joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140106870
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov r8, qword [rdx + rax*8]
xor qword [rcx + rax*8], r8
inc rax
cmp rax, 8
jne 0x140106792
ret
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
mov ebp, 1
mov qword [rsp + 0x20], rcx
mov rdi, rdx
mov rdx, rcx
mov rcx, r8
mov rbx, r8
call 0x140106790
mov rcx, rbx
cmp rbp, rdi
jae 0x140106a4e
call fcn.140106cf0
mov rcx, rbx
call fcn.140106c10
mov r10, qword [rbx]
mov r14, qword [rbx + 8]
mov r9, qword [rbx + 0x10]
mov r8, qword [rbx + 0x18]
mov rcx, r10
mov r13, qword [rbx + 0x20]
mov r12, qword [rbx + 0x28]
call fcn.140106bb0
mov rcx, r14
mov r11, qword [rbx + 0x30]
mov rsi, qword [rbx + 0x38]
xor r10, rax
mov r15, rax
mov qword [rsp + 0x28], r10
call fcn.140106bb0
mov rcx, r9
xor r14, rax
mov r10, rax
mov qword [rsp + 0x30], r14
call fcn.140106bb0
mov rcx, r8
xor r9, rax
mov r14, rax
mov qword [rsp + 0x38], r9
call fcn.140106bb0
mov rcx, r13
xor r8, rax
mov r9, rax
mov qword [rsp + 0x40], r8
call fcn.140106bb0
mov rcx, r12
xor r13, rax
mov r8, rax
mov qword [rsp + 0x48], r13
call fcn.140106bb0
mov rcx, r11
xor r12, rax
mov r13, rax
mov qword [rsp + 0x50], r12
call fcn.140106bb0
mov rcx, rsi
xor r11, rax
mov r12, rax
mov qword [rsp + 0x58], r11
call fcn.140106bb0
mov rcx, qword [rsp + 0x28]
xor rsi, rax
mov r11, rax
call fcn.140106be0
mov rcx, qword [rsp + 0x30]
xor r15, rax
xor r15, rsi
mov qword [rbx], r15
call fcn.140106be0
mov rcx, qword [rsp + 0x38]
xor r10, rax
mov rax, qword [rsp + 0x28]
xor r10, rax
xor r10, rsi
mov qword [rbx + 8], r10
call fcn.140106be0
mov rcx, qword [rsp + 0x40]
xor r14, rax
mov rax, qword [rsp + 0x30]
xor r14, rax
mov qword [rbx + 0x10], r14
call fcn.140106be0
mov rcx, qword [rsp + 0x48]
xor r9, rax
mov rax, qword [rsp + 0x38]
xor r9, rax
xor r9, rsi
mov qword [rbx + 0x18], r9
call fcn.140106be0
mov rcx, qword [rsp + 0x50]
xor r8, rax
mov rax, qword [rsp + 0x40]
xor r8, rax
xor r8, rsi
mov qword [rbx + 0x20], r8
call fcn.140106be0
mov rcx, qword [rsp + 0x58]
xor r13, rax
mov rax, qword [rsp + 0x48]
xor r13, rax
mov qword [rbx + 0x28], r13
call fcn.140106be0
mov rcx, rsi
xor r12, rax
mov rax, qword [rsp + 0x50]
xor r12, rax
mov qword [rbx + 0x30], r12
call fcn.140106be0
mov rdx, rbp
mov rcx, rbx
inc rbp
xor r11, rax
mov rax, qword [rsp + 0x58]
shl rdx, 6
xor r11, rax
mov rax, qword [rsp + 0x20]
mov qword [rbx + 0x38], r11
add rdx, rax
call 0x140106790
jmp 0x14010689b
call fcn.140106cf0
mov rcx, rbx
shl rdi, 6
call fcn.140106c10
mov rdx, qword [rsp + 0x20]
mov rcx, rbx
add rdx, rdi
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp 0x140106790
Function at 0x140107530
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
movzx r8d, r8b
mov r11, rcx
mov rbx, rdx
mov qword [rsp + 0x28], r8
call 0x140107530
mov r8, qword [rsp + 0x28]
lea rdx, [rdx + 0x28]
lea rcx, [rcx + 0x28]
call 0x140107530
mov r8, qword [rsp + 0x28]
lea rdx, [rbx + 0x50]
lea rcx, [r11 + 0x50]
add rsp, 0x30
pop rbx
jmp 0x140107530
xor eax, eax
neg r8
mov r10, qword [rcx + rax]
mov r9, qword [rdx + rax]
xor r9, r10
and r9, r8
xor r9, r10
mov qword [rcx + rax], r9
add rax, 8
cmp rax, 0x28
jne 0x140107535
ret

