joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14005bf70
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], rbp
push r14
sub rsp, 0x20
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14005c18c
movsxd rax, dword [rcx + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x14005c18c
mov r8d, dword [rax + rcx + 0xd8]
test r8d, r8d
je 0x14005c17e
mov r14, qword [r8 + rcx + 0x58]
test r14, r14
je 0x14005c17e
sub rcx, rdx
movabs rbp, 0x2b992ddfa232
add r14, rcx
cmp qword [r14], rbp
jne 0x14005c18c
mov rax, qword gs:[0x60]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], rdi
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x14005c077
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x14005c077
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0xfe44377c
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x14005c072
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x14005c050
cmp r8d, 0x6d4a24f
je 0x14005c07c
test r9d, r9d
jne 0x14005c030
mov rax, qword [rax]
jmp 0x14005c000
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
call rax
mov rcx, qword gs:[0x60]
mov esi, eax
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
nop dword [rax + rax]
mov r10, qword [rcx + 0x30]
movsxd rdx, dword [r10 + 0x3c]
mov ebx, dword [rdx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x14005c127
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x14005c127
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x1443c35
lea rax, [rdi + r9*4]
mov edx, dword [rax + r10]
add rdx, r10
movzx eax, byte [rdx]
inc rdx
test al, al
je 0x14005c122
nop
movsx eax, al
lea rdx, [rdx + 1]
xor eax, r8d
imul r8d, eax, 0x1000193
movzx eax, byte [rdx - 1]
test al, al
jne 0x14005c100
cmp r8d, 0x434a6be5
je 0x14005c12c
test r9d, r9d
jne 0x14005c0e0
mov rcx, qword [rcx]
jmp 0x14005c0b0
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
call rax
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
mov ecx, eax
movabs rax, 0x2b992ddfa233
xor rcx, rsi
mov rsi, qword [rsp + 0x38]
xor rcx, rbp
cmp rcx, rbp
cmove rcx, rax
mov al, 1
mov qword [r14], rcx
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov al, 1
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov rbp, qword [rsp + 0x48]
xor al, al
add rsp, 0x20
pop r14
ret
Function at 0x14005ca50
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x1400af040]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rsi, rdx
mov rdi, rcx
mov qword [rsp + 0x40], rcx
xor r8d, r8d
mov eax, 0x5a4d
cmp word [rdx], ax
jne 0x14005cb67
movsxd rax, dword [rdx + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x14005cb67
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x48], xmm1
mov qword [rsp + 0x58], r8
mov ecx, dword [rax + rdx + 0xb0]
test ecx, ecx
jne 0x14005cac9
mov qword [rdi], r8
mov qword [rdi + 8], r8
mov qword [rdi + 0x10], r8
jmp 0x14005cb72
lea rbx, [rdx + rcx]
mov ebp, dword [rax + rdx + 0xb4]
add rbp, rbx
mov rcx, qword [rsp + 0x50]
cmp rbx, rbp
jae 0x14005cb55
mov edx, dword [rbx + 4]
test edx, edx
je 0x14005cb55
mov eax, dword [rbx]
add rax, rsi
mov qword [rsp + 0x28], rax
lea rax, [rbx + 8]
mov qword [rsp + 0x30], rax
lea rax, [rdx - 8]
shr rax, 1
mov dword [rsp + 0x38], eax
