joyce8/EMBER2024-capa huggingface dataset:
Function at 0x57b8e0
Capabilities:
Access peb ldr_data

Disassembly:
lea r12, [rsp - 0x30]
cmp r12, qword [r14 + 0x10]
jbe 0x57bb29
push rbp
mov rbp, rsp
sub rsp, 0xa8
nop word [rax + rax]
test rax, rax
je 0x57bb14
mov qword [rsp + 0xb8], rax
mov rbx, qword [rax + 8]
test rbx, rbx
jne 0x57b922
xor ebx, ebx
xor ecx, ecx
nop
jmp 0x57b93c
mov rdx, qword [rax]
mov rcx, qword [rax + 0x10]
mov rax, rdx
call sym.net.IP.String
mov rcx, rax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x88], rcx
mov qword [rsp + 0x48], rbx
cmp qword [rax + 0x28], 0
je 0x57ba51
mov rcx, qword [rax + 0x18]
mov rax, rcx
nop dword [rax + rax]
call sym.internal_itoa.Itoa
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x58], rbx
mov rcx, qword [rsp + 0xb8]
mov r8, qword [rcx + 0x20]
mov r9, qword [rcx + 0x28]
mov rcx, qword [rsp + 0x48]
lea rdi, [0x00730248]
mov esi, 1
lea rax, [rsp + 0x68]
mov rbx, qword [rsp + 0x88]
call sym.runtime.concatstring3
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
call sym.internal_bytealg.IndexByteString.abi0
xorps xmm15, xmm15
mov r14, qword [0x00927048]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x57ba1b
xor eax, eax
lea rbx, [0x007302f0]
mov ecx, 1
mov rdi, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0x60]
lea r8, [0x006b84ad]
mov r9d, 2
mov r10, qword [rsp + 0x98]
mov r11, qword [rsp + 0x58]
call sym.runtime.concatstring4
jmp 0x57ba48
xor eax, eax
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x60]
lea rdi, [0x00730398]
mov esi, 1
mov r8, qword [rsp + 0x98]
mov r9, qword [rsp + 0x58]
call sym.runtime.concatstring3
add rsp, 0xa8
pop rbp
ret
mov rax, qword [rax + 0x18]
call sym.internal_itoa.Itoa
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x50], rbx
mov rcx, qword [rsp + 0x88]
mov qword [rsp], rcx
mov rdx, qword [rsp + 0x48]
mov qword [rsp + 8], rdx
mov byte [rsp + 0x10], 0x3a
call sym.internal_bytealg.IndexByteString.abi0
xorps xmm15, xmm15
mov r14, qword [0x00927048]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
nop
jl 0x57bade
xor eax, eax
lea rbx, [0x007302f0]
mov ecx, 1
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x48]
lea r8, [0x006b84ad]
mov r9d, 2
mov r10, qword [rsp + 0x90]
mov r11, qword [rsp + 0x50]
call sym.runtime.concatstring4
jmp 0x57bb0b
xor eax, eax
mov rbx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x48]
lea rdi, [0x00730398]
mov esi, 1
mov r8, qword [rsp + 0x90]
mov r9, qword [rsp + 0x50]
call sym.runtime.concatstring3
add rsp, 0xa8
pop rbp
ret
lea rax, [0x006b8895]
mov ebx, 5
add rsp, 0xa8
pop rbp
ret
mov qword [rsp + 8], rax
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
jmp sym.net._UDPAddr_.String
Function at 0x57fe60
Capabilities:
Parse credit card information

Disassembly:
lea ecx, [rax - 0x61]
cmp cl, 0x19
jbe 0x57fe78
lea ecx, [rax - 0x41]
cmp cl, 0x19
jbe 0x57fe78
lea ecx, [rax - 0x30]
cmp cl, 9
ja 0x57fe80
xor eax, eax
ret
cmp rbx, 3
je 0x57fe8c
cmp rbx, 4
jne 0x57feb9
cmp al, 0x2c
ja 0x57fea6
lea ecx, [rax - 0x21]
cmp cl, 1
jbe 0x57feb6
cmp al, 0x24
je 0x57feb6
