8
movzx eax, byte [rbp]
add esi, eax
add r14d, 8
js 0x1400299e4
movsxd r13, esi
movsxd rdi, r14d
lea ecx, [r14 + 6]
mov eax, 0xaaaaaaab
mul ecx
shr edx, 2
mov r15d, edx
imul eax, edx, 0xfffffffa
add r14d, eax
mov rax, r13
mov rcx, rdi
sar rax, cl
and eax, 0x3f
mov r9b, byte [rax + r8]
mov rcx, qword [rbx + 0x10]
cmp rcx, qword [rbx + 0x18]
jae 0x1400299c4
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x1400299b9
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x1400299da
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, rbx
call fcn.140007544
lea r8, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
sub rdi, 6
sub r15, 1
jne 0x14002998a
inc rbp
cmp rbp, r12
jne 0x14002995e
cmp r14d, 0xfffffffa
jle 0x140029a3c
lea ecx, [r14 + 8]
shl esi, 8
movsxd rdx, esi
sar rdx, cl
and edx, 0x3f
mov r9b, byte [rdx + r8]
mov rcx, qword [rbx + 0x10]
cmp rcx, qword [rbx + 0x18]
jae 0x140029a37
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x140029a29
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
xor r13d, r13d
mov byte [rax + rcx + 1], r13b
jmp 0x140029a77
xor r13d, r13d
jmp 0x140029a67
xor r13d, r13d
jmp 0x140029a77
cmp rcx, qword [rbx + 0x18]
jae 0x140029a64
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x140029a5c
mov rax, qword [rbx]
mov word [rcx + rax], 0x3d
jmp 0x140029a77
mov r9b, 0x3d
mov r8b, r13b
mov edx, 1
mov rcx, rbx
call fcn.140007544
mov rcx, qword [rbx + 0x10]
test cl, 3
jne 0x140029a41
mov rax, rbx
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140029ea8
Capabilities:
Hash data using sha1

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x80]
sub rsp, 0x180
xor ebx, ebx
mov dword [rsp + 0x20], 0x67452301
mov dword [rsp + 0x24], 0xefcdab89
mov r15, r8
mov dword [rsp + 0x28], 0x98badcfe
mov rsi, rdx
mov dword [rsp + 0x2c], 0x10325476
mov r14, rcx
mov dword [rsp + 0x30], 0xc3d2e1f0
cmp rdx, 0x40
jb 0x140029f67
lea rdi, [rdx - 0x40]
lea rax, [rbx + 0x40]
cmp rbx, rax
jae 0x140029f53
lea rdx, [r14 + 2]
mov r9d, reloc.WS2_32.dll_recv
add rdx, rbx
lea r8, [rsp + 0x40]
add rbx, 0x40
movzx eax, byte [rdx - 1]
movzx ecx, byte [rdx - 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx]
shl ecx, 8
lea rdx, [rdx + 4]
or ecx, eax
movzx eax, byte [rdx - 3]
shl ecx, 8
or ecx, eax
mov dword [r8], ecx
lea r8, [r8 + 4]
sub r9, 1
jne 0x140029f24
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.14003b9c4
cmp rbx, rdi
jbe 0x140029f05
mov r10, rsi
mov edi, reloc.WS2_32.dll_ntohs
sub r10, rbx
mov eax, edi
and dword [rsp + rax*4 + 0x40], 0
sub rax, 1
jns 0x140029f74
xor r9d, r9d
lea r11d, [r9 + 3]
test r10, r10
je 0x140029fb9
lea r8, [rbx + r14]
mov cl, r9b
mov eax, r11d
and cl, r11b
mov rdx, r9
sub al, cl
shr rdx, 2
mov cl, al
movzx eax, byte [r8 + r9]
shl cl, 3
inc r9
shl eax, cl
or dword [rsp + rdx*4 + 0x40], eax
cmp r9, r10
jb 0x140029f8f
mov r8, r9
mov edx, 0x80
and r9b, r11b
shr r8, 2
sub r11b, r9b
mov cl, r11b
shl cl, 3
shl edx, cl
or dword [rsp + r8*4 + 0x40], edx
cmp r10, 0x38
jb 0x140029ff8
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.14003b9c4
and dword [rsp + rdi*4 + 0x40], 0
sub rdi, 1
jns 0x140029fed
lea rax, [rsi*8]
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x7c], eax
lea rcx, [rsp + 0x20]
call fcn.14003b9c4
lea r9, [r15 + 0x13]
mov r10d, reloc.WS2_32.dll_send
mov r8d, 0xffffff80
mov rcx, r10
mov eax, r8d
sar rcx, 2
and eax, 0x18
dec r10
add r8d, 8
mov edx, dword [rsp + rcx*4 + 0x20]
mov cl, al
shr edx, cl
mov byte [r9], dl
dec r9
cmp r8d, 0x18
jle 0x14002a023
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x14002b77c
Capabilities:
Set socket configuration

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
xor r13d, r13d
mov r15, r9
mov r14, rdx
mov rdi, rcx
mov ebx, r13d
cmp rcx, 0xffffffffffffffff
je 0x14002b92e
test r8b, r8b
je 0x14002b7eb
test byte [rdx], 8
je 0x14002b7eb
lea rax, [rbp - 0x18]
mov dword [rbp + 0x30], r13d
mov qword [r11 - 0x68], rax
mov r9d, 0x80
lea rax, [rbp + 0x30]
mov qword [r11 - 0x70], 4
mov r8d, 0xffff
mov qword [r11 - 0x78], rax
call fcn.14004c4fc
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
test eax, eax
mov rcx, r15
mov ebx, eax
setne dl
call fcn.14003363c
test ebx, ebx
je 0x14002b92e
mov r12, qword [0x140081538]
lea r8, [0x140081530]
movabs rcx, 0x4d54ee85da812030
mov dword [rbp - 0x2c], r13d
add rcx, r12
mov esi, 1
cmp rcx, rsi
jbe 0x14002b856
mov rax, qword [0x140081530]
mov edx, 0x2733
mov rcx, r8
call qword [rax + 0x30]
mov r12, qword [0x140081538]
lea r8, [0x140081530]
jmp 0x14002b859
mov al, sil
movzx eax, al
lea rdx, [rbp - 0x18]
add rax, 2
mov qword [rbp - 0x28], r8
mov qword [rbp - 0x20], rax
mov rcx, r15
movsd xmm1, qword [rbp - 0x20]
mov dword [rbp - 0x30], 0x2733
movups xmm0, xmmword [rbp - 0x30]
movsd qword [rbp - 8], xmm1
movups xmmword [rbp - 0x18], xmm0
call fcn.14001dd28
test al, al
jne 0x14002b8fc
movabs rax, 0x4d54ee85da812030
mov dword [rbp - 0x2c], r13d
add rax, r12
lea r12, [0x140081530]
cmp rax, rsi
jbe 0x14002b8c3
mov rax, qword [0x140081530]
mov edx, 0x4d5
mov rcx, r12
call qword [rax + 0x30]
mov sil, al
movzx eax, sil
lea rdx, [rbp - 0x18]
add rax, 2
mov dword [rbp - 0x30], 0x4d5
mov qword [rbp - 0x20], rax
mov rcx, r15
movsd xmm1, qword [rbp - 0x20]
mov qword [rbp - 0x28], r12
movups xmm0, xmmword [rbp - 0x30]
movsd qword [rbp - 8], xmm1
movups xmmword [rbp - 0x18], xmm0
call fcn.14001dd28
test al, al
je 0x14002b92e
lea r8, [rbp + 0x30]
mov dword [rbp + 0x30], r13d
mov edx, 0x8004667e
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_ioctlsocket]
and byte [r14], 0xfc
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
test eax, eax
mov rcx, r15
mov ebx, eax
setne dl
call fcn.14003363c
lea r11, [rsp + 0x70]
mov eax, ebx
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x14002c3c4
Capabilities:
Connect socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rdi, r9
cmp rcx, 0xffffffffffffffff
jne 0x14002c444
and dword [rsp + 0x24], 0
lea rsi, [0x140081530]
movabs rcx, 0x4d54ee85da812030
mov eax, 1
add rcx, qword [0x140081538]
mov ebx, 0x2719
cmp rcx, rax
jbe 0x14002c417
mov rax, qword [0x140081530]
mov edx, ebx
mov rcx, rsi
call qword [rax + 0x30]
movzx ecx, al
add rcx, 2
mov dword [rsp + 0x20], ebx
mov qword [rsp + 0x28], rsi
or eax, 0xffffffff
movups xmm0, xmmword [rsp + 0x20]
mov qword [rsp + 0x30], rcx
movsd xmm1, qword [rsp + 0x30]
movups xmmword [rdi], xmm0
movsd qword [rdi + 0x10], xmm1
jmp 0x14002c45b
call qword [sym.imp.WS2_32.dll_connect]
test eax, eax
mov rcx, rdi
mov ebx, eax
setne dl
call fcn.14003363c
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret

Function at 0x140034628
Capabilities:
Resolve dns

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x450
mov r14d, 2
mov rsi, r9
mov rdi, r8
mov ebp, edx
mov rbx, rcx
cmp word [rcx], r14w
je 0x140034661
cmp word [rcx], 0x17
jne 0x140034670
movzx ecx, word [rcx + 2]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
mov dword [rsi], eax
mov esi, 0x401
lea rcx, [rsp + 0x40]
mov r8d, esi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x30], r14d
lea r8, [rsp + 0x40]
xor r14d, r14d
mov r9d, esi
mov dword [rsp + 0x28], r14d
mov edx, ebp
mov rcx, rbx
mov qword [rsp + 0x20], r14
call qword [sym.imp.WS2_32.dll_getnameinfo]
test eax, eax
jne 0x1400346ff
lea rax, [rsp + 0x40]
or rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], r14b
jne 0x1400346b6
cmp rbx, qword [rdi + 0x18]
ja 0x1400346ec
cmp qword [rdi + 0x18], 0x10
mov rsi, rdi
jb 0x1400346d2
mov rsi, qword [rdi]
mov r8, rbx
mov qword [rdi + 0x10], rbx
lea rdx, [rsp + 0x40]
mov rcx, rsi
call sub.VCRUNTIME140.dll_memmove
mov byte [rsi + rbx], r14b
jmp 0x1400346ff
lea r9, [rsp + 0x40]
mov r8b, r14b
mov rdx, rbx
mov rcx, rdi
call fcn.140007040
lea r11, [rsp + 0x450]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x14003517c
Capabilities:
Resolve dns

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rbp, r9
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
test rdx, rdx
je 0x1400351a6
cmp byte [rdx], 0
jne 0x1400351a8
xor edi, edi
test rbx, rbx
je 0x1400351b3
cmp byte [r8], 0
jne 0x1400351b5
xor ebx, ebx
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov r9, qword [rsp + 0x70]
mov r8, rbp
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov edx, eax
lea rcx, [rsp + 0x20]
call fcn.14004f44c
mov rcx, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movsd xmm1, qword [rax + 0x10]
movsd qword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax]
movsd xmm1, qword [rax + 0x10]
mov rax, rsi
movups xmmword [rsi], xmm0
movsd qword [rsi + 0x10], xmm1
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x140035420
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rdi, r9
mov rsi, r8
cmp rcx, 0xffffffffffffffff
jne 0x1400354a3
and dword [rsp + 0x24], 0
lea rsi, [0x140081530]
movabs rcx, 0x4d54ee85da812030
mov eax, 1
add rcx, qword [0x140081538]
mov ebx, 0x2719
cmp rcx, rax
jbe 0x140035476
mov rax, qword [0x140081530]
mov edx, ebx
mov rcx, rsi
call qword [rax + 0x30]
movzx ecx, al
add rcx, 2
mov dword [rsp + 0x20], ebx
mov qword [rsp + 0x28], rsi
or eax, 0xffffffff
movups xmm0, xmmword [rsp + 0x20]
mov qword [rsp + 0x30], rcx
movsd xmm1, qword [rsp + 0x30]
movups xmmword [rdi], xmm0
movsd qword [rdi + 0x10], xmm1
jmp 0x1400354ce
mov eax, dword [r8]
lea r8, [rsp + 0x50]
mov dword [rsp + 0x50], eax
call qword [sym.imp.WS2_32.dll_getsockname]
movsxd rcx, dword [rsp + 0x50]
test eax, eax
mov qword [rsi], rcx
mov ebx, eax
setne dl
mov rcx, rdi
call fcn.14003363c
mov eax, ebx
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x14003b9c4
Capabilities:
Encode data using xor
Hash data using sha1

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
mov ebx, dword [rcx]
mov rsi, rdx
mov r11d, dword [rcx + 4]
mov r9, rcx
mov r10d, dword [rcx + 8]
xor r8d, r8d
mov edi, dword [rcx + 0xc]
mov ebp, dword [rcx + 0x10]
mov eax, r10d
mov ecx, r11d
and eax, r11d
mov edx, ebx
rol edx, 5
not ecx
and ecx, edi
or eax, ecx
add eax, edx
add eax, dword [rsi + r8*4]
inc r8
add eax, ebp
mov ebp, edi
mov edi, r10d
mov r10d, r11d
ror r10d, 2
mov r11d, ebx
lea ebx, [rax + 0x5a827999]
cmp r8, 0x10
jl 0x14003b9f6
lea r14, [rsi + 8]
mov r15d, 4
mov r8d, dword [r14 + 0x2c]
mov eax, r10d
xor r8d, dword [r14 + 0x18]
and eax, r11d
xor r8d, dword [r14 - 8]
mov ecx, ebx
xor r8d, dword [r14]
mov edx, r11d
rol r8d, 1
not edx
rol ecx, 5
and edx, edi
mov dword [r14 + 0x38], r8d
lea r14, [r14 + 4]
or edx, eax
lea eax, [r8 + rcx]
add eax, edx
add eax, ebp
mov ebp, edi
mov edi, r10d
mov r10d, r11d
ror r10d, 2
mov r11d, ebx
lea ebx, [rax + 0x5a827999]
sub r15, 1
jne 0x14003ba3a
lea r14d, [r15 + 0x14]
mov r15d, r14d
lea r8, [rsi + 0x18]
mov edx, dword [r8 + 0x2c]
mov eax, ebx
xor edx, dword [r8 + 0x18]
mov ecx, edi
xor edx, dword [r8 - 8]
xor ecx, r10d
xor edx, dword [r8]
xor ecx, r11d
rol eax, 5
lea r8, [r8 + 4]
rol edx, 1
add eax, edx
mov dword [r8 + 0x34], edx
add eax, ecx
add eax, ebp
mov ebp, edi
mov edi, r10d
mov r10d, r11d
ror r10d, 2
mov r11d, ebx
lea ebx, [rax + 0x6ed9eba1]
sub r15, 1
jne 0x14003ba96
lea r15, [rsi + 0x68]
mov r12, r14
mov r8d, dword [r15 + 0x2c]
mov edx, ebx
xor r8d, dword [r15 + 0x18]
mov ecx, r10d
xor r8d, dword [r15 - 8]
or ecx, r11d
xor r8d, dword [r15]
and ecx, edi
mov eax, r10d
rol r8d, 1
and eax, r11d
rol edx, 5
or ecx, eax
mov dword [r15 + 0x38], r8d
add ecx, r8d
lea r15, [r15 + 4]
lea eax, [rdx + rbp]
mov ebp, edi
mov edi, r10d
add eax, 0x8f1bbcdc
mov r10d, r11d
add eax, ecx
ror r10d, 2
mov r11d, ebx
mov ebx, eax
sub r12, 1
jne 0x14003bae4
add rsi, 0xb8
mov edx, dword [rsi + 0x2c]
mov ecx, ebx
xor edx, dword [rsi + 0x18]
mov eax, edi
xor edx, dword [rsi - 8]
xor eax, r10d
xor edx, dword [rsi]
xor eax, r11d
rol edx, 1
mov dword [rsi + 0x38], edx
lea rsi, [rsi + 4]
add eax, edx
rol ecx, 5
lea edx, [rcx + rbp]
mov ebp, edi
mov edi, r10d
add edx, 0xca62c1d6
mov r10d, r11d
add edx, eax
ror r10d, 2
mov r11d, ebx
mov ebx, edx
sub r14, 1
jne 0x14003bb3e
add dword [r9 + 0xc], edi
add dword [r9], edx
add dword [r9 + 4], r11d
add dword [r9 + 8], r10d
add dword [r9 + 0x10], ebp
mov rbp, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
pop r15
pop r14
pop r12
ret
Function at 0x14003bdb4
Capabilities:
Set socket configuration

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x40
mov rbp, r9
mov esi, r8d
mov rbx, rdx
cmp rcx, 0xffffffffffffffff
jne 0x14003be43
and dword [rax - 0x24], 0
lea rdi, [0x140081530]
movabs rcx, 0x4d54ee85da812030
mov eax, 1
add rcx, qword [0x140081538]
mov ebx, 0x2719
cmp rcx, rax
jbe 0x14003be11
mov rax, qword [0x140081530]
mov edx, ebx
mov rcx, rdi
call qword [rax + 0x30]
movzx ecx, al
add rcx, 2
mov dword [rsp + 0x20], ebx
mov qword [rsp + 0x30], rcx
or eax, 0xffffffff
mov rcx, qword [rsp + 0x70]
movsd xmm1, qword [rsp + 0x30]
mov qword [rsp + 0x28], rdi
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rcx], xmm0
movsd qword [rcx + 0x10], xmm1
jmp 0x14003be7f
mov r8, rbp
mov edx, esi
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov rcx, qword [rsp + 0x70]
test eax, eax
mov edi, eax
sets dl
call fcn.14003363c
test edi, edi
js 0x14003be7d
cmp esi, 0x8004667e
jne 0x14003be7d
cmp dword [rbp], 0
mov cl, byte [rbx]
je 0x14003be78
or cl, 1
jmp 0x14003be7b
and cl, 0xfc
mov byte [rbx], cl
mov eax, edi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x14003bf90
Capabilities:
Terminate thread

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [rcx + 0x10]
lea rdx, [rsp + 0x20]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rax, qword [rcx + 8]
mov rbx, rcx
or r9d, 0xffffffff
mov qword [rsp + 0x28], rax
lea ecx, [r8 + 2]
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
lock xadd dword [0x140087254], eax
test eax, eax
je 0x14003bfe7
mov rcx, qword [rbx + 8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
jmp 0x14003c008
mov rdx, qword [rbx + 8]
lea rcx, [fcn.14000a988]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_QueueUserAPC]
mov rcx, qword [rbx + 8]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
add rsp, 0x30
pop rbx
ret

Function at 0x14003df5c
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xa0
mov rbx, rcx
and dword [rbp - 0x29], 0
and dword [rbp - 5], 0
and dword [rbp - 9], 0
mov dword [rbp - 1], 0x67452301
mov dword [rbp + 3], 0xefcdab89
mov dword [rbp + 7], 0x98badcfe
mov dword [rbp + 0xb], 0x10325476
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x14003dfac
mov rdx, qword [rdx]
lea rcx, [rbp - 9]
call fcn.14003dda4
lea rdx, [rbp - 0x21]
lea rcx, [rbp - 9]
call fcn.14003dea4
and qword [rbx], 0
and qword [rbx + 0x10], 0
and qword [rbx + 0x10], 0
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov dword [rbp - 0x29], 1
xor r8d, r8d
lea edx, [r8 + 0x10]
mov rcx, rbx
call fcn.140027d10
mov rax, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x14003dffe
mov rax, qword [rbx]
movups xmm0, xmmword [rbp - 0x21]
movdqu xmmword [rax], xmm0
mov rax, rbx
mov rbx, qword [rsp + 0xb8]
add rsp, 0xa0
pop rbp
ret
Function at 0x14003fae4
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rdi
push r14
lea rbp, [rsp - 0x380]
sub rsp, 0x480
and dword [rbp + 0x3b0], 0
lea rax, [rbp + 0x3b0]
and dword [rbp + 0x3b4], 0
lea r9, [rsp + 0x60]
mov rdi, rdx
mov qword [rbp + 0x178], rcx
mov rbx, rcx
mov qword [rsp + 0x68], rcx
inc ecx
mov qword [rsp + 0x20], rax
xor edx, edx
mov dword [rbp + 0x170], 1
lea r8, [rbp + 0x170]
mov dword [rsp + 0x60], 1
call qword [sym.imp.WS2_32.dll_select]
test eax, eax
je 0x14003fc2a
and dword [rbp + 0x3a0], 0
lea rax, [rbp + 0x3b8]
mov qword [rsp + 0x30], rdi
xor edx, edx
mov qword [rsp + 0x28], rax
mov r9d, 0x1007
lea rax, [rbp + 0x3a0]
mov qword [rbp + 0x3b8], 4
mov r8d, 0xffff
mov qword [rsp + 0x20], rax
mov rcx, rbx
call fcn.1400354e0
test eax, eax
jne 0x14003fc28
mov ebx, dword [rbp + 0x3a0]
test ebx, ebx
je 0x14003fc11
and dword [rsp + 0x44], eax
lea r14, [0x140081530]
movabs rcx, 0x4d54ee85da812030
add rcx, qword [0x140081538]
cmp rcx, 1
jbe 0x14003fbe2
mov rax, qword [0x140081530]
mov edx, ebx
mov rcx, r14
call qword [rax + 0x30]
jmp 0x14003fbe7
test ebx, ebx
setne al
movzx eax, al
mov dword [rsp + 0x40], ebx
add rax, 2
mov qword [rsp + 0x48], r14
movups xmm0, xmmword [rsp + 0x40]
mov qword [rsp + 0x50], rax
movsd xmm1, qword [rsp + 0x50]
movups xmmword [rdi], xmm0
movsd qword [rdi + 0x10], xmm1
jmp 0x14003fc28
and qword [rsp + 0x50], 0
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
movsd xmm0, qword [rsp + 0x50]
movsd qword [rdi + 0x10], xmm0
mov al, 1
mov rbx, qword [rsp + 0x4a8]
add rsp, 0x480
pop r14
pop rdi
pop rbp
ret

Function at 0x14004044c
Capabilities:
Create process on windows

Disassembly:
push rbx
sub rsp, 0x50
cmp qword [rcx + 0x18], 0x10
mov rdx, rcx
jb 0x14004045f
mov rdx, qword [rcx]
mov r8, qword [rcx + 0x10]
add r8, rdx
cmp qword [rcx + 0x18], 0x10
jb 0x140040470
mov rcx, qword [rcx]
mov rdx, rcx
lea r9, [rsp + 0x60]
lea rcx, [rsp + 0x30]
call fcn.140001d24
cmp qword [rsp + 0x48], 8
lea r8, [rsp + 0x30]
mov dword [rsp + 0x28], 1
lea rdx, str.open
cmovae r8, qword [rsp + 0x30]
xor r9d, r9d
and qword [rsp + 0x20], 0
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
lea rcx, [rsp + 0x30]
setg bl
call fcn.1400272c8
mov al, bl
add rsp, 0x50
pop rbx
ret
Function at 0x140045650
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x30
cmp byte [rcx + 0x19], 0
lea rsi, [rcx + 0x80]
mov r14, r9
mov rdi, r8
mov rbp, rcx
jge 0x1400456c0
mov r11, qword [rsi]
xor r8d, r8d
mov r10, qword [r11 + 0x10]
mov dword [rax + 8], r10d
test rdi, rdi
je 0x1400456aa
mov rax, r8
and eax, 3
mov al, byte [rsp + rax + 0x50]
xor byte [r8 + rdx], al
inc r8
cmp r8, rdi
jb 0x140045691
mov r11, qword [rsi]
mov rax, rdi
and eax, 3
je 0x1400456bc
lea ecx, [rax*8]
ror r10, cl
mov qword [r11 + 0x10], r10
mov rax, qword [rsi]
mov r8, rdi
mov rbx, qword [rax]
add rbx, 0x50
mov rcx, rbx
mov r15, qword [rbx + 0x10]
call fcn.140027c98
mov rcx, qword [rsi]
mov rax, qword [rcx]
cmp dword [rax + 0x70], 1
jne 0x140045737
cmp qword [rbx + 0x18], 0x10
lea r9, [rcx + 0x18]
mov rcx, rbx
jb 0x1400456f6
mov rcx, qword [rbx]
mov r8, qword [rbx + 0x10]
add r8, rcx
cmp qword [rbx + 0x18], 0x10
jb 0x140045707
mov rbx, qword [rbx]
lea rdx, [r15 + rbx]
mov rcx, r9
call fcn.14000a8ec
test al, al
jne 0x140045737
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
call fcn.140033f10
mov qword [rsp + 0x28], rax
xor eax, eax
movups xmm0, xmmword [rsp + 0x20]
movdqu xmmword [r14], xmm0
jmp 0x14004573e
sub qword [rbp + 0x30], rdi
mov rax, rdi
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret

Function at 0x140046a10
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rcx]
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
call qword [rax + reloc.WS2_32.dll_htonl]
test al, al
je 0x140046a52
cmp rbx, 0x7fffffff
ja 0x140046a52
mov rcx, qword [rdi + 8]
xor r9d, r9d
mov r8d, ebx
mov rdx, rsi
call qword [sym.imp.WS2_32.dll_recv]
cdqe
jmp 0x140046a56
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret