joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140008290
Capabilities:
Connect socket

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
mov rdx, qword [rcx + 0x60]
mov eax, reloc.WS2_32.dll_recv
mov r8d, 0x1c
mov rbx, rcx
movsxd rcx, dword [rcx + 0x48]
cmp word [rdx], 2
cmove r8d, eax
call qword [sym.imp.WS2_32.dll_connect]
mov edi, eax
test eax, eax
jns 0x140008337
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x140008388
lea rcx, str.connect
call fcn.14003d3cc
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
xor ecx, ecx
mov qword [rsp + 0x40], rbx
mov dword [rbx + 0x4c], eax
lea rdx, [rsp + 0x20]
lea rax, [0x140007120]
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x38], rax
xorps xmm0, xmm0
mov eax, dword [rbx + 0x44]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rcx
mov rcx, qword [rbx]
mov qword [rsp + 0x48], rax
movdqa xmmword [rsp + 0x50], xmm0
call fcn.140006400
mov eax, edi
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
test edi, edi
jne 0x140008388
xor ecx, ecx
mov qword [rsp + 0x40], rbx
lea rax, [0x140007ca0]
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x38], rax
lea rdx, [rsp + 0x20]
mov eax, dword [rbx + 0x44]
xorps xmm0, xmm0
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rcx
mov rcx, qword [rbx]
mov qword [rsp + 0x48], rax
movdqa xmmword [rsp + 0x50], xmm0
call fcn.140006400
xor eax, eax
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
mov eax, dword [rbx + 0x120]
lea rdx, [0x1400074e0]
mov rcx, qword [rbx]
test eax, eax
mov r8d, 0x2710
mov r9d, 1
cmovne r8d, eax
call fcn.140006b70
mov qword [rbx + 0x140], rax
lea rdx, [0x1400081e0]
mov r8d, 4
mov rcx, rbx
mov qword [rax + 0x28], rbx
or dword [rbx + 0x3c], 0x80
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
jmp fcn.140006f50
Function at 0x14000aa80
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
xor r10d, r10d
lea rsi, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__
mov edi, edx
mov rbx, rcx
mov r9d, r10d
test edx, edx
je 0x14000ab44
mov r11, rcx
nop dword [rax]
mov eax, 0xaaaaaaab
mov ecx, r10d
mul r10d
shr edx, 1
lea eax, [rdx + rdx*2]
sub ecx, eax
je 0x14000ab1f
sub ecx, 1
je 0x14000ab02
cmp ecx, 1
jne 0x14000ab35
lea eax, [r10 - 1]
mov ecx, r9d
movzx edx, byte [rax + rbx]
inc r9d
movzx eax, byte [r11]
and edx, 0xf
shr eax, 6
lea eax, [rax + rdx*4]
movzx eax, byte [rax + rsi]
mov byte [rcx + r8], al
movzx eax, byte [r11]
and eax, 0x3f
movzx eax, byte [rax + rsi]
mov byte [r9 + r8], al
jmp 0x14000ab32
lea eax, [r10 - 1]
movzx edx, byte [rax + rbx]
movzx eax, byte [r11]
and edx, 3
shl edx, 4
shr eax, 4
add edx, eax
movzx eax, byte [rdx + rsi]
jmp 0x14000ab2b
movzx eax, byte [r11]
shr rax, 2
movzx eax, byte [rax + rsi]
mov ecx, r9d
mov byte [rcx + r8], al
inc r9d
inc r10d
inc r11
cmp r10d, edi
jb 0x14000aab0
dec r10d
mov eax, 0xaaaaaaab
mul r10d
mov ecx, r10d
shr edx, 1
lea eax, [rdx + rdx*2]
sub ecx, eax
jne 0x14000ab95
movzx ecx, byte [r10 + rbx]
and ecx, 3
mov edx, r9d
inc r9d
add rcx, rcx
movzx ecx, byte [rsi + rcx*8]
mov byte [rdx + r8], cl
mov byte [r9 + r8], 0x3d
inc r9d
mov byte [r9 + r8], 0x3d
lea eax, [r9 + 1]
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
cmp ecx, 1
jne 0x14000abc9
movzx edx, byte [r10 + rbx]
and edx, 0xf
mov ecx, r9d
inc r9d
movzx eax, byte [rsi + rdx*4]
mov byte [rcx + r8], al
lea eax, [r9 + 1]
mov byte [r9 + r8], 0x3d
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
mov rbx, qword [rsp + 8]
mov eax, r9d
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret

Function at 0x14000b1b0
Capabilities:
Initialize winsock library

Disassembly:
sub rsp, 0x1d8
mov rax, qword [0x140066010]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov ecx, 1
xor eax, eax
lock cmpxchg dword [0x140068168], ecx
jne 0x14000b1ea
mov ecx, 0x202
lea rdx, [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_WSAStartup]
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.1400354e0
add rsp, 0x1d8
ret
Function at 0x14000b210
Capabilities:
Convert ip address from string
Initialize winsock library
Resolve dns

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x1e0
mov rax, qword [0x140066010]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
mov ebp, r8d
mov rsi, rdx
mov rbx, rcx
test rdx, rdx
je 0x14000b312
cmp byte [rdx], 0
je 0x14000b312
mov ecx, 1
xor eax, eax
lock cmpxchg dword [0x140068168], ecx
jne 0x14000b26d
mov ecx, 0x202
lea rdx, [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_WSAStartup]
mov edi, 2
lea r8, [rbx + 4]
mov ecx, edi
mov rdx, rsi
call qword [sym.imp.WS2_32.dll_inet_pton]
cmp eax, 1
jne 0x14000b28e
mov word [rbx], di
jmp 0x14000b334
mov edi, reloc.WS2_32.dll_socket
lea r8, [rbx + 8]
mov ecx, edi
mov rdx, rsi
call qword [sym.imp.WS2_32.dll_inet_pton]
cmp eax, 1
jne 0x14000b2aa
mov word [rbx], di
lea r9, [rsp + 0x20]
mov qword [rsp + 0x20], 0
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
jne 0x14000b343
mov rdi, qword [rsp + 0x20]
test rdi, rdi
je 0x14000b325
cmp qword [rdi + 0x20], 0
je 0x14000b325
cmp qword [rdi + 0x10], 0
je 0x14000b325
mov rdx, rdi
cmp dword [rdx + 4], 2
je 0x14000b2f7
mov rdx, qword [rdx + 0x28]
test rdx, rdx
jne 0x14000b2e5
mov rdx, rdi
mov r8, qword [rdx + 0x10]
mov rcx, rbx
mov rdx, qword [rdx + 0x20]
call fcn.140037460
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
jmp 0x14000b325
mov edi, 2
mov word [rcx], di
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_htonl]
mov dword [rbx + 4], eax
movzx eax, word [rbx]
cmp ax, 2
je 0x14000b334
cmp ax, 0x17
jne 0x14000b341
movzx ecx, bp
call qword [sym.imp.WS2_32.dll_htons]
mov word [rbx + 2], ax
xor eax, eax
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.1400354e0
mov rbx, qword [rsp + 0x218]
add rsp, 0x1e0
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000b450
Capabilities:
Connect socket
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov rax, qword [0x140066010]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov r14, r9
call fcn.14000b1b0
mov edi, 0xffffffff
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
xor esi, esi
mov r15d, 2
mov ecx, 0x7f000001
mov qword [rsp + 0x30], rsi
mov ebx, edi
mov word [rsp + 0x28], r15w
call qword [sym.imp.WS2_32.dll_htonl]
xor r8d, r8d
mov word [rsp + 0x2a], si
lea edx, [rdi + 2]
mov dword [rsp + 0x2c], eax
mov ecx, r15d
call qword [sym.imp.WS2_32.dll_socket]
movsxd rsi, eax
mov rbp, rax
test eax, eax
jns 0x14000b4e7
lea rcx, str.socket
call fcn.14003d3cc
cmp ebp, ebx
je 0x14000b5d3
jmp 0x14000b5ae
mov r8d, dword [rsp + 0x20]
lea rdx, [rsp + 0x28]
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_bind]
test eax, eax
jns 0x14000b50a
lea rcx, str.bind
jmp 0x14000b5a9
mov edx, 1
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_listen]
test eax, eax
jns 0x14000b528
lea rcx, str.listen
jmp 0x14000b5a9
lea r8, [rsp + 0x20]
mov rcx, rsi
lea rdx, [rsp + 0x28]
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jns 0x14000b548
lea rcx, str.getsockname
jmp 0x14000b5a9
xor r8d, r8d
mov ecx, r15d
lea edx, [r8 + 1]
call qword [sym.imp.WS2_32.dll_socket]
mov rbx, rax
test eax, eax
jns 0x14000b568
lea rcx, str.socket
jmp 0x14000b5a9
mov r8d, dword [rsp + 0x20]
lea rdx, [rsp + 0x28]
movsxd rcx, ebx
call qword [sym.imp.WS2_32.dll_connect]
test eax, eax
jns 0x14000b588
lea rcx, str.connect
jmp 0x14000b5a9
lea r8, [rsp + 0x20]
mov rcx, rsi
lea rdx, [rsp + 0x28]
call qword [sym.imp.WS2_32.dll_accept]
mov rdi, rax
test eax, eax
jns 0x14000b5da
lea rcx, str.accept
call fcn.14003d3cc
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_closesocket]
cmp ebx, 0xffffffff
je 0x14000b5c5
movsxd rcx, ebx
call qword [sym.imp.WS2_32.dll_closesocket]
cmp edi, 0xffffffff
je 0x14000b5d3
movsxd rcx, edi
call qword [sym.imp.WS2_32.dll_closesocket]
mov eax, 0xffffffff
jmp 0x14000b5ec
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
mov dword [r14], ebx
mov dword [r14 + 4], edi
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400354e0
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x14000d740
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbx, qword [rcx + 0x68]
mov rbp, rcx
lea rsi, [rbx + 0x268]
test rsi, rsi
je 0x14000d7d6
mov rcx, qword [rsi]
test rcx, rcx
je 0x14000d7d6
mov rdi, qword [rbx + 0x270]
test rdi, rdi
je 0x14000d7a3
mov ecx, dword [rcx]
sub ecx, 9
je 0x14000d78e
cmp ecx, 1
jne 0x14000d797
mov ecx, 0xd8
jmp 0x14000d793
mov ecx, 0x68
xor eax, eax
rep stosb byte [rdi], al
mov rcx, qword [rbx + 0x270]
call fcn.14003c2e4
mov rdx, qword [rbx + 0x278]
test rdx, rdx
je 0x14000d7ca
mov rax, qword [rsi]
movzx ecx, byte [rax + 5]
add rcx, rcx
je 0x14000d7c2
mov rdi, rdx
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rdx
call fcn.14003c2e4
mov rdi, rsi
xor eax, eax
mov ecx, 0x18
rep stosb byte [rdi], al
mov rax, qword [rbp + 0x68]
xor ecx, ecx
xorps xmm0, xmm0
movups xmmword [rax + 0x268], xmm0
mov qword [rax + 0x278], rcx
mov rdi, qword [rbp + 0x68]
add rdi, 0x268
je 0x14000d953
xor ebx, ebx
lea rax, [0x14005d0a0]
lea edx, [rcx + 0x68]
mov qword [rdi], rax
mov qword [rdi + 8], rbx
mov qword [rdi + 0x10], rbx
lea ecx, [rbx + 1]
call fcn.140039360
mov qword [rdi + 8], rax
test rax, rax
jne 0x14000d830
mov eax, 0xffffae80
jmp 0x14000d958
xorps xmm0, xmm0
xor ecx, ecx
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm0
movups xmmword [rax + 0x40], xmm0
movups xmmword [rax + 0x50], xmm0
mov qword [rax + 0x60], rcx
mov rdx, qword [rbp + 0x68]
add rdx, 0x268
je 0x14000d953
mov rcx, qword [rdx]
test rcx, rcx
je 0x14000d953
mov ecx, dword [rcx]
sub ecx, 9
je 0x14000d88f
cmp ecx, 1
jne 0x14000d953
mov rcx, qword [rdx + 8]
call fcn.140020cf0
test eax, eax
je 0x14000d8cf
jmp 0x14000d958
mov rax, qword [rdx + 8]
mov qword [rax + 0x40], rbx
mov dword [rax + 0x48], 0x6a09e667
mov dword [rax + 0x4c], 0xbb67ae85
mov dword [rax + 0x50], 0x3c6ef372
mov dword [rax + 0x54], 0xa54ff53a
mov dword [rax + 0x58], 0x510e527f
mov dword [rax + 0x5c], 0x9b05688c
mov dword [rax + 0x60], 0x1f83d9ab
mov dword [rax + 0x64], 0x5be0cd19
mov rcx, qword [rbp + 0x68]
add rcx, 0x280
call fcn.140018ab0
mov rax, qword [rbp + 0x68]
xor ecx, ecx
xorps xmm0, xmm0
movups xmmword [rax + 0x280], xmm0
mov qword [rax + 0x290], rcx
mov rdi, qword [rbp + 0x68]
add rdi, 0x280
je 0x14000d953
lea rax, [0x14005d0a8]
mov qword [rdi + 8], rbx
mov edx, 0xd8
mov qword [rdi], rax
mov ecx, 1
mov qword [rdi + 0x10], rbx
call fcn.140039360
mov qword [rdi + 8], rax
test rax, rax
je 0x14000d826
xor edx, edx
mov r8d, 0xd8
mov rcx, rax
call fcn.1400367b0
mov rcx, qword [rbp + 0x68]
add rcx, 0x280
call fcn.140018cb0
jmp 0x14000d958
mov eax, 0xffffaf00
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14000fe20
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push rdi
sub rsp, 0x40
mov rax, qword [0x140066010]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rax, qword [rcx]
lea rdx, [rsp + 0x20]
mov r9, qword [rcx + 0x68]
mov rdi, rcx
movzx r8d, byte [rax + 8]
xor r8d, 1
call qword [r9 + 0x28]
mov rcx, rdi
call fcn.1400110b0
mov r9d, eax
test eax, eax
jne 0x140010006
cmp dword [rdi + 0xe0], 0x16
je 0x14000fecf
cmp qword [rdi], 0
je 0x14000fec4
cmp qword [rdi + 0x150], 0
mov rcx, rdi
je 0x14000fe90
call fcn.140010c00
mov r9d, 0xffff8900
jmp 0x140010006
mov rax, qword [rdi + 0x138]
mov edx, 1
mov dword [rdi + 0x140], socket
mov qword [rdi + 0x148], 2
mov byte [rax], 2
mov rax, qword [rdi + 0x138]
mov byte [rax + 1], 0xa
call fcn.140010cc0
mov r9d, 0xffff8900
jmp 0x140010006
mov r11, qword [rdi + 0xd0]
cmp byte [r11], 0x14
jne 0x14000fe6d
cmp qword [rdi + 0xf8], 0x10
je 0x14000ff48
cmp qword [rdi], 0
je 0x14000ff3d
cmp qword [rdi + 0x150], 0
mov rcx, rdi
je 0x14000ff09
call fcn.140010c00
mov r9d, 0xffff8d00
jmp 0x140010006
mov rax, qword [rdi + 0x138]
mov edx, 1
mov dword [rdi + 0x140], socket
mov qword [rdi + 0x148], 2
mov byte [rax], 2
mov rax, qword [rdi + 0x138]
mov byte [rax + 1], 0x32
call fcn.140010cc0
mov r9d, 0xffff8d00
jmp 0x140010006
xor r8d, r8d
lea rax, [rsp + 0x20]
add r11, 4
mov r10d, r8d
sub r11, rax
nop word [rax + rax]
lea rax, [rsp + 0x20]
add rax, r8
inc r8
movzx ecx, byte [r11 + rax]
movzx edx, byte [rax]
xor edx, ecx
or r10d, edx
cmp r8, 0xc
jb 0x14000ff60
mov ecx, r10d
movzx eax, r10w
shr ecx, 0x10
or ecx, eax
je 0x14000ffe8
cmp qword [rdi], 0
je 0x14000ffe0
cmp qword [rdi + 0x150], 0
mov rcx, rdi
je 0x14000ffac
call fcn.140010c00
mov r9d, 0xffff9200
jmp 0x140010006
mov rax, qword [rdi + 0x138]
mov edx, 1
mov dword [rdi + 0x140], socket
mov qword [rdi + 0x148], 2
mov byte [rax], 2
mov rax, qword [rdi + 0x138]
mov byte [rax + 1], 0x33
call fcn.140010cc0
mov r9d, 0xffff9200
jmp 0x140010006
mov rax, qword [rdi + 0x68]
cmp byte [rax], 0
je 0x140010003
mov rax, qword [rdi]
cmp byte [rax + 8], 0
jne 0x140010006
mov dword [rdi + 8], 0xa
jmp 0x140010006
inc dword [rdi + 8]
xor eax, eax
lea rdi, [rsp + 0x20]
mov ecx, ntohl
rep stosb byte [rdi], al
mov eax, r9d
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400354e0
add rsp, 0x40
pop rdi
ret
Function at 0x140010750
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rdx, r8
xor ecx, ecx
mov r8, r9
mov qword [rbx], rcx
mov dword [rbx + 8], ecx
mov rcx, rbx
call fcn.140037460
mov r11, qword [rsp + 0x50]
add rbx, 4
mov r9, r11
mov r8d, 8
sub r9, rbx
xor edx, edx
mov r10d, r8d
mov rax, rbx
sub r10, rbx
nop
mov rcx, qword [r9 + rax]
add rdx, r8
xor rcx, qword [rax]
mov qword [rax], rcx
lea rax, [rax + 8]
lea rcx, [r10 + rax]
cmp rcx, r8
jbe 0x140010790
mov rcx, r8
sub rcx, rdx
cmp rdx, r8
jae 0x14001088b
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rdi
cmp rcx, 0x40
jb 0x140010865
lea rdi, [rdx + rbx]
lea rax, [r11 + 7]
lea r10, [rbx + 7]
lea rsi, [rdx + r11]
cmp rdi, rax
ja 0x1400107e7
cmp r10, rsi
jae 0x140010865
and ecx, 0x3f
mov r10, r8
sub r10, rcx
lea rax, [rdi + 0x10]
nop dword [rax]
nop dword [rax + rax]
movdqu xmm0, xmmword [rax - 0x10]
add rdx, 0x40
movdqu xmm1, xmmword [r9 + rax - 0x10]
movdqu xmm2, xmmword [rax + r9]
lea rax, [rax + 0x40]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x50], xmm1
movdqu xmm0, xmmword [rax - 0x40]
movdqu xmm1, xmmword [r9 + rax - 0x30]
pxor xmm2, xmm0
movdqu xmmword [rax - 0x40], xmm2
movdqu xmm0, xmmword [rax - 0x30]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x30], xmm1
movdqu xmm0, xmmword [rax - 0x20]
movdqu xmm1, xmmword [r9 + rax - 0x20]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x20], xmm1
cmp rdx, r10
jb 0x140010800
cmp rdx, r8
jae 0x140010881
lea rcx, [rdx + rbx]
sub r8, rdx
nop dword [rax]
movzx eax, byte [rcx + r9]
xor byte [rcx], al
lea rcx, [rcx + 1]
sub r8, 1
jne 0x140010870
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
Function at 0x140016390
Capabilities:
Convert ip address from string

Disassembly:
push rsi
push r13
push r14
sub rsp, 0x60
mov rax, qword [0x140066010]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov r13, r8
mov r14, rdx
mov rsi, 0xffffffffffffffff
inc rsi
cmp byte [rdx + rsi], 0
jne 0x1400163b6
test byte [rcx + 0x280], 0x20
mov qword [rsp + 0x98], rbx
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x40], r15
je 0x1400164f3
xor ebp, ebp
lea rbx, [rcx + 0x1c0]
mov r15d, ebp
mov r12d, ebp
mov rdi, rbx
test rbx, rbx
je 0x140016541
movzx ecx, byte [rdi]
and ecx, 0x1f
sub ecx, 2
je 0x140016425
sub ecx, 4
je 0x14001641d
cmp ecx, 1
jne 0x14001643b
mov r15d, ecx
jmp 0x14001643b
mov r12d, 1
jmp 0x14001643b
mov r8, rsi
mov rdx, r14
mov rcx, rdi
call fcn.140016270
test eax, eax
je 0x140016546
mov rdi, qword [rdi + 0x18]
test rdi, rdi
jne 0x140016403
test r15d, r15d
je 0x1400164c1
lea edx, [rdi + 0x3a]
mov rcx, r14
call fcn.1400361f0
lea r8, [rsp + 0x20]
mov rdx, r14
test rax, rax
jne 0x14001646f
lea ecx, [rdi + 2]
call qword [sym.imp.WS2_32.dll_inet_pton]
lea ecx, [rdi + 4]
jmp 0x14001647f
mov ecx, reloc.WS2_32.dll_socket
call qword [sym.imp.WS2_32.dll_inet_pton]
mov ecx, reloc.WS2_32.dll_recv
cmp eax, 1
cmove rbp, rcx
test rbp, rbp
je 0x1400164c1
mov rdi, rbx
nop
movzx eax, byte [rdi]
and al, 0x1f
cmp al, 7
jne 0x1400164b8
cmp qword [rdi + 8], rbp
jne 0x1400164b8
mov rcx, qword [rdi + 0x10]
lea rdx, [rsp + 0x20]
mov r8, rbp
call fcn.140051e50
test eax, eax
je 0x140016546
mov rdi, qword [rdi + 0x18]
test rdi, rdi
jne 0x140016490
test r12d, r12d
je 0x140016541
movzx eax, byte [rbx]
and al, 0x1f
cmp al, 6
jne 0x1400164e8
cmp qword [rbx + 8], rsi
jne 0x1400164e8
mov rcx, qword [rbx + 0x10]
mov r8, rsi
mov rdx, r14
call fcn.140051e50
test eax, eax
je 0x140016546
mov rbx, qword [rbx + 0x18]
test rbx, rbx
jne 0x1400164c6
jmp 0x140016541
lea rbx, [rcx + 0xe0]
test rbx, rbx
je 0x140016541
mov edi, 0x455
mov ebp, 3
nop dword [rax]
cmp qword [rbx + 8], rbp
jne 0x140016538
mov rax, qword [rbx + 0x10]
cmp di, word [rax]
jne 0x140016538
cmp bpl, byte [rax + 2]
jne 0x140016538
lea rcx, [rbx + 0x18]
mov r8, rsi
mov rdx, r14
call fcn.140016270
test eax, eax
je 0x140016546
mov rbx, qword [rbx + 0x30]
test rbx, rbx
jne 0x140016510
or dword [r13], 4
mov r15, qword [rsp + 0x40]
mov r12, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400354e0
add rsp, 0x60
pop r14
pop r13
pop rsi
ret
Function at 0x140017720
Capabilities:
Hash data using sha256

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x140066010]
xor rax, rsp
mov qword [rsp + 0x48], rax
lea r14, [0x14005d0a0]
mov rbx, r9
mov rsi, r8
movzx ebp, dl
mov rdi, rcx
cmp r9, 0x20
jbe 0x14001777a
lea r9, [rsp + 0x28]
mov r8, rbx
mov rdx, rsi
mov rcx, r14
call fcn.140018d20
mov edx, eax
test eax, eax
jne 0x1400178d1
lea rsi, [rsp + 0x28]
mov ebx, 0x20
cmp dword [rdi + 0x18], 0
mov byte [rsp + 0x20], bpl
mov byte [rsp + 0x21], bl
jne 0x140017850
xor ebp, ebp
mov qword [rdi], r14
mov qword [rdi + 8], rbp
mov qword [rdi + 0x10], rbp
lea edx, [rbp + 0x68]
lea ecx, [rbp + 1]
call fcn.140039360
mov qword [rdi + 8], rax
test rax, rax
jne 0x1400177b8
mov edx, 0xffffae80
jmp 0x1400178d1
xorps xmm0, xmm0
xor ecx, ecx
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm0
movups xmmword [rax + 0x40], xmm0
movups xmmword [rax + 0x50], xmm0
mov qword [rax + 0x60], rcx
mov rcx, qword [rdi]
test rcx, rcx
je 0x1400178cc
mov ecx, dword [rcx]
sub ecx, 9
je 0x140017809
cmp ecx, 1
jne 0x1400178cc
mov rcx, qword [rdi + 8]
call fcn.140020cf0
mov edx, eax
test eax, eax
jne 0x1400178d1
jmp 0x140017849
mov rax, qword [rdi + 8]
mov qword [rax + 0x40], rbp
mov dword [rax + 0x48], 0x6a09e667
mov dword [rax + 0x4c], 0xbb67ae85
mov dword [rax + 0x50], 0x3c6ef372
mov dword [rax + 0x54], 0xa54ff53a
mov dword [rax + 0x58], 0x510e527f
mov dword [rax + 0x5c], 0x9b05688c
mov dword [rax + 0x60], 0x1f83d9ab
mov dword [rax + 0x64], 0x5be0cd19
mov dword [rdi + 0x18], 1
mov rcx, qword [rdi]
test rcx, rcx
je 0x1400178cc
mov ecx, dword [rcx]
sub ecx, 9
je 0x140017878
cmp ecx, 1
jne 0x1400178cc
lea r8d, [rcx + 1]
mov rcx, qword [rdi + 8]
lea rdx, [rsp + 0x20]
call fcn.1400215b0
jmp 0x14001788c
mov rcx, qword [rdi + 8]
lea rdx, [rsp + 0x20]
mov r8d, 2
call fcn.140020af0
mov edx, eax
test eax, eax
jne 0x1400178d1
mov rcx, qword [rdi]
test rcx, rcx
je 0x1400178cc
mov ecx, dword [rcx]
sub ecx, 9
je 0x1400178b9
cmp ecx, 1
jne 0x1400178cc
mov rcx, qword [rdi + 8]
mov r8, rbx
mov rdx, rsi
call fcn.1400215b0
mov edx, eax
jmp 0x1400178d1
mov rcx, qword [rdi + 8]
mov r8, rbx
mov rdx, rsi
call fcn.140020af0
mov edx, eax
jmp 0x1400178d1
mov edx, 0xffffaf00
xor eax, eax
lea rdi, [rsp + 0x28]
mov ecx, 0x20
rep stosb byte [rdi], al
mov eax, edx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400354e0
add rsp, 0x50
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140017d30
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
xor r10d, r10d
mov r11, rcx
cmp r9, 8
jb 0x140017d7c
mov rbx, rdx
mov rdi, rcx
sub rbx, r8
sub rdi, r8
mov esi, 8
mov rax, r8
sub rsi, r8
nop
mov rcx, qword [rbx + rax]
add r10, 8
xor rcx, qword [rax]
mov qword [rdi + rax], rcx
lea rax, [rax + 8]
lea rcx, [rsi + rax]
cmp rcx, r9
jbe 0x140017d60
mov rcx, r9
sub rcx, r10
cmp r10, r9
jae 0x140017e7b
mov qword [rsp + 0x10], rbp
cmp rcx, 0x40
jb 0x140017e55
lea rbx, [r9 - 1]
lea rax, [r8 - 1]
add rbx, r11
add rax, r9
lea rdi, [r10 + r11]
lea rsi, [r10 + r8]
cmp rdi, rax
ja 0x140017dbe
cmp rbx, rsi
jae 0x140017e55
lea rax, [rdx - 1]
add rax, r9
lea rbp, [r10 + rdx]
cmp rdi, rax
ja 0x140017dd7
cmp rbx, rbp
jae 0x140017e55
and ecx, 0x3f
mov rbp, r9
sub rbp, rcx
mov rcx, rdx
lea rax, [rsi + 0x10]
sub rcx, r8
mov rbx, r11
sub rbx, r8
movdqu xmm0, xmmword [rax - 0x10]
add r10, 0x40
movdqu xmm1, xmmword [rcx + rax - 0x10]
movdqu xmm2, xmmword [rax + rcx]
lea rax, [rax + 0x40]
pxor xmm1, xmm0
movdqu xmm0, xmmword [rax - 0x40]
movdqu xmmword [rbx + rax - 0x50], xmm1
pxor xmm2, xmm0
movdqu xmm0, xmmword [rax - 0x30]
movdqu xmm1, xmmword [rcx + rax - 0x30]
movdqu xmmword [rax + rbx - 0x40], xmm2
pxor xmm1, xmm0
movdqu xmm0, xmmword [rax - 0x20]
movdqu xmm2, xmmword [rcx + rax - 0x20]
movdqu xmmword [rbx + rax - 0x30], xmm1
pxor xmm2, xmm0
movdqu xmmword [rbx + rax - 0x20], xmm2
cmp r10, rbp
jb 0x140017df0
cmp r10, r9
jae 0x140017e76
sub rdx, r8
lea rcx, [r10 + r8]
sub r11, r8
sub r9, r10
movzx eax, byte [rcx + rdx]
xor al, byte [rcx]
mov byte [rcx + r11], al
lea rcx, [rcx + 1]
sub r9, 1
jne 0x140017e62
mov rbp, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
pop rdi
ret