cmp rcx, r8
je 0x14005cb2e
movups xmm0, xmmword [rsp + 0x28]
movups xmmword [rcx], xmm0
movsd xmm1, qword [rsp + 0x38]
movsd qword [rcx + 0x10], xmm1
mov rcx, qword [rsp + 0x50]
add rcx, 0x18
mov qword [rsp + 0x50], rcx
jmp 0x14005cb45
lea r8, [rsp + 0x28]
mov rdx, rcx
lea rcx, [rsp + 0x48]
call fcn.14005d5e0
mov rcx, qword [rsp + 0x50]
mov eax, dword [rbx + 4]
add rbx, rax
mov r8, qword [rsp + 0x58]
cmp rbx, rbp
jb 0x14005cae1
mov rax, qword [rsp + 0x48]
mov qword [rdi], rax
mov qword [rdi + 8], rcx
mov qword [rdi + 0x10], r8
jmp 0x14005cb72
mov qword [rcx], r8
mov qword [rcx + 8], r8
mov qword [rcx + 0x10], r8
mov rax, rdi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14007f7f0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14005f150
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x50
mov rax, qword [0x1400af040]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor edx, edx
lea r9, [rsp + 0x20]
mov rsi, rcx
xor r14d, r14d
xor r8d, r8d
mov dword [rsp + 0x20], r14d
mov ebx, r14d
lea ecx, [rdx + 0xb]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x14005f1de
test rbx, rbx
je 0x14005f1a6
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rsp + 0x20]
xor ecx, ecx
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
mov rdx, rax
mov ecx, 0xb
mov rbx, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x14005f190
test eax, eax
jns 0x14005f1ff
test rbx, rbx
je 0x14005f204
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
jmp 0x14005f302
test rbx, rbx
jne 0x14005f20b
xor eax, eax
jmp 0x14005f302
mov qword [rsp + 0x78], rbp
mov qword [rsp + 0x80], rdi
mov edi, r14d
cmp dword [rbx], r14d
jbe 0x14005f2e2
mov eax, edi
xorps xmm0, xmm0
imul rcx, rax, 0x128
movups xmmword [rsp + 0x28], xmm0
movzx edx, word [rcx + rbx + 0x2e]
lea rbp, [rcx + rbx]
add rdx, 0x30
mov qword [rsp + 0x38], r14
add rdx, rcx
mov qword [rsp + 0x40], r14
add rdx, rbx
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rdx + r8], r14b
jne 0x14005f260
lea rcx, [rsp + 0x28]
call fcn.14005b280
cmp qword [rsi + 0x18], 0xf
mov rdx, rsi
jbe 0x14005f280
mov rdx, qword [rsi]
cmp qword [rsp + 0x40], 0xf
lea rcx, [rsp + 0x28]
cmova rcx, qword [rsp + 0x28]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x14005f318
mov rdx, qword [rsp + 0x40]
cmp rdx, 0xf
jbe 0x14005f2d8
mov rcx, qword [rsp + 0x28]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005f2d3
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005f361
call fcn.14007fc40
inc edi
cmp edi, dword [rbx]
jb 0x14005f224
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov rbp, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14007f7f0
add rsp, 0x50
pop r14
pop rsi
pop rbx
ret
mov rdi, qword [rbp + 0x18]
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rdx, qword [rsp + 0x40]
cmp rdx, 0xf
jbe 0x14005f36d
mov rcx, qword [rsp + 0x28]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005f368
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005f368
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007fc40
mov rax, rdi
jmp 0x14005f2f5
Function at 0x1400612d0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push rbx
mov eax, 0x13c0
call fcn.140080c80
sub rsp, rax
mov rax, qword [0x1400af040]
xor rax, rsp
mov qword [rsp + 0x13b0], rax
mov ebx, edx
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov dword [rsp + 0x13a4], 0xffffffff
mov r8d, 1
mov dword [rsp + 0x24], eax
mov r9d, 0x270
nop dword [rax]
nop dword [rax + rax]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, r8d
mov dword [rsp + r8*4 + 0x24], eax
inc r8
cmp r8, r9
jb 0x140061320
mov dword [rsp + 0x20], r9d
cmp ebx, 4
jne 0x1400613c3
lea r8, [rsp + 0x28]
nop dword [rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x140061350
mov eax, dword [rsp + 0x20]
mov ecx, dword [rsp + rax*4 + 0x24]
mov eax, ecx
shr eax, 0xb
and eax, dword [rsp + 0x13a4]
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
add eax, 5
jmp 0x140061415
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x13d0], rdi
add ebx, 0xfffffffc
call fcn.14007d3d0
mov ecx, eax
mov edi, ebx
imul rcx, rdi
cmp ecx, ebx
jae 0x140061406
mov eax, ebx
xor edx, edx
neg eax
div ebx
mov ebx, edx
cmp ecx, edx
jae 0x140061406
lea rcx, [rsp + 0x20]
call fcn.14007d3d0
mov ecx, eax
imul rcx, rdi
cmp ecx, ebx
jb 0x1400613f2
mov rdi, qword [rsp + 0x13d0]
shr rcx, 0x20
lea eax, [rcx + 5]
mov rcx, qword [rsp + 0x13b0]
xor rcx, rsp
call fcn.14007f7f0
add rsp, 0x13c0
pop rbx
ret
Function at 0x140061430
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov rax, qword [0x1400af040]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rsi, rcx
mov qword [rsp + 0x28], rcx
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov r14, rax
mov edx, dword [0x14009d180]
mov dword [rsp + 0x20], edx
movzx edx, word [0x14009d184]
mov word [rsp + 0x24], dx
movzx ecx, byte [0x14009d186]
mov byte [rsp + 0x20], 0x45
xor byte [rsp + 0x21], 0x32
xor byte [rsp + 0x22], 0x33
xor byte [rsp + 0x23], 0x34
xor dl, 0x35
mov byte [rsp + 0x24], dl
xor byte [rsp + 0x25], 0x36
xor cl, 0x37
mov byte [rsp + 0x26], cl
mov rbp, rsi
cmp qword [rsi + 0x18], 0xf
jbe 0x1400614b3
mov rbp, qword [rsi]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop dword [rax + rax]
mov r11, qword [rax + 0x30]
movsxd rcx, dword [r11 + 0x3c]
mov ebx, dword [rcx + r11 + 0x88]
add rbx, r11
cmp rbx, r11
je 0x140061546
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140061546
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r11]
add rcx, r11
mov r8d, 0x5459ce82
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x140061541
nop
movsx edx, dl
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx]
lea rcx, [rcx + 1]
test dl, dl
jne 0x140061520
cmp r8d, 0x45e81405
je 0x14006154b
test r9d, r9d
jne 0x140061500
mov rax, qword [rax]
jmp 0x1400614d0
mov ecx, dword [rbx + 0x1c]
add rcx, r11
mov eax, dword [rbx + 0x24]
add rax, r11
movzx eax, word [rax + r9*2]
mov r10d, dword [rcx + rax*4]
add r10, r11
mov r9d, select
lea r8, [rsp + 0x20]
mov rdx, rbp
mov rcx, r14
call r10
nop
mov rdx, qword [rsi + 0x18]
cmp rdx, 0xf
jbe 0x1400615ae
inc rdx
mov rcx, qword [rsi]
cmp rdx, 0x1000
jb 0x1400615a9
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400615e1
mov rcx, r8
call fcn.14007fc40
mov qword [rsi + 0x10], 0
mov qword [rsi + 0x18], select
mov byte [rsi], 0
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14007f7f0
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x140067460
Capabilities:
Allocate thread local storage

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x1400af040]
xor rax, rsp
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov edi, eax
cmp eax, 0xffffffff
jne 0x14006752a
mov qword [rsp + 0x70], rsi
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, qword [0x1400af560]
lea rsi, [0x1400af558]
mov ebx, eax
mov dword [rsp + 0x3c], 0
movabs rax, 0x4d54ee85da812030
add rdx, rax
cmp rdx, 1
jbe 0x1400674d5
mov rcx, qword [0x1400af558]
mov edx, ebx
mov r8, qword [rcx + 0x30]
mov rcx, rsi
call r8
jmp 0x1400674da
test ebx, ebx
setne al
lea rcx, str.C:Users_ntoskrnlDesktopSDK_boost_asio_182_0_boost_asiodetailimplwin_tss_ptr.ipp
movzx eax, al
add rax, 2
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x40], rsi
lea rcx, str.win_tss_ptr_create
mov rsi, qword [rsp + 0x70]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], 0x2e
mov dword [rsp + 0x34], 0x1a
test al, 1
je 0x14006752a
cmp rax, 1
jne 0x140067544
test ebx, ebx
jne 0x140067544
mov eax, edi
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14007f7f0
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
lea r8, [rsp + 0x20]
lea rdx, [0x14009c978]
lea rcx, [rsp + 0x38]
call fcn.140067340
int3

Function at 0x140067970
Capabilities:
Terminate thread

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x1400af040]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rax, qword [rcx + 0x10]
lea rdx, [rsp + 0x20]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rax, qword [rcx + 8]
mov rbx, rcx
mov r9d, 0xffffffff
mov qword [rsp + 0x28], rax
lea ecx, [r8 + 2]
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
lock xadd dword [0x1400b1264], eax
mov rcx, qword [rbx + 8]
test eax, eax
je 0x1400679e9
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14007f7f0
add rsp, 0x40
pop rbx
ret
mov rdx, rcx
xor r8d, r8d
lea rcx, [fcn.1400022c0]
call qword [sym.imp.KERNEL32.dll_QueueUserAPC]
mov rcx, qword [rbx + 8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14007f7f0
add rsp, 0x40
pop rbx
ret
Function at 0x140068610
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x70
xor eax, eax
lea rbx, [rcx + 0x28]
test rcx, rcx
mov ecx, dword [0x1400b13bc]
cmove rbx, rax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140068750
cmp qword [rax], rbx
je 0x14006864c
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x140068638
add rsp, 0x70
pop rbx
ret
mov rbx, qword [rax + 8]
test rbx, rbx
je 0x140068750
mov ecx, dword [rbx + 0x50]
test ecx, ecx
je 0x140068710
cmp ecx, 1
jne 0x140068750
xorps xmm0, xmm0
mov dword [rbx + 0x50], 2
lea rdx, [rbx + 0x58]
lea rcx, [rsp + 0x30]
movdqu xmmword [rsp + 0x30], xmm0
call qword [sym.imp.MSVCP140.dll_void___cdecl___ExceptionPtrCopy_void____ptr64__void_const____ptr64_]
xorps xmm0, xmm0
lea rax, vtable.boost::asio::multiple_exceptions.0
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x58]
movups xmmword [rsp + 0x48], xmm0
movdqu xmmword [rsp + 0x58], xmm0
call qword [sym.imp.MSVCP140.dll_void___cdecl___ExceptionPtrCopy_void____ptr64__void_const____ptr64_]
lea rcx, [rsp + 0x30]
call qword [sym.imp.MSVCP140.dll_void___cdecl___ExceptionPtrDestroy_void____ptr64_]
xorps xmm0, xmm0
lea rcx, [rsp + 0x20]
movdqu xmmword [rsp + 0x20], xmm0
call qword [sym.imp.MSVCP140.dll_void___cdecl___ExceptionPtrCreate_void____ptr64_]
lea r8, [0x1400ab2e8]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call qword [sym.imp.MSVCP140.dll_void___cdecl___ExceptionPtrCopyException_void____ptr64__void_const____ptr64__void_const____ptr64_]
lea rcx, [rsp + 0x58]
call qword [sym.imp.MSVCP140.dll_void___cdecl___ExceptionPtrDestroy_void____ptr64_]
lea rax, vtable.std::exception.0
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x40], rax
call qword [sym.imp.VCRUNTIME140.dll___std_exception_destroy]
jmp 0x140068736
xorps xmm0, xmm0
mov dword [rbx + 0x50], 1
lea rcx, [rsp + 0x20]
movdqu xmmword [rsp + 0x20], xmm0
call qword [sym.imp.MSVCP140.dll_void___cdecl___ExceptionPtrCreate_void____ptr64_]
lea rcx, [rsp + 0x20]
call qword [sym.imp.MSVCP140.dll_void___cdecl___ExceptionPtrCurrentException_void____ptr64_]
lea rdx, [rsp + 0x20]
lea rcx, [rbx + 0x58]
call qword [sym.imp.MSVCP140.dll_void___cdecl___ExceptionPtrAssign_void____ptr64__void_const____ptr64_]
lea rcx, [rsp + 0x20]
call qword [sym.imp.MSVCP140.dll_void___cdecl___ExceptionPtrDestroy_void____ptr64_]
add rsp, 0x70
pop rbx
ret
Function at 0x140068fc0
Capabilities:
Set socket configuration

Disassembly:
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xa0
mov rax, qword [0x1400af040]
xor rax, rsp
mov qword [rbp + 0x17], rax
xor r12d, r12d
mov r15, r9
mov r14, rdx
mov rdi, rcx
cmp rcx, 0xffffffffffffffff
je 0x1400691bb
mov qword [rsp + 0xe0], rbx
test r8b, r8b
je 0x140069040
movzx eax, byte [rdx]
test al, 8
je 0x140069040
or al, 8
mov dword [rbp + 0xf], r12d
mov byte [rdx], al
lea r9, [rbp + 0xf]
mov edx, 0xffff
mov dword [rsp + 0x20], 4
mov r8d, 0x80
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
lea rcx, [rbp - 0x21]
setne dl
call fcn.140068f00
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
test eax, eax
mov rcx, r15
mov ebx, eax
setne dl
call fcn.140068f00
test ebx, ebx
je 0x1400691b7
mov qword [rsp + 0x98], rsi
movabs rcx, 0x4d54ee85da812030
mov rsi, qword [0x1400af560]
add rcx, rsi
mov qword [rsp + 0x90], r13
mov dword [rbp - 0x35], r12d
lea r13, [0x1400af558]
cmp rcx, 1
jbe 0x1400690b0
mov rax, qword [0x1400af558]
mov edx, 0x2733
mov rcx, r13
call qword [rax + 0x30]
mov rsi, qword [0x1400af560]
jmp 0x1400690b2
mov al, 1
movzx eax, al
lea rdx, [rbp - 9]
add rax, 2
mov dword [rbp - 0x39], 0x2733
mov qword [rbp - 0x29], rax
mov rcx, r15
movsd xmm1, qword [rbp - 0x29]
mov qword [rbp - 0x31], r13
movups xmm0, xmmword [rbp - 0x39]
movsd qword [rbp + 7], xmm1
movups xmmword [rbp - 9], xmm0
call fcn.1400668b0
test al, al
jne 0x14006914f
movabs rax, 0x4d54ee85da812030
mov dword [rbp - 0x35], r12d
add rax, rsi
cmp rax, 1
jbe 0x140069115
mov rax, qword [0x1400af558]
mov edx, 0x4d5
mov rcx, r13
call qword [rax + 0x30]
jmp 0x140069117
mov al, 1
movzx eax, al
lea rdx, [rbp - 0x21]
add rax, 2
mov dword [rbp - 0x39], 0x4d5
mov qword [rbp - 0x29], rax
mov rcx, r15
movsd xmm1, qword [rbp - 0x29]
mov qword [rbp - 0x31], r13
movups xmm0, xmmword [rbp - 0x39]
movsd qword [rbp - 0x11], xmm1
movups xmmword [rbp - 0x21], xmm0
call fcn.1400668b0
test al, al
je 0x140069181
lea r8, [rbp + 0xf]
mov dword [rbp + 0xf], r12d
mov edx, 0x8004667e
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_ioctlsocket]
and byte [r14], 0xfc
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
test eax, eax
mov rcx, r15
mov ebx, eax
setne dl
call fcn.140068f00
mov rsi, qword [rsp + 0x98]
mov eax, ebx
mov r13, qword [rsp + 0x90]
mov rbx, qword [rsp + 0xe0]
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.14007f7f0
add rsp, 0xa0
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
mov eax, ebx
jmp 0x140069193
mov eax, r12d
jmp 0x14006919b
Function at 0x140069450
Capabilities:
Send data
Send data on socket

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1400af040]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, qword [rbp + 0x60]
lea r9, [rbp - 0x18]
xor r15d, r15d
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
mov dword [rbp - 0x18], r15d
call qword [sym.imp.WS2_32.dll_WSASend]
mov esi, eax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov rdx, qword [0x1400af560]
lea r14, [0x1400af558]
movabs r12, 0x4d54ee85da812030
mov dword [rbp - 0x2c], r15d
add rdx, r12
mov edi, eax
cmp rdx, 1
jbe 0x1400694d8
mov rcx, qword [0x1400af558]
mov edx, eax
mov r8, qword [rcx + 0x30]
mov rcx, r14
call r8
jmp 0x1400694dd
test edi, edi
setne al
movzx eax, al
movabs r10, 0x4800144005b3
add rax, 2
mov dword [rbp - 0x30], edi
mov qword [rbp - 0x28], r14
movups xmm0, xmmword [rbp - 0x30]
mov qword [rbp - 0x20], rax
movsd xmm1, qword [rbp - 0x20]
movups xmmword [rbx], xmm0
movsd qword [rbx + 0x10], xmm1
mov r9, qword [rbx + 0x10]
cmp r9, 1
je 0x14006951b
mov eax, dword [rbx]
mov r8d, eax
jmp 0x14006954b
mov rcx, qword [rbx + 8]
mov rax, r10
mov r8d, dword [rbx]
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 0x14
imul rax, rax, 0x1ffff7
sub rcx, rax
imul eax, ecx, 0x3e8
add eax, r8d
cmp eax, 0x40
jne 0x14006958a
mov rcx, qword [0x1400af560]
add rcx, r12
mov dword [rbp - 0x2c], r15d
cmp rcx, 1
jbe 0x14006957f
mov rax, qword [0x1400af558]
mov edx, 0x2746
mov rcx, r14
call qword [rax + 0x30]
mov dword [rbp - 0x30], 0x2746
jmp 0x1400695f7
mov al, 1
mov dword [rbp - 0x30], 0x2746
jmp 0x1400695f7
cmp r9, 1
jne 0x1400695bd
mov rcx, qword [rbx + 8]
mov rax, r10
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 0x14
imul rax, rax, 0x1ffff7
sub rcx, rax
imul eax, ecx, 0x3e8
add r8d, eax
cmp r8d, 0x4d2
jne 0x140069617
mov rcx, qword [0x1400af560]
add rcx, r12
mov dword [rbp - 0x2c], r15d
cmp rcx, 1
jbe 0x1400695ee
mov rax, qword [0x1400af558]
mov edx, 0x274d
mov rcx, r14
call qword [rax + 0x30]
jmp 0x1400695f0
mov al, 1
mov dword [rbp - 0x30], 0x274d
movzx eax, al
mov qword [rbp - 0x28], r14
add rax, 2
movups xmm0, xmmword [rbp - 0x30]
mov qword [rbp - 0x20], rax
movsd xmm1, qword [rbp - 0x20]
movups xmmword [rbx], xmm0
movsd qword [rbx + 0x10], xmm1
test esi, esi
je 0x140069622
mov eax, 0xffffffff
jmp 0x140069639
mov eax, dword [rbp - 0x18]
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbp - 0x20], r15
movsd xmm0, qword [rbp - 0x20]
movsd qword [rbx + 0x10], xmm0
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14007f7f0
add rsp, 0x70
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret