joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7ff748b53ea0
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
mov r14b, byte [0x7ff748c203b7]
mov rdi, rdx
mov rsi, rcx
call fcn.7ff748b6279c
mov ecx, eax
mov edx, 0x8000
call fcn.7ff748b625c4
cmp dword [rdi + 0x10], 0xb
mov ebp, eax
je 0x7ff748b9a574
lea rcx, [rsp + 0x20]
call fcn.7ff748b3a368
mov rcx, rdi
call fcn.7ff748b3d4cc
mov rcx, qword [rdi + 8]
lea rdx, [rsp + 0x20]
call fcn.7ff748b54120
mov r8, qword [rsp + 0x20]
lea rdx, [0x7ff748be6b28]
mov rcx, rsi
call fcn.7ff748b53f70
movsxd rbx, eax
test r14b, r14b
jne 0x7ff748b9a5a2
lea rcx, [rsp + 0x20]
call fcn.7ff748b3a07c
mov rcx, rsi
call fcn.7ff748b62c3c
mov rcx, rsi
call fcn.7ff748b6279c
mov ecx, 0x4000
cmp ebp, 0xffffffff
cmove ebp, ecx
mov ecx, eax
mov edx, ebp
call fcn.7ff748b625c4
mov rbp, qword [rsp + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
mov rcx, rdi
call fcn.7ff748bb18bc
mov rcx, rdi
movsxd rbx, eax
call fcn.7ff748bb1864
mov rcx, rax
mov r9, rsi
mov r8, rbx
mov edx, 1
call fcn.7ff748b62a04
mov rbx, rax
jmp 0x7ff748b53f2d
mov rcx, rdi
call fcn.7ff748b3d4cc
mov rcx, qword [rdi + 8]
mov rcx, qword [rcx]
call qword [0x7ff748be5470]
nop
jmp 0x7ff748b53f23

Function at 0x7ff748b59248
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x7ff748b58fac
Function at 0x7ff748b711cc
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x7ff748b7106c
call fcn.7ff748b655d4
mov dword [rax], 0x16
call fcn.7ff748b6b164
or eax, 0xffffffff
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x7ff748b71054
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x7ff748b71054
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x10]
shr ecx, 1
test cl, 1
je 0x7ff748b7109e
lock or dword [rax + 0x14], 0x10
jmp 0x7ff748b71054
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x7ff748b710bb
mov rcx, qword [rbp + 0x10]
call fcn.7ff748b7674c
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.7ff748b6279c
mov rdx, qword [rbp + 0x10]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.7ff748b70aa4
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x10]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 1
ja 0x7ff748b71112
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x10]
and dword [rax + 0x10], 0
jmp 0x7ff748b71054
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x7ff748b7117e
mov rcx, qword [rbp + 0x10]
call fcn.7ff748b6279c
cmp eax, 0xffffffff
je 0x7ff748b71165
mov rcx, qword [rbp + 0x10]
call fcn.7ff748b6279c
cmp eax, 0xfffffffe
je 0x7ff748b71165
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.7ff748b6279c
movsxd rdi, eax
lea rsi, [0x7ff748c1f880]
mov rcx, rbx
sar rdi, 6
call fcn.7ff748b6279c
and eax, 0x3f
shl rax, 6
add rax, qword [rsi + rdi*8]
jmp 0x7ff748b7116c
lea rax, [0x7ff748c1a300]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x7ff748b7117e
mov rax, qword [rbp + 0x10]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x10]
cmp dword [rax + 0x20], 0x200
jne 0x7ff748b711b4
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x7ff748b711b0
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x7ff748b711b0
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x10]
dec dword [rax + 0x10]
mov rcx, qword [rax]
movzx edx, byte [rcx]
inc rcx
mov qword [rax], rcx
mov eax, edx
jmp 0x7ff748b71057
jmp 0x7ff748b71024
Function at 0x7ff748ba7400
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov rcx, qword [r8]
mov rdi, rdx
mov rsi, r8
mov r14d, dword [rcx + rdx]
lea rax, [rcx + 4]
mov qword [r8], rax
mov eax, 2
movsxd rcx, r14d
inc rcx
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.7ff748b54c68
mov rdx, qword [rsi]
lea ecx, [r14 + r14]
movsxd rbx, ecx
add rdx, rdi
mov r8, rbx
mov rcx, rax
mov r15, rax
call fcn.7ff748b55d00
add qword [rsi], rbx
xor eax, eax
movsxd rcx, r14d
mov word [r15 + rcx*2], ax
test r14d, r14d
jle 0x7ff748ba748f
mov rax, r15
mov ecx, r14d
xor word [rax], r14w
lea rax, [rax + 2]
sub rcx, 1
jne 0x7ff748ba7481
mov rbx, qword [rsp + 0x30]
mov rax, r15
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret

Function at 0x7ff748baca98
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x2c0
mov rdi, rdx
movsxd rbx, ecx
mov ecx, 0x101
lea rdx, [rsp + 0x120]
call qword [sym.imp.ws2_32.dll_WSAStartup]
test eax, eax
jne 0x7ff748bacb76
mov edx, 0x100
lea rcx, [rsp + 0x20]
call qword [sym.imp.ws2_32.dll_gethostname]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ws2_32.dll_gethostbyname]
test rax, rax
je 0x7ff748bacb76
mov r9, qword [rax + 0x18]
xor ecx, ecx
cmp qword [r9], rcx
je 0x7ff748bacb04
mov rax, r9
inc ecx
lea rax, [rax + 8]
cmp qword [rax], 0
jne 0x7ff748bacaf8
cmp ebx, ecx
jle 0x7ff748bacb19
lea rdx, [0x7ff748c0d4f8]
mov rcx, rdi
call fcn.7ff748b58d7c
jmp 0x7ff748bacb6e
mov rdx, qword [r9 + rbx*8 - 8]
lea rcx, [rsp + 0x2e0]
mov r8d, 4
call fcn.7ff748b55d00
mov ecx, dword [rsp + 0x2e0]
call qword [sym.imp.ws2_32.dll_inet_ntoa]
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.7ff748b62460
or edx, 0xffffffff
lea rcx, [rsp + 0x20]
call fcn.7ff748badaa4
mov rdx, rax
mov rcx, rdi
mov rbx, rax
call fcn.7ff748b58d7c
mov rcx, rbx
call fcn.7ff748b54c24
call qword [sym.imp.ws2_32.dll_WSACleanup]
jmp 0x7ff748bacb85
lea rdx, [0x7ff748be64d8]
mov rcx, rdi
call fcn.7ff748b58d7c
mov rbx, qword [rsp + 0x2d0]
add rsp, 0x2c0
pop rdi
ret
Function at 0x7ff748bacf68
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov ebx, dword [rsp + 0x80]
xor edi, edi
mov byte [0x7ff748c20419], dil
mov esi, r9d
mov rbp, r8
mov r14, rdx
mov r15, rcx
test ebx, ebx
je 0x7ff748bacfde
mov byte [0x7ff748c2041a], 1
call qword [0x7ff748be52f0]
lea r9, [rsp + 0x30]
mov dword [rsp + 0x34], ebx
mov dword [rsp + 0x30], eax
lea r8, [0x7ff748bad4ac]
lea rax, [rsp + 0x80]
xor edx, edx
mov qword [rsp + 0x28], rax
xor ecx, ecx
and dword [rsp + 0x20], edi
call fcn.7ff748b61f44
mov rdi, rax
mov r9d, esi
mov r8, rbp
mov rdx, r14
mov rcx, r15
call qword [0x7ff748be5e20]
mov ebx, eax
test rdi, rdi
je 0x7ff748bad013
or edx, 0xffffffff
mov byte [0x7ff748c2041a], 0
mov rcx, rdi
call qword [0x7ff748be52c8]
mov rcx, rdi
call qword [0x7ff748be57e8]
mov rbp, qword [rsp + 0x68]
or eax, 0xffffffff
cmp byte [0x7ff748c20419], 1
mov rsi, qword [rsp + 0x70]
cmove ebx, eax
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret

Function at 0x7ff748bb1918
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 0x28
sub dword [0x7ff748c1ef20], 1
jne 0x7ff748bb192a
call fcn.7ff748bb1a18
mov rax, qword [0x7ff748c23078]
mov ecx, dword [rax]
add rax, 4
mov qword [0x7ff748c23078], rax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
shr eax, 1
add rsp, 0x28
ret

Function at 0x7ff748bb196c
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 0x28
sub dword [0x7ff748c1ef20], 1
jne 0x7ff748bb197e
call fcn.7ff748bb1a18
mov rax, qword [0x7ff748c23078]
xorps xmm0, xmm0
mov ecx, dword [rax]
add rax, 4
mov qword [0x7ff748c23078], rax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
cvtsi2sd xmm0, rax
mulsd xmm0, qword [0x7ff748c0ef88]
add rsp, 0x28
ret

Function at 0x7ff748bb19d0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov r8d, 1
mov dword [0x7ff748c226b0], ecx
mov ecx, r8d
lea rdx, [0x7ff748c226b4]
mov eax, dword [rdx - 4]
shr eax, 0x1e
xor eax, dword [rdx - 4]
imul eax, eax, 0x6c078965
add eax, ecx
add ecx, r8d
mov dword [rdx], eax
lea rdx, [rdx + 4]
cmp ecx, 0x270
jl 0x7ff748bb19e6
mov dword [0x7ff748c1ef20], r8d
mov dword [0x7ff748c23070], r8d
ret
Function at 0x7ff748bb1a18
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [0x7ff748c23070], 0
lea rbx, [0x7ff748c226b0]
jne 0x7ff748bb1a3d
xor ecx, ecx
call fcn.7ff748b647bc
mov rcx, rax
call fcn.7ff748bb19d0
mov dword [0x7ff748c1ef20], 0x270
mov edx, 0xe3
mov qword [0x7ff748c23078], rbx
mov r11d, 0x7ffffffe
mov eax, dword [rbx + 4]
mov ecx, eax
xor ecx, dword [rbx]
and al, 1
and ecx, r11d
xor ecx, dword [rbx]
shr ecx, 1
neg al
sbb eax, eax
and eax, 0x9908b0df
xor ecx, eax
xor ecx, dword [rbx + 0x634]
mov dword [rbx], ecx
add rbx, 4
sub edx, 1
jne 0x7ff748bb1a59
mov eax, dword [rbx]
mov r10d, 0x18c
mov edx, eax
lea r8, [rbx + 4]
mov r9d, dword [r8]
xor edx, r9d
and edx, r11d
xor edx, eax
mov eax, r9d
shr edx, 1
and al, 1
neg al
mov eax, r9d
sbb ecx, ecx
and ecx, 0x9908b0df
xor edx, ecx
xor edx, dword [rbx - 0x38c]
mov dword [rbx], edx
lea rbx, [r8]
sub r10d, 1
jne 0x7ff748bb1a8d
mov eax, dword [0x7ff748c226b0]
mov ecx, r9d
xor ecx, eax
and al, 1
and ecx, r11d
xor ecx, r9d
shr ecx, 1
neg al
sbb eax, eax
and eax, 0x9908b0df
xor ecx, eax
xor ecx, dword [r8 - 0x38c]
mov dword [r8], ecx
add rsp, 0x20
pop rbx
ret

Function at 0x7ff748bb1e88
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov edi, dword [rcx + 0x18]
mov rbx, rcx
cmp dword [rcx + 0x458], edi
jae 0x7ff748bb1fb0
mov r14d, 0x1ffff
mov edx, 1
mov rcx, rbx
call fcn.7ff748bb1bd0
mov rcx, rbx
cmp eax, 1
jne 0x7ff748bb1eee
lea edx, [rax + 7]
call fcn.7ff748bb1bd0
mov edx, dword [rbx + 0x458]
mov rcx, qword [rbx + 0x450]
and rdx, r14
mov byte [rdx + rcx], al
inc dword [rbx + 0x458]
inc dword [rbx + 0x45c]
jmp 0x7ff748bb1f49
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x38]
call fcn.7ff748bb1c9c
mov r8d, dword [rbx + 0x458]
sub r8d, dword [rsp + 0x38]
mov r9d, dword [rsp + 0x30]
test r9d, r9d
je 0x7ff748bb1f49
mov ecx, dword [rbx + 0x458]
mov eax, r8d
mov rdx, qword [rbx + 0x450]
and rax, r14
and rcx, r14
inc r8d
mov al, byte [rax + rdx]
mov byte [rcx + rdx], al
inc dword [rbx + 0x458]
inc dword [rbx + 0x45c]
add r9d, 0xffffffff
jne 0x7ff748bb1f13
mov dword [rsp + 0x30], r9d
mov rcx, rbx
call fcn.7ff748bb20cc
mov eax, dword [0x7ff748c23080]
cmp eax, 0x1000
jbe 0x7ff748bb1f93
and dword [0x7ff748c23080], 0
mov r9, qword [rbx + 0x470]
test r9, r9
je 0x7ff748bb1f9b
imul eax, dword [rbx + 0x10], 0x64
xor edx, edx
mov ecx, dword [rbx + 0x14]
div dword [rbx + 0x18]
mov edx, dword [rbx + 0x10]
mov r8d, eax
call r9
test eax, eax
jne 0x7ff748bb1f9b
mov byte [rbx + 0x464], 1
jmp 0x7ff748bb1f9b
inc eax
mov dword [0x7ff748c23080], eax
cmp byte [rbx + 0x464], 0
jne 0x7ff748bb1fed
cmp dword [rbx + 0x458], edi
jb 0x7ff748bb1eb0
movsxd rax, dword [rbx + 0x488]
test eax, eax
je 0x7ff748bb1fda
mov r9, qword [rbx + 0x30]
mov r8, rax
mov rcx, qword [rbx + 0x478]
mov edx, 1
call fcn.7ff748b62a04
and dword [rbx + 0x488], 0
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov eax, 4
jmp 0x7ff748bb1fdc
Function at 0x7ff748bb2038
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
mov edx, 1
lea r8d, [rdx + 7]
cmp dword [rcx + 0x1c], edx
jne 0x7ff748bb2069
mov edx, dword [rcx + 0x14]
add rdx, qword [rcx + 8]
lea rcx, [rsp + 0x30]
call fcn.7ff748b55d00
jmp 0x7ff748bb2077
mov r9, qword [rcx + 0x28]
lea rcx, [rsp + 0x30]
call fcn.7ff748b64c5c
movzx ecx, byte [rsp + 0x34]
lea rdx, [0x7ff748c0d6c0]
movzx eax, byte [rsp + 0x35]
add dword [rbx + 0x14], 8
xor ebx, ebx
shl ecx, 8
or ecx, eax
mov byte [rsp + 0x34], bl
movzx eax, byte [rsp + 0x36]
shl ecx, 8
or ecx, eax
movzx eax, byte [rsp + 0x37]
shl ecx, 8
or ecx, eax
mov dword [rdi], ecx
lea rcx, [rsp + 0x30]
call fcn.7ff748b64d40
test eax, eax
setne bl
mov eax, ebx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x7ff748bb20cc
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov eax, dword [rcx + 0x460]
mov rbx, rcx
cmp eax, dword [rcx + 0x458]
jae 0x7ff748bb219b
cmp dword [rcx + 0x20], 1
jne 0x7ff748bb2128
mov r8d, dword [rbx + 0x460]
mov rax, qword [rbx + 0x450]
and r8d, 0x1ffff
mov edx, dword [rbx + 0x10]
mov rcx, qword [rbx]
mov al, byte [r8 + rax]
mov byte [rdx + rcx], al
inc dword [rbx + 0x460]
inc dword [rbx + 0x10]
mov eax, dword [rbx + 0x460]
cmp eax, dword [rbx + 0x458]
jb 0x7ff748bb20ed
jmp 0x7ff748bb219b
movsxd rdx, dword [rbx + 0x488]
mov r8d, eax
mov rax, qword [rbx + 0x450]
and r8d, 0x1ffff
mov rcx, qword [rbx + 0x478]
mov al, byte [r8 + rax]
mov byte [rdx + rcx], al
inc dword [rbx + 0x488]
cmp dword [rbx + 0x488], 0x10000
jne 0x7ff748bb2182
mov r9, qword [rbx + 0x30]
mov edx, 1
mov rcx, qword [rbx + 0x478]
mov r8d, 0x10000
call fcn.7ff748b62a04
and dword [rbx + 0x488], 0
mov eax, dword [rbx + 0x460]
inc dword [rbx + 0x10]
inc eax
mov dword [rbx + 0x460], eax
cmp eax, dword [rbx + 0x458]
jb 0x7ff748bb2128
and dword [rbx + 0x45c], 0
add rsp, 0x20
pop rbx
ret

Function at 0x7ff748bb21a8
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x48c]
mov rbx, rcx
mov r8d, 0x10000
test edx, edx
je 0x7ff748bb21c6
cmp edx, r8d
jne 0x7ff748bb21e4
mov r9, qword [rcx + 0x28]
mov edx, 1
mov rcx, qword [rcx + 0x480]
call fcn.7ff748b64c5c
and dword [rbx + 0x48c], 0
xor edx, edx
mov rax, qword [rbx + 0x480]
movsxd rcx, edx
mov al, byte [rcx + rax]
lea ecx, [rdx + 1]
mov dword [rbx + 0x48c], ecx
add rsp, 0x20
pop rbx
ret

Function at 0x7ff748bb240c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x100
mov rdi, rcx
mov esi, edx
lea rcx, [rsp + 0x20]
mov ebx, r8d
call fcn.7ff748bb2200
mov edx, ebx
lea rcx, [rsp + 0x20]
call fcn.7ff748bb225c
test esi, esi
je 0x7ff748bb2457
mov ebx, esi
lea rcx, [rsp + 0x20]
call fcn.7ff748bb23d4
xor byte [rdi], al
inc rdi
sub rbx, 1
jne 0x7ff748bb2442
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x7ff748bbe87c
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x420
mov rbp, rdx
mov rdi, rcx
mov rcx, qword [rcx + 0x50]
lea rdx, [0x7ff748c0d6d0]
call fcn.7ff748b648e0
mov rsi, rax
test rax, rax
jne 0x7ff748bbe8b6
lea edx, [rax + 0x1f]
jmp 0x7ff748bbe928
mov ebx, 1
mov dword [rsp + 0x430], ebx
lea r9, [rsp + 0x430]
mov r8d, 0x400
lea rdx, [rsp + 0x20]
mov rcx, rbp
call qword [0x7ff748be5f88]
test eax, eax
je 0x7ff748bbe923
mov eax, dword [rsp + 0x430]
test eax, eax
je 0x7ff748bbe90e
mov edx, eax
lea rcx, [rsp + 0x20]
mov r9, rsi
mov r8, rbx
call fcn.7ff748b62a04
mov ecx, dword [rsp + 0x430]
add qword [rdi + 0x10], rcx
test ecx, ecx
jne 0x7ff748bbe8c2
cmp qword [rdi + 0x10], 0
jne 0x7ff748bbe91c
mov edx, 0x21
jmp 0x7ff748bbe928
xor edx, edx
xor r8d, r8d
jmp 0x7ff748bbe930
mov edx, 0x20
xor bl, bl
mov r8d, 0xdeadbeef
mov r9b, bl
mov rcx, rdi
call fcn.7ff748bbeab8
mov bl, al
test rsi, rsi
je 0x7ff748bbe94a
mov rcx, rsi
call fcn.7ff748b64970
lea r11, [rsp + 0x420]
mov al, bl
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x7ff748bbedbc
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [rcx + 0x188], 0
mov rbx, rcx
je 0x7ff748bbee23
test dl, dl
je 0x7ff748bbee23
mov rcx, qword [rcx + 0x190]
test rcx, rcx
je 0x7ff748bbedec
call qword [0x7ff748be57e8]
and qword [rbx + 0x190], 0
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [0x7ff748be5580]
mov r8, rbx
lea rcx, [0x7ff748bbee6c]
xor edx, edx
mov qword [rbx + 0x190], rax
call fcn.7ff748b61e74
cmp dword [rbx + 0x20], 0
sete al
add rsp, 0x20
pop rbx
ret
add rsp, 0x20
pop rbx
jmp fcn.7ff748bbda70

Function at 0x7ff748bc4e8c
Capabilities:
Hash data with crc32

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
mov esi, dword [rsp + 0x30]
lea r14, [0x7ff748c09e50]
mov ebp, r9d
mov edi, r8d
imul ebp, dword [rsp + 0x30]
mov eax, r9d
shl eax, 2
or r10d, 0xffffffff
movsxd rbx, eax
add rdi, rdx
add rbx, rdx
mov r11, rdx
mov r9, rdx
shl ebp, 2
shl esi, 2
movzx eax, byte [r11 + 2]
movzx ecx, r10b
xor rcx, rax
shr r10d, 8
movzx eax, byte [r11 + 1]
mov edx, dword [r14 + rcx*4]
xor edx, r10d
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [r11]
add r11, rbp
mov r8d, dword [r14 + rcx*4]
xor r8d, edx
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
mov r10d, dword [r14 + rcx*4]
xor r10d, r8d
cmp r11, rdi
jb 0x7ff748bc4f28
mov eax, esi
add r9, rax
mov r11, r9
cmp r9, rbx
jb 0x7ff748bc4ed6
mov rbx, qword [rsp + 0x10]
not r10d
mov rbp, qword [rsp + 0x18]
xorps xmm0, xmm0
mov rsi, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
mov eax, r10d
cvtsi2sd xmm0, rax
pop r14
ret
Function at 0x7ff748bc5f2c
Capabilities:
Get socket status

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x20], rdi
push r14
sub rsp, 0x30
and dword [r8], 0
mov r14, rdx
mov qword [r8 + 8], rdx
mov eax, 0x10624dd3
inc dword [r8]
mov rdi, rcx
imul r9d
xor ecx, ecx
mov rsi, r8
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x3e8
mov dword [rsp + 0x50], edx
sub r9d, eax
imul eax, r9d, 0x3e8
xor r9d, r9d
mov dword [rsp + 0x54], eax
lea rax, [r11 + 0x18]
mov qword [r11 - 0x18], rax
cmp byte [rsp + 0x60], cl
je 0x7ff748bc5f96
xor edx, edx
jmp 0x7ff748bc5f9c
xor r8d, r8d
mov rdx, rsi
call qword [sym.imp.ws2_32.dll_select]
mov ebx, eax
test eax, eax
jne 0x7ff748bc5fca
cmp byte [rsp + 0x60], al
je 0x7ff748bc6020
mov rax, qword [rdi]
movsxd rcx, dword [rax + 4]
add rcx, 8
add rcx, rdi
call fcn.7ff748b34afc
mov dword [rax + 0x1c], 0x274c
jmp 0x7ff748bc6017
jle 0x7ff748bc5ff7
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.ws2_32.dll___WSAFDIsSet]
test eax, eax
jne 0x7ff748bc6020
lea ebx, [rax - 2]
mov rax, qword [rdi]
movsxd rcx, dword [rax + 4]
add rcx, 8
add rcx, rdi
call fcn.7ff748b34afc
mov dword [rax + 0x1c], ebx
jmp 0x7ff748bc6017
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
mov rcx, qword [rdi]
mov r8d, eax
movsxd rcx, dword [rcx + 4]
add rcx, 8
add rcx, rdi
call fcn.7ff748b34afc
mov dword [rax + 0x1c], r8d
call fcn.7ff748b34afc
mov byte [rax + 0x20], 0
mov rsi, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x7ff749504688
Capabilities:
Decompress data using aplib

Disassembly:
call 0x7ff74950480f
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x7ff7495046b9
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x7ff74950469f
add dl, dl
jne 0x7ff7495046c6
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x7ff749504726
xor eax, eax
add dl, dl
jne 0x7ff7495046d5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x7ff7495047dd
add dl, dl
jne 0x7ff7495046e6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7ff7495046f3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7ff749504700
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7ff74950470d
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x7ff74950471a
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x7ff7495046ae
mov eax, 1
add dl, dl
jne 0x7ff749504736
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7ff749504743
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x7ff74950472b
sub eax, ebx
mov ebx, 1
jne 0x7ff74950477c
mov ecx, 1
add dl, dl
jne 0x7ff74950475e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x7ff74950476b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x7ff749504753
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x7ff7495046ae
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x7ff749504798
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x7ff7495047a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x7ff74950478d
cmp eax, 0x7d00
jae 0x7ff7495047cb
cmp eax, 0x500
jb 0x7ff7495047c6
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x7ff7495046ae
cmp eax, 0x7f
ja 0x7ff7495047ce
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x7ff7495046ae
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x7ff749504802
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x7ff7495046ae
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20