joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180102ee0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rsi
sub rsp, 0xb0
mov rax, rdx
mov rsi, rcx
xorps xmm0, xmm0
movaps xmmword [rsp + 0xa0], xmm0
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x2c], 0x80
lea rdx, [rsp + 0x30]
lea r8, [rsp + 0x2c]
mov rcx, rax
call qword [sym.imp.ws2_32.dll_getsockname]
cmp eax, 0xffffffff
je 0x180102f90
mov eax, dword [rsp + 0x2c]
movzx ecx, word [rsp + 0x30]
cmp ecx, 2
je 0x180102fa0
cmp ecx, 0x17
jne 0x180102fc7
cmp eax, 0x1b
jbe 0x180102fe0
movzx eax, word [rsp + 0x32]
rol ax, 8
movups xmm0, xmmword [rsp + 0x38]
mov ecx, dword [rsp + 0x34]
mov edx, dword [rsp + 0x48]
mov word [rsi], 1
movups xmmword [rsi + 4], xmm0
mov dword [rsi + 0x14], ecx
mov dword [rsi + 0x18], edx
mov word [rsi + 0x1c], ax
add rsp, 0xb0
pop rsi
ret
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
jmp 0x180102fce
cmp eax, 0xf
jbe 0x180102ffa
movzx eax, word [rsp + 0x32]
rol ax, 8
mov ecx, dword [rsp + 0x34]
mov word [rsi], 0
mov word [rsi + 6], ax
mov dword [rsi + 2], ecx
add rsp, 0xb0
pop rsi
ret
lea rax, str.invalid_argument
mov qword [rsi + 8], rax
mov word [rsi], 2
add rsp, 0xb0
pop rsi
ret
lea rcx, str.assertion_failed:_len_as_usize___mem::size_of::_c::sockaddr_in6___
lea r8, [0x1801d6280]
mov edx, 0x43
call fcn.180131da0
ud2
lea rcx, str.assertion_failed:_len_as_usize___mem::size_of::_c::sockaddr_in___library_std_src_sys_common_net.rs
lea r8, [0x1801d6220]
mov edx, 0x42
call fcn.180131da0
ud2
Function at 0x180112e40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test r8, r8
je 0x180112eba
mov rax, rdx
mov rdx, qword [rsp + 0x70]
mov esi, ecx
shr esi, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov rbx, rax
movzx edi, byte [rax + 1]
add rax, 2
lea r10, [r11 + rdi]
cmp byte [rbx], sil
jne 0x180112eb0
cmp r11, r10
ja 0x180112f53
cmp r10, rdx
ja 0x180112f67
add r11, r9
xor ebx, ebx
nop dword [rax]
cmp rdi, rbx
je 0x180112eb2
lea r14, [rbx + 1]
cmp byte [r11 + rbx], cl
mov rbx, r14
jne 0x180112e90
jmp 0x180112f27
ja 0x180112eba
mov r11, r10
cmp rax, r8
jne 0x180112e62
mov rdx, qword [rsp + 0x80]
test rdx, rdx
je 0x180112f2b
mov r8, qword [rsp + 0x78]
add rdx, r8
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r10, [r8 + 1]
movzx r9d, byte [r8]
test r9b, r9b
js 0x180112f00
mov r8, r10
sub ecx, r9d
jns 0x180112f1e
jmp 0x180112f2d
cmp r10, rdx
je 0x180112f39
movzx r10d, byte [r8 + 1]
add r8, 2
and r9d, 0x7f
shl r9d, 8
or r9d, r10d
sub ecx, r9d
js 0x180112f2d
xor al, 1
cmp r8, rdx
jne 0x180112ee0
jmp 0x180112f2d
xor eax, eax
jmp 0x180112f2d
mov al, 1
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, [0x1801d89d9]
lea r8, str.librarycore_srcunicodeprintable.rs
mov edx, 0x2b
call fcn.180131da0
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.1801322b0
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.180132230
ud2

Function at 0x180114a10
Capabilities:
Encode data using xor

Disassembly:
mov r10, rcx
xor r9b, r9b
xor ecx, ecx
mov r11, rdx
test r8, r8
je 0x180114ae4
sub r10, rdx
cmp r8, 0x20
jb 0x180114abe
mov rdx, r8
lea rax, [r11 + 0x10]
and rdx, 0xffffffffffffffe0
xorps xmm3, xmm3
xorps xmm2, xmm2
nop dword [rax]
nop word [rax + rax]
movdqu xmm0, xmmword [rax - 0x10]
add rcx, 0x20
movdqu xmm1, xmmword [r10 + rax - 0x10]
lea rax, [rax + 0x20]
xorps xmm1, xmm0
orps xmm3, xmm1
movdqu xmm1, xmmword [r10 + rax - 0x20]
movdqu xmm0, xmmword [rax - 0x20]
xorps xmm1, xmm0
orps xmm2, xmm1
cmp rcx, rdx
jb 0x180114a50
orps xmm2, xmm3
movdqa xmm0, xmm2
psrldq xmm0, 8
orps xmm2, xmm0
movdqa xmm0, xmm2
psrldq xmm0, 4
orps xmm2, xmm0
movdqa xmm0, xmm2
psrldq xmm0, 2
orps xmm2, xmm0
movdqa xmm0, xmm2
psrldq xmm0, 1
orps xmm2, xmm0
movd r9d, xmm2
cmp rcx, r8
jae 0x180114ae4
lea rax, [rcx + r11]
sub r8, rcx
nop word [rax + rax]
movzx ecx, byte [r10 + rax]
xor cl, byte [rax]
lea rax, [rax + 1]
or r9b, cl
sub r8, 1
jne 0x180114ad0
movzx eax, r9b
ret
Function at 0x180115850
Capabilities:
Encrypt data using curve25519

Disassembly:
movzx eax, byte [rcx + 0x1f]
and byte [rcx], 0xf8
and al, 0x3f
or al, 0x40
mov byte [rcx + 0x1f], al
ret

Function at 0x18011aca0
Capabilities:
Encode data using xor

Disassembly:
mov r9, rdx
mov r10, rcx
mov rax, 0xffffffffffffffff
test r8, r8
je 0x18011acf2
sub r10, rdx
nop word [rax + rax]
mov rcx, qword [r10 + r9]
xor rcx, qword [r9]
lea r9, [r9 + 8]
lea rdx, [rcx - 1]
not rcx
shr rcx, 0x3f
shr rdx, 0x3f
and rdx, rcx
mov rcx, rax
neg rdx
not rcx
or rdx, rcx
and rax, rdx
sub r8, 1
jne 0x18011acc0
ret

Function at 0x18011b0b0
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x18011b26f
mov r11, rsp
push rbx
push rdi
push r12
push r14
push r15
sub rsp, 0x4c0
mov rax, qword [0x1801ec500]
xor rax, rsp
mov qword [rsp + 0x4a0], rax
mov rbx, qword [rsp + 0x510]
mov r15, rdx
mov qword [r11 + 0x18], rbp
mov rdi, rcx
mov qword [r11 - 0x30], rsi
lea rcx, [r11 - 0x408]
mov rdx, r9
mov qword [r11 - 0x38], r13
mov r12, r9
mov r14, r8
call fcn.18011b8b0
movups xmm0, xmmword [rbx]
lea rcx, [rsp + 0x20]
lea rbx, [rsp + 0xa0]
movups xmmword [rcx], xmm0
mov rax, qword [rcx]
sub rbx, rdi
mov qword [rcx + 0x10], rax
mov rax, qword [rcx + 8]
mov qword [rcx + 0x18], rax
mov rax, qword [rcx + 0x10]
mov qword [rcx + 0x20], rax
mov rax, qword [rcx + 0x18]
mov qword [rcx + 0x28], rax
mov rax, qword [rcx + 0x20]
mov qword [rcx + 0x30], rax
mov rax, qword [rcx + 0x28]
mov qword [rcx + 0x38], rax
mov r13d, dword [rsp + 0x2c]
bswap r13d
lea ebp, [r13 + 2]
mov ecx, 4
lea rdx, [rsp + 0x20]
cmp r14, rcx
mov eax, r13d
bswap eax
mov dword [rsp + 0x2c], eax
mov rsi, r14
cmovae rsi, rcx
lea eax, [rbp - 1]
bswap eax
mov dword [rsp + 0x3c], eax
lea rcx, [rsp + 0x60]
mov eax, ebp
mov r8, rsi
bswap eax
mov dword [rsp + 0x4c], eax
lea eax, [rbp + 1]
bswap eax
mov dword [rsp + 0x5c], eax
call fcn.18011c310
mov edx, dword [r12 + 0xf0]
lea r8, [rsp + 0x60]
lea rcx, [rsp + 0xe0]
call fcn.18011b610
lea r8, [rsp + 0x60]
mov rdx, rsi
lea rcx, [rsp + 0xa0]
call fcn.18011b950
test rsi, rsi
je 0x18011b21b
mov r8, r15
mov rax, rdi
sub r8, rdi
mov r9, rsi
nop dword [rax]
nop word [rax + rax]
mov edx, 2
nop word [rax + rax]
mov rcx, qword [rbx + rax]
xor rcx, qword [rax]
mov qword [r8 + rax], rcx
add rax, 8
sub rdx, 1
jne 0x18011b200
sub r9, 1
jne 0x18011b1f0
sub r14, rsi
je 0x18011b238
add rdi, 0x40
sub rbx, 0x40
add r15, 0x40
add r13d, 4
add ebp, 4
jmp 0x18011b15d
mov rsi, qword [rsp + 0x4b8]
mov rbp, qword [rsp + 0x500]
mov r13, qword [rsp + 0x4b0]
mov rcx, qword [rsp + 0x4a0]
xor rcx, rsp
call fcn.18011f080
add rsp, 0x4c0
pop r15
pop r14
pop r12
pop rdi
pop rbx
ret
Function at 0x18011b350
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rdi
sub rsp, 0x98
mov rax, qword [0x1801ec500]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rdi, r8
cmp edx, 0x80
je 0x18011b399
cmp edx, 0x100
je 0x18011b389
mov eax, 1
jmp 0x18011b4e7
mov rdx, rcx
mov rcx, rdi
call fcn.18011bd90
jmp 0x18011b4e5
mov qword [rsp + 0xb8], rbp
mov rdx, rcx
mov qword [rsp + 0xc8], rsi
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x90], r14
mov dword [r8 + 0xf0], 0xa
call fcn.18011b510
movups xmm2, xmmword [rsp + 0x60]
mov ebx, 1
lea r14, [0x1801711c0]
movabs rbp, 0xf000000000000
movups xmmword [rdi], xmm2
add rdi, 0x10
xor esi, esi
nop dword [rax]
movq qword [rsp + 0x20], xmm2
lea rcx, [rsp + 0x20]
psrldq xmm2, 8
xorps xmm0, xmm0
xorps xmm1, xmm1
movq qword [rsp + 0x40], xmm2
mov qword [rsp + 0x28], rsi
movdqa xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x48], rsi
movdqa xmmword [rsp + 0x50], xmm1
call fcn.18011c480
lea rcx, [rsp + 0x20]
call fcn.18011bfb0
lea rcx, [rsp + 0x20]
call fcn.18011c480
mov rax, qword [rsp + 0x20]
movzx r9d, byte [rbx + r14 - 1]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x78], rax
mov rax, rsi
nop dword [rax + rax]
mov rdx, qword [rsp + rax*8 + 0x70]
movzx ecx, al
shl cl, 2
mov r8, r9
shr r8, cl
mov rcx, rdx
shr rcx, 0x10
and r8d, 0xf
and rdx, rbp
or rcx, rdx
shr rcx, 0x24
xor r8, rcx
xor r8, qword [rsp + rax*8 + 0x60]
mov rcx, r8
shl rcx, 0x10
xor rcx, r8
shl rcx, 0x10
xor rcx, r8
shl rcx, 0x10
xor rcx, r8
mov qword [rsp + rax*8 + 0x60], rcx
inc rax
cmp rax, 2
jb 0x18011b460
movups xmm2, xmmword [rsp + 0x60]
inc rbx
movups xmmword [rdi], xmm2
add rdi, 0x10
cmp rbx, 0xa
jbe 0x18011b3f0
mov r14, qword [rsp + 0x90]
mov rsi, qword [rsp + 0xc8]
mov rbp, qword [rsp + 0xb8]
xor eax, eax
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.18011f080
add rsp, 0x98
pop rdi
pop rbx
ret
Function at 0x18011b950
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rdi
sub rsp, 0x88
mov rax, qword [0x1801ec500]
xor rax, rsp
mov qword [rsp + 0x60], rax
movups xmm0, xmmword [r8]
mov rdi, rcx
lea rcx, [rsp + 0x20]
movups xmm1, xmmword [r8 + 0x10]
mov rbx, rdx
movaps xmmword [rsp + 0x20], xmm0
movups xmm0, xmmword [r8 + 0x20]
movaps xmmword [rsp + 0x30], xmm1
movups xmm1, xmmword [r8 + 0x30]
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x50], xmm1
call fcn.18011c480
xor r11d, r11d
test rbx, rbx
je 0x18011baf6
mov qword [rsp + 0xa8], rbp
movabs rbp, 0xff000000ff00
mov qword [rsp + 0xb8], rsi
mov esi, 0xffff0000
mov qword [rsp + 0x80], r12
movabs r12, 0xffffffff00000000
mov qword [rsp + 0x78], r14
movabs r14, 0xf000f000f000f0
mov qword [rsp + 0x70], r15
lea r15, [rsp + 0x20]
nop word [rax + rax]
mov r10, qword [rsp + r11*8 + 0x40]
lea rdi, [rdi + 0x10]
mov r8, qword [r15 + r11*8]
mov rdx, r10
shl rdx, 0x20
and r10, r12
mov eax, r8d
inc r11
or rdx, rax
shr r8, 0x20
or r10, r8
mov rcx, rdx
shr rcx, 0x10
xor rcx, rdx
and rcx, rsi
mov rax, rcx
shl rax, 0x10
xor rax, rcx
xor rdx, rax
mov rcx, rdx
shr rcx, 8
xor rcx, rdx
and rcx, rbp
mov rax, rcx
shl rax, 8
xor rax, rcx
mov rcx, r10
xor rdx, rax
shr rcx, 0x10
xor rcx, r10
mov rax, rdx
shr rax, 4
and rcx, rsi
xor rax, rdx
and rax, r14
mov r9, rax
shl r9, 4
xor r9, rax
mov rax, rcx
shl rax, 0x10
xor r9, rdx
xor rax, rcx
mov qword [rdi - 0x10], r9
xor r10, rax
mov rcx, r10
shr rcx, 8
xor rcx, r10
and rcx, rbp
mov rax, rcx
shl rax, 8
xor rax, rcx
xor r10, rax
mov rcx, r10
shr rcx, 4
xor rcx, r10
and rcx, r14
mov rax, rcx
shl rax, 4
xor rax, rcx
xor rax, r10
mov qword [rdi - 8], rax
cmp r11, rbx
jb 0x18011ba00
mov r15, qword [rsp + 0x70]
mov r14, qword [rsp + 0x78]
mov r12, qword [rsp + 0x80]
mov rsi, qword [rsp + 0xb8]
mov rbp, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.18011f080
add rsp, 0x88
pop rdi
pop rbx
ret
Function at 0x18011c310
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x20
xorps xmm0, xmm0
xor esi, esi
mov rbx, r8
mov rdi, rdx
movups xmmword [rcx], xmm0
movups xmmword [rcx + 0x10], xmm0
movups xmmword [rcx + 0x20], xmm0
movups xmmword [rcx + 0x30], xmm0
test r8, r8
je 0x18011c467
mov qword [rsp + 0x40], rbp
movabs rbp, 0xf000f000f000f0
mov qword [rsp + 0x48], r12
movabs r12, 0xffffffff00000000
mov qword [rsp + 0x50], r14
movabs r14, 0xff000000ff00
mov qword [rsp + 0x58], r15
mov r15d, 0xffff0000
nop dword [rax]
nop word [rax + rax]
mov rdx, qword [rdi]
mov r10, qword [rdi + 8]
lea rdi, [rdi + 0x10]
mov rax, rdx
shr rax, 4
xor rax, rdx
and rax, rbp
mov r8, rax
shl r8, 4
xor r8, rax
xor r8, rdx
mov rdx, r8
shr rdx, 8
xor rdx, r8
and rdx, r14
mov rax, rdx
shl rax, 8
xor rax, rdx
xor r8, rax
mov rax, r8
shr rax, 0x10
xor rax, r8
and rax, r15
mov r11, rax
shl r11, 0x10
xor r11, rax
mov rax, r10
shr rax, 4
xor r11, r8
xor rax, r10
and rax, rbp
mov r9, rax
shl r9, 4
xor r9, rax
xor r9, r10
mov rdx, r9
shr rdx, 8
xor rdx, r9
and rdx, r14
mov rax, rdx
shl rax, 8
xor rax, rdx
xor r9, rax
mov rax, r9
shr rax, 0x10
xor rax, r9
and rax, r15
mov r8, rax
shl r8, 0x10
xor r8, rax
mov eax, r11d
xor r8, r9
shr r11, 0x20
mov rdx, r8
and r8, r12
shl rdx, 0x20
or r11, r8
or rdx, rax
mov qword [rcx + rsi*8 + 0x20], r11
mov qword [rcx + rsi*8], rdx
inc rsi
cmp rsi, rbx
jb 0x18011c380
mov r15, qword [rsp + 0x58]
mov r14, qword [rsp + 0x50]
mov r12, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
pop rsi
pop rbx
jmp fcn.18011c480
Function at 0x18011eac0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
xor eax, eax
mov r11, rcx
mov r10d, 1
movabs rdi, 0x8000000000000000
lea ebx, [rax + 0x20]
nop dword [rax]
nop word [rax + rax]
shr rax, 1
mov r9, r10
and r9d, 1
neg r9
mov rdx, r9
and r9, rdi
add r9, rax
and rdx, r11
mov r8, rdx
shr r9, 1
xor r8, r10
and rdx, r10
shr r8, 1
add r8, rdx
mov rax, r8
and eax, 1
neg rax
mov rcx, rax
and rax, rdi
and rcx, r11
add rax, r9
mov r10, rcx
and rcx, r8
xor r10, r8
shr r10, 1
add r10, rcx
sub rbx, 1
jne 0x18011eaf0
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret
Function at 0x180126d14
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.kernel32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x180126d44
xor eax, eax
jmp 0x180126e07
mov rbp, rbx
cmp word [rax], si
je 0x180126d69
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x180126d50
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x180126d4c
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.180126c34
movsxd r14, eax
test eax, eax
jne 0x180126da7
mov rcx, rbx
call qword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
jmp 0x180126d3d
mov rcx, r14
call fcn.180127fa4
mov rdi, rax
test rax, rax
jne 0x180126dc0
xor ecx, ecx
call fcn.18012526c
jmp 0x180126d9c
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.180126c34
test eax, eax
jne 0x180126df1
mov rcx, rdi
call fcn.18012526c
jmp 0x180126dfb
xor ecx, ecx
call fcn.18012526c
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x18012c550
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x18012c578
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x18012c578
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x180130de0
Capabilities:
Resolve dns

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
mov ebp, r9d
mov rsi, rcx
lea rcx, [rsp + 0x30]
call fcn.18010a9e0
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x180130e3b
lea rax, str.file_name_contained_an_unexpected_NUL_byte
mov qword [rsi + 8], rax
mov qword [rsi], 1
mov rdx, qword [rsp + 0x38]
test rdx, rdx
je 0x180130eb4
mov r8d, 1
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
jmp fcn.180013060
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
mov dword [rsp + 0x58], 1
mov qword [rsp + 0x28], 0
lea r8, [rsp + 0x50]
lea r9, [rsp + 0x28]
mov rcx, rdi
xor edx, edx
call qword [sym.imp.ws2_32.dll_getaddrinfo]
test eax, eax
je 0x180130ec1
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
mov byte [rdi], 0
test rbx, rbx
je 0x180130eb4
mov r8d, 1
mov rcx, rdi
mov rdx, rbx
call fcn.180013060
nop
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
ret
mov rax, qword [rsp + 0x28]
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], bp
xor eax, eax
mov qword [rsi], rax
mov byte [rdi], 0
test rbx, rbx
jne 0x180130ea3
jmp 0x180130eb4
Function at 0x140024a50
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov qword [rax - 0x48], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rbp, rcx
xor r12d, r12d
mov qword [rcx], r12
mov qword [rcx + 8], r12
mov qword [rcx + 0x10], r12
mov qword [rcx + 0x18], r12
mov dword [rcx + 0x30], 0x3e8
call fcn.14007ecc8
cmp eax, 1
lea r13d, [rax + rax]
ja 0x140024aa7
lea r13d, [r12 + 4]
mov rax, qword [0x140146e98]
test rax, rax
jne 0x140024c56
mov edi, r12d
mov ebx, 0x8a289a29
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
movups xmm0, xmmword [rax + 0x58]
movups xmmword [rsp + 0x28], xmm0
movd ecx, xmm0
sub cx, 8
test edi, edi
je 0x140024b43
mov r8, qword [rsp + 0x30]
movzx ecx, cx
shr rcx, 1
mov r10d, 0xda6471f8
mov r9, r12
lea rdx, [r8 + rcx*2]
lea r11, [rcx*2 + 1]
shr r11, 1
cmp r8, rdx
cmova r11, r12
test r11, r11
je 0x140024b3a
nop dword [rax]
nop dword [rax + rax]
movsx ecx, byte [r8]
xor ecx, r10d
imul r10d, ecx, 0x1000193
lea r8, [r8 + 2]
inc r9
cmp r9, r11
jne 0x140024b20
cmp r10d, edi
jne 0x140024c47
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov rdx, qword [rcx + r10 + 0x88]
mov r15, rdx
shr r15, 0x20
mov r11d, edx
add r11, r10
cmp r11, r10
je 0x140024c47
mov r9d, dword [r11 + 0x18]
test r9d, r9d
je 0x140024c47
mov r14d, dword [r11 + 0x20]
nop word [rax + rax]
dec r9d
lea rcx, [r14 + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
mov r8d, 0xda6471f8
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140024bb8
nop
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x140024ba0
cmp r8d, ebx
je 0x140024bca
test r9d, r9d
jne 0x140024b80
mov rax, qword [rax]
jmp 0x140024ad0
mov ecx, dword [r11 + 0x1c]
add rcx, r10
mov eax, dword [r11 + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov eax, dword [rcx + rax*4]
add rax, r10
cmp rax, r11
jbe 0x140024c4f
lea rcx, [r15 + r11]
cmp rax, rcx
jae 0x140024c4f
mov edi, 0xda6471f8
mov ebx, edi
movzx ecx, byte [rax]
cmp cl, 0x2e
je 0x140024c16
movsx ecx, cl
xor ecx, edi
imul edi, ecx, 0x1000193
inc rax
movzx ecx, byte [rax]
cmp cl, 0x2e
jne 0x140024c00
inc rax
movzx ecx, byte [rax]
test cl, cl
je 0x140024c36
movsx ecx, cl
xor ecx, ebx
imul ebx, ecx, 0x1000193
lea rax, [rax + 1]
movzx ecx, byte [rax]
test cl, cl
jne 0x140024c20
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov rax, qword [rax]
jmp 0x140024ad0
mov qword [0x140146e98], rax
mov r9d, r13d
xor r8d, r8d
xor edx, edx
lea rcx, [rdx - 1]
call rax
mov qword [rbp], rax
mov eax, r12d
xchg byte [rbp + 0x20], al
xchg qword [rbp + 0x28], r12
mov rax, rbp
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140024ca0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rcx
push rbx
push rbp
sub rsp, 0x48
mov rbp, qword [0x140146178]
mov qword [r11 + 0x20], r12
mov r12, r8
mov qword [r11 - 0x18], r13
mov r13, rdx
mov rax, qword [rbp]
mov qword [rsp + 0x60], rax
mov rax, qword [0x140146ef0]
test rax, rax
jne 0x140024ea1
mov rax, qword gs:[0x60]
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x18], rdi
xor edi, edi
mov qword [r11 - 0x20], r14
mov ebx, edi
mov rax, qword [rax + 0x18]
mov qword [r11 - 0x28], r15
mov r11d, 0xfc8018fe
mov rax, qword [rax + 0x10]
nop word [rax + rax]
movups xmm0, xmmword [rax + 0x58]
movd ecx, xmm0
movups xmmword [rsp + 0x20], xmm0
sub cx, 8
test ebx, ebx
je 0x140024d72
mov rdx, qword [rsp + 0x28]
mov r9d, 0xbedb48b3
movzx r10d, cx
mov r8, rdi
shr r10, 1
lea rcx, [rdx + r10*2]
cmp rdx, rcx
cmova r10, rdi
test r10, r10
je 0x140024d69
nop word [rax + rax]
movsx ecx, byte [rdx]
lea rdx, [rdx + 2]
xor ecx, r9d
inc r8
imul r9d, ecx, 0x1000193
cmp r8, r10
jne 0x140024d50
cmp r9d, ebx
jne 0x140024e7e
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov rdx, qword [rcx + r10 + 0x88]
mov r15, rdx
mov edi, edx
shr r15, 0x20
add rdi, r10
cmp rdi, r10
je 0x140024e7c
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140024e7c
mov r14d, dword [rdi + 0x20]
nop dword [rax + rax]
dec r9d
mov r8d, 0xbedb48b3
lea rcx, [r14 + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140024de9
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x140024dd0
cmp r8d, r11d
je 0x140024dfd
test r9d, r9d
jne 0x140024db0
mov rax, qword [rax]
xor edi, edi
jmp 0x140024d10
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
cmp rax, rdi
jbe 0x140024e86
lea rcx, [r15 + rdi]
cmp rax, rcx
jae 0x140024e86
movzx ecx, byte [rax]
mov ebx, 0xbedb48b3
mov r11d, ebx
cmp cl, 0x2e
je 0x140024e48
movsx ecx, cl
inc rax
xor ecx, ebx
imul ebx, ecx, 0x1000193
movzx ecx, byte [rax]
cmp cl, 0x2e
jne 0x140024e32
movzx ecx, byte [rax + 1]
inc rax
test cl, cl
je 0x140024e6b
movsx ecx, cl
lea rax, [rax + 1]
xor ecx, r11d
imul r11d, ecx, 0x1000193
movzx ecx, byte [rax]
test cl, cl
jne 0x140024e53
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
xor edi, edi
mov rax, qword [rax]
jmp 0x140024d10
mov r15, qword [rsp + 0x30]
mov r14, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x68]
mov qword [0x140146ef0], rax
mov rdx, qword [rsp + 0x60]
xor r9d, r9d
mov r8, r12
mov rcx, r13
call rax
mov r13, qword [rsp + 0x40]
test rax, rax
mov r12, qword [rsp + 0x78]
setne bl
test rax, rax
jne 0x140024ecd
add rsp, 0x48
pop rbp
pop rbx
ret
mov eax, 1
lock xadd qword [rbp + 0x28], rax
nop dword [rax + rax]
mov rcx, qword [rbp + 0x28]
mov eax, dword [rbp + 0x30]
cmp rcx, rax
jbe 0x140024ef9
mov ecx, 1
call qword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x140024ee0
movzx eax, bl
add rsp, 0x48
pop rbp
pop rbx
ret