joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000a8d4
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r15
lea rbp, [rsp - 0x380]
sub rsp, 0x480
and qword [rsp + 0x50], 0
lea rax, [rbp - 0x80]
xorps xmm0, xmm0
mov qword [rsp + 0x78], rax
movups xmmword [rsp + 0x40], xmm0
mov rdi, rcx
mov dword [rsp + 0x70], 0x400
movabs r15, 0x4800144005b3
and qword [rsp + 0x30], 0
lea rax, [rbp + 0x3a8]
and qword [rsp + 0x28], 0
lea r9, [rbp + 0x3a0]
mov rcx, qword [rdi]
lea rdx, [rsp + 0x70]
and dword [rbp + 0x3a0], 0
mov r8d, 1
and dword [rbp + 0x3a8], 0
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_WSARecv]
mov dl, 1
lea rcx, [rsp + 0x40]
mov ebx, eax
call fcn.1400080a8
mov r10, qword [rsp + 0x50]
mov r9, qword [rsp + 0x48]
mov r8d, dword [rsp + 0x40]
cmp r10, 1
je 0x14000a981
mov eax, r8d
jmp 0x14000a9ab
mov rax, r15
mov ecx, r9d
mul r9
mov rax, r9
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 0x14
imul eax, eax, 0x1ffff7
sub ecx, eax
imul eax, ecx, 0x3e8
add eax, r8d
cmp eax, 0x40
jne 0x14000a9b7
mov edx, 0x2746
jmp 0x14000a9f8
cmp r10, 1
je 0x14000a9c2
mov eax, r8d
jmp 0x14000a9ec
mov rax, r15
mov ecx, r9d
mul r9
mov rax, r9
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 0x14
imul eax, eax, 0x1ffff7
sub ecx, eax
imul eax, ecx, 0x3e8
add eax, r8d
cmp eax, 0x4d2
jne 0x14000aa04
mov edx, 0x274d
lea rcx, [rsp + 0x40]
call fcn.1400238c8
jmp 0x14000aa78
cmp r10, 1
je 0x14000aa0f
mov eax, r8d
jmp 0x14000aa39
mov rax, r15
mov ecx, r9d
mul r9
mov rax, r9
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 0x14
imul eax, eax, 0x1ffff7
sub ecx, eax
imul eax, ecx, 0x3e8
add eax, r8d
cmp eax, 0x2738
je 0x14000aa7c
cmp r10, 1
jne 0x14000aa6f
mov rax, r15
mul r9
mov rax, r9
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 0x14
imul eax, eax, 0x1ffff7
sub r9d, eax
imul eax, r9d, 0x3e8
add r8d, eax
cmp r8d, 0xea
je 0x14000aa7c
test ebx, ebx
jne 0x14000aaad
and qword [rsp + 0x68], 0
xorps xmm0, xmm0
mov eax, dword [rbp + 0x3a0]
movups xmmword [rsp + 0x40], xmm0
movsd xmm0, qword [rsp + 0x68]
movsd qword [rsp + 0x50], xmm0
cmp eax, 0x400
je 0x14000a918
test eax, eax
jg 0x14000aaf8
je 0x14000aaf4
mov edx, 0x2733
lea rcx, [rsp + 0x58]
call fcn.140023954
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x40]
call fcn.140007234
test al, al
jne 0x14000aaf8
mov edx, 0x4d5
lea rcx, [rsp + 0x58]
call fcn.140023954
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x40]
call fcn.140007234
test al, al
setne al
jmp 0x14000aafa
xor al, al
jmp 0x14000aafa
mov al, 1
mov rbx, qword [rsp + 0x4b0]
add rsp, 0x480
pop r15
pop rdi
pop rbp
ret
Function at 0x14000b9e8
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rax, qword [rcx + 8]
mov r11, r9
mov rbx, r8
mov r10, rdx
mov rdi, rcx
lock inc dword [rax + 0x30]
cmp byte [rsp + 0x78], 0
je 0x14000ba1a
xor r9d, r9d
xor r8d, r8d
jmp 0x14000ba29
cmp qword [rdx], 0xffffffffffffffff
jne 0x14000ba37
xor r9d, r9d
mov r8d, 0x2719
mov rdx, qword [rsp + 0x80]
mov rcx, qword [rcx + 8]
jmp 0x14000ba9a
and qword [rsp + 0x30], 0
lea r9, [rsp + 0x78]
mov eax, dword [rsp + 0x70]
mov r8d, r11d
mov rsi, qword [rsp + 0x80]
mov rdx, rbx
mov rcx, qword [r10]
and dword [rsp + 0x78], 0
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], eax
call qword [sym.imp.WS2_32.dll_WSASend]
mov ebx, eax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x4d2
mov ecx, 0x274d
cmove eax, ecx
test ebx, ebx
je 0x14000baa1
cmp eax, 0x3e5
je 0x14000baa1
mov r9d, dword [rsp + 0x78]
mov r8d, eax
mov rcx, qword [rdi + 8]
mov rdx, rsi
call fcn.1400096a8
jmp 0x14000baad
mov rcx, qword [rdi + 8]
mov rdx, rsi
call fcn.140009614
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret

Function at 0x14000bac0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rax, qword [rcx + 8]
mov r11, r9
mov rsi, r8
mov r10, rdx
mov rbx, rcx
lock inc dword [rax + 0x30]
cmp byte [rsp + 0x78], 0
je 0x14000baf2
xor r9d, r9d
xor r8d, r8d
jmp 0x14000bb01
cmp qword [rdx], 0xffffffffffffffff
jne 0x14000bb0f
xor r9d, r9d
mov r8d, 0x2719
mov rdx, qword [rsp + 0x80]
mov rcx, qword [rcx + 8]
jmp 0x14000bb88
mov eax, dword [rsp + 0x70]
lea r9, [rsp + 0x78]
and qword [rsp + 0x30], 0
mov r8d, r11d
mov rdi, qword [rsp + 0x80]
mov rdx, rsi
mov rcx, qword [r10]
and dword [rsp + 0x78], 0
mov dword [rsp + 0x50], eax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_WSARecv]
mov esi, eax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x40
jne 0x14000bb61
mov eax, 0x2746
jmp 0x14000bb6e
cmp eax, 0x4d2
mov ecx, 0x274d
cmove eax, ecx
test esi, esi
je 0x14000bb8f
cmp eax, 0x3e5
je 0x14000bb8f
mov r9d, dword [rsp + 0x78]
mov r8d, eax
mov rcx, qword [rbx + 8]
mov rdx, rdi
call fcn.1400096a8
jmp 0x14000bb9b
mov rcx, qword [rbx + 8]
mov rdx, rdi
call fcn.140009614
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x14000caec
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x38
mov r12, r8
mov rbx, rcx
and dword [rbp - 0x18], 0
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
and qword [rcx + 0x10], 0
and qword [rcx + 0x10], 0
mov qword [rcx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rcx], 0
mov dword [rbp - 0x18], 1
xor edi, edi
xor ecx, ecx
lea esi, [rdi + 3]
dec r12
mov al, byte [rdx]
mov byte [rbp + rcx + 0x58], al
inc edi
inc rcx
inc rdx
mov qword [rbp + 0x50], rdx
mov r13b, byte [rbp + 0x5a]
mov r14b, byte [rbp + 0x59]
mov r15b, byte [rbp + 0x58]
cmp rcx, rsi
jne 0x14000cbff
mov al, r15b
shr al, 2
mov byte [rbp + 0x60], al
mov cl, r15b
and cl, sil
shl cl, 4
mov al, r14b
shr al, 4
add cl, al
mov byte [rbp + 0x61], cl
mov cl, r14b
and cl, 0xf
shl cl, 2
mov al, r13b
shr al, 6
add cl, al
mov byte [rbp + 0x62], cl
mov al, r13b
and al, 0x3f
mov byte [rbp + 0x63], al
xor edi, edi
lea rcx, [0x140086b10]
cmp qword [0x140086b28], 0xf
cmova rcx, qword [0x140086b10]
movzx eax, byte [rbp + rdi + 0x60]
mov r9b, byte [rax + rcx]
mov rcx, qword [rbx + 0x10]
cmp rcx, qword [rbx + 0x18]
jae 0x14000cbe6
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x14000cbdb
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x14000cbee
mov rcx, rbx
call fcn.140027990
inc rdi
cmp rdi, 4
jl 0x14000cb9c
xor edi, edi
xor ecx, ecx
mov rdx, qword [rbp + 0x50]
test r12, r12
jne 0x14000cb37
test edi, edi
je 0x14000cd1b
cmp edi, esi
jge 0x14000cc38
mov eax, esi
sub eax, edi
movsxd r8, eax
movsxd rax, edi
lea rcx, [rbp + 0x58]
add rcx, rax
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov r13b, byte [rbp + 0x5a]
mov r14b, byte [rbp + 0x59]
mov r15b, byte [rbp + 0x58]
mov al, r15b
shr al, 2
mov byte [rbp + 0x60], al
and r15b, sil
shl r15b, 4
mov al, r14b
shr al, 4
add r15b, al
mov byte [rbp + 0x61], r15b
and r14b, 0xf
shl r14b, 2
mov al, r13b
shr al, 6
add r14b, al
mov byte [rbp + 0x62], r14b
and r13b, 0x3f
mov byte [rbp + 0x63], r13b
xor r14d, r14d
lea eax, [rdi + 1]
movsxd r15, eax
test eax, eax
jle 0x14000ccda
lea rcx, [0x140086b10]
cmp qword [0x140086b28], 0xf
cmova rcx, qword [0x140086b10]
movzx eax, byte [rbp + r14 + 0x60]
mov r9b, byte [rax + rcx]
mov rcx, qword [rbx + 0x10]
cmp rcx, qword [rbx + 0x18]
jae 0x14000ccca
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x14000ccbf
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x14000ccd2
mov rcx, rbx
call fcn.140027990
inc r14
cmp r14, r15
jl 0x14000cc7f
cmp edi, esi
jge 0x14000cd1b
sub esi, edi
movsxd rdi, esi
mov rcx, qword [rbx + 0x10]
cmp rcx, qword [rbx + 0x18]
jae 0x14000cd0a
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x14000cd02
mov rax, qword [rbx]
mov word [rax + rcx], 0x3d
jmp 0x14000cd15
mov r9b, 0x3d
mov rcx, rbx
call fcn.140027990
sub rdi, 1
jne 0x14000cce3
mov rax, rbx
add rsp, 0x38
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x14000e49c
Capabilities:
Encode data using xor
Hash data using sha1

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
push r15
mov r13d, dword [rcx]
mov rbx, rdx
mov r10d, dword [rcx + 4]
mov esi, r13d
mov r9d, dword [rcx + 8]
mov r11, rcx
mov edi, dword [rcx + 0xc]
xor r8d, r8d
mov r14d, dword [rcx + 0x10]
mov eax, r9d
mov ecx, r10d
and eax, r10d
mov edx, esi
ror edx, 0x1b
not ecx
and ecx, edi
or eax, ecx
add eax, edx
add eax, dword [rbx + r8*4]
inc r8
add eax, r14d
mov r14d, edi
mov edi, r9d
mov r9d, r10d
shr r10d, 2
shl r9d, 0x1e
or r9d, r10d
mov r10d, esi
lea esi, [rax + 0x5a827999]
cmp r8, 0x10
jl 0x14000e4d5
lea rbp, [rbx + 8]
mov r15d, 4
mov eax, dword [rbp + 0x2c]
mov edx, r10d
xor eax, dword [rbp + 0x18]
mov ecx, esi
xor eax, dword [rbp - 8]
not edx
xor eax, dword [rbp]
and edx, edi
mov r8d, eax
ror ecx, 0x1b
add eax, eax
shr r8d, 0x1f
or r8d, eax
mov eax, r9d
mov dword [rbp + 0x38], r8d
lea rbp, [rbp + 4]
and eax, r10d
or edx, eax
lea eax, [r8 + rcx]
add eax, edx
add eax, r14d
mov r14d, edi
mov edi, r9d
mov r9d, r10d
shr r10d, 2
shl r9d, 0x1e
or r9d, r10d
mov r10d, esi
lea esi, [rax + 0x5a827999]
sub r15, 1
jne 0x14000e522
lea ebp, [r15 + 0x14]
mov r15d, ebp
lea r8, [rbx + 0x18]
mov eax, dword [r8 + 0x2c]
mov ecx, edi
xor eax, dword [r8 + 0x18]
xor ecx, r9d
xor eax, dword [r8 - 8]
xor ecx, r10d
xor eax, dword [r8]
lea r8, [r8 + 4]
mov edx, eax
add eax, eax
shr edx, 0x1f
or edx, eax
mov eax, esi
ror eax, 0x1b
add eax, edx
mov dword [r8 + 0x34], edx
add eax, ecx
add eax, r14d
mov r14d, edi
mov edi, r9d
mov r9d, r10d
shr r10d, 2
shl r9d, 0x1e
or r9d, r10d
mov r10d, esi
lea esi, [rax + 0x6ed9eba1]
sub r15, 1
jne 0x14000e58d
lea r15, [rbx + 0x68]
mov r12, rbp
mov eax, dword [r15 + 0x2c]
mov ecx, r9d
xor eax, dword [r15 + 0x18]
or ecx, r10d
xor eax, dword [r15 - 8]
and ecx, edi
xor eax, dword [r15]
mov edx, esi
mov r8d, eax
ror edx, 0x1b
add eax, eax
shr r8d, 0x1f
or r8d, eax
mov eax, r9d
mov dword [r15 + 0x38], r8d
lea r15, [r15 + 4]
and eax, r10d
or ecx, eax
lea eax, [r14 + rdx]
add ecx, r8d
add eax, 0x8f1bbcdc
add eax, ecx
mov r14d, edi
mov edi, r9d
mov r9d, r10d
shr r10d, 2
shl r9d, 0x1e
or r9d, r10d
mov r10d, esi
mov esi, eax
sub r12, 1
jne 0x14000e5eb
add rbx, 0xb8
mov eax, dword [rbx + 0x2c]
mov ecx, esi
xor eax, dword [rbx + 0x18]
xor eax, dword [rbx - 8]
xor eax, dword [rbx]
lea rbx, [rbx + 4]
mov edx, eax
ror ecx, 0x1b
add eax, eax
shr edx, 0x1f
or edx, eax
mov eax, edi
xor eax, r9d
mov dword [rbx + 0x34], edx
xor eax, r10d
add eax, edx
lea edx, [r14 + rcx]
add edx, 0xca62c1d6
mov r14d, edi
mov edi, r9d
add edx, eax
mov r9d, r10d
shr r10d, 2
shl r9d, 0x1e
or r9d, r10d
mov r10d, esi
mov esi, edx
sub rbp, 1
jne 0x14000e657
add dword [r11 + 0xc], edi
lea eax, [rdx + r13]
add dword [r11 + 4], r10d
add dword [r11 + 8], r9d
add dword [r11 + 0x10], r14d
mov rbx, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov dword [r11], eax
pop r15
pop r14
pop r13
pop r12
ret
Function at 0x1400104bc
Capabilities:
Resolve dns

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x450
mov r14d, 2
mov rsi, r9
mov rdi, r8
mov ebp, edx
mov rbx, rcx
cmp word [rcx], r14w
je 0x1400104f5
cmp word [rcx], 0x17
jne 0x140010504
movzx ecx, word [rcx + 2]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
mov dword [rsi], eax
mov esi, 0x401
lea rcx, [rsp + 0x40]
mov r8d, esi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x30], r14d
lea r8, [rsp + 0x40]
xor r14d, r14d
mov r9d, esi
mov dword [rsp + 0x28], r14d
mov edx, ebp
mov rcx, rbx
mov qword [rsp + 0x20], r14
call qword [sym.imp.WS2_32.dll_getnameinfo]
test eax, eax
jne 0x140010590
lea rax, [rsp + 0x40]
or rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], r14b
jne 0x14001054a
cmp rbx, qword [rdi + 0x18]
ja 0x140010580
cmp qword [rdi + 0x18], 0xf
mov rsi, rdi
jbe 0x140010566
mov rsi, qword [rdi]
mov r8, rbx
mov qword [rdi + 0x10], rbx
lea rdx, [rsp + 0x40]
mov rcx, rsi
call sub.VCRUNTIME140.dll_memmove
mov byte [rsi + rbx], r14b
jmp 0x140010590
lea r9, [rsp + 0x40]
mov rdx, rbx
mov rcx, rdi
call fcn.140027ad0
lea r11, [rsp + 0x450]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x1400116f8
Capabilities:
Get socket status

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
push rdi
sub rsp, 0x240
mov rdx, qword [rcx + 8]
mov r8, qword [rcx + 0x18]
mov rax, qword [rcx + 0x10]
mov qword [rsp + 0x38], rdx
lea edi, [rdx + 1]
mov dword [rsp + 0x30], 1
mov dword [r11 + 8], eax
mov dword [r11 + 0xc], r8d
lea rax, [rsp + 0x250]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x30]
mov ecx, edi
call qword [sym.imp.WS2_32.dll_select]
mov ebx, eax
test eax, eax
jns 0x14001175c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 4
je 0x14001172b
test ebx, ebx
mov rbx, qword [rsp + 0x258]
setg al
add rsp, 0x240
pop rdi
ret

Function at 0x140011774
Capabilities:
Get socket status

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
push rdi
sub rsp, 0x240
mov rdx, qword [rcx + 8]
mov r8, qword [rcx + 0x28]
mov rax, qword [rcx + 0x20]
mov qword [rsp + 0x38], rdx
lea edi, [rdx + 1]
mov dword [rsp + 0x30], 1
mov dword [r11 + 8], eax
mov dword [r11 + 0xc], r8d
lea rax, [rsp + 0x250]
xor r9d, r9d
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rax
xor edx, edx
mov ecx, edi
call qword [sym.imp.WS2_32.dll_select]
mov ebx, eax
test eax, eax
jns 0x1400117d7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 4
je 0x1400117a7
test ebx, ebx
mov rbx, qword [rsp + 0x258]
setg al
add rsp, 0x240
pop rdi
ret

Function at 0x1400117f0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rcx]
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
call qword [rax + reloc.WS2_32.dll_htonl]
test al, al
je 0x140011832
cmp rbx, 0x7fffffff
ja 0x140011832
mov rcx, qword [rdi + 8]
xor r9d, r9d
mov r8d, ebx
mov rdx, rsi
call qword [sym.imp.WS2_32.dll_recv]
cdqe
jmp 0x140011836
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140011848
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rcx]
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
call qword [rax + reloc.WS2_32.dll_recv]
test al, al
je 0x14001188a
cmp rbx, 0x7fffffff
ja 0x14001188a
mov rcx, qword [rdi + 8]
xor r9d, r9d
mov r8d, ebx
mov rdx, rsi
call qword [sym.imp.WS2_32.dll_send]
cdqe
jmp 0x14001188e
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140017568
Capabilities:
Create process on windows

Disassembly:
push rbx
sub rsp, 0x50
cmp qword [rcx + 0x18], 0xf
mov rdx, rcx
jbe 0x14001757b
mov rdx, qword [rcx]
mov r9, qword [rcx + 0x10]
add r9, rdx
cmp qword [rcx + 0x18], 0xf
jbe 0x14001758c
mov rcx, qword [rcx]
xor ebx, ebx
xorps xmm0, xmm0
xorps xmm1, xmm1
movups xmmword [rsp + 0x30], xmm0
movdqu xmmword [rsp + 0x40], xmm1
cmp rcx, r9
jne 0x1400175b3
lea eax, [rbx + 7]
mov word [rsp + 0x30], bx
mov qword [rsp + 0x48], rax
jmp 0x1400175c8
sub r9, rcx
mov rdx, rcx
lea rcx, [rsp + 0x30]
call fcn.14002ed50
mov rax, qword [rsp + 0x48]
cmp rax, 7
mov dword [rsp + 0x28], 1
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rbx
cmova r8, qword [rsp + 0x30]
lea rdx, str.open
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rdx, qword [rsp + 0x48]
cmp eax, 0x20
setg bl
cmp rdx, 7
jbe 0x140017641
mov rcx, qword [rsp + 0x30]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001763c
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001763c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400571a8
mov al, bl
add rsp, 0x50
pop rbx
ret
Function at 0x14001c0e4
Capabilities:
Initialize winsock library

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x1f0
mov bl, dl
mov rdi, rcx
mov eax, 1
lock xadd dword [0x140086b90], eax
inc eax
cmp eax, 1
jne 0x14001c125
mov ecx, 0x202
lea rdx, [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_WSAStartup]
xchg dword [0x140086b94], eax
test bl, bl
je 0x14001c1b2
xor ebx, ebx
lock xadd dword [0x140086b94], ebx
test ebx, ebx
je 0x14001c1b2
and dword [rsp + 0x3c], 0
lea rsi, [0x14007f0d0]
movabs rcx, 0x4d54ee85da812030
add rcx, qword [0x14007f0d8]
cmp rcx, 1
jbe 0x14001c16f
mov rax, qword [0x14007f0d0]
mov edx, ebx
mov rcx, rsi
call qword [rax + 0x30]
jmp 0x14001c171
mov al, 1
lea rcx, str.E:_software_boost_1_85_0_boost_asiodetailimplwinsock_init.ipp
movzx eax, al
add rax, 2
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x48], rax
lea rcx, str.void___cdecl_boost::asio::detail::winsock_init_base::throw_on_error_struct_boost::asio::detail::winsock_init_base::data__
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x38], ebx
mov qword [rsp + 0x40], rsi
mov dword [rsp + 0x30], 0x48
mov dword [rsp + 0x34], 0x1a
test al, 1
jne 0x14001c1ca
lea r11, [rsp + 0x1f0]
mov rax, rdi
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
lea r8, [rsp + 0x20]
lea rdx, str.winsock
lea rcx, [rsp + 0x38]
call fcn.140007bd0
int3

Function at 0x14001ca18
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rcx, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x14001ca4b
movzx eax, byte [rdx + r9]
movabs r10, 0x100000001b3
xor rcx, rax
inc r9
imul rcx, r10
cmp r9, r8
jb 0x14001ca2d
mov eax, ecx
ret
Function at 0x14003a694
Capabilities:
Hash data using sha1

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rax - 0xb8]
sub rsp, 0x1a0
mov rdi, r8
mov r14, rdx
mov rcx, rdi
lea rdx, str.258EAFA5_E914_47DA_95CA_C5AB0DC85B11
mov r8d, 0x24
call fcn.14001d388
cmp qword [rdi + 0x18], 0xf
mov r15, rdi
jbe 0x14003a6e2
mov r15, qword [rdi]
mov rsi, qword [rdi + 0x10]
xor ebx, ebx
mov dword [rsp + 0x20], 0x67452301
mov dword [rsp + 0x24], 0xefcdab89
mov dword [rsp + 0x28], 0x98badcfe
mov dword [rsp + 0x2c], 0x10325476
mov dword [rsp + 0x30], 0xc3d2e1f0
cmp rsi, 0x40
jb 0x14003a77c
lea r12, [rsi - 0x40]
lea rax, [rbx + 0x40]
cmp rbx, rax
jae 0x14003a768
lea rdx, [r15 + 2]
mov r9d, reloc.WS2_32.dll_recv
add rdx, rbx
lea r8, [rsp + 0x60]
add rbx, 0x40
movzx eax, byte [rdx - 1]
movzx ecx, byte [rdx - 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx]
shl ecx, 8
lea rdx, [rdx + 4]
or ecx, eax
movzx eax, byte [rdx - 3]
shl ecx, 8
or ecx, eax
mov dword [r8], ecx
lea r8, [r8 + 4]
sub r9, 1
jne 0x14003a739
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x20]
call fcn.14000e49c
cmp rbx, r12
jbe 0x14003a71a
mov r10, rsi
mov eax, reloc.WS2_32.dll_ntohs
sub r10, rbx
and dword [rsp + rax*4 + 0x60], 0
sub rax, 1
jns 0x14003a787
xor r9d, r9d
lea r11d, [r9 + 3]
test r10, r10
je 0x14003a7cc
add rbx, r15
movzx edx, byte [rbx + r9]
mov cl, r9b
and cl, r11b
mov r8, r9
shr r8, 2
mov eax, r11d
sub al, cl
inc r9
shl al, 3
mov cl, al
shl edx, cl
or dword [rsp + r8*4 + 0x60], edx
cmp r9, r10
jb 0x14003a7a1
mov rdx, r9
mov eax, 0x80
and r9b, r11b
shr rdx, 2
sub r11b, r9b
mov cl, r11b
shl cl, 3
shl eax, cl
or dword [rsp + rdx*4 + 0x60], eax
cmp r10, 0x38
jb 0x14003a814
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x20]
call fcn.14000e49c
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
lea rax, [rsi*8]
lea rdx, [rsp + 0x60]
mov dword [rbp - 0x64], eax
lea rcx, [rsp + 0x20]
call fcn.14000e49c
lea r8, [rsp + 0x53]
mov edx, 0xffffff80
mov r9d, reloc.WS2_32.dll_send
mov rax, r9
mov ecx, edx
sar rax, 2
and ecx, 0x18
dec r9
add edx, 8
mov eax, dword [rsp + rax*4 + 0x20]
shr eax, cl
mov byte [r8], al
dec r8
cmp edx, 0x18
jle 0x14003a83e
mov r8d, setsockopt
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.14000caec
mov rdx, rax
mov rcx, rdi
call fcn.14001d4c8
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x14003a8c1
mov rcx, qword [rsp + 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003a8bc
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003a8bc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400571a8
and dword [r14], 0
lea r11, [rsp + 0x1a0]
mov rbx, qword [r11 + 0x20]
lea rax, [0x14007f380]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov qword [r14 + 8], rax
mov rax, r14
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x140056850
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x14005688a
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x14005688f
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x1400568d8
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, reloc.WS2_32.dll_accept
cmp byte [rcx + rax], 0
je 0x1400568d8
dec r8
sub rdx, 1
jne 0x1400568be
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x1400570c0
Capabilities:
Generate random numbers via winapi

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, qword [rcx]
lea r8, [rsp + 0x30]
mov edx, 4
mov rcx, qword [rbx]
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x1400570ea
mov eax, dword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret
lea rdx, str.error_while_reading
mov rcx, rbx
call fcn.140057100
int3

Function at 0x1400580a0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400580ea
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400580ea
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400580ea
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400580ea
cmp dword [rcx + 0x84], 0xe
jbe 0x1400580ea
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400580ec
xor al, al
add rsp, 0x28
ret

Function at 0x1004039e0
Capabilities:
Encode data using xor

Disassembly:
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al