joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44f660
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
test rbx, rbx
jbe 0x44f7d7
movzx edx, byte [rax]
test edx, edx
jne 0x44f694
nop dword [rax]
test r8b, r8b
jne 0x44f694
xor eax, eax
xor ebx, ebx
mov rcx, rbx
xor edi, edi
add rsp, 0x10
pop rbp
ret
bt edx, 7
jae 0x44f6a7
xor edx, edx
xor r8d, r8d
xor r9d, r9d
jmp 0x44f797
mov r8d, 1
mov r9d, edx
and edx, 1
neg edx
shr r9d, 1
xor edx, r9d
add dword [rsi], edx
nop dword [rax]
cmp rbx, r8
jb 0x44f785
sub rbx, r8
sub rcx, r8
mov rdx, rcx
neg rdx
sar rdx, 0x3f
and r8, rdx
lea rdx, [rax + r8]
test rbx, rbx
jbe 0x44f777
movzx esi, byte [rax + r8]
bt esi, 7
jae 0x44f6fd
xor eax, eax
xor esi, esi
xor r8d, r8d
jmp 0x44f740
mov eax, 1
cmp rax, rbx
ja 0x44f72b
add qword [rdi], rsi
sub rcx, rax
sub rbx, rax
mov rsi, rcx
neg rsi
sar rsi, 0x3f
and rax, rsi
add rax, rdx
mov edi, 1
add rsp, 0x10
pop rbp
ret
mov rcx, rbx
call fcn.00461940
lea r8d, [rcx + 7]
mov rcx, r11
mov eax, r12d
nop dword [rax]
cmp rax, rbx
jae 0x44f76f
movzx r9d, byte [rax + rdx]
mov r10d, r9d
and r9d, 0x7f
mov r11, rcx
mov ecx, r8d
shl r9d, cl
lea r12d, [rax + 1]
or esi, r9d
test r10b, 0x80
jne 0x44f733
mov rcx, r11
mov eax, r12d
jmp 0x44f702
mov rcx, rbx
call fcn.00461880
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.00461880
mov eax, r8d
mov rcx, rbx
call fcn.00461940
lea r9d, [rcx + 7]
mov rcx, r12
cmp rbx, rdx
jbe 0x44f7cd
movzx r10d, byte [rdx + rax]
mov r11d, r10d
and r10d, 0x7f
mov r12, rcx
mov ecx, r9d
shl r10d, cl
inc edx
or r8d, r10d
test r11b, 0x80
jne 0x44f790
mov rcx, r12
mov r9d, edx
mov edx, r8d
mov r8d, r9d
jmp 0x44f6ad
mov eax, edx
mov rcx, rbx
call fcn.00461880
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.00461880
nop
int3
Function at 0x456ba0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x456c4f
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x68]
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rsi, [0x00456ca0]
mov qword [rsp + 0x10], rsi
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.0045f4c0
xorps xmm15, xmm15
mov r14, qword [0x005e2108]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0045f600
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp fcn.00456ba0
Function at 0x4613e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x403783
push rbp
mov rbp, rsp
sub rsp, 0x18
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
call fcn.00409620
add rsp, 0x18
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045f600
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x403760
cmp byte [0x005e1eaa], 0
je 0x4613f5
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x45e640
jmp 0x403760

Function at 0x461400
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov eax, dword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x005e21c0]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d124b
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x005e1eaa], 0
je 0x461435
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x005e24a0]
aesenc xmm0, xmmword [0x005e24b0]
aesenc xmm0, xmmword [0x005e24c0]
movq rax, xmm0
ret
jmp 0x409840

Function at 0x461440
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x005e21c0]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x005e1eaa], 0
je 0x461476
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x005e24a0]
aesenc xmm0, xmmword [0x005e24b0]
aesenc xmm0, xmmword [0x005e24c0]
movq rax, xmm0
ret
jmp 0x4098a0

Function at 0x463140
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
mov rbp, rsp
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x463174
mov rcx, 0x28
jmp 0x46317f
shl rcx, 3
add rcx, 0x1480
mov qword [0x005e2108], rcx
pop rbp
ret
Function at 0x46b0e0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46b1aa
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.00403680
xorps xmm15, xmm15
mov r14, qword [0x005e2108]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x46b18f
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x004aef80]
xor ebx, ebx
mov rcx, rdx
call fcn.00448560
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.0046b6c0
inc rbx
cmp rcx, rbx
jae 0x46b17e
mov edi, 1
lea rsi, [0x004aef80]
call fcn.00448640
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x004f0768]
lea rsi, [0x004effc8]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045f600
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0046b0e0
Function at 0x496680
Capabilities:
Hash data using fnv

Disassembly:
test byte [rax], al
mov rcx, rbx
and ebx, 0x7f
shl rbx, 5
lea rdx, [rax + rbx]
xor eax, eax
jmp 0x496697
inc rax
cmp rax, 4
jge 0x4966af
lea rbx, [rdx + rax*8]
mov rbx, qword [rbx]
cmp rbx, rcx
jne 0x496694
mov eax, 1
ret
xor eax, eax
movabs rbx, 0xcbf29ce484222325
jmp 0x4966c0
inc rax
cmp rax, 4
jge 0x4966ce
mov rsi, qword [rdx + rax*8]
xor edi, edi
jmp 0x4966f7
and ebx, 3
lea rdx, [rdx + rbx*8]
xchg qword [rdx], rcx
xor eax, eax
ret
movzx r8d, sil
xor rbx, r8
inc rdi
shr rsi, 8
movabs r8, 0x100000001b3
imul rbx, r8
cmp rdi, 8
jl 0x4966db
jmp 0x4966bd
Function at 0x14000a190
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x460
mov rax, qword [0x1401f41c0]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov qword [rsp + 0x30], rdx
lea rcx, [rsp + 0x251]
mov rbx, r8
mov rdi, rdx
xor esi, esi
xor edx, edx
mov r8d, 0x1ff
mov byte [rsp + 0x250], sil
call fcn.140191ec0
cmp qword [rbx + 0x18], 0xf
jbe 0x14000a1e8
mov rbx, qword [rbx]
mov r9, rbx
lea r8, str.SYSTEMCurrentControlSetControlNetwork4D36E972_E325_11CE_BFC1_08002BE10318_sConnection
mov edx, 0x200
lea rcx, [rsp + 0x250]
call fcn.140006bc0
lea rax, [rsp + 0x30]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x250]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x14000a26a
call fcn.140067ee0
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.AcCommMgr.getConnectionName:_Open_registry_error__d_
mov rcx, rbx
mov r8d, eax
call fcn.140067c40
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rdi], sil
jmp 0x14000a326
xor edx, edx
mov dword [rsp + 0x38], 0x200
mov r8d, 0x1ff
mov byte [rsp + 0x50], sil
lea rcx, [rsp + 0x51]
call fcn.140191ec0
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
lea rax, [rsp + 0x50]
xor r8d, r8d
lea rdx, [0x14019b588]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x14000a2eb
call fcn.140067ee0
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.GetNetworkConnectionNameFromRegistry:_Get_network_connection_name_error__d_
mov rcx, rbx
mov r8d, eax
call fcn.140067c40
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14000a250
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xorps xmm0, xmm0
lea rax, [rsp + 0x50]
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov r8, 0xffffffffffffffff
mov qword [rdi + 0x18], rsi
inc r8
cmp byte [rax + r8], sil
jne 0x14000a310
lea rdx, [rsp + 0x50]
mov rcx, rdi
call fcn.1400056b0
mov rax, rdi
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.14016ab50
lea r11, [rsp + 0x460]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14000dd00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r12, r9
mov rdi, r8
mov rbx, rdx
mov r14, rcx
xor eax, eax
lock xadd dword [rcx + 0x3c], eax
test eax, eax
je 0x14000dd3c
xor eax, eax
jmp 0x14000df04
lea r13, [rcx + 0x60]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor edx, edx
mov r15d, edx
mov esi, edx
mov ebp, edx
cmp qword [rdi + 0x20], rdx
jne 0x14000dd62
cmp rdi, qword [rbx + 0x10]
jne 0x14000de45
movabs r14, 0x4d54ee85da812030
lea r13, section..data
cmp rbp, r12
je 0x14000de23
mov rbx, qword [rdi]
test rbx, rbx
je 0x14000de23
mov dword [rsp + 0x24], edx
mov rcx, qword [0x1401ef008]
add rcx, r14
cmp rcx, 1
jbe 0x14000ddb2
mov rax, qword [section..data]
mov edx, 0x3e3
mov rcx, r13
call qword [rax + 0x30]
xor edx, edx
jmp 0x14000ddb4
mov al, 1
movzx eax, al
add rax, 2
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x20], 0x3e3
mov qword [rsp + 0x28], r13
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rbx + 0x38], xmm0
movsd xmm1, qword [rsp + 0x30]
movsd qword [rbx + 0x48], xmm1
mov rcx, qword [rdi]
test rcx, rcx
je 0x14000ddfd
mov rax, qword [rcx + 0x20]
mov qword [rdi], rax
test rax, rax
jne 0x14000ddf9
mov qword [rdi + 8], rdx
mov qword [rcx + 0x20], rdx
mov qword [rbx + 0x20], rdx
test rsi, rsi
je 0x14000de15
mov qword [rsi + 0x20], rbx
inc rbp
mov rsi, rbx
jmp 0x14000dd73
mov r15, rbx
inc rbp
mov rsi, rbx
jmp 0x14000dd73
cmp qword [rdi], 0
mov r14, qword [rsp + 0x80]
lea r13, [r14 + 0x60]
jne 0x14000de45
mov rdx, rdi
mov rcx, qword [rsp + 0x88]
call fcn.140012be0
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rbx, r15
test r15, r15
je 0x14000df01
mov rdi, r15
mov r12d, 1
nop dword [rax]
nop word [rax + rax]
mov rcx, qword [r15 + 0x20]
mov r15, rcx
mov qword [rdi + 0x20], 0
mov rdi, rcx
xor eax, eax
test rcx, rcx
cmovne rax, rsi
mov rsi, rax
mov dword [rbx + 0x30], r12d
mov r9, rbx
xor r8d, r8d
xor edx, edx
mov rcx, qword [r14 + 0x28]
call qword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
test eax, eax
je 0x14000deb2
mov rbx, rdi
test rdi, rdi
jne 0x14000de70
jmp 0x14000df01
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov qword [rbx + 0x20], 0
mov rax, qword [r14 + 0x98]
test rax, rax
je 0x14000ded5
mov qword [rax + 0x20], rbx
jmp 0x14000dedc
mov qword [r14 + 0x90], rbx
mov qword [r14 + 0x98], rbx
test r15, r15
je 0x14000def3
mov qword [rbx + 0x20], r15
mov qword [r14 + 0x98], rsi
xchg dword [r14 + 0x58], r12d
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
mov rax, rbp
mov rbx, qword [rsp + 0x90]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400113c0
Capabilities:
Set socket configuration

Disassembly:
push rbp
push rsi
push rdi
push r12
push r15
mov rbp, rsp
sub rsp, 0x60
xor r12d, r12d
mov r15, r9
mov rsi, rdx
mov rdi, rcx
cmp rcx, 0xffffffffffffffff
je 0x140011596
mov qword [rsp + 0x98], rbx
test r8b, r8b
je 0x14001142c
movzx eax, byte [rdx]
test al, 8
je 0x14001142c
or al, 8
mov dword [rbp + 0x30], r12d
mov byte [rdx], al
lea r9, [rbp + 0x30]
mov edx, 0xffff
mov dword [rsp + 0x20], 4
mov r8d, 0x80
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
lea rcx, [rbp - 0x18]
setne dl
call fcn.1400124a0
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
test eax, eax
mov rcx, r15
mov ebx, eax
setne dl
call fcn.1400124a0
test ebx, ebx
je 0x140011592
mov qword [rsp + 0xa0], r13
movabs rcx, 0x4d54ee85da812030
mov qword [rsp + 0xa8], r14
lea r13, section..data
mov r14, qword [0x1401ef008]
add rcx, r14
mov dword [rbp - 0x2c], r12d
cmp rcx, 1
jbe 0x14001149c
mov rax, qword [section..data]
mov edx, 0x2733
mov rcx, r13
call qword [rax + 0x30]
mov r14, qword [0x1401ef008]
jmp 0x14001149e
mov al, 1
movzx eax, al
lea rdx, [rbp - 0x18]
add rax, 2
mov dword [rbp - 0x30], 0x2733
mov qword [rbp - 0x20], rax
mov rcx, r15
movsd xmm1, qword [rbp - 0x20]
mov qword [rbp - 0x28], r13
movups xmm0, xmmword [rbp - 0x30]
movsd qword [rbp - 8], xmm1
movups xmmword [rbp - 0x18], xmm0
call fcn.1400104e0
test al, al
jne 0x14001153b
movabs rax, 0x4d54ee85da812030
mov dword [rbp - 0x2c], r12d
add rax, r14
cmp rax, 1
jbe 0x140011501
mov rax, qword [section..data]
mov edx, 0x4d5
mov rcx, r13
call qword [rax + 0x30]
jmp 0x140011503
mov al, 1
movzx eax, al
lea rdx, [rbp - 0x18]
add rax, 2
mov dword [rbp - 0x30], 0x4d5
mov qword [rbp - 0x20], rax
mov rcx, r15
movsd xmm1, qword [rbp - 0x20]
mov qword [rbp - 0x28], r13
movups xmm0, xmmword [rbp - 0x30]
movsd qword [rbp - 8], xmm1
movups xmmword [rbp - 0x18], xmm0
call fcn.1400104e0
test al, al
je 0x14001156c
lea r8, [rbp + 0x30]
mov dword [rbp + 0x30], r12d
mov edx, 0x8004667e
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_ioctlsocket]
and byte [rsi], 0xfc
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
test eax, eax
mov rcx, r15
mov ebx, eax
setne dl
call fcn.1400124a0
mov r13, qword [rsp + 0xa0]
mov eax, ebx
mov r14, qword [rsp + 0xa8]
mov rbx, qword [rsp + 0x98]
add rsp, 0x60
pop r15
pop r12
pop rdi
pop rsi
pop rbp
ret
mov eax, ebx
jmp 0x14001157e
mov eax, r12d
add rsp, 0x60
pop r15
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140012810
Capabilities:
Terminate thread

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [rcx + 0x10]
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
mov rbx, rcx
mov rax, qword [rcx + 8]
mov r9d, 0xffffffff
mov ecx, 2
mov qword [rsp + 0x28], rax
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
lock xadd dword [0x1401f9030], eax
test eax, eax
mov rax, qword [rbx + 8]
je 0x140012871
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateThread]
add rsp, 0x30
pop rbx
ret
xor r8d, r8d
lea rcx, [fcn.14000e0a0]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_QueueUserAPC]
mov rcx, qword [rbx + 8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
add rsp, 0x30
pop rbx
ret
Function at 0x1400131c0
Capabilities:
Send data
Send data on socket

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x60
mov rbx, qword [rsp + 0xa0]
xor r14d, r14d
mov qword [rax - 0x48], r14
mov qword [rax - 0x50], r14
mov dword [rax - 0x58], r9d
lea r9, [rax + 0x20]
mov dword [rax + 0x20], r14d
call qword [sym.imp.WS2_32.dll_WSASend]
mov esi, eax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov rdx, qword [0x1401ef008]
lea rbp, section..data
movabs r15, 0x4d54ee85da812030
mov dword [rsp + 0x44], r14d
add rdx, r15
mov edi, eax
cmp rdx, 1
jbe 0x140013242
mov rcx, qword [section..data]
mov edx, eax
mov r8, qword [rcx + 0x30]
mov rcx, rbp
call r8
jmp 0x140013247
test edi, edi
setne al
movzx eax, al
movabs r10, 0x4800144005b3
add rax, 2
mov dword [rsp + 0x40], edi
mov qword [rsp + 0x48], rbp
movups xmm0, xmmword [rsp + 0x40]
mov qword [rsp + 0x50], rax
movsd xmm1, qword [rsp + 0x50]
movups xmmword [rbx], xmm0
movsd qword [rbx + 0x10], xmm1
mov r9, qword [rbx + 0x10]
cmp r9, 1
je 0x14001328a
mov eax, dword [rbx]
mov r8d, eax
jmp 0x1400132ba
mov rcx, qword [rbx + 8]
mov rax, r10
mov r8d, dword [rbx]
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 0x14
imul rax, rax, 0x1ffff7
sub rcx, rax
imul eax, ecx, 0x3e8
add eax, r8d
cmp eax, 0x40
jne 0x1400132fc
mov rcx, qword [0x1401ef008]
add rcx, r15
mov dword [rsp + 0x44], r14d
cmp rcx, 1
jbe 0x1400132f0
mov rax, qword [section..data]
mov edx, 0x2746
mov rcx, rbp
call qword [rax + 0x30]
mov dword [rsp + 0x40], 0x2746
jmp 0x14001336b
mov al, 1
mov dword [rsp + 0x40], 0x2746
jmp 0x14001336b
cmp r9, 1
jne 0x14001332f
mov rcx, qword [rbx + 8]
mov rax, r10
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 0x14
imul rax, rax, 0x1ffff7
sub rcx, rax
imul eax, ecx, 0x3e8
add r8d, eax
cmp r8d, 0x4d2
jne 0x14001338f
mov rcx, qword [0x1401ef008]
add rcx, r15
mov dword [rsp + 0x44], r14d
cmp rcx, 1
jbe 0x140013361
mov rax, qword [section..data]
mov edx, 0x274d
mov rcx, rbp
call qword [rax + 0x30]
jmp 0x140013363
mov al, 1
mov dword [rsp + 0x40], 0x274d
movzx eax, al
mov qword [rsp + 0x48], rbp
add rax, 2
movups xmm0, xmmword [rsp + 0x40]
mov qword [rsp + 0x50], rax
movsd xmm1, qword [rsp + 0x50]
movups xmmword [rbx], xmm0
movsd qword [rbx + 0x10], xmm1
test esi, esi
je 0x14001339a
mov eax, 0xffffffff
jmp 0x1400133b7
mov eax, dword [rsp + 0x98]
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rsp + 0x50], r14
movsd xmm0, qword [rsp + 0x50]
movsd qword [rbx + 0x10], xmm0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x140016140
Capabilities:
Initialize winsock library

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x200
mov rax, qword [0x1401f41c0]
xor rax, rsp
mov qword [rsp + 0x1f0], rax
movzx ebx, dl
mov rdi, rcx
mov eax, 1
lock xadd dword [0x1401f8fe8], eax
inc eax
cmp eax, 1
jne 0x14001618f
mov ecx, 2
lea rdx, [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_WSAStartup]
xchg dword [0x1401f8fec], eax
test bl, bl
je 0x140016233
xor ebx, ebx
lock xadd dword [0x1401f8fec], ebx
test ebx, ebx
je 0x140016233
movabs rcx, 0x4d54ee85da812030
mov qword [rsp + 0x210], rsi
add rcx, qword [0x1401ef008]
lea rsi, section..data
mov dword [rsp + 0x3c], 0
cmp rcx, 1
jbe 0x1400161e8
mov rax, qword [section..data]
mov edx, ebx
mov rcx, rsi
call qword [rax + 0x30]
jmp 0x1400161ea
mov al, 1
lea rcx, str.F:_vcpkg_installed_x64_windows_static_include_boost_asio_detail_impl_winsock_init.ipp
movzx eax, al
add rax, 2
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x40], rsi
lea rcx, str.throw_on_error
mov rsi, qword [rsp + 0x210]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], 0x48
mov dword [rsp + 0x34], 0x1a
test al, 1
jne 0x140016257
mov rax, rdi
mov rcx, qword [rsp + 0x1f0]
xor rcx, rsp
call fcn.14016ab50
mov rbx, qword [rsp + 0x218]
add rsp, 0x200
pop rdi
ret
lea r8, [rsp + 0x20]
lea rdx, str.winsock
lea rcx, [rsp + 0x38]
call fcn.1400122a0
int3
Function at 0x140019250
Capabilities:
Access firewall settings via inetfwmgr

Disassembly:
push rbx
sub rsp, 0x40
mov edx, 6
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov ebx, eax
mov eax, 0x80000000
lea ecx, [rbx + rax]
test eax, ecx
jne 0x140019296
cmp ebx, 0x80010106
je 0x140019296
call fcn.140067ee0
mov r8d, ebx
lea rdx, str.addAcServicesToFirewall4XP:_CoInitialize_failed__0x_08lx
mov rcx, rax
call fcn.140067c40
add rsp, 0x40
pop rbx
ret
lea rax, [rsp + 0x58]
mov qword [rsp + 0x50], rdi
xor edi, edi
mov qword [rsp + 0x20], rax
lea r9, [0x14019d3a0]
mov qword [rsp + 0x58], rdi
xor edx, edx
lea rcx, [0x14019d390]
mov r8d, 1
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov ebx, eax
test eax, eax
jns 0x1400192f6
call qword [sym.imp.ole32.dll_CoUninitialize]
call fcn.140067ee0
mov r8d, ebx
lea rdx, str.addAcServicesToFirewall4XP:_Create_INetFwMgr_failed__0x_08lx
mov rcx, rax
call fcn.140067c40
mov rdi, qword [rsp + 0x50]
add rsp, 0x40
pop rbx
ret
mov rcx, qword [rsp + 0x58]
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x60], rdi
mov rax, qword [rcx]
call qword [rax + 0x38]
mov ebx, eax
test eax, eax
jns 0x140019344
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rcx]
call qword [rdx + select]
call qword [sym.imp.ole32.dll_CoUninitialize]
call fcn.140067ee0
mov r8d, ebx
lea rdx, str.addAcServicesToFirewall4XP:_Get_local_policy_failed__0x_08lx
mov rcx, rax
call fcn.140067c40
mov rdi, qword [rsp + 0x50]
add rsp, 0x40
pop rbx
ret
mov rcx, qword [rsp + 0x60]
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x30], rdi
mov rax, qword [rcx]
call qword [rax + 0x38]
mov rcx, qword [rsp + 0x60]
mov ebx, eax
test eax, eax
jns 0x14001939d
mov rdx, qword [rcx]
call qword [rdx + select]
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rcx]
call qword [rdx + select]
call qword [sym.imp.ole32.dll_CoUninitialize]
call fcn.140067ee0
mov r8d, ebx
lea rdx, str.addAcServicesToFirewall4XP:_Get_current_profile_failed__0x_08lx
mov rcx, rax
call fcn.140067c40
mov rdi, qword [rsp + 0x50]
add rsp, 0x40
pop rbx
ret
mov rax, qword [rcx]
call qword [rax + select]
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
call qword [rax + select]
mov rcx, qword [rsp + 0x30]
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x68], rdi
mov rax, qword [rcx]
call qword [rax + 0xa0]
mov ebx, eax
test eax, eax
jns 0x1400193f4
call qword [sym.imp.ole32.dll_CoUninitialize]
call fcn.140067ee0
mov r8d, ebx
lea rdx, str.addAcServicesToFirewall4XP:_Get_authorized_applications_failed__0x_08lx
mov rcx, rax
call fcn.140067c40
mov rdi, qword [rsp + 0x50]
add rsp, 0x40
pop rbx
ret
mov rdx, qword [rsp + 0x68]
lea r8, [0x14019d4f8]
lea rcx, str.InfoSafeAcService
call fcn.1400195e0
mov rdx, qword [rsp + 0x68]
lea r8, str.ISVS.exe
lea rcx, str.InfoSafeISVService
call fcn.1400195e0
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
call qword [rax + select]
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
call qword [rax + select]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rdi, qword [rsp + 0x50]
add rsp, 0x40
pop rbx
ret