joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5484e0
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x38
xor r9d, r9d
cmp r8d, 0x3b9aca00
je 0x548545
mov r9d, 0x3e8
mov rax, rdx
mul r9
mov r9d, 0xffffffff
jo 0x548545
mov edx, r8d
imul rdx, rdx, 0x431bde83
shr rdx, 0x32
add rax, rdx
jb 0x548545
imul edx, r8d, 0x68c26139
ror edx, 6
xor r8d, r8d
cmp edx, 0x10c7
setae r8b
add rax, r8
jb 0x548545
mov r9d, 0xffffffff
cmp rax, r9
cmovb r9, rax
test r9, r9
je 0x548582
mov dword [rsp + 0x34], r9d
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x34]
mov edx, 0xffff
mov r8d, 0x1006
call sub.ws2_32.dll_setsockopt
cmp eax, 0xffffffff
je 0x548570
xor eax, eax
jmp 0x54857d
call fcn.005abbd4
shl rax, 0x20
or rax, 2
add rsp, 0x38
ret
lea rax, str.cannot_set_a_0_duration_timeout
jmp 0x54857d

Function at 0x548590
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x38
xor r9d, r9d
cmp r8d, 0x3b9aca00
je 0x5485f5
mov r9d, 0x3e8
mov rax, rdx
mul r9
mov r9d, 0xffffffff
jo 0x5485f5
mov edx, r8d
imul rdx, rdx, 0x431bde83
shr rdx, 0x32
add rax, rdx
jb 0x5485f5
imul edx, r8d, 0x68c26139
ror edx, 6
xor r8d, r8d
cmp edx, 0x10c7
setae r8b
add rax, r8
jb 0x5485f5
mov r9d, 0xffffffff
cmp rax, r9
cmovb r9, rax
test r9, r9
je 0x548632
mov dword [rsp + 0x34], r9d
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x34]
mov edx, 0xffff
mov r8d, 0x1005
call sub.ws2_32.dll_setsockopt
cmp eax, 0xffffffff
je 0x548620
xor eax, eax
jmp 0x54862d
call fcn.005abbd4
shl rax, 0x20
or rax, 2
add rsp, 0x38
ret
lea rax, str.cannot_set_a_0_duration_timeout
jmp 0x54862d

Function at 0x548640
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rsi
sub rsp, 0x20
mov rax, r8
mov rsi, rcx
mov rcx, qword [rdx]
cmp r9, 0x7fffffff
mov r8d, 0x7fffffff
cmovb r8, r9
mov rdx, rax
xor r9d, r9d
call sub.ws2_32.dll_recv
cmp eax, 0xffffffff
je 0x548673
cdqe
jmp 0x548681
call fcn.005abbd4
cmp eax, 0x274a
jne 0x548689
xor eax, eax
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x54869a
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
mov rax, rsi
add rsp, 0x20
pop rsi
ret

Function at 0x5486b0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdx, qword [r8 + 8]
mov rsi, qword [r8 + 0x10]
mov rax, rdx
sub rax, rsi
jb 0x54872a
mov rdi, r8
mov rcx, qword [rcx]
cmp rax, 0x7fffffff
mov r8d, 0x7fffffff
cmovb r8, rax
mov rdx, qword [rdi]
add rdx, rsi
xor r9d, r9d
call sub.ws2_32.dll_recv
cmp eax, 0xffffffff
je 0x54870b
cdqe
add rsi, rax
mov qword [rdi + 0x10], rsi
mov rax, qword [rdi + 0x18]
cmp rax, rsi
cmova rsi, rax
mov qword [rdi + 0x18], rsi
xor eax, eax
jmp 0x548723
call fcn.005abbd4
cmp eax, 0x274a
jne 0x54871b
xor eax, eax
jmp 0x548723
shl rax, 0x20
or rax, 2
add rsp, 0x28
pop rdi
pop rsi
ret
lea r8, str.library_std_src_io_readbuf.rslibrary_std_src_sync_once.rs
mov rcx, rsi
call fcn.00429500
ud2
Function at 0x5487d0
Capabilities:
Send data
Send data on socket

Disassembly:
push rsi
sub rsp, 0x20
mov rax, r8
mov rsi, rcx
cmp r9, 0x7fffffff
mov r8d, 0x7fffffff
cmovb r8, r9
mov rcx, qword [rdx]
mov rdx, rax
xor r9d, r9d
call sub.ws2_32.dll_send
cmp eax, 0xffffffff
je 0x548809
cdqe
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x54881f
call fcn.005abbd4
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
mov rax, rsi
add rsp, 0x20
pop rsi
ret

Function at 0x548830
Capabilities:
Send data
Send data on socket

Disassembly:
push rsi
sub rsp, 0x40
mov rax, r8
mov rsi, rcx
mov r8d, 0xffffffff
cmp r9, r8
cmovb r8, r9
mov dword [rsp + 0x3c], 0
mov rcx, qword [rdx]
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x3c]
mov rdx, rax
call sub.ws2_32.dll_WSASend
cmp eax, 0xffffffff
je 0x548881
mov eax, dword [rsp + 0x3c]
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x548897
call fcn.005abbd4
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
mov rax, rsi
add rsp, 0x40
pop rsi
ret

Function at 0x548d40
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x28
movzx eax, dl
mov dword [rsp + 0x24], eax
lea r8, [rsp + 0x24]
mov edx, 0x8004667e
call sub.ws2_32.dll_ioctlsocket
cmp eax, 0xffffffff
je 0x548d63
xor eax, eax
jmp 0x548d70
call fcn.005abbd4
shl rax, 0x20
or rax, 2
add rsp, 0x28
ret
Function at 0x54ce80
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rsi, rcx
lea rcx, [rsp + 0x20]
call fcn.00544d70
mov rdi, qword [rsp + 0x28]
test rdi, rdi
je 0x54cec4
mov rbx, qword [rsp + 0x20]
mov r14, qword [rsp + 0x30]
mov rcx, rdi
call sub.KERNEL32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x54cf2b
mov qword [rsi], rbx
mov qword [rsi + 8], rdi
mov qword [rsi + 0x10], r14
jmp 0x54cf21
mov rbx, qword [rsp + 0x20]
mov eax, ebx
and eax, 3
cmp eax, 1
jne 0x54cf19
lea rdi, [rbx - 1]
mov rcx, qword [rbx - 1]
mov rax, qword [rbx + 7]
call qword [rax]
mov rax, qword [rbx + 7]
cmp qword [rax + 8], 0
je 0x54cf08
mov r8, qword [rdi]
cmp qword [rax + 0x10], 0x11
jb 0x54cefa
mov r8, qword [r8 - 8]
mov rcx, qword [0x00677420]
xor edx, edx
call fcn.005ab9d4
mov rcx, qword [0x00677420]
xor edx, edx
mov r8, rdi
call fcn.005ab9d4
mov qword [rsi + 8], 0
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
mov qword [rsi + 8], 0
test rbx, rbx
je 0x54cf21
mov rcx, qword [0x00677420]
xor edx, edx
mov r8, rdi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.005ab9d4
Function at 0x54e420
Capabilities:
Resolve dns

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x1e8
mov rsi, rcx
mov r14, qword [rdx]
mov rbx, qword [rdx + 8]
movzx edi, word [rdx + 0x10]
mov rax, qword [0x00677468]
cmp rax, 3
jne 0x528c07
cmp rbx, 0x17f
ja 0x528c19
lea rcx, [rsp + 0x68]
mov rdx, r14
mov r8, rbx
call sub.msvcrt.dll_memcpy
mov byte [rsp + rbx + 0x68], 0
lea r8, [rbx + 1]
cmp rbx, 0xe
ja 0x528b59
lea rcx, [rbx + 1]
xor eax, eax
xor edx, edx
nop
cmp byte [rsp + rdx + 0x68], 0
je 0x528b6c
inc rdx
cmp rcx, rdx
jne 0x528b40
mov rdx, r8
test rax, rax
jne 0x528b76
jmp 0x528bd0
lea rdx, [rsp + 0x68]
xor ecx, ecx
call fcn.00428e20
test rax, rax
jne 0x528b76
jmp 0x528bd0
mov eax, 1
test rax, rax
je 0x528bd0
cmp rdx, rbx
jne 0x528bd0
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x28], 0
lea rcx, [rsp + 0x68]
lea r8, [rsp + 0x30]
lea r9, [rsp + 0x28]
xor edx, edx
call sub.ws2_32.dll_getaddrinfo
test eax, eax
je 0x528be4
call fcn.005abbd4
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
jmp 0x528bf7
lea rax, str.file_name_contained_an_unexpected_NUL_byte
mov qword [rsi + 8], rax
mov qword [rsi], 1
jmp 0x528bfa
mov rax, qword [rsp + 0x28]
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], di
xor eax, eax
mov qword [rsi], rax
add rsp, 0x1e8
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.005518b0
cmp rbx, 0x17f
jbe 0x528b18
mov rcx, rsi
mov rdx, r14
mov r8, rbx
mov r9d, edi
add rsp, 0x1e8
pop rbx
pop rdi
pop rsi
pop r14
jmp 0x54e420
push r14
push rsi
push rdi
push rbx
sub rsp, 0x88
mov ebx, r9d
mov rsi, rcx
lea rcx, [rsp + 0x30]
call fcn.00417660
mov r8, qword [rsp + 0x40]
test r8, r8
je 0x54e47e
lea rax, str.file_name_contained_an_unexpected_NUL_byte
mov qword [rsi + 8], rax
mov qword [rsi], 1
cmp qword [rsp + 0x38], 0
je 0x54e50a
mov rcx, qword [0x00677420]
xor edx, edx
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.005ab9d4
mov rdi, qword [rsp + 0x30]
mov r14, qword [rsp + 0x38]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
mov dword [rsp + 0x58], 1
mov qword [rsp + 0x28], 0
lea r8, [rsp + 0x50]
lea r9, [rsp + 0x28]
mov rcx, rdi
xor edx, edx
call sub.ws2_32.dll_getaddrinfo
test eax, eax
je 0x54e4db
call fcn.005abbd4
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
jmp 0x54e4ee
mov rax, qword [rsp + 0x28]
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], bx
xor eax, eax
mov qword [rsi], rax
mov byte [rdi], 0
test r14, r14
je 0x54e50a
mov rcx, qword [0x00677420]
xor edx, edx
mov r8, rdi
call fcn.005ab9d4
nop
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x54f730
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rdi, rdx
cmp qword [rdx], 0
jne 0x54f833
mov rsi, rcx
mov rbx, qword [rdi + 0x28]
mov rax, qword [rbx]
test rax, rax
jne 0x54f767
mov rdx, qword [rbx + 0x10]
lea rax, [rdx + 0xf]
cmp rax, 0xf
jbe 0x54f81d
xor eax, eax
mov rdx, qword [rbx + 0x10]
cmp rax, rdx
je 0x54f800
sub rax, rdx
add rdx, qword [rbx + 8]
mov r8, qword [rdi + 0x20]
mov ecx, 0xffffffff
cmp rax, rcx
cmovae rax, rcx
mov dword [rsp + 0x30], 0
mov rcx, qword [rdi + 0x10]
mov qword [rsp + 0x20], r8
lea r9, [rsp + 0x30]
mov r8d, eax
call sub.KERNEL32.dll_ReadFile
test eax, eax
je 0x54f7bd
mov eax, dword [rsp + 0x30]
mov ecx, 2
test rax, rax
jne 0x54f7d9
jmp 0x54f7ce
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x3e5
je 0x54f7d4
cmp eax, 0x6d
jne 0x54f7f0
mov byte [rsi + 1], 0
jmp 0x54f7e4
mov ecx, 1
mov qword [rdi], rcx
mov qword [rdi + 8], rax
mov byte [rsi + 1], 1
xor eax, eax
mov byte [rsi], al
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov al, 1
jmp 0x54f7e6
mov r8d, 1
mov rcx, rbx
mov rdx, rax
call fcn.00519a60
mov rax, qword [rbx]
mov rdx, qword [rbx + 0x10]
jmp 0x54f774
mov r8d, 0x10
mov rcx, rbx
call fcn.00519a60
mov rax, qword [rbx]
jmp 0x54f767
mov qword [rsp + 0x40], 0
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.0053de90
ud2

Function at 0x54f850
Capabilities:
Create thread

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rbx, r8
mov r14, rdx
mov rdi, rcx
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x40], r8
mov ecx, 0x10
mov edx, 8
call fcn.00414fe0
test rax, rax
je 0x54f91f
mov rsi, rax
mov qword [rax], r14
mov qword [rax + 8], rbx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10000
lea r8, [0x0054f970]
xor ebx, ebx
xor ecx, ecx
mov rdx, rdi
mov r9, rax
call sub.KERNEL32.dll_CreateThread
mov rdx, rax
test rax, rax
jne 0x54f912
mov rcx, qword [rsi]
mov rax, qword [rsi + 8]
call qword [rax]
mov rax, qword [rsi + 8]
cmp qword [rax + 8], 0
je 0x54f8ed
mov r8, qword [rsi]
cmp qword [rax + 0x10], 0x11
jb 0x54f8df
mov r8, qword [r8 - 8]
mov rcx, qword [0x00677420]
xor edx, edx
call fcn.005ab9d4
mov rcx, qword [0x00677420]
xor edx, edx
mov r8, rsi
call fcn.005ab9d4
call sub.KERNEL32.dll_GetLastError
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov ebx, 1
mov rax, rbx
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret
mov ecx, 0x10
mov edx, 8
call fcn.00417bf0
ud2
Function at 0x5511b0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rsi, rcx
mov ecx, dword [0x005b7228]
test ecx, ecx
je 0x5512c8
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jbe 0x5511e7
mov rbx, rax
cmp qword [rax], 0
je 0x5511e7
add rbx, 8
jmp 0x5512bd
mov ecx, dword [0x005b7228]
test ecx, ecx
je 0x5512db
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x551288
mov rdi, rax
test rax, rax
jne 0x551267
mov qword [rsp + 0x20], 0
lea rax, [0x005b7210]
mov qword [rsp + 0x38], rax
mov ecx, 0x20
mov edx, 8
call fcn.00414fe0
test rax, rax
je 0x551301
mov rdi, rax
movups xmm0, xmmword [rsp + 0x20]
movups xmm1, xmmword [rsp + 0x30]
movups xmmword [rax + 0x10], xmm1
movups xmmword [rax], xmm0
mov ecx, dword [0x005b7228]
test ecx, ecx
je 0x5512ee
dec ecx
mov rdx, rdi
call sub.KERNEL32.dll_TlsSetValue
test rsi, rsi
je 0x55128c
mov rax, qword [rsi]
mov qword [rsi], 0
mov rdx, rax
test rax, rax
je 0x551290
mov rax, qword [rsi + 8]
mov rdx, qword [rsi + 0x10]
jmp 0x551290
xor ebx, ebx
jmp 0x5512bd
xor eax, eax
xor edx, edx
lea rbx, [rdi + 8]
cmp qword [rdi], 0
mov rcx, qword [rdi + 0x10]
mov qword [rdi], 1
mov qword [rdi + 8], rax
mov qword [rdi + 0x10], rdx
je 0x5512bd
test rcx, rcx
je 0x5512bd
lock dec qword [rcx]
jne 0x5512bd
call fcn.00545b40
mov rax, rbx
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x005b7210]
call fcn.0053fad0
mov ecx, eax
jmp 0x5511ca
lea rcx, [0x005b7210]
call fcn.0053fad0
mov ecx, eax
jmp 0x5511f7
lea rcx, [0x005b7210]
call fcn.0053fad0
mov ecx, eax
jmp 0x55125f
mov ecx, 0x20
mov edx, 8
call fcn.00417bf0
ud2

Function at 0x551980
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
mov ecx, dword [rcx + 0x18]
test ecx, ecx
je 0x551a2d
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jbe 0x5519b1
cmp byte [rax + 8], 0
je 0x5519b1
add rax, 9
jmp 0x551a25
mov ecx, dword [rdi + 0x18]
test ecx, ecx
je 0x551a3c
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x551a23
mov rbx, rax
test rax, rax
jne 0x551a00
mov ecx, 0x10
mov edx, 8
call fcn.00414fe0
test rax, rax
je 0x551a57
mov rbx, rax
mov qword [rax], rdi
mov byte [rax + 8], 0
mov ecx, dword [rdi + 0x18]
test ecx, ecx
je 0x551a4b
dec ecx
mov rdx, rbx
call sub.KERNEL32.dll_TlsSetValue
xor ecx, ecx
test rsi, rsi
je 0x551a16
cmp byte [rsi], 0
mov byte [rsi], 0
movzx eax, byte [rsi + 1]
cmove eax, ecx
mov ecx, eax
lea rax, [rbx + 9]
mov byte [rbx + 8], 1
mov byte [rbx + 9], cl
jmp 0x551a25
xor eax, eax
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
mov rcx, rdi
call fcn.0053fad0
mov ecx, eax
jmp 0x55199a
mov rcx, rdi
call fcn.0053fad0
mov ecx, eax
jmp 0x5519be
mov rcx, rdi
call fcn.0053fad0
mov ecx, eax
jmp 0x5519f8
mov ecx, 0x10
mov edx, 8
call fcn.00417bf0
ud2
Function at 0x551a70
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov ecx, dword [0x005b7128]
test ecx, ecx
je 0x551b5a
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jbe 0x551aa3
mov rdi, rax
cmp qword [rax], 0
je 0x551aa3
add rdi, 8
jmp 0x551b50
mov ecx, dword [0x005b7128]
test ecx, ecx
je 0x551b6d
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x551b4e
mov rsi, rax
test rax, rax
jne 0x551b1f
mov qword [rsp + 0x20], 0
lea rax, [0x005b7110]
mov qword [rsp + 0x30], rax
mov ecx, 0x18
mov edx, 8
call fcn.00414fe0
test rax, rax
je 0x551b90
mov rsi, rax
mov rax, qword [rsp + 0x30]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rsi], xmm0
mov ecx, dword [0x005b7128]
test ecx, ecx
je 0x551b80
dec ecx
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
lea rdi, [rsi + 8]
mov rcx, qword [rsi + 8]
cmp qword [rsi], 0
mov qword [rsi], 1
mov qword [rsi + 8], 0
je 0x551b50
test rcx, rcx
je 0x551b50
lock dec qword [rcx]
jne 0x551b50
call fcn.00545a80
jmp 0x551b50
xor edi, edi
mov rax, rdi
add rsp, 0x38
pop rdi
pop rsi
ret
lea rcx, [0x005b7110]
call fcn.0053fad0
mov ecx, eax
jmp 0x551a86
lea rcx, [0x005b7110]
call fcn.0053fad0
mov ecx, eax
jmp 0x551ab3
lea rcx, [0x005b7110]
call fcn.0053fad0
mov ecx, eax
jmp 0x551b17
mov ecx, 0x18
mov edx, 8
call fcn.00417bf0
ud2

Function at 0x551bc0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov ecx, dword [0x005b7190]
test ecx, ecx
je 0x551c69
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jbe 0x551bec
cmp qword [rax], 0
je 0x551bec
add rax, 8
jmp 0x551c63
mov ecx, dword [0x005b7190]
test ecx, ecx
je 0x551c7c
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x551c61
mov rsi, rax
test rax, rax
jne 0x551c4c
mov ecx, 0x18
mov edx, 8
call fcn.00414fe0
test rax, rax
je 0x551c9f
mov rsi, rax
mov qword [rax], 0
lea rax, [0x005b7178]
mov qword [rsi + 0x10], rax
mov ecx, dword [0x005b7190]
test ecx, ecx
je 0x551c8f
dec ecx
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
lea rax, [rsi + 8]
mov qword [rsi], 1
mov qword [rsi + 8], 0
jmp 0x551c63
xor eax, eax
add rsp, 0x20
pop rsi
ret
lea rcx, [0x005b7178]
call fcn.0053fad0
mov ecx, eax
jmp 0x551bd5
lea rcx, [0x005b7178]
call fcn.0053fad0
mov ecx, eax
jmp 0x551bfc
lea rcx, [0x005b7178]
call fcn.0053fad0
mov ecx, eax
jmp 0x551c44
mov ecx, 0x18
mov edx, 8
call fcn.00417bf0
ud2
Function at 0x552110
Capabilities:
Create udp socket

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov edi, r8d
mov rsi, rcx
test dx, dx
mov eax, 2
mov ebx, 0x17
cmove ebx, eax
mov dword [rsp + 0x28], 0x81
mov dword [rsp + 0x20], 0
mov ecx, ebx
mov edx, r8d
xor r8d, r8d
xor r9d, r9d
call sub.ws2_32.dll_WSASocketW
cmp rax, 0xffffffffffffffff
je 0x552160
mov qword [rsi + 8], rax
mov qword [rsi], 0
jmp 0x5521cd
call fcn.005abbd4
cmp eax, 0x2726
je 0x552173
cmp eax, 0x2739
jne 0x5521ba
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0
mov ecx, ebx
mov edx, edi
xor r8d, r8d
xor r9d, r9d
call sub.ws2_32.dll_WSASocketW
cmp rax, 0xffffffffffffffff
je 0x5521b5
mov rdi, rax
mov rcx, rax
mov edx, 1
xor r8d, r8d
call sub.KERNEL32.dll_SetHandleInformation
test eax, eax
je 0x5521d5
mov qword [rsi + 8], rdi
jmp 0x552157
call fcn.005abbd4
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov qword [rsi], 1
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov qword [rsi], 1
mov rcx, rdi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
jmp sub.ws2_32.dll_closesocket

Function at 0x5528ae
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
test rdx, rdx
je 0x5528e3
mov rsi, rdx
mov rdi, rcx
xor ebx, ebx
imul rcx, rbx, 0x150
add rcx, rdi
mov eax, ebx
and eax, 1
xor rbx, 1
lea rbx, [rbx + rax*2]
call fcn.0055292a
cmp rbx, rsi
jne 0x5528c2
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret

Function at 0x5556c7
Capabilities:
Accept command line arguments

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov rax, rdx
mov rsi, rcx
lea rdx, [rsp + 0x24]
mov rcx, rax
call sub.shell32.dll_CommandLineToArgvW
test rax, rax
je 0x5557e0
mov rdi, rax
mov qword [rsp + 0x40], rsi
movsxd rbp, dword [rsp + 0x24]
xor eax, eax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 8
mov qword [rsp + 0x38], rax
test rbp, rbp
je 0x5557b6
shl rbp, 3
mov r15d, 8
xor esi, esi
lea rbx, [rsp + 0x60]
lea r14, [rsp + 0x48]
xor r12d, r12d
mov r13, qword [rdi + rsi]
mov rcx, r13
call sub.msvcrt.dll_wcslen
lea rax, [rax*2]
add rax, r13
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], r13
mov word [rsp + 0x58], 0
mov rcx, rbx
mov rdx, r14
call fcn.0058c8c5
cmp r12, qword [rsp + 0x28]
jne 0x555788
lea rcx, [rsp + 0x28]
mov rdx, r12
call fcn.005559f8
mov r15, qword [rsp + 0x30]
mov r12, qword [rsp + 0x38]
lea rax, [r12 + r12*2]
mov rcx, qword [rsp + 0x70]
mov qword [r15 + rax*8 + 0x10], rcx
movups xmm0, xmmword [rsp + 0x60]
movups xmmword [r15 + rax*8], xmm0
mov r12, qword [rsp + 0x38]
inc r12
mov qword [rsp + 0x38], r12
add rsi, 8
cmp rbp, rsi
jne 0x555737
mov rcx, rdi
call sub.KERNEL32.dll_LocalFree
test rax, rax
jne 0x5557c8
call sub.KERNEL32.dll_GetLastError
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
mov qword [rcx + 0x10], rax
movups xmm0, xmmword [rsp + 0x28]
movups xmmword [rcx], xmm0
jmp 0x5557f1
xor eax, eax
mov qword [rsi], rax
mov qword [rsi + 8], 8
mov qword [rsi + 0x10], rax
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x5560e0
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r10, qword [rcx + 0x40]
test r10, r10
je 0x556118
mov r9d, 8
sub r9, r10
cmp r8, r9
mov rsi, r9
cmovb rsi, r8
cmp rsi, 3
jbe 0x556120
mov r11d, dword [rdx]
mov edi, 4
jmp 0x556125
xor r9d, r9d
jmp 0x55620e
xor edi, edi
xor r11d, r11d
mov rcx, rdi
or rcx, 1
cmp rcx, rsi
jae 0x556146
movzx ebx, word [rdx + rdi]
lea ecx, [rdi*8]
shl rbx, cl
or r11, rbx
or rdi, 2
cmp rdi, rsi
jae 0x55616e
lea ecx, [rdi*8]
movzx esi, byte [rdx + rdi]
shl rsi, cl
mov rcx, rsi
not rcx
and rcx, r11
xor rsi, r11
add rsi, r11
sub rsi, rcx
mov r11, rsi
mov ecx, r10d
and ecx, 8
mov esi, r10d
or esi, 8
imul esi, ecx
xor ecx, 8
mov edi, r10d
and edi, 0xfffffff7
imul edi, ecx
add esi, edi
mov ecx, esi
not ecx
or ecx, 0x3f
add ecx, esi
inc cl
shl r11, cl
or r11, qword [rax + 0x38]
mov qword [rax + 0x38], r11
cmp r9, r8
jbe 0x5561ae
add r10, r8
jmp 0x556305
mov rsi, qword [rax + 0x18]
mov r10, qword [rax + 0x10]
mov rcx, qword [rax]
add rcx, r10
rol r10, 0xd
xor rsi, r11
xor r10, rcx
rol rcx, 0x20
mov rdi, qword [rax + 8]
add rdi, rsi
rol rsi, 0x10
xor rsi, rdi
add rcx, rsi
rol rsi, 0x15
mov rbx, rcx
and rbx, rsi
add rsi, rcx
add rbx, rbx
sub rsi, rbx
add rdi, r10
rol r10, 0x11
mov qword [rax + 0x18], rsi
xor r10, rdi
rol rdi, 0x20
mov qword [rax + 0x10], r10
mov qword [rax + 8], rdi
xor rcx, r11
mov qword [rax], rcx
sub r8, r9
mov rcx, r8
not rcx
or rcx, 7
lea r10, [r8 + rcx]
inc r10
sub r8, r10
cmp r9, r8
jae 0x556297
mov rcx, qword [rax]
mov r11, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
mov rbx, qword [rdx + r9]
xor rdi, rbx
add rcx, rsi
rol rsi, 0xd
xor rsi, rcx
rol rcx, 0x20
add r11, rdi
rol rdi, 0x10
xor rdi, r11
add rcx, rdi
rol rdi, 0x15
mov r14, rcx
and r14, rdi
add rdi, rcx
add r11, rsi
rol rsi, 0x11
add r14, r14
xor rsi, r11
rol r11, 0x20
sub rdi, r14
xor rcx, rbx
add r9, 8
cmp r9, r8
jb 0x556239
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r11
mov qword [rax], rcx
cmp r10, 3
jbe 0x5562a9
mov r11d, dword [rdx + r9]
mov r8d, 4
jmp 0x5562af
xor r8d, r8d
xor r11d, r11d
mov rcx, r8
or rcx, 1
cmp rcx, r10
jae 0x5562d5
lea rcx, [r8 + r9]
movzx esi, word [rdx + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r11, rsi
or r8, 2
cmp r8, r10
jae 0x556301
add r9, r8
shl r8d, 3
movzx edx, byte [rdx + r9]
mov ecx, r8d
shl rdx, cl
mov rcx, rdx
not rcx
and rcx, r11
xor rdx, r11
add rdx, r11
sub rdx, rcx
mov r11, rdx
mov qword [rax + 0x38], r11
mov qword [rax + 0x40], r10
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x55a48a
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x40
mov r15, r9
mov rdi, rdx
mov rsi, rcx
movzx r14d, word [rcx + 0x322]
lea rbx, [r14 + 1]
add rcx, 0x218
mov rax, qword [r8 + 0x10]
lea r9, [rsp + 0x20]
mov qword [r9 + 0x10], rax
movups xmm0, xmmword [r8]
movaps xmmword [r9], xmm0
mov rdx, rbx
mov r8, rdi
call fcn.0055a5f1
lea r12, [rdi + 1]
cmp r12, r14
ja 0x55a527
lea rdx, [rdi + rdi*2]
shl rdx, 4
add rdx, rsi
lea rcx, [r12 + r12*2]
shl rcx, 4
add rcx, rsi
mov r8, r14
sub r8, rdi
mov rax, rdi
sub rax, rbx
mov r9, rax
not r9
and eax, 0x30
and r9, 0xffffffffffffffcf
imul r9, rax
mov eax, r8d
and eax, 0x30
or r8, 0x30
imul r8, rax
add r8, r9
call sub.msvcrt.dll_memmove
mov r13, qword [rsp + 0xa0]
lea rax, [rdi + rdi*2]
shl rax, 4
movups xmm0, xmmword [r15]
movups xmm1, xmmword [r15 + 0x10]
movups xmm2, xmmword [r15 + 0x20]
movups xmmword [rsi + rax + 0x20], xmm2
movups xmmword [rsi + rax + 0x10], xmm1
movups xmmword [rsi + rax], xmm0
lea r15, [r14 + 2]
lea rax, [rdi + 2]
cmp rax, r15
jae 0x55a5a0
lea rcx, [rsi + 0x328]
lea rdx, [rcx + r12*8]
lea rcx, [rcx + rax*8]
sub r14, rdi
mov rax, r14
and rax, 0xfffffffffffffff7
mov r8d, r12d
sub r8d, r15d
and r8d, 8
imul r8, rax
mov eax, r14d
and eax, 8
or r14, 8
imul r14, rax
add r14, r8
mov r8, r14
call sub.msvcrt.dll_memmove
mov qword [rsi + rdi*8 + 0x330], r13
mov word [rsi + 0x322], bx
cmp r12, r15
jae 0x55a5e1
mov eax, r12d
mov rcx, qword [rsi + r12*8 + 0x328]
mov qword [rcx + 0x210], rsi
mov word [rcx + 0x320], r12w
xor r12, 1
and eax, 1
lea rax, [r12 + rax*2]
mov r12, rax
cmp rax, r15
jb 0x55a5b4
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret