joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140063760
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
movzx r9d, byte [r8 + 0x10]
mov r10, rcx
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r9, rax
mov rdi, rdx
movzx eax, byte [r8 + 0x11]
mov rdx, qword [r10 + 0x30]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 0x12]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 0x13]
imul r9, rcx
xor r9, rax
imul r9, rcx
mov rcx, qword [r10 + 0x18]
and rdx, r9
shl rdx, 4
add rcx, rdx
cmp qword [rcx + 8], r8
jne 0x1400637f1
cmp qword [rcx], r8
jne 0x1400637e7
mov rax, qword [r10 + 8]
mov qword [rcx], rax
mov rcx, qword [r10 + 0x18]
mov rax, qword [r10 + 8]
mov qword [rdx + rcx + 8], rax
jmp 0x1400637fc
mov rax, qword [r8 + 8]
mov qword [rcx + 8], rax
jmp 0x1400637fc
cmp qword [rcx], r8
jne 0x1400637fc
mov rax, qword [r8]
mov qword [rcx], rax
mov rax, qword [r8 + 8]
mov rbx, qword [r8]
mov qword [rax], rbx
mov rcx, qword [r8]
mov rax, qword [r8 + 8]
mov qword [rcx + 8], rax
mov rcx, r8
dec qword [r10 + 0x10]
call fcn.140087110
mov qword [rdi], rbx
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400639c0
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x80
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0xa0], rbx
mov rax, qword [0x1400b59e8]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rbx, r9
mov rdi, rdx
mov r9, rcx
mov r10d, dword [rbx + 4]
sub r10d, 1
je 0x140063a15
sub r10d, 1
je 0x140063a0e
cmp r10d, 1
jne 0x140063a15
lea ecx, [r10 + 3]
jmp 0x140063a17
mov ecx, 2
jmp 0x140063a17
xor ecx, ecx
xor eax, eax
test r8b, r8b
jne 0x140063a23
or eax, 1
jmp 0x140063a26
and eax, 0xfffffffe
mov edx, eax
or rdx, rcx
lea rax, [0x1400978f8]
mov rcx, qword [r9]
mov rax, qword [rax + rdx*8]
mov qword [rcx + 0x108], rax
mov ecx, dword [0x1400c0fb0]
mov rax, qword gs:[0x58]
mov edx, 4
mov rax, qword [rax + rcx*8]
mov ecx, dword [rdx + rax]
cmp dword [0x1400bd560], ecx
jle 0x140063b05
lea rcx, [0x1400bd560]
call fcn.1400875d8
cmp dword [0x1400bd560], 0xffffffff
jne 0x140063b05
mov dword [rsp + 0x40], 1
lea rax, [0x140058b90]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x50], 2
lea rax, [0x14005c360]
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x60], 3
lea rax, [0x14005fb30]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
lea rcx, [0x1400bd520]
call fcn.14006a110
lea rcx, [0x14008bd60]
call fcn.1400873bc
nop
lea rcx, [0x1400bd560]
call fcn.140087578
mov r9d, dword [rbx + 4]
movzx r8d, r9b
movabs rax, 0xcbf29ce484222325
xor r8, rax
movabs rdx, 0x100000001b3
imul r8, rdx
mov eax, r9d
shr eax, 8
movzx ecx, al
xor r8, rcx
imul r8, rdx
mov eax, r9d
shr eax, 0x10
movzx ecx, al
xor r8, rcx
imul r8, rdx
mov eax, r9d
shr eax, 0x18
movzx ecx, al
xor r8, rcx
imul r8, rdx
and r8, qword [0x1400bd550]
mov rax, r8
add rax, rax
mov rdx, qword [0x1400bd538]
mov rax, qword [rdx + rax*8]
lea rcx, [r8 + r8]
mov r8, qword [rdx + rcx*8]
lea r10, [rdx + rcx*8]
mov rdx, qword [0x1400bd528]
cmp r8, rdx
jne 0x140063b8d
mov rcx, rdx
jmp 0x140063b94
mov rcx, qword [r10 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x140063bb2
cmp dword [rax + 0x10], r9d
je 0x140063ba4
mov rax, qword [rax]
jmp 0x140063b83
cmp rax, rdx
je 0x140063bb2
mov rcx, qword [rax + 0x18]
mov qword [rdi], rcx
jmp 0x140063bb9
mov qword [rdi], 0
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140087840
mov rbx, qword [rsp + 0xa0]
add rsp, 0x80
pop rdi
ret
Function at 0x140063be0
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x80
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0xa0], rbx
mov rax, qword [0x1400b59e8]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rbx, r9
mov rdi, rdx
mov r11, rcx
mov r10d, dword [r9 + 4]
sub r10d, 1
je 0x140063c35
sub r10d, 1
je 0x140063c2e
cmp r10d, 1
jne 0x140063c35
lea ecx, [r10 + 3]
jmp 0x140063c37
mov ecx, 2
jmp 0x140063c37
xor ecx, ecx
xor eax, eax
test r8b, r8b
jne 0x140063c43
or eax, 1
jmp 0x140063c46
and eax, 0xfffffffe
mov edx, eax
or rdx, rcx
lea rax, [0x140097990]
mov rcx, qword [r11]
mov rax, qword [rax + rdx*8]
mov qword [rcx + 0x108], rax
mov edx, 1
lea r8, [r11 + 8]
nop dword [rax]
mov rax, qword [r11]
mov rcx, qword [r8]
mov rax, qword [rax + 0x108]
mov qword [rcx + 0x108], rax
inc edx
lea r8, [r8 + 8]
cmp edx, 2
jb 0x140063c70
mov ecx, dword [0x1400c0fb0]
mov rax, qword gs:[0x58]
mov edx, 4
mov rax, qword [rax + rcx*8]
mov ecx, dword [rdx + rax]
cmp dword [0x1400bd5b0], ecx
jle 0x140063d54
lea rcx, [0x1400bd5b0]
call fcn.1400875d8
cmp dword [0x1400bd5b0], 0xffffffff
jne 0x140063d54
mov dword [rsp + 0x40], 1
lea rax, [0x1400596a0]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x50], 2
lea rax, [0x14005ce70]
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x60], 3
lea rax, [0x140060640]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
lea rcx, [0x1400bd570]
call fcn.14006a110
lea rcx, [0x14008bdd0]
call fcn.1400873bc
nop
lea rcx, [0x1400bd5b0]
call fcn.140087578
mov r9d, dword [rbx + 4]
movzx r8d, r9b
movabs rax, 0xcbf29ce484222325
xor r8, rax
movabs rdx, 0x100000001b3
imul r8, rdx
mov eax, r9d
shr eax, 8
movzx ecx, al
xor r8, rcx
imul r8, rdx
mov eax, r9d
shr eax, 0x10
movzx ecx, al
xor r8, rcx
imul r8, rdx
mov eax, r9d
shr eax, 0x18
movzx ecx, al
xor r8, rcx
imul r8, rdx
and r8, qword [0x1400bd5a0]
mov rax, r8
add rax, rax
mov rdx, qword [0x1400bd588]
mov rax, qword [rdx + rax*8]
lea rcx, [r8 + r8]
mov r8, qword [rdx + rcx*8]
lea r10, [rdx + rcx*8]
mov rdx, qword [0x1400bd578]
cmp r8, rdx
jne 0x140063ddc
mov rcx, rdx
jmp 0x140063de3
mov rcx, qword [r10 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x140063e01
cmp dword [rax + 0x10], r9d
je 0x140063df3
mov rax, qword [rax]
jmp 0x140063dd2
cmp rax, rdx
je 0x140063e01
mov rcx, qword [rax + 0x18]
mov qword [rdi], rcx
jmp 0x140063e08
mov qword [rdi], 0
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140087840
mov rbx, qword [rsp + 0xa0]
add rsp, 0x80
pop rdi
ret
Function at 0x140063e30
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x80
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0xa0], rbx
mov rax, qword [0x1400b59e8]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rbx, r9
mov rdi, rdx
mov r11, rcx
mov r10d, dword [r9 + 4]
sub r10d, 1
je 0x140063e85
sub r10d, 1
je 0x140063e7e
cmp r10d, 1
jne 0x140063e85
lea ecx, [r10 + 3]
jmp 0x140063e87
mov ecx, 2
jmp 0x140063e87
xor ecx, ecx
xor eax, eax
test r8b, r8b
jne 0x140063e93
or eax, 1
jmp 0x140063e96
and eax, 0xfffffffe
mov edx, eax
or rdx, rcx
lea rax, [0x1400979c0]
mov rcx, qword [r11]
mov rax, qword [rax + rdx*8]
mov qword [rcx + 0x108], rax
mov edx, 1
lea r8, [r11 + 8]
nop dword [rax]
mov rax, qword [r11]
mov rcx, qword [r8]
mov rax, qword [rax + 0x108]
mov qword [rcx + 0x108], rax
inc edx
lea r8, [r8 + 8]
cmp edx, 3
jb 0x140063ec0
mov ecx, dword [0x1400c0fb0]
mov rax, qword gs:[0x58]
mov edx, 4
mov rax, qword [rax + rcx*8]
mov ecx, dword [rdx + rax]
cmp dword [0x1400bd600], ecx
jle 0x140063fa4
lea rcx, [0x1400bd600]
call fcn.1400875d8
cmp dword [0x1400bd600], 0xffffffff
jne 0x140063fa4
mov dword [rsp + 0x40], 1
lea rax, [0x14005a1d0]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x50], 2
lea rax, [0x14005d9a0]
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x60], 3
lea rax, [0x140061170]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
lea rcx, [0x1400bd5c0]
call fcn.14006a110
lea rcx, [0x14008be40]
call fcn.1400873bc
nop
lea rcx, [0x1400bd600]
call fcn.140087578
mov r9d, dword [rbx + 4]
movzx r8d, r9b
movabs rax, 0xcbf29ce484222325
xor r8, rax
movabs rdx, 0x100000001b3
imul r8, rdx
mov eax, r9d
shr eax, 8
movzx ecx, al
xor r8, rcx
imul r8, rdx
mov eax, r9d
shr eax, 0x10
movzx ecx, al
xor r8, rcx
imul r8, rdx
mov eax, r9d
shr eax, 0x18
movzx ecx, al
xor r8, rcx
imul r8, rdx
and r8, qword [0x1400bd5f0]
mov rax, r8
add rax, rax
mov rdx, qword [0x1400bd5d8]
mov rax, qword [rdx + rax*8]
lea rcx, [r8 + r8]
mov r8, qword [rdx + rcx*8]
lea r10, [rdx + rcx*8]
mov rdx, qword [0x1400bd5c8]
cmp r8, rdx
jne 0x14006402c
mov rcx, rdx
jmp 0x140064033
mov rcx, qword [r10 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x140064051
cmp dword [rax + 0x10], r9d
je 0x140064043
mov rax, qword [rax]
jmp 0x140064022
cmp rax, rdx
je 0x140064051
mov rcx, qword [rax + 0x18]
mov qword [rdi], rcx
jmp 0x140064058
mov qword [rdi], 0
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140087840
mov rbx, qword [rsp + 0xa0]
add rsp, 0x80
pop rdi
ret
Function at 0x140064080
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x80
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0xa0], rbx
mov rax, qword [0x1400b59e8]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rbx, r9
mov rdi, rdx
mov r11, rcx
mov r10d, dword [r9 + 4]
sub r10d, 1
je 0x1400640d5
sub r10d, 1
je 0x1400640ce
cmp r10d, 1
jne 0x1400640d5
lea ecx, [r10 + 3]
jmp 0x1400640d7
mov ecx, 2
jmp 0x1400640d7
xor ecx, ecx
xor eax, eax
test r8b, r8b
jne 0x1400640e3
or eax, 1
jmp 0x1400640e6
and eax, 0xfffffffe
mov edx, eax
or rdx, rcx
lea rax, [0x1400979f0]
mov rcx, qword [r11]
mov rax, qword [rax + rdx*8]
mov qword [rcx + 0x108], rax
mov edx, 1
lea r8, [r11 + 8]
nop dword [rax]
mov rax, qword [r11]
mov rcx, qword [r8]
mov rax, qword [rax + 0x108]
mov qword [rcx + 0x108], rax
inc edx
lea r8, [r8 + 8]
cmp edx, 4
jb 0x140064110
mov ecx, dword [0x1400c0fb0]
mov rax, qword gs:[0x58]
mov edx, 4
mov rax, qword [rax + rcx*8]
mov ecx, dword [rdx + rax]
cmp dword [0x1400bd650], ecx
jle 0x1400641f4
lea rcx, [0x1400bd650]
call fcn.1400875d8
cmp dword [0x1400bd650], 0xffffffff
jne 0x1400641f4
mov dword [rsp + 0x40], 1
lea rax, [0x14005ad00]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x50], 2
lea rax, [0x14005e4d0]
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x60], 3
lea rax, [0x140061ca0]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
lea rcx, [0x1400bd610]
call fcn.14006a110
lea rcx, [0x14008beb0]
call fcn.1400873bc
nop
lea rcx, [0x1400bd650]
call fcn.140087578
mov r9d, dword [rbx + 4]
movzx r8d, r9b
movabs rax, 0xcbf29ce484222325
xor r8, rax
movabs rdx, 0x100000001b3
imul r8, rdx
mov eax, r9d
shr eax, 8
movzx ecx, al
xor r8, rcx
imul r8, rdx
mov eax, r9d
shr eax, 0x10
movzx ecx, al
xor r8, rcx
imul r8, rdx
mov eax, r9d
shr eax, 0x18
movzx ecx, al
xor r8, rcx
imul r8, rdx
and r8, qword [0x1400bd640]
mov rax, r8
add rax, rax
mov rdx, qword [0x1400bd628]
mov rax, qword [rdx + rax*8]
lea rcx, [r8 + r8]
mov r8, qword [rdx + rcx*8]
lea r10, [rdx + rcx*8]
mov rdx, qword [0x1400bd618]
cmp r8, rdx
jne 0x14006427c
mov rcx, rdx
jmp 0x140064283
mov rcx, qword [r10 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x1400642a1
cmp dword [rax + 0x10], r9d
je 0x140064293
mov rax, qword [rax]
jmp 0x140064272
cmp rax, rdx
je 0x1400642a1
mov rcx, qword [rax + 0x18]
mov qword [rdi], rcx
jmp 0x1400642a8
mov qword [rdi], 0
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140087840
mov rbx, qword [rsp + 0xa0]
add rsp, 0x80
pop rdi
ret
Function at 0x1400642d0
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x80
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0xa0], rbx
mov rax, qword [0x1400b59e8]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rbx, r9
mov rdi, rdx
mov r11, rcx
mov r10d, dword [r9 + 4]
sub r10d, 1
je 0x140064325
sub r10d, 1
je 0x14006431e
cmp r10d, 1
jne 0x140064325
lea ecx, [r10 + 3]
jmp 0x140064327
mov ecx, 2
jmp 0x140064327
xor ecx, ecx
xor eax, eax
test r8b, r8b
jne 0x140064333
or eax, 1
jmp 0x140064336
and eax, 0xfffffffe
mov edx, eax
or rdx, rcx
lea rax, [0x140097a20]
mov rcx, qword [r11]
mov rax, qword [rax + rdx*8]
mov qword [rcx + 0x108], rax
mov edx, 1
lea r8, [r11 + 8]
nop dword [rax]
mov rax, qword [r11]
mov rcx, qword [r8]
mov rax, qword [rax + 0x108]
mov qword [rcx + 0x108], rax
inc edx
lea r8, [r8 + 8]
cmp edx, 5
jb 0x140064360
mov ecx, dword [0x1400c0fb0]
mov rax, qword gs:[0x58]
mov edx, 4
mov rax, qword [rax + rcx*8]
mov ecx, dword [rdx + rax]
cmp dword [0x1400bd6a0], ecx
jle 0x140064444
lea rcx, [0x1400bd6a0]
call fcn.1400875d8
cmp dword [0x1400bd6a0], 0xffffffff
jne 0x140064444
mov dword [rsp + 0x40], 1
lea rax, [0x14005b830]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x50], 2
lea rax, [0x14005f000]
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x60], 3
lea rax, [0x1400627d0]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
lea rcx, [0x1400bd660]
call fcn.14006a110
lea rcx, [0x14008bf20]
call fcn.1400873bc
nop
lea rcx, [0x1400bd6a0]
call fcn.140087578
mov r9d, dword [rbx + 4]
movzx r8d, r9b
movabs rax, 0xcbf29ce484222325
xor r8, rax
movabs rdx, 0x100000001b3
imul r8, rdx
mov eax, r9d
shr eax, 8
movzx ecx, al
xor r8, rcx
imul r8, rdx
mov eax, r9d
shr eax, 0x10
movzx ecx, al
xor r8, rcx
imul r8, rdx
mov eax, r9d
shr eax, 0x18
movzx ecx, al
xor r8, rcx
imul r8, rdx
and r8, qword [0x1400bd690]
mov rax, r8
add rax, rax
mov rdx, qword [0x1400bd678]
mov rax, qword [rdx + rax*8]
lea rcx, [r8 + r8]
mov r8, qword [rdx + rcx*8]
lea r10, [rdx + rcx*8]
mov rdx, qword [0x1400bd668]
cmp r8, rdx
jne 0x1400644cc
mov rcx, rdx
jmp 0x1400644d3
mov rcx, qword [r10 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x1400644f1
cmp dword [rax + 0x10], r9d
je 0x1400644e3
mov rax, qword [rax]
jmp 0x1400644c2
cmp rax, rdx
je 0x1400644f1
mov rcx, qword [rax + 0x18]
mov qword [rdi], rcx
jmp 0x1400644f8
mov qword [rdi], 0
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140087840
mov rbx, qword [rsp + 0xa0]
add rsp, 0x80
pop rdi
ret
Function at 0x140075790
Capabilities:
Connect socket

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor eax, eax
mov rdi, rcx
xchg byte [rcx + 8], al
mov rdx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x28]
mov r8d, dword [rdx + 0x10]
mov rdx, qword [rdx + 0x20]
call qword [sym.imp.WS2_32.dll_connect]
mov rcx, qword [rdi + 0x20]
mov ebx, eax
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
mov qword [rdi + 0x20], 0
test ebx, ebx
je 0x1400757ea
mov rcx, qword [rdi + 0x10]
lea rdx, str.CONNECT_error:
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140074540
mov al, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140077520
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
movzx eax, byte [rcx + 8]
test al, al
je 0x140077539
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov rcx, qword [rcx + 0x28]
xor r9d, r9d
mov qword [rsp + 0x30], rdi
call qword [sym.imp.WS2_32.dll_recv]
mov edi, eax
test eax, eax
jne 0x14007756e
mov rcx, qword [rbx + 0x10]
lea rdx, str.RECEIVE_error:_socket_closed
call fcn.1400744d0
mov eax, edi
mov rdi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret
cmp edi, 0xffffffff
jg 0x140077583
mov rcx, qword [rbx + 0x10]
lea rdx, str.RECEIVE_error:
call fcn.140074540
mov eax, edi
mov rdi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret

Function at 0x1400775b0
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor edi, edi
mov rsi, rdx
or rbx, 0xffffffffffffffff
mov rbp, rcx
inc rbx
cmp byte [rdx + rbx], dil
jne 0x1400775d0
test rbx, rbx
je 0x140077606
nop
mov rcx, qword [rbp + 0x28]
lea rdx, [rdi + rsi]
mov r8d, ebx
xor r9d, r9d
sub r8d, edi
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x14007761d
cdqe
add rdi, rax
cmp rdi, rbx
jne 0x1400775e0
mov al, 1
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rcx, qword [rbp + 0x10]
lea rdx, str.SEND_error:
call fcn.140074540
xor al, al
jmp 0x140077608
Function at 0x140077640
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
xor eax, eax
mov rbx, rcx
xchg byte [rcx + 8], al
mov rcx, qword [rcx + 0x18]
mov rdi, rdx
test rcx, rcx
jne 0x1400776b6
call sub.libssl_1_1_x64.dll_TLS_method
test rax, rax
je 0x140077698
mov rcx, rax
call sub.libssl_1_1_x64.dll_SSL_CTX_new
mov qword [rbx + 0x18], rax
test rax, rax
je 0x140077698
call fcn.140040a50
mov rcx, rax
call fcn.14004a410
test al, al
je 0x140077698
mov rcx, qword [rbx + 0x18]
mov edx, 0x6000000
call sub.libssl_1_1_x64.dll_SSL_CTX_set_options
mov rcx, qword [rbx + 0x18]
test rcx, rcx
jne 0x1400776b6
mov rcx, rbx
call fcn.140077300
xor al, al
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
call sub.libssl_1_1_x64.dll_BIO_new_ssl_connect
mov qword [rbx + 0x20], rax
test rax, rax
je 0x1400776a1
xor r9d, r9d
mov dword [rsp + 0x40], 1
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 0x69]
call sub.libcrypto_1_1_x64.dll_BIO_ctrl
mov edx, 6
movsxd rcx, eax
lea r9, [rsp + 0x40]
mov dword [rsp + 0x20], 4
lea r8d, [rdx - 5]
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rcx, qword [rbx + 0x20]
xor r8d, r8d
mov r9, rdi
lea edx, [r8 + 0x64]
call sub.libcrypto_1_1_x64.dll_BIO_ctrl
cmp eax, 1
jne 0x1400776a1
mov rcx, qword [rbx + 0x20]
lea r9, [rbx + 0x28]
xor r8d, r8d
lea edx, [rax + 0x6d]
call sub.libcrypto_1_1_x64.dll_BIO_ctrl
cmp qword [rbx + 0x28], 0
je 0x1400776a1
call fcn.140040a50
mov rcx, rax
call fcn.14004a410
test al, al
je 0x14007775d
mov rcx, qword [rbx + 0x28]
lea rdx, str.HIGH:_aNULL:_PSK:_SRP:_MD5:_RC4:_SHA1
call sub.libssl_1_1_x64.dll_SSL_set_cipher_list
cmp eax, 1
jne 0x1400776a1
mov al, 1
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x140077770
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
xor eax, eax
mov rbx, rcx
xchg byte [rcx + 8], al
mov rcx, qword [rcx + 0x18]
mov rdi, rdx
test rcx, rcx
jne 0x1400777e6
call sub.libssl_1_1_x64.dll_TLS_method
test rax, rax
je 0x1400777c8
mov rcx, rax
call sub.libssl_1_1_x64.dll_SSL_CTX_new
mov qword [rbx + 0x18], rax
test rax, rax
je 0x1400777c8
call fcn.140040a50
mov rcx, rax
call fcn.14004a410
test al, al
je 0x1400777c8
mov rcx, qword [rbx + 0x18]
mov edx, 0x6000000
call sub.libssl_1_1_x64.dll_SSL_CTX_set_options
mov rcx, qword [rbx + 0x18]
test rcx, rcx
jne 0x1400777e6
mov rcx, rbx
call fcn.140077360
xor al, al
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
call sub.libssl_1_1_x64.dll_BIO_new_ssl_connect
mov qword [rbx + 0x20], rax
test rax, rax
je 0x1400777d1
xor r9d, r9d
mov dword [rsp + 0x40], 1
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 0x69]
call sub.libcrypto_1_1_x64.dll_BIO_ctrl
mov edx, 6
movsxd rcx, eax
lea r9, [rsp + 0x40]
mov dword [rsp + 0x20], 4
lea r8d, [rdx - 5]
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rcx, qword [rbx + 0x20]
xor r8d, r8d
mov r9, rdi
lea edx, [r8 + 0x64]
call sub.libcrypto_1_1_x64.dll_BIO_ctrl
cmp eax, 1
jne 0x1400777d1
mov rcx, qword [rbx + 0x20]
lea r9, [rbx + 0x28]
xor r8d, r8d
lea edx, [rax + 0x6d]
call sub.libcrypto_1_1_x64.dll_BIO_ctrl
cmp qword [rbx + 0x28], 0
je 0x1400777d1
call fcn.140040a50
mov rcx, rax
call fcn.14004a410
test al, al
je 0x14007788d
mov rcx, qword [rbx + 0x28]
lea rdx, str.HIGH:_aNULL:_PSK:_SRP:_MD5:_RC4:_SHA1
call sub.libssl_1_1_x64.dll_SSL_set_cipher_list
cmp eax, 1
jne 0x1400777d1
mov al, 1
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x140078160
Capabilities:
Manipulate user privileges

Disassembly:
push rbp
push rbx
push rsi
push r14
lea rbp, [rsp - 0x3f]
sub rsp, 0xb8
xor esi, esi
mov r14d, esi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rbp - 0x41]
lea edx, [rsi + 8]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
cmp eax, 1
jne 0x140078375
mov rcx, qword [rbp - 0x41]
lea rax, [rbp + 0x7f]
lea r9d, [rsi + 4]
mov qword [rsp + 0x20], rax
lea r8, [rbp - 0x49]
mov dword [rbp + 0x7f], 4
lea edx, [rsi + 0x14]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov rcx, qword [rbp - 0x41]
lea edx, [rsi + 1]
test eax, eax
mov dword [rbp + 0x67], esi
lea rax, [rbp + 0x67]
mov ebx, esi
cmovne ebx, dword [rbp - 0x49]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov eax, dword [rbp + 0x67]
test eax, eax
je 0x140078218
test ebx, ebx
je 0x140078218
mov edx, eax
lea ecx, [rsi + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r9d, dword [rbp + 0x67]
lea edx, [rsi + 1]
mov rcx, qword [rbp - 0x41]
mov r14, rax
lea rax, [rbp + 0x67]
mov r8, r14
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov rcx, qword [rbp - 0x41]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r14, r14
je 0x140078375
xor eax, eax
lea r9, [rbp - 0x31]
mov r8d, 0xf0fff
mov qword [rbp - 0x19], rax
lea rdx, [rbp - 0x19]
mov qword [rbp - 0x11], rax
xor ecx, ecx
mov qword [rbp - 9], rax
mov qword [rbp - 1], rax
mov qword [rbp + 7], rax
mov qword [rbp + 0xf], rax
call sub.ADVAPI32.dll_LsaOpenPolicy
test eax, eax
jne 0x14007835d
mov rdx, qword [r14]
lea rax, [0x140099dc0]
mov rcx, qword [rbp - 0x31]
lea r9, [rbp + 0x6f]
lea r8, [rbp - 0x39]
mov qword [rbp - 0x21], rax
mov dword [rbp - 0x29], 0x2c002a
mov qword [rbp - 0x39], rsi
mov dword [rbp + 0x6f], esi
mov dword [rbp + 0x77], esi
call sub.ADVAPI32.dll_LsaEnumerateAccountRights
test eax, eax
jne 0x140078338
mov rax, qword [rbp - 0x39]
mov qword [rsp + 0xb0], rdi
mov rdi, rsi
mov qword [rsp + 0x98], r15
mov r15d, dword [rbp + 0x6f]
test r15, r15
je 0x14007831b
mov qword [rsp + 0xa8], r12
mov rbx, rax
movzx r12d, word [rbp - 0x29]
mov qword [rsp + 0xa0], r13
mov r13, qword [rbp - 0x21]
cmp word [rbx], r12w
jne 0x1400782f2
mov rcx, qword [rbx + 8]
mov r8d, 0x2a
mov rdx, r13
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140078300
inc rdi
add rbx, 0x10
cmp rdi, r15
jb 0x1400782d6
jmp 0x140078307
mov dword [rbp + 0x77], 1
mov rax, qword [rbp - 0x39]
mov r12, qword [rsp + 0xa8]
mov r13, qword [rsp + 0xa0]
mov rcx, rax
call sub.ADVAPI32.dll_LsaFreeMemory
mov r15, qword [rsp + 0x98]
mov rdi, qword [rsp + 0xb0]
cmp dword [rbp + 0x77], esi
jne 0x140078354
mov rdx, qword [r14]
lea r8, [rbp - 0x29]
mov rcx, qword [rbp - 0x31]
mov r9d, 1
call sub.ADVAPI32.dll_LsaAddAccountRights
test eax, eax
sete sil
mov rcx, qword [rbp - 0x31]
call sub.ADVAPI32.dll_LsaClose
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, esi
add rsp, 0xb8
pop r14
pop rsi
pop rbx
pop rbp
ret
xor eax, eax
add rsp, 0xb8
pop r14
pop rsi
pop rbx
pop rbp
ret