Function at 0x140107560
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
neg r8
mov r10, qword [rcx + rax]
mov r9, qword [rdx + rax]
xor r9, r10
and r9, r8
xor r10, r9
mov qword [rcx + rax], r10
xor qword [rdx + rax], r9
add rax, 8
cmp rax, 0x28
jne 0x140107565
ret
Function at 0x14000178f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov eax, ecx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov byte [rbp + 0x10], al
mov byte [rbp - 1], 0
jmp 0x140001828
mov byte [rbp - 2], 0
jmp 0x14000181e
movzx eax, byte [rbp - 1]
movzx edx, byte [rbp - 2]
mov rcx, qword [rbp + 0x18]
movsxd rdx, edx
cdqe
shl rax, 2
add rax, rcx
add rax, rdx
movzx r8d, byte [rax]
movzx eax, byte [rbp + 0x10]
lea edx, [rax*4]
movzx eax, byte [rbp - 1]
add eax, edx
lea edx, [rax*4]
movzx eax, byte [rbp - 2]
add eax, edx
movsxd rdx, eax
mov rax, qword [rbp + 0x20]
add rax, rdx
movzx edx, byte [rax]
movzx eax, byte [rbp - 1]
movzx ecx, byte [rbp - 2]
xor edx, r8d
mov r8, qword [rbp + 0x18]
movsxd rcx, ecx
cdqe
shl rax, 2
add rax, r8
add rax, rcx
mov byte [rax], dl
add byte [rbp - 2], 1
cmp byte [rbp - 2], 3
jbe 0x1400017b0
add byte [rbp - 1], 1
cmp byte [rbp - 1], 3
jbe 0x1400017aa
nop
nop
add rsp, 0x10
pop rbp
ret

Function at 0x14000183a
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rbp + 0x10], rcx
mov byte [rbp - 1], 0
jmp 0x1400018ad
mov byte [rbp - 2], 0
jmp 0x1400018a3
movzx eax, byte [rbp - 2]
movzx edx, byte [rbp - 1]
mov rcx, qword [rbp + 0x10]
movsxd rdx, edx
cdqe
shl rax, 2
add rax, rcx
add rax, rdx
movzx eax, byte [rax]
movzx eax, al
movzx r9d, byte [rbp - 2]
movzx ecx, byte [rbp - 1]
cdqe
lea rdx, str.cw
movzx edx, byte [rax + rdx]
mov r8, qword [rbp + 0x10]
movsxd rcx, ecx
movsxd rax, r9d
shl rax, 2
add rax, r8
add rax, rcx
mov byte [rax], dl
add byte [rbp - 2], 1
cmp byte [rbp - 2], 3
jbe 0x140001852
add byte [rbp - 1], 1
cmp byte [rbp - 1], 3
jbe 0x14000184c
nop
nop
add rsp, 0x10
pop rbp
ret

