joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180109f2c
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.1800e3ba8
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x180109fb6
cmp byte [rbp - 0x21], r15b
je 0x180109fb1
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x180109fec
call fcn.1800fb2b8
test eax, eax
jne 0x180109fd8
cmp byte [rbp - 0x21], r15b
je 0x180109fd0
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x180109fec
cmp byte [rbp - 0x21], r15b
je 0x180109fe9
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.1800eba44
test eax, eax
jne 0x18010a08c
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.1800e3ba8
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x18010a02b
cmp byte [rbp - 0x21], r15b
je 0x18010a060
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x18010a060
call fcn.1800fb2b8
test eax, eax
jne 0x18010a04c
cmp byte [rbp - 0x21], r15b
je 0x18010a045
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x18010a060
cmp byte [rbp - 0x21], r15b
je 0x18010a05d
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.1800eba44
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x18010a08c
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x18010a08f
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x18010a09d
mov rcx, rdi
call fcn.1800f8b04
cmp byte [rbp + 0x3f], r15b
je 0x18010a0ac
mov rcx, qword [rbp + 0x27]
call fcn.1800f8b04
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x18010af14
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.1800fdee0
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.1800fdee0
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x18010b064
cmp rax, 0xffffffffffffffff
je 0x18010b064
xor edi, edi
test rbp, rbp
jle 0x18010b00f
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.1800fd0bc
mov rbx, rax
test rax, rax
jne 0x18010af9c
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x18010b005
mov edx, 0x8000
mov ecx, r14d
call fcn.18010ad9c
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.1800fc7fc
cmp eax, 0xffffffff
je 0x18010afe5
cdqe
sub rbp, rax
test rbp, rbp
jg 0x18010afac
mov edx, r15d
mov ecx, r14d
call fcn.18010ad9c
jmp 0x18010b005
cmp byte [rsi + 0x38], dil
je 0x18010affc
cmp dword [rsi + 0x34], 5
jne 0x18010affc
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], reloc.WS2_32.dll_listen
cmp byte [rsi + 0x30], dil
je 0x18010b005
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.1800f8b04
jmp 0x18010b078
jns 0x18010b078
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.1800fdee0
cmp rax, 0xffffffffffffffff
jne 0x18010b030
cmp byte [rsi + 0x30], dil
je 0x18010b078
mov edi, dword [rsi + 0x2c]
jmp 0x18010b078
mov ecx, r14d
call fcn.180108000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x18010b078
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, reloc.WS2_32.dll_listen
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], reloc.WS2_32.dll_listen
jmp 0x18010b078
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x18010b071
mov eax, dword [rsi + 0x2c]
jmp 0x18010b076
mov eax, socket
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.1800fdee0
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x18010b610
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x18010b638
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x18010b638
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x14000b9fc
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x140016950], eax
call fcn.14000b77c
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_UnhandledExceptionFilter]
cmp dword [0x140016950], 0
jne case.default.0x14000ba52
mov ecx, 1
call fcn.14000b77c
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
int3
cmp byte [rsi + 0x579433b1], ah
mov edx, 0xd2d4f839
cld
cdq
sbb dword [rdi + rbp + 0x67], ebp
wait
xchg edi, eax
sbb byte [rsi - 0x4bf1ac7d], dil
jns 0x1400231fc
movabs al, byte [0x7f76ddc7bf741613]
ret 0xe6f8
push 0xffffffffffffffc4
insd dword [rdi], dx
jmp 0x14002321a
sub edx, edi
int 0xe6
je 0x140023252
out 0x74, al
fsubr qword [rbx - 0x6d2c3212]
stosd dword [rdi], eax
out dx, al
int 0xd3
xchg edx, eax
in eax, 0x3e
imul edx, dword [rsi], 0x9d74057b
xchg esi, esp
je 0x14002328d
invalid
mov edi, edx
jns 0x140023273
cdq
mov bh, 0xe5
lodsb al, byte [rsi]
mov dword [rdi], esi
jp 0x1400232e7
cmp bh, byte [0x1bebd1b35]
nop
pop rbp
xor eax, 0x5bd067ce
or al, 0x8c
fdivp st(2)
mov esi, dword [rbp + riz - 0x76004332]
jle 0x1400232b3
invalid
ficom word [rax + rsi*4]
mov ah, 0xde
sbb eax, 0xc07de4f0
movabs al, byte [0x3fb8bd6dd5f5e91a]
cld
invalid
outsd dx, dword [rsi]
movsb byte [rdi], byte [rsi]
or ch, al
mov ecx, 0xfce4dc9f
mov bl, 0x7e
call qword [rbp - 0x4e]
jle 0x1400232de
push qword [rcx + 0x7f48486c]
mov esp, dword [rax - 0x68d40048]
xor bh, byte [rsi + rbp*8]
out dx, al
mov cl, 0x6c
jg 0x140023270
movabs al, byte [0xeeee3c32972bffb8]
jmp [rbx]
jmp 0x16e32c665
imul edx, dword [rbp + 0x4cf34bed], 0x43b67a9d
outsd dx, dword [rsi]
popfq
jp 0x1400232cf
outsd dx, dword [rsi]
jge 0x140023339
jg 0x140023315
in al, dx
loope 0x140023394
sal byte [0xf09fbf2b], 0xc
movabs r13, 0xf7f43e73be150ec6
mov esi, 0xf7f43e73
xchg edi, eax
std
add byte [rdi - 6], bh
jbe 0x14002332e
hlt
invalid
std
inc byte [rdi]
mov edx, 0x534d146c
jmp 0x140023335
Function at 0x140005078
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
call fcn.14009b000
add rsp, 0x28
jmp 0x140005078
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push r14
sub rsp, 0xb0
and dword [rsp + 0x20], 0
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor edi, edi
xor eax, eax
lock cmpxchg qword [0x14000a5f8], rbx
je 0x1400050c2
cmp rax, rbx
jne 0x1400050d7
mov edi, 1
mov eax, dword [0x14000a600]
cmp eax, 1
jne 0x1400050e4
lea ecx, [rax + 0x1e]
call sub.msvcrt.dll__amsg_exit
jmp 0x140005151
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400050ab
mov eax, dword [0x14000a600]
test eax, eax
jne 0x140005147
mov dword [0x14000a600], 1
lea r14, [0x1400063e0]
lea rbx, [0x1400063c8]
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x24], eax
cmp rbx, r14
jae 0x140005139
test eax, eax
jne 0x14000513d
cmp qword [rbx], 0
je 0x14000512e
mov rax, qword [rbx]
mov rcx, qword [0x1400063a8]
call rcx
mov dword [rsp + 0x24], eax
add rbx, 8
mov qword [rsp + 0x30], rbx
jmp 0x14000510f
test eax, eax
je 0x140005151
mov eax, 0xff
jmp 0x1400052a4
mov dword [0x140009fc4], 1
mov eax, dword [0x14000a600]
cmp eax, 1
jne 0x140005179
lea rdx, [0x1400063c0]
lea rcx, [0x1400063b0]
call sub.msvcrt.dll__initterm
mov dword [0x14000a600], 2
test edi, edi
jne 0x140005186
xor eax, eax
xchg qword [0x14000a5f8], rax
cmp qword [0x14000a608], 0
je 0x1400051ba
lea rcx, [0x14000a608]
call fcn.1400055a0
test eax, eax
je 0x1400051ba
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x14000a608]
mov r9, qword [0x1400063a8]
call r9
mov rax, qword [sym.imp.msvcrt.dll__acmdln]
mov rbx, qword [rax]
mov qword [rsp + 0x28], rbx
mov edi, dword [rsp + 0x20]
movzx ecx, byte [rbx]
cmp cl, 0x20
ja 0x140005246
test cl, cl
je 0x1400051dd
test edi, edi
jne 0x140005246
dec cl
cmp cl, 0x1f
ja 0x1400051f0
inc rbx
mov qword [rsp + 0x28], rbx
mov cl, byte [rbx]
jmp 0x1400051dd
test byte [rsp + 0x7c], 1
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rbx
xor edx, edx
lea rcx, [0x140000000]
call fcn.140004c84
mov dword [0x140009fc0], eax
cmp dword [0x140009fe0], 0
jne 0x14000522f
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x140009fc4], 0
jne 0x140005244
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x140009fc0]
jmp 0x1400052a4
cmp cl, 0x22
jne 0x140005258
xor eax, eax
test edi, edi
sete al
mov edi, eax
mov dword [rsp + 0x20], eax
call qword [sym.imp.msvcrt.dll__ismbblead]
test eax, eax
je 0x14000526a
inc rbx
mov qword [rsp + 0x28], rbx
inc rbx
mov qword [rsp + 0x28], rbx
jmp 0x1400051cd
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop r14
ret
Function at 0x14000549c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1400054e8
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400054e0
cmp dword [rcx + 0x3c], edx
jl 0x1400054e0
cmp dword [rcx + 0x3c], 0x10000000
jae 0x1400054e0
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x1400054e8
mov rax, rdx
add rsp, 0x18
ret
Function at 0x140065980
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
cmp byte [rdx + 0x10], 0
je 0x1400659a3
xor eax, eax
nop dword [rax]
lea ecx, [rax + 0x29]
xor byte [rax + rdx], cl
inc rax
cmp rax, 0xf
jb 0x140065990
mov byte [rdx + 0x10], 0
call fcn.140070ff0
lea rax, [0x140335ee0]
add rsp, 0x28
ret

Function at 0x1400659c0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
cmp byte [rdx + 0x15], 0
je 0x1400659e3
xor eax, eax
nop dword [rax]
lea ecx, [rax + 0x29]
xor byte [rax + rdx], cl
inc rax
cmp rax, 0x14
jb 0x1400659d0
mov byte [rdx + 0x15], 0
call fcn.140070ff0
lea rax, [0x140335ee0]
add rsp, 0x28
ret
Function at 0x140068980
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
cmp byte [rdx + 0x4a], 0
je 0x1400689a3
xor eax, eax
nop dword [rax]
lea ecx, [rax + 0x29]
xor byte [rax + rdx], cl
inc rax
cmp rax, 0x49
jb 0x140068990
mov byte [rdx + 0x4a], 0
call fcn.140070ff0
lea rax, [0x140335ee0]
add rsp, 0x28
ret
Function at 0x14006bb40
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x14032d5c0]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, rdx
mov rdi, rcx
mov qword [rbp - 0x38], rcx
mov qword [rbp - 0x38], rdx
xor r14d, r14d
call fcn.14009b9f0
mov rsi, rax
xorps xmm0, xmm0
test rax, rax
jne 0x14006bc1a
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], r14
mov qword [rdi + 0x18], r14
lea r8d, [r14 + 4]
lea rdx, str.null
mov rcx, rdi
call fcn.140072200
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x14006bbe4
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x14006bbdf
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14006bd47
mov rcx, r8
call fcn.140216d60
mov rax, rdi
mov byte [rbx], 0
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov qword [rbx + 0x10], r14
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140216c70
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
movups xmmword [rbp - 0x30], xmm0
movdqa xmm1, xmmword [0x140303ae0]
movdqu xmmword [rbp - 0x20], xmm1
mov byte [rbp - 0x30], 0
movdqa xmm0, xmmword [str.A_]
movdqu xmmword [rbp - 0x60], xmm0
mov dword [rbp - 0x50], 0x5d14514c
mov dword [rbp - 0x4c], 0x7110574d
mov dword [rbp - 0x48], 0x6c726f
mov byte [rbp - 0x44], 1
mov rcx, r14
nop dword [rax + rax]
lea eax, [rcx + 0x29]
xor byte [rbp + rcx - 0x60], al
inc rcx
cmp rcx, 0x1b
jb 0x14006bc60
mov byte [rbp - 0x44], 0
lea r8, [rbp - 0x60]
mov edx, 0x2712
mov rcx, rsi
call fcn.14009fa80
xor r8d, r8d
lea edx, [r8 + 0x40]
mov rcx, rsi
call fcn.14009fa80
xor r8d, r8d
lea edx, [r8 + 0x51]
mov rcx, rsi
call fcn.14009fa80
mov r8, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x14006bcb0
mov r8, qword [rbx]
mov edx, 0x271f
mov rcx, rsi
call fcn.14009fa80
lea r8, [0x14006bb10]
mov edx, 0x4e2b
mov rcx, rsi
call fcn.14009fa80
lea r8, [rbp - 0x30]
mov edx, 0x2711
mov rcx, rsi
call fcn.14009fa80
mov edx, 0x34
lea r8d, [rdx - 0x33]
mov rcx, rsi
call fcn.14009fa80
mov rcx, rsi
call fcn.14009bac0
test eax, eax
je 0x14006bd1a
mov ecx, eax
call fcn.14009cb20
mov rdx, rax
mov r9d, reloc.WS2_32.dll_recv
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rcx, rsi
call fcn.14009b9d0
movups xmm0, xmmword [rbp - 0x30]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rbp - 0x20]
movups xmmword [rdi + 0x10], xmm1
movdqa xmm0, xmmword [0x140303ae0]
movdqu xmmword [rbp - 0x20], xmm0
mov byte [rbp - 0x30], 0
jmp 0x14006bbaa
call fcn.14023861c
int3
Function at 0x1400a5960
Capabilities:
Convert ip address from string

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x88
mov rax, qword [0x14032d5c0]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov r13, qword [rcx]
mov ebp, r8d
mov rsi, rcx
lea r8, [rsp + 0x20]
mov ebx, 2
xor r14d, r14d
mov ecx, ebx
mov r15, r9
mov r12, qword [r13 + 0x11b0]
mov rdi, rdx
mov dword [r9], r14d
call qword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
jle 0x1400a59cc
mov r9d, ebp
lea rdx, [rsp + 0x20]
mov r8, rdi
mov ecx, ebx
call fcn.1400c45e0
jmp 0x1400a5aaa
mov ebx, reloc.WS2_32.dll_socket
lea r8, [rsp + 0x58]
mov ecx, ebx
mov rdx, rdi
call qword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
jle 0x1400a59fc
mov r9d, ebp
lea rdx, [rsp + 0x58]
mov r8, rdi
mov ecx, ebx
call fcn.1400c45e0
jmp 0x1400a5aaa
mov ecx, dword [rsi + 0x440]
sub ecx, 1
je 0x1400a5a20
cmp ecx, 1
je 0x1400a5a0f
mov ebx, r14d
call fcn.1400a6490
test al, al
mov eax, 2
cmove ebx, eax
jmp 0x1400a5a25
mov ebx, 2
cmp dword [rsi + 0xbc], 3
lea r8, [0x1402fcad4]
xorps xmm0, xmm0
lea rcx, [rsp + 0x68]
movups xmmword [rsp + 0x28], xmm0
setne r14b
mov dword [rsp + 0x2c], ebx
inc r14d
mov r9d, ebp
mov edx, ntohs
mov dword [rsp + 0x30], r14d
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
call fcn.1400b5950
lea rcx, [rsp + 0x58]
call fcn.1400a57f0
lea r9, [rsp + 0x28]
mov r8d, ebp
mov rdx, rdi
mov rcx, rsi
movups xmm0, xmmword [rax]
movups xmmword [r12], xmm0
call fcn.1400a60f0
test al, al
je 0x1400a5a99
mov dword [r15], 1
jmp 0x1400a5aa8
lea rdx, str.getaddrinfo___thread_failed_to_start_n
mov rcx, r13
call fcn.1400b1a10
xor eax, eax
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140216c70
add rsp, 0x88
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
jmp 0x1400a5960
Function at 0x1400b5220
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp byte [0x140332100], 0
mov esi, r8d
mov rdi, qword [rsp + 0x68]
je 0x1400b52cf
test rdi, rdi
je 0x1400b52cf
mov eax, dword [0x140332104]
test eax, eax
jne 0x1400b52c7
mov r8d, dword [rsp + 0x60]
lea rsi, str.recv
mov r9, rsi
lea rcx, str.LIMIT__s:_d__s_reached_memlimit_n
mov rdx, rdi
call fcn.1400b4f70
mov ecx, 2
call fcn.140229a74
mov r9d, dword [rsp + 0x60]
lea rdx, str.LIMIT__s:_d__s_reached_memlimit_n
mov rcx, rax
mov qword [rsp + 0x20], rsi
mov r8, rdi
call fcn.1400b5920
mov rcx, qword [0x1403320f8]
call fcn.140229ecc
call fcn.140238910
mov dword [rax], ntohs
mov eax, 0xffffffff
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
dec eax
mov dword [0x140332104], eax
call qword [sym.imp.WS2_32.dll_recv]
mov ebx, eax
test rdi, rdi
je 0x1400b52f7
mov r8d, dword [rsp + 0x60]
lea rcx, str.RECV__s:_d_recv__lu____ld_n
mov r9d, esi
mov dword [rsp + 0x20], eax
mov rdx, rdi
call fcn.1400b4f70
mov rsi, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x1400b5370
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp byte [0x140332100], 0
mov esi, r8d
mov rdi, qword [rsp + 0x68]
je 0x1400b541f
test rdi, rdi
je 0x1400b541f
mov eax, dword [0x140332104]
test eax, eax
jne 0x1400b5417
mov r8d, dword [rsp + 0x60]
lea rsi, str.send
mov r9, rsi
lea rcx, str.LIMIT__s:_d__s_reached_memlimit_n
mov rdx, rdi
call fcn.1400b4f70
mov ecx, 2
call fcn.140229a74
mov r9d, dword [rsp + 0x60]
lea rdx, str.LIMIT__s:_d__s_reached_memlimit_n
mov rcx, rax
mov qword [rsp + 0x20], rsi
mov r8, rdi
call fcn.1400b5920
mov rcx, qword [0x1403320f8]
call fcn.140229ecc
call fcn.140238910
mov dword [rax], ntohs
mov eax, 0xffffffff
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
dec eax
mov dword [0x140332104], eax
call qword [sym.imp.WS2_32.dll_send]
mov ebx, eax
test rdi, rdi
je 0x1400b5447
mov r8d, dword [rsp + 0x60]
lea rcx, str.SEND__s:_d_send__lu____ld_n
mov r9d, esi
mov dword [rsp + 0x20], eax
mov rdx, rdi
call fcn.1400b4f70
mov rsi, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x1400c4960
Capabilities:
Convert ip address from string

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x88
mov rax, qword [0x14032d5c0]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov r13, qword [rcx]
mov ebp, r8d
mov rsi, rcx
lea r8, [rsp + 0x20]
mov ebx, 2
xor r14d, r14d
mov ecx, ebx
mov r15, r9
mov r12, qword [r13 + 0x11b0]
mov rdi, rdx
mov dword [r9], r14d
call qword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
jle 0x1400a59cc
mov r9d, ebp
lea rdx, [rsp + 0x20]
mov r8, rdi
mov ecx, ebx
call fcn.1400c45e0
jmp 0x1400a5aaa
mov ebx, reloc.WS2_32.dll_socket
lea r8, [rsp + 0x58]
mov ecx, ebx
mov rdx, rdi
call qword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
jle 0x1400a59fc
mov r9d, ebp
lea rdx, [rsp + 0x58]
mov r8, rdi
mov ecx, ebx
call fcn.1400c45e0
jmp 0x1400a5aaa
mov ecx, dword [rsi + 0x440]
sub ecx, 1
je 0x1400a5a20
cmp ecx, 1
je 0x1400a5a0f
mov ebx, r14d
call fcn.1400a6490
test al, al
mov eax, 2
cmove ebx, eax
jmp 0x1400a5a25
mov ebx, 2
cmp dword [rsi + 0xbc], 3
lea r8, [0x1402fcad4]
xorps xmm0, xmm0
lea rcx, [rsp + 0x68]
movups xmmword [rsp + 0x28], xmm0
setne r14b
mov dword [rsp + 0x2c], ebx
inc r14d
mov r9d, ebp
mov edx, ntohs
mov dword [rsp + 0x30], r14d
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
call fcn.1400b5950
lea rcx, [rsp + 0x58]
call fcn.1400a57f0
lea r9, [rsp + 0x28]
mov r8d, ebp
mov rdx, rdi
mov rcx, rsi
movups xmm0, xmmword [rax]
movups xmmword [r12], xmm0
call fcn.1400a60f0
test al, al
je 0x1400a5a99
mov dword [r15], 1
jmp 0x1400a5aa8
lea rdx, str.getaddrinfo___thread_failed_to_start_n
mov rcx, r13
call fcn.1400b1a10
xor eax, eax
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140216c70
add rsp, 0x88
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
jmp 0x1400a5960
Function at 0x1400c87a0
Capabilities:
Encode data using xor

Disassembly:
push r14
push r15
sub rsp, 0x1f8
mov rax, qword [0x14032d5c0]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
cmp byte [0x1403323c0], 0
mov r14, rcx
jne 0x1400c87d9
call fcn.1401017c0
test eax, eax
je 0x1400c87f7
mov byte [0x1403323c0], 1
xor eax, eax
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.140216c70
add rsp, 0x1f8
pop r15
pop r14
ret
mov rcx, qword [r14 + 0xcf8]
test rcx, rcx
je 0x1400c8816
mov edx, 0x400
call fcn.140102860
call fcn.1401017c0
test eax, eax
jne 0x1400c87d9
mov qword [rsp + 0x218], rbx
xor r15d, r15d
mov qword [rsp + 0x220], rbp
mov qword [rsp + 0x228], rsi
mov qword [rsp + 0x1f0], rdi
movaps xmmword [rsp + 0x1e0], xmm6
movaps xmmword [rsp + 0x1d0], xmm7
movsd xmm7, qword [0x14026c578]
nop dword [rax]
nop word [rax + rax]
mov rsi, r15
lea rbp, [rsp + 0x80]
nop dword [rax + rax]
lea rcx, [rsp + 0x30]
call fcn.1400a57f0
mov ecx, 1
movups xmm6, xmmword [rax]
movups xmmword [rsp + 0x20], xmm6
call fcn.1400b1900
lea rcx, [rsp + 0x40]
lea rdi, [rsi + 3]
call fcn.1400a57f0
lea rcx, [rsp + 0x50]
movsxd rbx, dword [rax + 8]
call fcn.1400a57f0
mov rdx, rbx
lea rcx, [rdi - 2]
add rdx, qword [rax]
movq rax, xmm6
imul rdx, rdi
imul rcx, rax
shl rdx, 8
xor rdx, rcx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x20], rdx
call fcn.1400a57f0
lea rcx, [rsp + 0x70]
mov rbx, rax
call fcn.1400a57f0
mov ecx, dword [rbx + 8]
lea rbp, [rbp + 0x10]
add ecx, dword [rax]
lea eax, [rsi + 4]
imul ecx, eax
lea eax, [rsi + 2]
imul eax, dword [rsp + 0x28]
inc rsi
shl ecx, 0x10
xor ecx, eax
mov dword [rsp + 0x28], ecx
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rbp - 0x10], xmm0
cmp rsi, 4
jb 0x1400c8870
movaps xmm2, xmm7
lea rcx, [rsp + 0x80]
mov edx, 0x40
call fcn.1401014f0
call fcn.1401017c0
test eax, eax
je 0x1400c8860
mov edx, 0x100
mov byte [rsp + 0xc0], r15b
lea rcx, [rsp + 0xc0]
call fcn.1401025f0
movaps xmm7, xmmword [rsp + 0x1d0]
movaps xmm6, xmmword [rsp + 0x1e0]
mov rdi, qword [rsp + 0x1f0]
mov rsi, qword [rsp + 0x228]
mov rbp, qword [rsp + 0x220]
mov rbx, qword [rsp + 0x218]
cmp byte [rsp + 0xc0], r15b
je 0x1400c89ad
mov edx, 0x400
lea rcx, [rsp + 0xc0]
call fcn.140102860
call fcn.1401017c0
test eax, eax
jne 0x1400c87d9
lea rdx, str.libcurl_is_now_using_a_weak_random_seed__n
mov rcx, r14
call fcn.1400b1b90
call fcn.1401017c0
test eax, eax
mov ecx, reloc.WLDAP32.dll_Ordinal_35
cmovne ecx, r15d
mov eax, ecx
jmp 0x1400c87db