joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180053ee0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
movaps xmmword [rsp + 0x60], xmm6
movaps xmmword [rsp + 0x50], xmm7
mov rax, qword [0x180072040]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov r14, r8
mov rbp, rdx
mov r12, rcx
xor edi, edi
lea rsi, [rcx + 0x14]
mov qword [rsi], rdi
mov qword [rsi + 8], rdi
mov qword [rsi + 0x10], rdi
mov qword [rsi + 0x18], rdi
mov qword [rsi + 0x20], rdi
mov qword [rsi + 0x28], rdi
mov qword [rsi + 0x30], rdi
mov qword [rsi + 0x38], rdi
mov dword [rcx + 4], 0x7f7fffff
mov dword [rcx + 8], 0x7f7fffff
mov dword [rcx + 0xc], 0xff7fffff
mov dword [rcx + 0x10], 0xff7fffff
movsd xmm6, qword [0x1800664d8]
movsd xmm7, qword [0x1800664c8]
test dil, 1
je 0x180053f74
movss xmm0, dword [r14]
jmp 0x180053f79
movss xmm0, dword [rbp]
movss dword [rsp + 0x20], xmm0
test dil, 2
je 0x180053f8d
movss xmm0, dword [r14 + 4]
jmp 0x180053f92
movss xmm0, dword [rbp + 4]
movss dword [rsp + 0x24], xmm0
test dil, 4
je 0x180053fa6
movss xmm0, dword [r14 + 8]
jmp 0x180053fab
movss xmm0, dword [rbp + 8]
movss dword [rsp + 0x28], xmm0
mov rax, qword [0x18009b668]
cmp qword [rax + 0x88], 0
je 0x1800540f2
movss xmm0, dword [rsi]
movss dword [rsp + 0x38], xmm0
lea r15, [rsi + 4]
movss xmm0, dword [r15]
movss dword [rsp + 0x3c], xmm0
mov rax, qword [rax + 0x88]
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x20]
call rax
movzx ebx, al
mov rax, qword [0x18009b678]
mov rcx, qword [rax + 8]
mov rax, qword [rcx]
lea r8, [rsp + 0x34]
lea rdx, [rsp + 0x30]
call qword [rax + 0x180]
movss xmm2, dword [rsp + 0x38]
cvtps2pd xmm2, xmm2
addsd xmm2, xmm6
mulsd xmm2, xmm7
movd xmm0, dword [rsp + 0x30]
cvtdq2ps xmm0, xmm0
cvtps2pd xmm1, xmm0
mulsd xmm2, xmm1
cvtpd2ps xmm3, xmm2
movss dword [rsi], xmm3
movd xmm0, dword [rsp + 0x34]
cvtdq2ps xmm0, xmm0
cvtps2pd xmm2, xmm0
movss xmm1, dword [rsp + 0x3c]
cvtps2pd xmm1, xmm1
addsd xmm1, xmm6
mulsd xmm1, xmm7
mulsd xmm1, xmm2
subsd xmm2, xmm1
cvtpd2ps xmm0, xmm2
movss dword [r15], xmm0
test bl, bl
jne 0x1800540f2
lea rax, [r12 + 4]
movss xmm0, dword [r12 + 4]
comiss xmm0, xmm3
cmova rax, rsi
mov eax, dword [rax]
mov dword [r12 + 4], eax
lea rax, [r12 + 8]
movss xmm0, dword [r12 + 8]
comiss xmm0, dword [r15]
cmova rax, r15
mov eax, dword [rax]
mov dword [r12 + 8], eax
lea rax, [r12 + 0xc]
movss xmm0, dword [rsi]
comiss xmm0, dword [r12 + 0xc]
cmova rax, rsi
mov eax, dword [rax]
mov dword [r12 + 0xc], eax
lea rcx, [r12 + 0x10]
movss xmm0, dword [r15]
comiss xmm0, dword [r12 + 0x10]
cmova rcx, r15
mov ecx, dword [rcx]
mov dword [r12 + 0x10], ecx
inc edi
add rsi, 8
cmp edi, 8
jl 0x180053f67
mov byte [r12], 1
jmp 0x1800540f7
mov byte [r12], 0
mov rax, r12
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1800586f0
mov rbx, qword [rsp + 0xc8]
movaps xmm6, xmmword [rsp + 0x60]
movaps xmm7, xmmword [rsp + 0x50]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x180057e80
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x28
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x180057eb5
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x50], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x20], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.1800576b0
lea rax, [rdi - 1]
mov qword [rsi + 0x38], rdi
mov qword [rsi + 0x30], rax
mov rax, qword [rsi + 8]
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x180057ff4
mov qword [rsp + 0x58], rbp
movabs rdi, 0x100000001b3
movabs rbp, 0xcbf29ce484222325
nop dword [rax + rax]
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rbp
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rdi
xor r11, rdx
imul r11, rdi
and r11, qword [rsi + 0x30]
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rbx
jne 0x180057f6d
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x180057fe3
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x180057faa
mov r10, qword [rdx]
cmp r10, rax
je 0x180057fa4
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x180057fe3
cmp r9, rdx
je 0x180057fbf
nop
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x180058005
cmp r9, rdx
jne 0x180057fb0
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
jne 0x180057f20
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov r14, qword [rsp + 0x20]
add rsp, 0x28
pop rdi
pop rsi
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x180057fe3
Function at 0x180058030
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x180058061
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x18009c4a8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x18009c4b8]
lea rdx, [rdi + rdi]
call fcn.1800576b0
mov rax, qword [0x18009c4a8]
lea r9, [rdi - 1]
mov qword [0x18009c4d0], r9
mov qword [0x18009c4d8], rdi
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x1800581d4
mov qword [rsp + 0x40], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rsi
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rdi
xor r11, rdx
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x18009c4b8]
mov r9, qword [r11]
cmp r9, rbx
jne 0x180058120
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x180058195
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x18005815d
mov r10, qword [rdx]
cmp r10, rax
je 0x180058157
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x180058195
cmp r9, rdx
je 0x180058171
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x1800581a9
cmp r9, rdx
jne 0x180058162
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
je 0x1800581cf
mov r9, qword [0x18009c4d0]
jmp 0x1800580d1
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x180058195
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x180058510
Capabilities:
Hash data using fnv

Disassembly:
movsx eax, byte [rcx]
test al, al
jne 0x18005851a
mov eax, edx
ret
xor eax, edx
imul edx, eax, 0x1000193
inc rcx
jmp fcn.180058510
Function at 0x180058530
Capabilities:
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, rcx
mov edx, 0xe80c2f78
lea rcx, [0x1800663d1]
call fcn.180052d10
mov edx, 0xc60bf9f2
mov dword [rsp + 0x58], eax
lea rcx, [0x1800663e1]
call fcn.180052d10
lea r8, [rsp + 0x50]
mov dword [rsp + 0x50], eax
lea rdx, [rsp + 0x20]
call fcn.180057aa0
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x30]
mov rcx, qword [rax]
add rcx, 0x18
call fcn.1800577f0
mov rcx, qword [rax]
movsx rax, word [rcx + 0x1c]
mov rbx, qword [rax + rbx]
test rbx, rbx
je 0x18005862c
mov edx, 0xe80c2f78
lea rcx, [0x1800663f1]
call fcn.180052d10
mov edx, 0xc60bf9f2
mov dword [rsp + 0x58], eax
lea rcx, [0x180066401]
call fcn.180052d10
lea r8, [rsp + 0x50]
mov dword [rsp + 0x50], eax
lea rdx, [rsp + 0x30]
call fcn.180057aa0
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x20]
mov rcx, qword [rax]
add rcx, 0x18
call fcn.1800577f0
mov rcx, qword [rax]
movsx rax, word [rcx + 0x1c]
mov r8, qword [rax + rbx]
test r8, r8
je 0x18005862c
movsx eax, byte [r8]
mov ecx, 0x811c9dc5
test al, al
je 0x18005861d
xor eax, ecx
lea rcx, [r8 + 1]
imul edx, eax, 0x1000193
call fcn.180058510
mov ecx, eax
cmp ecx, 0x3b96c0aa
sete al
add rsp, 0x40
pop rbx
ret
xor al, al
add rsp, 0x40
pop rbx
ret

Function at 0x180059750
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x18005978a
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x18005978f
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x1800597d8
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x18005c880]
cmp byte [rcx + rax], 0
je 0x1800597d8
dec r8
sub rdx, 1
jne 0x1800597be
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x140033220
Capabilities:
Encode data using xor

Disassembly:
cmp edi, dword [rbx - 0x44]
cmp bl, byte [rsi + rax]
xor esi, dword [rbx]
xor eax, eax
jne 0x140033110
xor esi, dword [rbx]
sal byte [rbp + 3], 0x6f
outsd dx, dword [rsi]
cmp al, 0xaa
nop
jnp 0x140033145
hlt
jg 0x140033101
idiv byte [rbx - 0x40]
mov bl, dh
jnp 0x140033108
ror byte [rax - 0x441840d], 0x1b
xchg edi, eax
add eax, 0xc07b3232
js 0x140033147
jnp 0x140033108
sti
sbb edx, dword [rdi + 0x7b323205]
sar byte [rax - 0xd], 0x1e
jnp 0x14003310e
invalid
invalid
sbb eax, 0x80c07b62
and ebx, dword [rbx]
pop rsp
add al, 0x32
xor bh, byte [rbx - 0x42]
cmp edi, dword [rsi - 0x4384c48d]
invalid
sti
cmpsd dword [rsi], dword [rdi]
jo 0x1400331f9
xor bh, byte [rax]
xchg edi, eax
pop rdx
xor rdi, qword [rbx - 0x42]
mov bl, dh
jae 0x140033141
sub dword [rdi - 0x58f148b3], esp
jnp 0x140033153
and byte [rbx], 0x1b
jge 0x14003319b
xor dh, byte [rdx]
invalid
invalid
add esi, dword [rdx]
xor bl, byte [rsi]
out dx, eax
mov bh, 0xe
cmpsd dword [rsi], dword [rdi]
cmp al, 0x7b
rol byte [rax + 0x32a81c23], 0x32
xor bh, byte [rbx - 0x40]
add byte [rbx], 0x1e
xlatb
jnp 0x14003317a
invalid
cmp byte [rdx + 0x5a], bl
xor rdi, qword [rbp + 0x38c07b3b]
invalid
push rdi
xchg ebx, eax
jnp 0x1400331a2
cli
jl 0x1400331a5
mov es, word [rbx + 0x7c]
mov esi, 0xbe7c4ba6
scasb al, byte [rdi]
push rbx
cmp byte [rsi - 0x4183a45a], 0x16
nop
idiv bh
invalid
imul edx, dword [rdx - 0x544c9858], 0x34
xchg edx, eax
test al, 0x61
jnp 0x1400331c6
xor eax, 0x238bc7b
pop rcx
xor rax, qword [rdx - 0xf]
mov r14b, 0x1d
je 0x14003329b
xor dh, bl
jnp 0x1400331e0
cmp dl, dh
pop rcx
xor rsi, qword [rsi + 0x41a9362d]
mov dh, 0x94
cmp esi, dword [rbx]
jnp 0x1400331ea
push rsp
xor edi, ecx
je 0x140033274
xor eax, 0xb67b3b1e
push rsp
xor esi, dword [rsi + 0x7b333b94]
mov esi, 0xbc7bf6f4
invalid
jnp 0x140033204
hlt
cmp edi, dword [rbx - 0x44]
scasd eax, dword [rdi]
push rdi
mov byte [r11 - 0x42], dil
invalid
rol dword [rbp + 0x33], 1
cli
xor r15d, r10d
js 0x140033275
xor esi, dword [r11]
xor edi, dword [rbx - 0x44]
js 0x140033275
jnp 0x140033244
mov byte [rbx], al
pop rbx
js 0x14003327d
jnp 0x14003324c
xor bl, 0x99
mov dl, 0x78
add ebx, dword [rbx]
iretd
xor esi, dword [rbx]
xor edi, dword [rbx - 0x42]
or bh, byte [rbx - 0x42]
sti
sbb edx, dword [rsi + 0x1e323204]
lea edi, [rdi - 0x44]
xor bl, 0x77
mov esp, 0xb374fb80
sub ecx, dword [rdx + 0x38be94a8]
insb byte [rdi], dx
pop rcx
xor rsi, rsp
sbb eax, dword [rdx + 0x2a]
add esi, dword [rsi - 0x6457cbed]
jnp 0x1400332fd
cmc
jnp 0x14003328a
pop rcx
xor rsi, qword [rbx + r14*4 + 0x2b]
mov ch, byte [rax - 0x7f3f84c4]
and ebx, dword [rbx]
sub ecx, dword [rdx - 0x3f84c358]
and byte [rbx], 0x1b
jns 0x140033314
xor esi, dword [rbx]
jnp 0x1400332a4
add byte [rbx], 0x1b
invalid
mov esp, 0xfb78be3a
mov esp, 0xc07f3b7a
invalid
push rbx
jl 0x1400332d5
invalid
Function at 0x1400122f4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001233e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14001233e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14001233e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14001233e
cmp dword [rcx + 0x84], 0xe
jbe 0x14001233e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140012340
xor al, al
add rsp, 0x28
ret

Function at 0x140016a98
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140016894
Function at 0x140019b5c
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x140019b8c
xor eax, eax
jmp 0x140019c4f
mov rbp, rbx
cmp word [rax], si
je 0x140019bb1
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x140019b98
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x140019b94
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.140019a7c
movsxd r14, eax
test eax, eax
jne 0x140019bef
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x140019b85
mov rcx, r14
call fcn.14001aa38
mov rdi, rax
test rax, rax
jne 0x140019c08
xor ecx, ecx
call fcn.1400180dc
jmp 0x140019be4
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.140019a7c
test eax, eax
jne 0x140019c39
mov rcx, rdi
call fcn.1400180dc
jmp 0x140019c43
xor ecx, ecx
call fcn.1400180dc
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x14001d140
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.140018b4c
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x14001d1ca
cmp byte [rbp - 0x21], r15b
je 0x14001d1c5
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x14001d200
call fcn.14001b248
test eax, eax
jne 0x14001d1ec
cmp byte [rbp - 0x21], r15b
je 0x14001d1e4
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x14001d200
cmp byte [rbp - 0x21], r15b
je 0x14001d1fd
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.14001812c
test eax, eax
jne 0x14001d2a0
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.140018b4c
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x14001d23f
cmp byte [rbp - 0x21], r15b
je 0x14001d274
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x14001d274
call fcn.14001b248
test eax, eax
jne 0x14001d260
cmp byte [rbp - 0x21], r15b
je 0x14001d259
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x14001d274
cmp byte [rbp - 0x21], r15b
je 0x14001d271
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.14001812c
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x14001d2a0
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x14001d2a3
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x14001d2b1
mov rcx, rdi
call fcn.1400180dc
cmp byte [rbp + 0x3f], r15b
je 0x14001d2c0
mov rcx, qword [rbp + 0x27]
call fcn.1400180dc
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x140020170
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140020198
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140020198
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140012110
Capabilities:
Terminate thread

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [rcx + 0x10]
lea rdx, [rsp + 0x20]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rax, qword [rcx + 8]
mov rbx, rcx
mov r9d, 0xffffffff
mov qword [rsp + 0x28], rax
lea ecx, [r8 + 2]
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
lock xadd dword [0x140133438], eax
mov rcx, qword [rbx + 8]
test eax, eax
je 0x14001216d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
add rsp, 0x30
pop rbx
ret
mov rdx, rcx
xor r8d, r8d
lea rcx, [fcn.14000f810]
call qword [sym.imp.KERNEL32.dll_QueueUserAPC]
mov rcx, qword [rbx + 8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
add rsp, 0x30
pop rbx
ret

Function at 0x140012410
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, qword [rcx]
mov rdi, rcx
test rbx, rbx
je 0x1400124d4
nop dword [rax]
mov rax, qword [rbx + 0x10]
lea rdx, [rsp + 0x20]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rax, qword [rbx + 8]
mov r9d, 0xffffffff
mov qword [rsp + 0x28], rax
lea ecx, [r8 + 2]
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
lock xadd dword [0x140133438], eax
mov rcx, qword [rbx + 8]
test eax, eax
je 0x140012480
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
jmp 0x1400124a2
mov rdx, rcx
xor r8d, r8d
lea rcx, [fcn.14000f810]
call qword [sym.imp.KERNEL32.dll_QueueUserAPC]
mov rcx, qword [rbx + 8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rbx, qword [rdi]
mov rax, qword [rbx + 0x18]
mov qword [rdi], rax
test rbx, rbx
je 0x1400124c8
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0x20
mov rcx, rbx
call fcn.14001bba0
mov rbx, qword [rdi]
test rbx, rbx
jne 0x140012430
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x140014080
Capabilities:
Initialize winsock library

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x200
mov rax, qword [0x14012e040]
xor rax, rsp
mov qword [rsp + 0x1f0], rax
movzx ebx, dl
mov rdi, rcx
mov eax, 1
lock xadd dword [0x140133440], eax
inc eax
cmp eax, 1
jne 0x1400140cd
lea ecx, [rax + 1]
lea rdx, [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_WSAStartup]
xchg dword [0x140133444], eax
test bl, bl
je 0x140014171
xor ebx, ebx
lock xadd dword [0x140133444], ebx
test ebx, ebx
je 0x140014171
movabs rcx, 0x4d54ee85da812030
mov qword [rsp + 0x210], rsi
add rcx, qword [0x14012e300]
lea rsi, [0x14012e2f8]
mov dword [rsp + 0x3c], 0
cmp rcx, 1
jbe 0x140014126
mov rax, qword [0x14012e2f8]
mov edx, ebx
mov rcx, rsi
call qword [rax + 0x30]
jmp 0x140014128
mov al, 1
lea rcx, str.E:_boost_1_83_0_boost_asiodetailimplwinsock_init.ipp
movzx eax, al
add rax, 2
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x40], rsi
lea rcx, str.throw_on_error
mov rsi, qword [rsp + 0x210]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], 0x48
mov dword [rsp + 0x34], 0x1a
test al, 1
jne 0x140014195
mov rax, rdi
mov rcx, qword [rsp + 0x1f0]
xor rcx, rsp
call fcn.1400c8700
mov rbx, qword [rsp + 0x218]
add rsp, 0x200
pop rdi
ret
lea r8, [rsp + 0x20]
lea rdx, str.winsock
lea rcx, [rsp + 0x38]
call fcn.140011bc0
int3
Function at 0x14001ea10
Capabilities:
Set socket configuration

Disassembly:
push rbp
push rsi
push rdi
push r12
push r15
mov rbp, rsp
sub rsp, 0x60
xor r12d, r12d
mov r15, r9
mov rsi, rdx
mov rdi, rcx
cmp rcx, 0xffffffffffffffff
je 0x14001ebe6
mov qword [rsp + 0x98], rbx
test r8b, r8b
je 0x14001ea7c
movzx eax, byte [rdx]
test al, 8
je 0x14001ea7c
or al, 8
mov dword [rbp + 0x30], r12d
mov byte [rdx], al
lea r9, [rbp + 0x30]
mov edx, 0xffff
mov dword [rsp + 0x20], 4
mov r8d, 0x80
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
lea rcx, [rbp - 0x18]
setne dl
call fcn.14001e950
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
test eax, eax
mov rcx, r15
mov ebx, eax
setne dl
call fcn.14001e950
test ebx, ebx
je 0x14001ebe2
mov qword [rsp + 0xa0], r13
movabs rcx, 0x4d54ee85da812030
mov qword [rsp + 0xa8], r14
lea r13, [0x14012e2f8]
mov r14, qword [0x14012e300]
add rcx, r14
mov dword [rbp - 0x2c], r12d
cmp rcx, 1
jbe 0x14001eaec
mov rax, qword [0x14012e2f8]
mov edx, 0x2733
mov rcx, r13
call qword [rax + 0x30]
mov r14, qword [0x14012e300]
jmp 0x14001eaee
mov al, 1
movzx eax, al
lea rdx, [rbp - 0x18]
add rax, 2
mov dword [rbp - 0x30], 0x2733
mov qword [rbp - 0x20], rax
mov rcx, r15
movsd xmm1, qword [rbp - 0x20]
mov qword [rbp - 0x28], r13
movups xmm0, xmmword [rbp - 0x30]
movsd qword [rbp - 8], xmm1
movups xmmword [rbp - 0x18], xmm0
call fcn.14001b4a0
test al, al
jne 0x14001eb8b
movabs rax, 0x4d54ee85da812030
mov dword [rbp - 0x2c], r12d
add rax, r14
cmp rax, 1
jbe 0x14001eb51
mov rax, qword [0x14012e2f8]
mov edx, 0x4d5
mov rcx, r13
call qword [rax + 0x30]
jmp 0x14001eb53
mov al, 1
movzx eax, al
lea rdx, [rbp - 0x18]
add rax, 2
mov dword [rbp - 0x30], 0x4d5
mov qword [rbp - 0x20], rax
mov rcx, r15
movsd xmm1, qword [rbp - 0x20]
mov qword [rbp - 0x28], r13
movups xmm0, xmmword [rbp - 0x30]
movsd qword [rbp - 8], xmm1
movups xmmword [rbp - 0x18], xmm0
call fcn.14001b4a0
test al, al
je 0x14001ebbc
lea r8, [rbp + 0x30]
mov dword [rbp + 0x30], r12d
mov edx, 0x8004667e
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_ioctlsocket]
and byte [rsi], 0xfc
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
test eax, eax
mov rcx, r15
mov ebx, eax
setne dl
call fcn.14001e950
mov r13, qword [rsp + 0xa0]
mov eax, ebx
mov r14, qword [rsp + 0xa8]
mov rbx, qword [rsp + 0x98]
add rsp, 0x60
pop r15
pop r12
pop rdi
pop rsi
pop rbp
ret
mov eax, ebx
jmp 0x14001ebce
mov eax, r12d
add rsp, 0x60
pop r15
pop r12
pop rdi
pop rsi
pop rbp
ret