Function at 0x140002366
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rbp + 0x10], rcx
mov byte [rbp - 1], 0
jmp 0x1400023d9
mov byte [rbp - 2], 0
jmp 0x1400023cf
movzx eax, byte [rbp - 2]
movzx edx, byte [rbp - 1]
mov rcx, qword [rbp + 0x10]
movsxd rdx, edx
cdqe
shl rax, 2
add rax, rcx
add rax, rdx
movzx eax, byte [rax]
movzx eax, al
movzx r9d, byte [rbp - 2]
movzx ecx, byte [rbp - 1]
cdqe
lea rdx, [0x14003c100]
movzx edx, byte [rax + rdx]
mov r8, qword [rbp + 0x10]
movsxd rcx, ecx
movsxd rax, r9d
shl rax, 2
add rax, r8
add rax, rcx
mov byte [rax], dl
add byte [rbp - 2], 1
cmp byte [rbp - 2], 3
jbe 0x14000237e
add byte [rbp - 1], 1
cmp byte [rbp - 1], 3
jbe 0x140002378
nop
nop
add rsp, 0x10
pop rbp
ret

Function at 0x14000262c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov byte [rbp - 1], 0
jmp 0x140002675
movzx edx, byte [rbp - 1]
mov rax, qword [rbp + 0x10]
add rax, rdx
movzx r8d, byte [rax]
movzx edx, byte [rbp - 1]
mov rax, qword [rbp + 0x18]
add rax, rdx
movzx ecx, byte [rax]
movzx edx, byte [rbp - 1]
mov rax, qword [rbp + 0x10]
add rax, rdx
mov edx, r8d
xor edx, ecx
mov byte [rax], dl
add byte [rbp - 1], 1
cmp byte [rbp - 1], 0xf
jbe 0x140002642
nop
nop
add rsp, 0x10
pop rbp
ret
Function at 0x140002d50
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.140003b70
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.140003b70
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop dword [rax]

Function at 0x140002dc0
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x14003f0a4]
mov rbx, rcx
test esi, esi
jle 0x140002ef0
mov rax, qword [0x14003f0a8]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x140002e0b
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x140002e95
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x140002df0
mov rcx, rbx
call fcn.140003810
mov rdi, rax
test rax, rax
je 0x140002f12
mov rax, qword [0x14003f0a8]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call fcn.140003950
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x14003f0a8]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140002ef7
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x140002e8e
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x140002ea0
add dword [0x14003f0a4], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x14003f0a8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140002e8e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.140002d50
nop dword [rax]
xor esi, esi
jmp 0x140002e18
mov rax, qword [0x14003f0a8]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.140002d50
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call fcn.140002d50
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x140003480
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x14003f100]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x14003f0e0]
test rbx, rbx
je 0x1400034dc
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x1400034d3
test rsi, rsi
je 0x1400034d3
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x1400034b8
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x140003810
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x14003c5b0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140003830
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140003838
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140003830
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x14000388d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x140003884
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x140003830
add rax, 0x28
cmp rax, r9
jne 0x140003870
xor eax, eax
ret

Function at 0x140003890
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14003c5b0]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x1400038af
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400038b8
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x1400038af
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x140003950
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14003c5b0]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x14000396f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x140003978
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret
Function at 0x40a870
Capabilities:
Get socket status

Disassembly:
sub rsp, 0x258
xor r9d, r9d
xor r8d, r8d
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x48], rcx
mov dword [rsp + 0x38], edx
inc ecx
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x3c], 0
call qword [sym.imp.WS2_32.dll_select]
test eax, eax
setg al
add rsp, 0x258
ret
mov rax, qword [rcx + 0x128]
cmp byte [rax], 0
je 0x40dc28
mov eax, 1
ret
mov rcx, qword [rcx + 0x118]
jmp 0x40a870

Function at 0x40a8c0
Capabilities:
Get socket status

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x258
mov r12, rcx
mov rcx, r8
mov rdi, r8
mov rbp, rdx
call sub.msvcrt.dll_strlen
lea ebx, [rax + 1]
cdqe
mov byte [rdi + rax], 0xa
test ebx, ebx
jle 0x40a961
xor esi, esi
lea r14, [rsp + 0x40]
lea r13, [rsp + 0x38]
lea r15, [rsp + 0x34]
nop word [rax + rax]
mov rcx, qword [rbp]
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x20], r13
mov qword [rsp + 0x48], rcx
xor r9d, r9d
inc ecx
xor edx, edx
mov r8, r14
mov dword [rsp + 0x40], 1
call qword [sym.imp.WS2_32.dll_select]
test eax, eax
jle 0x40a975
mov rcx, qword [r12]
lea rdx, [rdi + rsi]
mov r9, r15
movsxd r8, ebx
call qword [sym.imp.libcurl_4.dll_curl_easy_send]
test eax, eax
jne 0x40a970
movsxd rdx, dword [rsp + 0x34]
sub ebx, edx
add rsi, rdx
test ebx, ebx
jg 0x40a908
mov eax, 1
jmp 0x40a977
cmp eax, 0x51
je 0x40a908
xor eax, eax
add rsp, 0x258
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x40c180
Capabilities:
Query environment variable

Disassembly:
push r13
push r12
push rsi
push rbx
sub rsp, 0x148
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 0
mov qword [rsp + 0x80], 0
mov qword [rsp + 0x88], 0
mov qword [rsp + 0x90], 0
mov qword [rsp + 0x98], 0
mov qword [rsp + 0xa0], 0
mov qword [rsp + 0xa8], 0
mov qword [rsp + 0xb0], 0
mov qword [rsp + 0xb8], 0
mov qword [rsp + 0xc0], 0
mov qword [rsp + 0xc8], 0
mov qword [rsp + 0xd0], 0
mov qword [rsp + 0xd8], 0
mov qword [rsp + 0xe0], 0
mov qword [rsp + 0xe8], 0
mov qword [rsp + 0xf0], 0
mov qword [rsp + 0xf8], 0
mov qword [rsp + 0x100], 0
mov qword [rsp + 0x108], 0
mov qword [rsp + 0x110], 0
mov qword [rsp + 0x118], 0
mov qword [rsp + 0x120], 0
mov qword [rsp + 0x128], 0
mov qword [rsp + 0x130], 0
mov qword [rsp + 0x138], 0
mov rbx, rcx
mov qword [rsp + 0x20], 0
mov r13, rdx
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
call qword [sym.imp.libcurl_4.dll_curl_easy_init]
mov r12, rax
test rax, rax
je 0x40c4c0
mov r8, rbx
mov rbx, qword [sym.imp.libcurl_4.dll_curl_easy_setopt]
mov edx, 0x2712
mov rcx, rax
call rbx
mov r8d, 1
mov edx, 0x4a
mov rcx, r12
call rbx
lea rsi, [rsp + 0x40]
mov r8d, 0xf
mov edx, 0x4e
mov rcx, r12
call rbx
mov r8, rsi
mov edx, 0x271a
mov rcx, r12
call rbx
mov r8d, 1
mov edx, 0x63
mov rcx, r12
call rbx
mov r8d, 1
mov edx, 0x79
mov rcx, r12
call rbx
lea r8, [0x0040a7a0]
mov edx, 0x4e2b
mov rcx, r12
call rbx
lea r8, [rsp + 0x20]
mov edx, 0x2711
mov rcx, r12
call rbx
mov rax, qword [0x007611d0]
mov r8, qword [rax]
test r8, r8
je 0x40c450
mov edx, 0x2714
mov rcx, r12
call rbx
mov rax, qword [0x007611e0]
mov edx, 0x65
mov r8d, dword [rax]
mov rcx, r12
call rbx
mov rcx, r12
call qword [sym.imp.libcurl_4.dll_curl_easy_perform]
test eax, eax
jne 0x40c4a0
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x40c40b
cmp qword [rsp + 0x28], 0
jne 0x40c440
lea rdx, str.Empty_data_received_for_config
mov ecx, 1
call fcn.0040a990
xor r13d, r13d
mov rcx, r12
call qword [sym.imp.libcurl_4.dll_curl_easy_cleanup]
mov rax, r13
add rsp, 0x148
pop rbx
pop rsi
pop r12
pop r13
ret
mov r8, r13
xor edx, edx
call fcn.006bfa60
mov r13, rax
jmp 0x40c41f
lea rcx, str.http_proxy
call sub.msvcrt.dll_getenv
test rax, rax
je 0x40c3e8
lea rcx, str.all_proxy
call sub.msvcrt.dll_getenv
lea rcx, str.all_proxy
test rax, rax
je 0x40c4e0
call sub.msvcrt.dll_getenv
mov r8, rax
mov rcx, r12
mov edx, 0x2714
call rbx
mov rcx, r12
call qword [sym.imp.libcurl_4.dll_curl_easy_perform]
test eax, eax
je 0x40c3f9
nop dword [rax]
mov r8, rsi
lea rdx, str.Remote_config_read_failed:__s
mov ecx, 1
call fcn.0040a990
xor r13d, r13d
jmp 0x40c41f
lea rdx, str.Remote_config_init_failed_
mov ecx, 1
call fcn.0040a990
xor r13d, r13d
jmp 0x40c428
lea rcx, str.ALL_PROXY
call sub.msvcrt.dll_getenv
test rax, rax
je 0x40c500
lea rcx, str.ALL_PROXY
jmp 0x40c479
lea r8, [0x006febe3]
mov edx, 0x2714
mov rcx, r12
call rbx
jmp 0x40c3e8
Function at 0x40dc10
Capabilities:
Get socket status

Disassembly:
sub rsp, 0x258
xor r9d, r9d
xor r8d, r8d
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x48], rcx
mov dword [rsp + 0x38], edx
inc ecx
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x3c], 0
call qword [sym.imp.WS2_32.dll_select]
test eax, eax
setg al
add rsp, 0x258
ret
mov rax, qword [rcx + 0x128]
cmp byte [rax], 0
je 0x40dc28
mov eax, 1
ret
mov rcx, qword [rcx + 0x118]
jmp 0x40a870
Function at 0x416970
Capabilities:
Hash data using sha512

Disassembly:
sub rsp, 0x68
test rcx, rcx
je 0x416af4
lea rax, [rdx - 1]
cmp rax, 0x3f
ja 0x416ac0
xor eax, eax
mov word [rsp + 0x3e], ax
lea rax, [rcx + 0x48]
and rax, 0xfffffffffffffff8
mov r8d, ecx
mov byte [rsp + 0x20], dl
mov qword [rsp + 0x21], 0x10100
mov qword [rsp + 0x29], 0
mov byte [rsp + 0x31], 0
mov qword [rsp + 0x32], 0
mov dword [rsp + 0x3a], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
sub r8d, eax
mov qword [rcx + 0x40], 0
mov qword [rcx + 0xd0], 0
mov qword [rcx + 0xd8], 0
mov qword [rcx + 0xe0], 0
mov qword [rcx + 0xe8], 0
lea r11d, [r8 + 0xf0]
xor r10d, r10d
and r11d, 0xffffffe0
xor r9d, r9d
mov r8d, r9d
add r9d, 0x20
mov qword [rax + r8], r10
mov qword [rax + r8 + 8], r10
mov qword [rax + r8 + 0x10], r10
mov qword [rax + r8 + 0x18], r10
cmp r9d, r11d
jb 0x416a35
vmovdqu xmm1, xmmword [0x007016b0]
vmovdqu xmm3, xmmword [0x00701680]
vmovdqu xmm4, xmmword [0x00701690]
vmovdqu xmm5, xmmword [0x007016a0]
vmovups xmmword [rcx + 0x30], xmm1
vmovdqu64 ymm1, ymmword [rsp + 0x20]
vmovups xmmword [rcx], xmm3
vmovups xmmword [rcx + 0x10], xmm4
vmovups xmmword [rcx + 0x20], xmm5
vpxor ymm0, ymm1, ymmword [rcx]
vmovdqu64 ymm2, ymmword [rcx + 0x20]
vmovdqu64 ymmword [rcx], ymm0
vpxor ymm0, ymm2, ymmword [rsp + 0x40]
xor eax, eax
mov dword [rcx + 0xe4], edx
vmovdqu64 ymmword [rcx + 0x20], ymm0
vzeroupper
add rsp, 0x68
ret
mov edx, 0xf0
mov qword [rsp + 0x70], rcx
call fcn.00419110
mov rcx, qword [rsp + 0x70]
cmp byte [rcx + 0xe8], 0
je 0x416ae5
mov qword [rcx + 0x58], 0xffffffffffffffff
mov qword [rcx + 0x50], 0xffffffffffffffff
mov eax, 0xffffffff
jmp 0x416ab8
mov eax, 0xffffffff
jmp 0x416ab8
Function at 0x416b00
Capabilities:
Hash data using sha512

Disassembly:
push r13
push r12
sub rsp, 0xe8
mov r11, r8
mov r12, rcx
mov r8, r9
test rcx, rcx
je 0x416d11
lea rax, [rdx - 1]
cmp rax, 0x3f
ja 0x416ce0
lea rax, [r9 - 1]
cmp rax, 0x3f
ja 0x416ce0
test r11, r11
je 0x416ce0
xor eax, eax
mov word [rsp + 0x3e], ax
lea rax, [rcx + 0x48]
and rax, 0xfffffffffffffff8
mov byte [rsp + 0x21], r9b
mov byte [rsp + 0x20], dl
mov qword [rsp + 0x22], 0x101
mov qword [rsp + 0x2a], 0
mov qword [rsp + 0x32], 0
mov dword [rsp + 0x3a], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
mov qword [rcx + 0x40], 0
mov qword [rcx + 0xd0], 0
mov qword [rcx + 0xd8], 0
mov qword [rcx + 0xe0], 0
mov qword [rcx + 0xe8], 0
sub ecx, eax
lea r13d, [rcx + 0xf0]
xor r10d, r10d
and r13d, 0xffffffe0
xor r9d, r9d
mov ecx, r9d
add r9d, 0x20
mov qword [rax + rcx], r10
mov qword [rax + rcx + 8], r10
mov qword [rax + rcx + 0x10], r10
mov qword [rax + rcx + 0x18], r10
cmp r9d, r13d
jb 0x416be8
vmovdqu xmm1, xmmword [0x007016b0]
vmovdqu xmm3, xmmword [0x00701680]
vmovdqu xmm4, xmmword [0x00701690]
vmovdqu xmm5, xmmword [0x007016a0]
vmovups xmmword [r12 + 0x30], xmm1
vmovdqu64 ymm1, ymmword [rsp + 0x20]
vmovups xmmword [r12], xmm3
vmovups xmmword [r12 + 0x10], xmm4
vmovups xmmword [r12 + 0x20], xmm5
vpxor ymm0, ymm1, ymmword [r12]
vmovdqu64 ymm2, ymmword [r12 + 0x20]
vmovdqu64 ymmword [r12], ymm0
mov dword [r12 + 0xe4], edx
vpxor ymm0, ymm2, ymmword [rsp + 0x40]
lea r13, [rsp + 0x60]
vmovdqu64 ymmword [r12 + 0x20], ymm0
xor r9d, r9d
xor ecx, ecx
mov eax, ecx
add ecx, 0x20
mov qword [r13 + rax], r9
mov qword [r13 + rax + 8], r9
mov qword [r13 + rax + 0x10], r9
mov qword [r13 + rax + 0x18], r9
cmp ecx, 0x80
jb 0x416c7f
mov rdx, r11
mov rcx, r13
vzeroupper
call sub.msvcrt.dll_memcpy
mov r8d, pe_nt_image_headers64
mov rdx, r13
mov rcx, r12
call fcn.004165f0
mov edx, pe_nt_image_headers64
mov rcx, r13
call fcn.00419110
xor eax, eax
add rsp, 0xe8
pop r12
pop r13
ret
mov edx, 0xf0
mov rcx, r12
call fcn.00419110
cmp byte [r12 + 0xe8], 0
je 0x416d01
mov qword [r12 + 0x58], 0xffffffffffffffff
mov qword [r12 + 0x50], 0xffffffffffffffff
mov eax, 0xffffffff
jmp 0x416cce
mov eax, 0xffffffff
jmp 0x416cce

Function at 0x41b3a0
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
mov r9, r8
test rcx, rcx
je 0x41b3f0
test rdx, rdx
je 0x41b3f0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r8, rdx
xor ecx, ecx
xor edx, edx
call qword [sym.imp.msvcrt.dll__beginthreadex]
test rax, rax
mov qword [rbx], rax
sete al
movzx eax, al
neg eax
add rsp, 0x30
pop rbx
ret
mov eax, 0xffffffff
jmp 0x41b3e1
Function at 0x44abe0
Capabilities:
Hash data using sha512

Disassembly:
push r13
push r12
sub rsp, 0x28
vmovdqu xmm0, xmmword [0x007026c0]
vmovdqu xmm1, xmmword [0x007026d0]
vmovdqu xmm2, xmmword [0x007026e0]
vmovdqu xmm3, xmmword [0x007026f0]
mov qword [rcx + 0xc8], 0
mov qword [rcx + 0xc0], 0
mov qword [rcx + 0xd0], 0
mov r12, rcx
mov r13, rdx
vmovups xmmword [rcx + 0x80], xmm0
mov rdx, r8
vmovups xmmword [rcx + 0x90], xmm1
vmovups xmmword [rcx + 0xa0], xmm2
vmovups xmmword [rcx + 0xb0], xmm3
mov r8, r9
call fcn.0044a840
mov rdx, r13
mov rcx, r12
add rsp, 0x28
pop r12
pop r13
jmp fcn.0044a950
Function at 0x455d00
Capabilities:
Hash data using sha512

Disassembly:
movabs rax, 0x6a09e667f3bcc908
vpbroadcastq zmm0, rax
movabs rax, 0xbb67ae8584caa73b
vmovdqu64 zmmword [rcx + 0x400], zmm0
vpbroadcastq zmm0, rax
movabs rax, 0x3c6ef372fe94f82b
vmovdqu64 zmmword [rcx + 0x440], zmm0
vpbroadcastq zmm0, rax
movabs rax, 0xa54ff53a5f1d36f1
vmovdqu64 zmmword [rcx + 0x480], zmm0
vpbroadcastq zmm0, rax
movabs rax, 0x510e527fade682d1
vmovdqu64 zmmword [rcx + 0x4c0], zmm0
vpbroadcastq zmm0, rax
movabs rax, 0x9b05688c2b3e6c1f
vmovdqu64 zmmword [rcx + 0x500], zmm0
vpbroadcastq zmm0, rax
movabs rax, 0x1f83d9abfb41bd6b
vmovdqu64 zmmword [rcx + 0x540], zmm0
vpbroadcastq zmm0, rax
movabs rax, 0x5be0cd19137e2179
vmovdqu64 zmmword [rcx + 0x580], zmm0
vpbroadcastq zmm0, rax
mov qword [rcx + 0x710], 0
mov qword [rcx + 0x708], 0
mov qword [rcx + 0x700], 0
vmovdqu64 zmmword [rcx + 0x5c0], zmm0
vzeroupper
ret