nop dword [rax]
cmp al, 0x26
jae 0x57feb6
jmp 0x57feb9
lea ecx, [rax - 0x3a]
cmp cl, 4
jbe 0x57feb6
cmp al, 0x5b
je 0x57feb6
cmp al, 0x5d
jne 0x57feb9
xor eax, eax
ret
cmp al, 0x2f
ja 0x57fef2
nop dword [rax]
cmp al, 0x26
ja 0x57fed1
cmp al, 0x24
je 0x57ff11
cmp al, 0x26
je 0x57ff11
jmp 0x57ff8b
lea ecx, [rax - 0x2b]
cmp cl, 1
jbe 0x57ff11
lea ecx, [rax - 0x2d]
nop dword [rax]
cmp cl, 1
jbe 0x57ff88
cmp al, 0x2f
je 0x57ff11
jmp 0x57ff8b
cmp al, 0x3d
ja 0x57ff09
lea ecx, [rax - 0x3a]
cmp cl, 1
jbe 0x57ff11
nop
cmp al, 0x3d
je 0x57ff11
jmp 0x57ff8b
lea ecx, [rax - 0x3f]
cmp cl, 1
ja 0x57ff80
cmp rbx, 2
jg 0x57ff47
cmp rbx, 1
je 0x57ff41
nop dword [rax]
cmp rbx, 2
jne 0x57ff8b
cmp al, 0x2f
je 0x57ff32
cmp al, 0x3b
je 0x57ff32
cmp al, 0x2c
jne 0x57ff39
mov ecx, 1
jmp 0x57ff3e
cmp al, 0x3f
sete cl
mov eax, ecx
ret
cmp al, 0x3f
sete al
ret
cmp rbx, 5
jne 0x57ff6a
cmp al, 0x40
je 0x57ff59
cmp al, 0x2f
je 0x57ff59
cmp al, 0x3f
jne 0x57ff62
mov ecx, 1
nop
jmp 0x57ff67
cmp al, 0x3a
sete cl
mov eax, ecx
ret
cmp rbx, 6
je 0x57ff79
cmp rbx, 7
jne 0x57ff8b
xor eax, eax
ret
mov eax, 1
ret
cmp al, 0x5f
je 0x57ff88
cmp al, 0x7e
jne 0x57ff8b
xor eax, eax
ret
cmp rbx, 7
jne 0x57ffa1
cmp al, 0x21
je 0x57ff9d
lea ecx, [rax - 0x28]
cmp cl, 2
ja 0x57ffa1
xor eax, eax
nop
ret
mov eax, 1
ret

Function at 0x584f80
Capabilities:
Encrypt data using des

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
xor eax, eax
jmp 0x584f8f
inc rax
cmp rax, 8
jge 0x584f99
xor ecx, ecx
jmp 0x584fa2
add rsp, 0x10
pop rbp
ret
inc rcx
cmp rcx, 4
jge 0x584f8c
xor edx, edx
jmp 0x584fc0
mov dword [rbx + rax*4], ecx
lea rbx, [rdi + 1]
mov rax, r10
mov rcx, r9
mov rdx, rbx
nop dword [rax]
cmp rdx, 0x10
jge 0x584f9f
mov rbx, rax
shl rax, 6
lea rsi, [0x008a1ec0]
lea rdi, [rsi + rax]
mov r8, rcx
shl rcx, 4
add rdi, rcx
movzx edi, byte [rdi + rdx]
lea rcx, [rbx - 7]
neg rcx
shl rcx, 2
shl rdi, cl
cmp rcx, 0x40
sbb r9, r9
and rdi, r9
xor eax, eax
xor ecx, ecx
jmp 0x585096
mov rdi, r8
and r8d, 2
shl r8, 4
mov r9, rdi
and edi, 1
or r8, rdi
mov rdi, rdx
shl rdx, 1
or r8d, edx
mov rdx, rcx
shl rcx, 1
shr rdx, 0x1f
mov r10, rbx
shl rbx, 8
movzx eax, r8b
or rcx, rdx
lea rdx, [0x009290a0]
add rbx, rdx
cmp rax, 0x40
jb 0x584fac
jmp 0x5850a5
lea r9, [0x0089ed20]
movzx r10d, byte [r9 + rax]
mov r11, rcx
mov ecx, r10d
mov r12, rdi
shr r12, cl
lea r13, [rax - 0x1f]
neg r13
inc rax
cmp cl, 0x40
sbb rcx, rcx
and rcx, r12
and ecx, 1
mov r10, rcx
mov rcx, r13
shl r10, cl
cmp rcx, 0x40
sbb rcx, rcx
and rcx, r10
or rcx, r11
cmp rax, 0x20
jl 0x585052
nop dword [rax]
jmp 0x585007
mov ecx, 0x40
call sym.runtime.panicIndex
nop
int3
Function at 0x586480
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x58668b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x58], rax
add qword [rax + 0x58], rcx
mov rdx, qword [rax + 0x50]
test rdx, rdx
jle 0x5865a4
cmp rdx, 0x40
ja 0x58667d
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rbx
lea rsi, [rdx - 0x40]
mov r8, rsi
neg rsi
sar r8, 0x3f
and r8, rdx
lea rdx, [rax + r8]
lea rdx, [rdx + 0x10]
cmp rcx, rsi
cmovl rsi, rcx
mov qword [rsp + 0x28], rsi
cmp rbx, rdx
je 0x586514
mov rax, rdx
mov rcx, rsi
call sym.runtime.memmove
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
mov rdx, qword [rax + 0x50]
add rdx, rsi
mov qword [rax + 0x50], rdx
nop
cmp rdx, 0x40
jne 0x586580
mov qword [rsp], rax
lea rcx, [rax + 0x10]
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], 0x40
mov qword [rsp + 0x18], 0x40
call sym.crypto_md5.block.abi0
xorps xmm15, xmm15
mov r14, qword [0x00927048]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x50], 0
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
nop dword [rax]
cmp rcx, rsi
jb 0x586675
sub rdi, rsi
mov rdx, rdi
neg rdx
sar rdx, 0x3f
and rdx, rsi
mov r8, rcx
sub r8, rsi
add rbx, rdx
jmp 0x5865a7
mov r8, rcx
cmp r8, 0x40
jl 0x586625
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x40], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
and r8, 0xffffffffffffffc0
mov qword [rsp + 0x20], r8
mov qword [rsp + 0x10], r8
mov qword [rsp + 0x18], rdi
call sym.crypto_md5.block.abi0
xorps xmm15, xmm15
mov r14, qword [0x00927048]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x38]
mov rdx, rax
sub rax, rcx
sar rax, 0x3f
mov r8, qword [rsp + 0x30]
and rax, r8
and rax, 0xffffffffffffffc0
mov rcx, qword [rsp + 0x40]
lea rbx, [rcx + rax]
sub r8, rdx
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
test r8, r8
je 0x586668
lea rdx, [rax + 0x10]
cmp r8, 0x40
mov esi, 0x40
cmovl rsi, r8
nop dword [rax + rax]
cmp rbx, rdx
je 0x586664
mov qword [rsp + 0x38], rsi
mov rax, rdx
mov rcx, rsi
call sym.runtime.memmove
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x38]
mov qword [rax + 0x50], rsi
mov rax, rcx
xor ebx, ebx
xor ecx, ecx
add rsp, 0x48
pop rbp
ret
mov rax, rsi
call sym.runtime.panicSliceB
mov rax, rdx
mov ecx, 0x40
call sym.runtime.panicSliceB
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
nop
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp sym.crypto_md5._digest_.Write
Function at 0x59b800
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x59b8fe
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rsi
nop dword [rax]
test r8, r8
je 0x59b882
cmp r8, rdi
ja 0x59b8f2
cmp rsi, rbx
je 0x59b865
mov rdx, rbx
lea rdi, [rsi + r8]
lea rdi, [rdi - 1]
nop
nop
cmp rdi, rbx
jb 0x59b862
mov rdi, rsi
lea r9, [rdx + r8]
lea r9, [r9 - 1]
cmp r9, rsi
jae 0x59b8df
mov rbx, rdx
mov rsi, rdi
nop
jmp 0x59b865
mov rbx, rdx
test byte [rax], al
lea rdx, [r8 - 1]
cmp rcx, rdx
jbe 0x59b8d7
movzx ecx, byte [rax + 0x400]
movzx edx, byte [rax + 0x401]
xor edi, edi
jmp 0x59b8c0
add rsp, 0x10
pop rbp
ret
movzx r9d, byte [rsi + rdi]
inc ecx
movzx r10d, cl
mov r11d, dword [rax + r10*4]
add edx, r11d
movzx r12d, dl
mov r13d, dword [rax + r12*4]
mov dword [rax + r10*4], r13d
mov dword [rax + r12*4], r11d
lea r10d, [r11 + r13]
movzx r10d, r10b
xor r9d, dword [rax + r10*4]
mov byte [rbx + rdi], r9b
inc rdi
nop dword [rax]
cmp r8, rdi
jg 0x59b888
mov byte [rax + 0x400], cl
mov byte [rax + 0x401], dl
add rsp, 0x10
pop rbp
ret
mov rax, rdx
call sym.runtime.panicIndex
lea rax, [0x00661e40]
lea rbx, [0x007329b0]
call sym.runtime.gopanic
mov rcx, r8
mov rdx, rdi
call sym.runtime.panicSliceAcap
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
jmp sym.crypto_rc4._Cipher_.XORKeyStream
Function at 0x59e5a0
Capabilities:
Encode data using xor

Disassembly:
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov r15, qword [rsp + 0x18]
mov r8, qword [rdi]
mov r9, qword [rdi + 8]
mov r10, qword [rdi + 0x10]
mov r11, qword [rdi + 0x18]
mov r12, qword [rdi + 0x20]
cmp r15, 0x10
jb 0x59e667
add r8, qword [rsi]
adc r9, qword [rsi + 8]
adc r10, 1
lea rsi, [rsi + 0x10]
mov rax, r11
mul r8
mov rbx, rax
mov rcx, rdx
mov rax, r11
mul r9
add rcx, rax
adc rdx, 0
mov r13, r11
imul r13, r10
add r13, rdx
mov rax, r12
mul r8
add rcx, rax
adc rdx, 0
mov r8, rdx
mov r14, r12
imul r14, r10
mov rax, r12
mul r9
add r13, rax
adc r14, rdx
add r13, r8
adc r14, 0
mov r8, rbx
mov r9, rcx
mov r10, r13
and r10, 3
mov rbx, r13
and rbx, 0xfffffffffffffffc
add r8, rbx
adc r9, r14
adc r10, 0
shrd r13, r14, 2
shr r14, 2
add r8, r13
adc r9, r14
adc r10, 0
sub r15, 0x10
cmp r15, 0x10
jae 0x59e5cc
test r15, r15
je 0x59e6aa
mov rbx, 1
xor rcx, rcx
xor r13, r13
add rsi, r15
shld rcx, rbx, 8
shl rbx, 8
mov r13b, byte [rsi - 1]
xor rbx, r13
dec rsi
dec r15
jne 0x59e67c
add r8, rbx
adc r9, rcx
adc r10, 0
mov r15, 0x10
jmp 0x59e5db
mov qword [rdi], r8
mov qword [rdi + 8], r9
mov qword [rdi + 0x10], r10
ret
Function at 0x59fb60
Capabilities:
Encode data using xor

Disassembly:
xor r10, r10
xor r11, r11
xor r12, r12
cmp r9, 0xd
jne 0x59fc07
mov r10, qword [rcx]
mov r11, qword [rcx + 5]
shr r11, 0x18
mov r12, 1
mov rax, qword [rbp]
mov r15, rax
mul r10
mov r13, rax
mov r14, rdx
mov rax, qword [rbp]
mul r11
imul r15, r12
add r14, rax
adc r15, rdx
mov rax, qword [rbp + 8]
mov r8, rax
mul r10
add r14, rax
adc rdx, 0
mov r10, rdx
mov rax, qword [rbp + 8]
mul r11
add r15, rax
adc rdx, 0
imul r8, r12
add r15, r10
adc r8, rdx
mov r10, r13
mov r11, r14
mov r12, r15
and r12, 3
mov r13, r15
and r13, 0xfffffffffffffffc
mov r14, r8
shrd r15, r8, 2
shr r8, 2
add r10, r13
adc r11, r14
adc r12, 0
add r10, r15
adc r11, r8
adc r12, 0
ret
cmp r9, 0x10
jb 0x59fcaa
add r10, qword [rcx]
adc r11, qword [rcx + 8]
adc r12, 1
lea rcx, [rcx + 0x10]
sub r9, 0x10
mov rax, qword [rbp]
mov r15, rax
mul r10
mov r13, rax
mov r14, rdx
mov rax, qword [rbp]
mul r11
imul r15, r12
add r14, rax
adc r15, rdx
mov rax, qword [rbp + 8]
mov r8, rax
mul r10
add r14, rax
adc rdx, 0
mov r10, rdx
mov rax, qword [rbp + 8]
mul r11
add r15, rax
adc rdx, 0
imul r8, r12
add r15, r10
adc r8, rdx
mov r10, r13
mov r11, r14
mov r12, r15
and r12, 3
mov r13, r15
and r13, 0xfffffffffffffffc
mov r14, r8
shrd r15, r8, 2
shr r8, 2
add r10, r13
adc r11, r14
adc r12, 0
add r10, r15
adc r11, r8
adc r12, 0
jmp 0x59fc07
cmp r9, 0
je 0x59fd63
xor r13, r13
xor r14, r14
xor r15, r15
add rcx, r9
shld r14, r13, 8
shl r13, 8
mov r15b, byte [rcx - 1]
xor r13, r15
dec rcx
dec r9
jne 0x59fcc0
add r10, r13
adc r11, r14
adc r12, 1
mov rax, qword [rbp]
mov r15, rax
mul r10
mov r13, rax
mov r14, rdx
mov rax, qword [rbp]
mul r11
imul r15, r12
add r14, rax
adc r15, rdx
mov rax, qword [rbp + 8]
mov r8, rax
mul r10
add r14, rax
adc rdx, 0
mov r10, rdx
mov rax, qword [rbp + 8]
mul r11
add r15, rax
adc rdx, 0
imul r8, r12
add r15, r10
adc r8, rdx
mov r10, r13
mov r11, r14
mov r12, r15
and r12, 3
mov r13, r15
and r13, 0xfffffffffffffffc
mov r14, r8
shrd r15, r8, 2
shr r8, 2
add r10, r13
adc r11, r14
adc r12, 0
add r10, r15
adc r11, r8
adc r12, 0
ret
Function at 0x5ed8e0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
movd xmm0, dword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movdqu xmm1, xmmword [rsi]
movdqu xmm2, xmmword [rsi + 0x10]
movdqu xmm3, xmmword [rsi + 0x20]
movdqu xmm4, xmmword [rsi + 0x30]
pxor xmm1, xmm0
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jb 0x5ed9b5
movdqa xmm0, xmmword [0x00731d10]
movdqa xmm5, xmm1
movdqa xmm6, xmm2
movdqa xmm7, xmm3
movdqa xmm8, xmm4
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm2, xmm0, 0
pclmulqdq xmm3, xmm0, 0
pclmulqdq xmm4, xmm0, 0
movdqu xmm11, xmmword [rsi]
movdqu xmm12, xmmword [rsi + 0x10]
movdqu xmm13, xmmword [rsi + 0x20]
movdqu xmm14, xmmword [rsi + 0x30]
pclmulqdq xmm5, xmm0, 0x11
pclmulqdq xmm6, xmm0, 0x11
pclmulqdq xmm7, xmm0, 0x11
pclmulqdq xmm8, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm2, xmm6
pxor xmm3, xmm7
pxor xmm4, xmm8
pxor xmm1, xmm11
pxor xmm2, xmm12
pxor xmm3, xmm13
pxor xmm4, xmm14
add rdi, 0x40
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jge 0x5ed921
movdqa xmm0, xmmword [0x00731d20]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm2
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm3
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm4
cmp rcx, 0x10
jb 0x5eda37
movdqu xmm10, xmmword [rsi]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm10
sub rcx, 0x10
add rsi, 0x10
cmp rcx, 0x10
jge 0x5eda0b
pcmpeqb xmm3, xmm3
pclmulqdq xmm0, xmm1, 1
psrldq xmm1, 8
pxor xmm1, xmm0
movdqa xmm2, xmm1
movq xmm0, qword [0x007319a8]
psrlq xmm3, 0x20
psrldq xmm2, 4
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
movdqa xmm0, xmmword [0x00731d30]
movdqa xmm2, xmm1
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0x10
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
pextrd eax, xmm1, 1
mov dword [rsp + 0x28], eax
ret
Function at 0x5fa540
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5fa6db
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rsp + 0x80], rax
xor ecx, ecx
jmp 0x5fa561
inc rcx
cmp rbx, rcx
jle 0x5fa6d1
movzx edx, byte [rax + rcx]
cmp dl, 0x80
jb 0x5fa55e
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x80], rax
call sym.net.SplitHostPort
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x48], rdi
mov rdx, qword [0x008c68d0]
test rsi, rsi
mov r8, qword [rsp + 0x88]
cmovne rbx, r8
mov r8, qword [rsp + 0x80]
cmovne rax, r8
mov r8, rax
mov rax, rdx
mov r9, rbx
mov rbx, r8
mov rcx, r9
mov edi, 1
call sym.vendor_golang.org_x_net_idna._Profile_.process
mov rdx, qword [rsp + 0x58]
test rdx, rdx
mov rdx, qword [rsp + 0x48]
mov esi, 0
cmovne rdx, rsi
mov r8, qword [rsp + 0x60]
mov r9d, 0
cmovne r8, r9
nop word [rax + rax]
test rcx, rcx
jne 0x5fa6c5
test rdx, rdx
je 0x5fa6ba
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x68], rax
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
call sym.internal_bytealg.IndexByteString.abi0
xorps xmm15, xmm15
mov r14, qword [0x00927048]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x5fa689
xor eax, eax
lea rbx, [0x007302f0]
mov ecx, 1
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x50]
lea r8, [0x006b84ad]
mov r9d, 2
mov r10, qword [rsp + 0x60]
mov r11, qword [rsp + 0x48]
call sym.runtime.concatstring4
jmp 0x5fa6b0
xor eax, eax
mov rbx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x50]
lea rdi, [0x00730398]
mov esi, 1
mov r8, qword [rsp + 0x60]
mov r9, qword [rsp + 0x48]
call sym.runtime.concatstring3
xor ecx, ecx
xor edi, edi
add rsp, 0x70
pop rbp
ret
xor ecx, ecx
mov rdi, r9
add rsp, 0x70
pop rbp
ret
mov rax, r9
mov rbx, rsi
add rsp, 0x70
pop rbp
ret
xor ecx, ecx
xor edi, edi
add rsp, 0x70
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.vendor_golang.org_x_net_http_httpguts.PunycodeHostPort
Function at 0x638a20
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x638b22
push rbp
mov rbp, rsp
sub rsp, 0x68
mov qword [rsp + 0x78], rax
mov rcx, qword [rax + 0x28]
mov rbx, qword [rax + 0x30]
nop
mov rax, rcx
call sym.net_url.splitHostPort
test rdi, rdi
jne 0x638a73
mov rbx, qword [0x008d1c98]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rdx]
mov rdi, qword [rdx + 8]
lea rax, [0x00670220]
call sym.runtime.mapaccess1_faststr
mov rdi, qword [rax + 8]
mov rcx, qword [rax]
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x58], rcx
mov rax, qword [rsp + 0x78]
call sym.net_http.idnaASCIIFromURL
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x50], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
nop
call sym.internal_bytealg.IndexByteString.abi0
xorps xmm15, xmm15
mov r14, qword [0x00927048]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x638af5
xor eax, eax
lea rbx, [0x007302f0]
mov ecx, 1
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x50]
lea r8, [0x006b84ad]
mov r9d, 2
mov r10, qword [rsp + 0x58]
mov r11, qword [rsp + 0x48]
call sym.runtime.concatstring4
jmp 0x638b1c
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x50]
lea rdi, [0x00730398]
mov esi, 1
mov r8, qword [rsp + 0x58]
mov r9, qword [rsp + 0x48]
call sym.runtime.concatstring3
add rsp, 0x68
pop rbp
ret
mov qword [rsp + 8], rax
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
jmp sym.net_http.canonicalAddr
Function at 0x140984058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1409841df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140984089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14098406f
add dl, dl
jne 0x140984096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1409840f6
xor eax, eax
add dl, dl
jne 0x1409840a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1409841ad
add dl, dl
jne 0x1409840b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1409840c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1409840d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1409840dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1409840ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14098407e
mov eax, 1
add dl, dl
jne 0x140984106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140984113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1409840fb
sub eax, ebx
mov ebx, 1
jne 0x14098414c
mov ecx, 1
add dl, dl
jne 0x14098412e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14098413b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140984123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14098407e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140984168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140984175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14098415d
cmp eax, 0x7d00
jae 0x14098419b
cmp eax, 0x500
jb 0x140984196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14098407e
cmp eax, 0x7f
ja 0x14098419e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14098407e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1409841d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14098407e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x11e70
Capabilities:
Create device object

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rdi
sub rsp, 0x40
and qword [r11 + 0x20], 0
lea rax, [r11 + 0x20]
mov rsi, r8
mov qword [r11 - 0x18], rax
mov rdi, rdx
mov r9d, 0x32
xor r8d, r8d
xor edx, edx
mov byte [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x100
call qword [sym.imp.ntoskrnl.exe_IoCreateDevice]
test eax, eax
js 0x11fd9
mov rcx, qword [rsp + 0x68]
mov rdx, rsi
call qword [sym.imp.ntoskrnl.exe_IoAttachDeviceToDeviceStack]
test rax, rax
mov rbx, rax
jne 0x11ee4
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
mov eax, 0xc00000f1
jmp 0x11fd9
lea rcx, [0x00047198]
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
mov rcx, qword [rsp + 0x68]
mov qword [rcx + 0x40], rdi
mov rcx, qword [rsp + 0x68]
mov r11b, al
mov qword [rdi + 0x258], rsi
mov qword [rdi + 0x250], rbx
mov qword [rdi + 0x248], rcx
lock add dword [rdi + 0x224], 1
mov rax, qword [rdi]
mov rcx, rax
mov rdx, rax
and rcx, 0xfffffffffffffc00
lock cmpxchg qword [rdi], rcx
cmp rdx, rax
jne 0x11f22
mov rax, qword [rdi]
mov rcx, rax
mov rdx, rax
or rcx, 0x40
lock cmpxchg qword [rdi], rcx
cmp rdx, rax
jne 0x11f3c
mov eax, dword [rdi + 0x130]
and dword [rdi + 0x130], 0
mov dword [rdi + 0x134], eax
lea rax, fcn.0001afac
mov qword [rdi + 0x10], rax
mov cl, byte [rbx + 0x4c]
mov rax, qword [rsp + 0x68]
add cl, 1
mov byte [rax + 0x4c], cl
mov rax, qword [rsp + 0x68]
mov ecx, dword [rbx + 0x98]
mov dword [rax + 0x98], ecx
bt dword [rbx + 0x30], 0xd
jae 0x11f9e
mov rax, qword [rsp + 0x68]
bts dword [rax + 0x30], 0xd
test byte [rbx + 0x30], 0x10
je 0x11fad
mov rax, qword [rsp + 0x68]
or dword [rax + 0x30], 0x10
test byte [rbx + 0x30], 4
je 0x11fbc
mov rax, qword [rsp + 0x68]
or dword [rax + 0x30], 4
lea rcx, [0x00047198]
mov dl, r11b
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
mov r11, qword [rsp + 0x68]
btr dword [r11 + 0x30], 7
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret