joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140038f30
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rdi
sub rsp, 0x28
movabs rax, 0xfffffffffffffff
mov rbp, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x140039146
lea rax, [rdx - 1]
mov qword [rsp + 0x40], rbx
mov rbx, qword [rbp + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x58], r14
inc ecx
shl rdi, cl
lea rcx, [rbp + 0x18]
lea rdx, [rdi + rdi]
call fcn.140038bb0
mov rcx, qword [rbp + 8]
lea rax, [rdi - 1]
mov qword [rbp + 0x30], rax
mov qword [rbp + 0x38], rdi
mov rcx, qword [rcx]
mov rdx, rcx
cmp rcx, rbx
je 0x14003910f
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], r12
mov r12d, 0xe6546b64
mov qword [rsp + 0x20], r15
movabs r15, 0xc6a4a7935bd1e995
nop word [rax + rax]
mov rdx, qword [rdx]
lea r11, [rcx + 0x18]
lea rdi, [r11 + 0x20]
xor r9d, r9d
mov r10, r11
cmp r11, rdi
je 0x140039018
nop word [rax + rax]
mov rax, qword [r10]
add r10, 8
imul rax, r15
mov r8, rax
shr r8, 0x2f
xor r8, rax
imul r8, r15
xor r9, r8
imul r9, r15
add r9, r12
cmp r10, rdi
jne 0x140038ff0
mov rdi, qword [rbp + 0x30]
and rdi, r9
shl rdi, 4
add rdi, qword [rbp + 0x18]
mov r9, qword [rdi]
cmp r9, rbx
jne 0x14003903b
mov qword [rdi], rcx
mov qword [rdi + 8], rcx
jmp 0x1400390f4
mov rax, qword [rdi + 8]
mov rsi, qword [r11]
cmp rsi, qword [rax + 0x18]
jne 0x140039095
mov r8, qword [rax + 0x20]
cmp qword [r11 + 8], r8
jne 0x140039095
mov r8, qword [rax + 0x28]
cmp qword [r11 + 0x10], r8
jne 0x140039095
mov r8, qword [rax + 0x30]
cmp qword [r11 + 0x18], r8
jne 0x140039095
mov r10, qword [rax]
cmp r10, rcx
je 0x14003908f
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
mov qword [rdi + 8], rcx
jmp 0x1400390f4
mov r10, rax
cmp r9, rax
je 0x1400390d0
nop dword [rax]
mov rax, qword [rax + 8]
mov r10, rax
cmp rsi, qword [rax + 0x18]
jne 0x1400390cb
mov r8, qword [rax + 0x20]
cmp qword [rcx + 0x20], r8
jne 0x1400390cb
mov r8, qword [rax + 0x28]
cmp qword [rcx + 0x28], r8
jne 0x1400390cb
mov r8, qword [rax + 0x30]
cmp qword [rcx + 0x30], r8
je 0x140039120
cmp r9, rax
jne 0x1400390a0
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
mov qword [rdi], rcx
mov rcx, rdx
cmp rdx, rbx
jne 0x140038fd0
mov r15, qword [rsp + 0x20]
mov r12, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov r14, qword [rsp + 0x58]
add rsp, 0x28
pop rdi
pop rbp
ret
mov r10, qword [rax]
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
jmp 0x1400390f4
lea rcx, str.invalid_hash_bucket_count
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_
int3
Function at 0x14003c140
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x80
mov r14, qword [rsp + 0xc0]
mov rbx, rdx
mov rsi, rcx
mov r15d, r9d
mov ecx, 0xa8
mov rbp, r8
lea rdx, [r14 + 0x40]
call fcn.1400046d0
xor r12d, r12d
mov rdi, rax
mov rax, qword [rbx + 0x18]
mov r8d, r12d
mov edx, r12d
test rax, rax
je 0x14003c1a3
mov rdx, qword [rbx + 0x10]
mov r8, rax
lock inc dword [rax + 0xc]
mov qword [rdi + 0x20], r12
lea rax, [0x1400437e0]
mov qword [rdi + 0x28], rax
mov qword [rdi], r12
mov qword [rdi + 8], r12
mov qword [rdi + 0x10], r12
mov qword [rdi + 0x18], r12
mov dword [rdi + 0x30], r12d
mov qword [rdi + 0x38], r12
mov qword [rdi + 0x40], r12
test r8, r8
je 0x14003c1df
mov qword [rdi + 0x38], rdx
mov qword [rdi + 0x40], r8
lock inc dword [r8 + 0xc]
movups xmm0, xmmword [rbp]
movups xmmword [rdi + 0x48], xmm0
mov rax, qword [r14]
mov qword [rdi + 0x58], rax
movups xmm0, xmmword [r14 + 8]
movups xmmword [rdi + 0x60], xmm0
movsd xmm1, qword [r14 + 0x18]
movsd qword [rdi + 0x70], xmm1
mov eax, dword [r14 + 0x20]
mov dword [rdi + 0x78], eax
mov rax, qword [r14 + 0x28]
mov qword [rdi + 0x80], rax
mov rax, qword [r14 + 0x30]
mov qword [rdi + 0x88], rax
movups xmm0, xmmword [r14 + 0x40]
movups xmmword [rdi + 0x98], xmm0
test r8, r8
je 0x14003c249
mov eax, 0xffffffff
lock xadd dword [r8 + 0xc], eax
cmp eax, 1
jne 0x14003c249
mov rax, qword [r8]
mov rcx, r8
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test byte [rbx + 8], 0x10
movups xmm0, xmmword [rbp]
mov rax, qword [rbp + 8]
mov qword [rsp + 0x70], rax
movups xmmword [rsp + 0x50], xmm0
movq qword [rsp + 0x68], xmm0
movq xmm0, qword [rbp + 8]
movd dword [rsp + 0x60], xmm0
je 0x14003c296
test rax, rax
jne 0x14003c296
mov rax, qword [rsi + 8]
lock inc dword [rax + 0x30]
mov rcx, qword [rsi + 8]
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
call fcn.140044690
jmp 0x14003c333
mov rax, qword [rsi + 8]
lock inc dword [rax + 0x30]
mov rcx, qword [rbx]
cmp rcx, 0xffffffffffffffff
jne 0x14003c2be
mov rcx, qword [rsi + 8]
xor r9d, r9d
mov r8d, 0x2719
mov rdx, rdi
call fcn.140044690
jmp 0x14003c333
mov qword [rsp + 0x30], r12
lea r9, [rsp + 0xc0]
mov qword [rsp + 0x28], rdi
lea rdx, [rsp + 0x60]
mov r8d, 1
mov dword [rsp + 0x20], r15d
mov dword [rsp + 0xc0], r12d
call qword [sym.imp.WS2_32.dll_WSASend]
mov ebx, eax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x4d2
mov ecx, 0x274d
cmove eax, ecx
test ebx, ebx
je 0x14003c327
cmp eax, 0x3e5
je 0x14003c327
mov r9d, dword [rsp + 0xc0]
mov r8d, eax
mov rcx, qword [rsi + 8]
mov rdx, rdi
call fcn.140044690
jmp 0x14003c333
mov rcx, qword [rsi + 8]
mov rdx, rdi
call fcn.140044740
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x14003f0a0
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x20
cmp qword [rcx], 0xffffffffffffffff
mov rbx, rcx
je 0x14003f170
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x40], rsi
call fcn.140066c50
mov rdi, qword [rbx]
cmp rdi, 0xffffffffffffffff
je 0x14003f15c
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
mov ebx, eax
call fcn.140066c50
mov rbp, rax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
test ebx, ebx
je 0x14003f15c
call fcn.140066c50
cmp rbp, rax
jne 0x14003f10d
cmp esi, 0x2733
je 0x14003f11f
call fcn.140066c50
cmp rbp, rax
jne 0x14003f161
cmp esi, 0x4d5
jne 0x14003f161
lea r8, [rsp + 0x30]
mov dword [rsp + 0x30], 0
mov edx, 0x8004667e
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_ioctlsocket]
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
mov ebx, eax
call fcn.140066c50
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
test ebx, ebx
jne 0x14003f161
call fcn.140066c50
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop rbx
ret
Function at 0x140040e40
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], rsi
mov rsi, rcx
mov qword [rsp + 0x40], rdi
call fcn.140066c50
mov rcx, qword [rsi]
xor ebp, ebp
cmp qword [rsi + 8], 0xffffffffffffffff
je 0x140040f80
xor eax, eax
lock cmpxchg qword [rcx + 0x38], rbp
je 0x140040e8d
mov rdx, qword [rsi + 8]
lea r8, [rsi + 0x28]
mov r9b, 1
mov rcx, rax
call fcn.140042c50
mov rdi, qword [rsi + 8]
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r15
cmp rdi, 0xffffffffffffffff
je 0x140040f5b
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
mov ebx, eax
call fcn.140066c50
mov r15, rax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov qword [rsp + 0x28], r15
mov r14d, eax
mov dword [rsp + 0x20], eax
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
test ebx, ebx
je 0x140040f5b
call fcn.140066c50
cmp r15, rax
jne 0x140040ef4
cmp r14d, 0x2733
je 0x140040f07
call fcn.140066c50
cmp r15, rax
jne 0x140040f74
cmp r14d, 0x4d5
jne 0x140040f74
lea r8, [rsp + 0x50]
mov dword [rsp + 0x50], ebp
mov edx, 0x8004667e
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_ioctlsocket]
and byte [rsi + 0x10], 0xfc
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
mov edi, eax
call fcn.140066c50
mov rbx, rax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], eax
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
test edi, edi
jne 0x140040f74
mov dword [rsp + 0x20], ebp
call fcn.140066c50
mov qword [rsp + 0x28], rax
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
mov r15, qword [rsp + 0x30]
mov r14, qword [rsp + 0x38]
jmp 0x140040f99
mov dword [rsp + 0x20], ebp
call fcn.140066c50
mov qword [rsp + 0x28], rax
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
mov byte [rsi + 0x10], 0
mov rdi, 0xffffffffffffffff
mov qword [rsi + 8], rdi
mov rbx, qword [rsi + 0x20]
mov qword [rsi + 0x18], rbp
mov qword [rsi + 0x20], rbp
mov rsi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
test rbx, rbx
je 0x140040fea
mov eax, edi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x140040fea
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x140040fea
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
cmp dword [rsp + 0x20], 0
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x58]
jne 0x140041000
add rsp, 0x48
ret
lea rdx, str.close
lea rcx, [rsp + 0x20]
call fcn.140004440
int3
Function at 0x140041020
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x40
xor r15d, r15d
mov rsi, r9
mov rbp, rdx
mov r14, rcx
mov edi, r15d
cmp rcx, 0xffffffffffffffff
je 0x140041156
test r8b, r8b
je 0x1400410a8
test byte [rdx], 8
je 0x1400410a8
mov dword [rsp + 0x60], r15d
call fcn.140066c50
or byte [rbp], 8
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_WSASetLastError]
lea r9, [rsp + 0x60]
mov dword [rsp + 0x20], 4
mov edx, 0xffff
mov r8d, 0x80
mov rcx, r14
call qword [sym.imp.WS2_32.dll_setsockopt]
mov ebx, eax
call fcn.140066c50
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
test ebx, ebx
jne 0x1400410a8
call fcn.140066c50
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov rcx, r14
call qword [sym.imp.WS2_32.dll_closesocket]
mov edi, eax
call fcn.140066c50
mov rbx, rax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], eax
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rsi], xmm0
test edi, edi
je 0x140041156
call fcn.140066c50
cmp qword [rsi + 8], rax
jne 0x1400410f1
cmp dword [rsi], 0x2733
je 0x140041104
call fcn.140066c50
cmp qword [rsi + 8], rax
jne 0x14004116d
cmp dword [rsi], 0x4d5
jne 0x14004116d
lea r8, [rsp + 0x60]
mov dword [rsp + 0x60], r15d
mov edx, 0x8004667e
mov rcx, r14
call qword [sym.imp.WS2_32.dll_ioctlsocket]
and byte [rbp], 0xfc
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov rcx, r14
call qword [sym.imp.WS2_32.dll_closesocket]
mov edi, eax
call fcn.140066c50
mov rbx, rax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], eax
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rsi], xmm0
test edi, edi
jne 0x14004116d
mov dword [rsp + 0x30], r15d
call fcn.140066c50
mov qword [rsp + 0x38], rax
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rsi], xmm0
mov rbx, qword [rsp + 0x68]
mov eax, edi
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x140041190
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
call fcn.140066c50
mov rdi, qword [rsi]
cmp rdi, 0xffffffffffffffff
je 0x140041248
xor ecx, ecx
mov qword [rsp + 0x48], r14
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
mov ebx, eax
call fcn.140066c50
mov r14, rax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebp, eax
test ebx, ebx
je 0x14004123e
call fcn.140066c50
cmp r14, rax
jne 0x1400411ef
cmp ebp, 0x2733
je 0x140041201
call fcn.140066c50
cmp r14, rax
jne 0x140041243
cmp ebp, 0x4d5
jne 0x140041243
lea r8, [rsp + 0x40]
mov dword [rsp + 0x40], 0
mov edx, 0x8004667e
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_ioctlsocket]
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
mov ebx, eax
call fcn.140066c50
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
test ebx, ebx
jne 0x140041243
call fcn.140066c50
mov r14, qword [rsp + 0x48]
mov rdi, qword [rsi + 8]
cmp rdi, 0xffffffffffffffff
je 0x1400412e3
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
mov ebx, eax
call fcn.140066c50
mov rbp, rax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
test ebx, ebx
je 0x1400412de
call fcn.140066c50
cmp rbp, rax
jne 0x14004128f
cmp esi, 0x2733
je 0x1400412a1
call fcn.140066c50
cmp rbp, rax
jne 0x1400412e3
cmp esi, 0x4d5
jne 0x1400412e3
lea r8, [rsp + 0x40]
mov dword [rsp + 0x40], 0
mov edx, 0x8004667e
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_ioctlsocket]
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
mov ebx, eax
call fcn.140066c50
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
test ebx, ebx
jne 0x1400412e3
call fcn.140066c50
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
Function at 0x140041900
Capabilities:
Connect socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rdi, r9
mov rsi, r8
mov rbp, rdx
mov rbx, rcx
cmp rcx, 0xffffffffffffffff
jne 0x140041944
mov dword [rsp + 0x20], 0x2719
call fcn.140066c50
mov qword [rsp + 0x28], rax
mov eax, ebx
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rdi], xmm0
jmp 0x140041998
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov r8d, esi
mov rdx, rbp
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_connect]
mov esi, eax
call fcn.140066c50
mov rbx, rax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], eax
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rdi], xmm0
test esi, esi
jne 0x140041996
mov dword [rsp + 0x20], esi
call fcn.140066c50
mov qword [rsp + 0x28], rax
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rdi], xmm0
mov eax, esi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x140043f50
Capabilities:
Send data
Send data on socket

Disassembly:
push rbx
sub rsp, 0x50
lea rax, [rsp + 0x60]
mov byte [rsp + 0x60], 0
mov qword [rsp + 0x48], rax
mov rbx, rcx
mov dword [rsp + 0x40], 1
call fcn.140066c50
mov rbx, qword [rbx + 8]
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_WSASetLastError]
xor eax, eax
lea r9, [rsp + 0x68]
mov qword [rsp + 0x30], rax
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov rcx, rbx
mov dword [rsp + 0x68], eax
lea r8d, [rax + 1]
mov dword [rsp + 0x20], eax
call qword [sym.imp.WS2_32.dll_WSASend]
mov ebx, eax
call fcn.140066c50
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x40
je 0x140043fc5
cmp eax, 0x4d2
jne 0x140043fca
call fcn.140066c50
test ebx, ebx
jne 0x140043fd3
call fcn.140066c50
add rsp, 0x50
pop rbx
ret

Function at 0x140044000
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
cmp qword [rcx + 0x78], 0
je 0x140044079
mov rcx, qword [rcx + 0x58]
mov rcx, qword [rcx + 0x10]
test edx, edx
jne 0x140044042
call fcn.1400052b0
mov rcx, qword [rdi + 0x78]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp fcn.140004a40
xor esi, esi
mov eax, esi
xchg dword [rcx + 0x34], eax
lea ecx, [rsi + 0x18]
call fcn.140066e10
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14004406d
xor r8d, r8d
mov rdx, qword [rdi + 0x58]
mov rcx, rax
call fcn.14003a2f0
mov rsi, rax
mov rdx, rsi
lea rcx, [rdi + 0x78]
call fcn.140012670
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140044090
Capabilities:
Act as tcp client
Connect tcp socket
Get local ipv4 addresses
Get socket information
Set socket configuration
Start tcp server

Disassembly:
sub rsp, 0x28
cmp edx, 2
jne 0x1400440cf
mov qword [rsp + 0x20], rbx
lea rbx, [rcx + 0x58]
mov rcx, rbx
call fcn.140041190
mov rcx, rbx
mov qword [rbx + 8], 0xffffffffffffffff
mov qword [rbx], 0xffffffffffffffff
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
jmp fcn.1400447e0
add rsp, 0x28
ret
Function at 0x140049180
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rbx, qword [rcx + 0x10]
mov rdi, rcx
test rbx, rbx
je 0x1400491dd
mov rbx, qword [rbx + 0x58]
test rbx, rbx
je 0x1400491d5
mov qword [rsp + 0x30], rsi
mov esi, 0xffffffff
mov eax, esi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x1400491d0
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], esi
cmp esi, 1
jne 0x1400491d0
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rsi, qword [rsp + 0x30]
mov qword [rdi + 0x10], 0
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x140049235
mov ecx, dword [0x14009eca4]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140049225
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x140049225
cmp qword [rcx], 0
jne 0x140049225
movzx eax, byte [rbx + 0x80]
mov byte [rbx], al
mov qword [rcx], rbx
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rcx, rbx
call fcn.140067248
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400499e0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
mov rbx, rcx
xor edi, edi
mov dword [rsp + 0x20], edi
call fcn.140066c50
mov qword [rsp + 0x28], rax
mov rbx, qword [rbx + 0x10]
mov eax, edi
lock xadd dword [rbx + 0x30], eax
test eax, eax
jne 0x140005ba0
mov ecx, 1
mov eax, ecx
xchg dword [rbx + 0x34], eax
test eax, eax
jne 0x140005b75
xchg dword [rbx + 0x38], ecx
test ecx, ecx
jne 0x140005b75
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
test eax, eax
jne 0x140005b75
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [rsp + 0x40], eax
call fcn.140066c50
mov qword [rsp + 0x48], rax
test ebx, ebx
jne 0x140005c79
mov dword [rsp + 0x40], edi
call fcn.140066c50
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x20], xmm0
jmp 0x140005c56
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
lea rax, [rbx + 0x28]
test rbx, rbx
cmove rax, rdi
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x58], rax
mov ecx, dword [0x14009eca4]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x60], rax
lea rdx, [rsp + 0x50]
mov ecx, dword [0x14009eca4]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
lea r8, [rsp + 0x20]
mov edx, 0xffffffff
mov rcx, rbx
call fcn.1400053b0
test rax, rax
je 0x140005c26
nop dword [rax]
lea rax, [rdi + 1]
cmp rdi, 0xffffffffffffffff
cmove rax, rdi
mov rdi, rax
lea r8, [rsp + 0x20]
mov edx, 0xffffffff
mov rcx, rbx
call fcn.1400053b0
test rax, rax
jne 0x140005c00
mov rdx, qword [rsp + 0x60]
mov ecx, dword [0x14009eca4]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140005c47
call fcn.140067248
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140005c56
call fcn.140067248
cmp dword [rsp + 0x20], 0
jne 0x140005c6e
mov rax, rdi
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
lea rcx, [rsp + 0x20]
call fcn.140004400
int3
lea rdx, str.pqcs
lea rcx, [rsp + 0x40]
call fcn.140004440
int3
mov rcx, qword [rcx + 0x18]
jmp 0x140005b00
Function at 0x140067bbc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140067c06
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140067c06
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140067c06
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140067c06
cmp dword [rcx + 0x84], 0xe
jbe 0x140067c06
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140067c08
xor al, al
add rsp, 0x28
ret
Function at 0x14006a200
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rdi
push r14
push r15
sub rsp, 0x100
mov rax, qword [0x14009a2c0]
xor rax, rsp
mov qword [rsp + 0xf0], rax
mov rbx, qword [rsp + 0x150]
mov r14, r9
mov rdi, r8
mov rbp, rdx
mov r15, rcx
test rcx, rcx
je 0x14006a43a
test r8, r8
jne 0x14006a24c
test r9, r9
jne 0x14006a43a
cmp rbx, 0xc8
jae 0x14006a43a
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, VarDecRound
call sub.VCRUNTIME140.dll_memset
cmp r14, rbx
jb 0x14006a3c6
mov qword [rsp + 0x138], rsi
lea rsi, [rsp + 0x20]
sub rsi, rdi
xor eax, eax
test rbx, rbx
je 0x14006a3a2
cmp rbx, 8
jb 0x14006a380
lea rcx, [rbx - 1]
add rcx, rdi
lea r8, [rsp + 0x20]
lea rdx, [rsp + rbx + 0x1f]
cmp r8, rcx
ja 0x14006a2b8
cmp rdx, rdi
jae 0x14006a380
cmp rbx, 0x40
jb 0x14006a343
mov rdx, rbx
mov r8, rbx
and edx, 0x3f
sub r8, rdx
lea rcx, [rdi + 0x20]
nop dword [rax]
nop word [rax + rax]
movdqu xmm0, xmmword [rsi + rcx - 0x20]
add rax, 0x40
movdqu xmm1, xmmword [rcx - 0x20]
lea rcx, [rcx + 0x40]
xorps xmm1, xmm0
movdqu xmmword [rsi + rcx - 0x60], xmm1
movdqu xmm0, xmmword [rsi + rcx - 0x50]
movdqu xmm1, xmmword [rcx - 0x50]
xorps xmm1, xmm0
movdqu xmmword [rsi + rcx - 0x50], xmm1
movdqu xmm0, xmmword [rsi + rcx - 0x40]
movdqu xmm1, xmmword [rcx - 0x40]
xorps xmm1, xmm0
movdqu xmmword [rsi + rcx - 0x40], xmm1
movdqu xmm0, xmmword [rsi + rcx - 0x30]
movdqu xmm1, xmmword [rcx - 0x30]
xorps xmm1, xmm0
movdqu xmmword [rsi + rcx - 0x30], xmm1
cmp rax, r8
jb 0x14006a2e0
cmp rdx, 8
jb 0x14006a36d
mov rcx, rbx
and rcx, 0xfffffffffffffff8
nop word [rax + rax]
movq xmm0, qword [rsp + rax + 0x20]
movq xmm1, qword [rax + rdi]
xorps xmm1, xmm0
movq qword [rsp + rax + 0x20], xmm1
add rax, 8
cmp rax, rcx
jb 0x14006a350
cmp rax, rbx
jae 0x14006a3a2
nop dword [rax]
nop word [rax + rax]
lea rdx, [rsp + 0x20]
add rdx, rax
lea r8, [rsp + 0x40]
mov rcx, rdx
inc rax
sub rcx, r8
movzx ecx, byte [rcx + rdi + 0x20]
xor byte [rdx], cl
cmp rax, rbx
jb 0x14006a380
lea rcx, [rsp + 0x20]
call fcn.14006a460
add rdi, rbx
sub rsi, rbx
sub r14, rbx
cmp r14, rbx
jae 0x14006a284
mov rsi, qword [rsp + 0x138]
movzx eax, byte [rsp + 0x158]
lea rcx, [rsp + 0x20]
xor byte [rsp + r14 + 0x20], al
mov r8, r14
xor byte [rsp + rbx + 0x1f], 0x80
mov rdx, rdi
call fcn.14006aa50
lea rcx, [rsp + 0x20]
call fcn.14006a460
cmp rbp, rbx
jb 0x14006a421
test rbx, rbx
je 0x14006a40c
mov r8, rbx
lea rdx, [rsp + 0x20]
mov rcx, r15
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rsp + 0x20]
call fcn.14006a460
add r15, rbx
sub rbp, rbx
cmp rbp, rbx
jae 0x14006a3f7
test rbp, rbp
je 0x14006a436
mov r8, rbp
lea rdx, [rsp + 0x20]
mov rcx, r15
call sub.VCRUNTIME140.dll_memcpy
xor eax, eax
jmp 0x14006a43f
mov eax, 0xffffffff
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.140066cd0
add rsp, 0x100
pop r15
pop r14
pop rdi
pop rbp
pop rbx
ret