joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140025d20
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
push rsi
push rdi
push r14
sub rsp, 0x28
mov rbx, rcx
mov eax, 0x7fffffff
mov rcx, qword [rcx + 0x48]
cmp r8, rax
mov rdi, r8
mov r14, rdx
cmova rdi, rax
mov rsi, qword [rbx + 0x50]
cmp rcx, rsi
jae 0x140025d90
mov rdx, qword [rbx + 0x30]
sub rsi, rcx
add rdx, rcx
mov rcx, r14
cmp rdi, rsi
ja 0x140025d77
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
add qword [rbx + 0x48], rdi
mov rax, rdi
add rsp, 0x28
pop r14
pop rdi
pop rsi
pop rbx
ret
mov r8, rsi
call sub.VCRUNTIME140.dll_memcpy
add qword [rbx + 0x48], rsi
mov rax, rsi
add rsp, 0x28
pop r14
pop rdi
pop rsi
pop rbx
ret
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_htonl]
test al, al
jne 0x140025dae
mov rax, 0xffffffffffffffff
add rsp, 0x28
pop r14
pop rdi
pop rsi
pop rbx
ret
xor eax, eax
mov qword [rsp + 0x68], rbp
mov rbp, qword [rbx + 8]
mov qword [rbx + 0x48], rax
mov qword [rbx + 0x50], rax
cmp rdi, 0x1000
jae 0x140025e60
mov qword [rsp + 0x20], r15
mov r15, qword [rbx + 0x30]
nop word [rax + rax]
xor r9d, r9d
mov r8d, 0x1000
mov rdx, r15
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_recv]
movsxd rsi, eax
test eax, eax
jns 0x140025e07
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 4
je 0x140025de0
mov r15, qword [rsp + 0x20]
test rsi, rsi
jle 0x140025e25
mov rdx, qword [rbx + 0x30]
mov rcx, r14
cmp rsi, rdi
jg 0x140025e37
mov r8, rsi
call sub.VCRUNTIME140.dll_memcpy
mov rbp, qword [rsp + 0x68]
mov rax, rsi
add rsp, 0x28
pop r14
pop rdi
pop rsi
pop rbx
ret
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rbp, qword [rsp + 0x68]
mov rax, rdi
mov qword [rbx + 0x48], rdi
mov qword [rbx + 0x50], rsi
add rsp, 0x28
pop r14
pop rdi
pop rsi
pop rbx
ret
xor r9d, r9d
mov r8d, edi
mov rdx, r14
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_recv]
movsxd rbx, eax
test eax, eax
jns 0x140025e84
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 4
je 0x140025e60
mov rbp, qword [rsp + 0x68]
mov rax, rbx
add rsp, 0x28
pop r14
pop rdi
pop rsi
pop rbx
ret

Function at 0x140025ea0
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rcx]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
call qword [rax + reloc.WS2_32.dll_recv]
test al, al
jne 0x140025ed9
mov rax, 0xffffffffffffffff
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov rdi, qword [rdi + 8]
mov qword [rsp + 0x38], rbx
xor r9d, r9d
mov r8d, esi
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_send]
movsxd rbx, eax
test eax, eax
jns 0x140025f06
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 4
je 0x140025ee2
mov rbp, qword [rsp + 0x40]
mov rax, rbx
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x140025f30
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0xc0
mov rax, qword [0x14007a040]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rdi, r8
mov dword [rsp + 0x20], 0x80
mov rbx, rdx
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x140025a05
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x30]
mov r9, rdi
mov r8, rbx
call fcn.1400258a0
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.14005ac30
mov rbx, qword [rsp + 0xe8]
add rsp, 0xc0
pop rdi
ret
mov rcx, qword [rcx + 8]
jmp 0x1400259b0

Function at 0x140029250
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
push rsi
push r12
push r14
sub rsp, 0x70
mov qword [rax + 8], rbx
xor r12d, r12d
mov qword [rax - 0x28], rdi
mov rsi, r8
mov rdi, qword [r8 + 0x10]
mov r14, rdx
mov qword [rax - 0x30], r13
mov r13, rcx
mov qword [rax - 0x38], r15
mov r15, qword [r8 + 0x18]
cmp r15, 0xf
jbe 0x140029289
mov r8, qword [r8]
movabs rdx, 0xcbf29ce484222325
mov rcx, r12
test rdi, rdi
je 0x1400292c4
movabs r9, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [rcx + r8]
inc rcx
xor rdx, rax
imul rdx, r9
cmp rcx, rdi
jb 0x1400292b0
mov rcx, qword [r13 + 0x30]
mov rax, qword [r13 + 0x18]
and rcx, rdx
add rcx, rcx
mov rbx, qword [rax + rcx*8 + 8]
cmp rbx, qword [r13 + 8]
jne 0x1400292e2
mov rbx, r12
jmp 0x140029332
mov qword [rsp + 0x68], rbp
mov rbp, qword [rax + rcx*8]
nop dword [rax + rax]
cmp qword [rbx + 0x28], 0xf
lea rdx, [rbx + 0x10]
mov rax, qword [rdx + 0x10]
jbe 0x140029302
mov rdx, qword [rdx]
mov rcx, rsi
cmp r15, 0xf
jbe 0x14002930e
mov rcx, qword [rsi]
cmp rdi, rax
jne 0x14002931f
mov r8, rdi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14002932d
cmp rbx, rbp
je 0x14002932a
mov rbx, qword [rbx + 8]
jmp 0x1400292f0
mov rbx, r12
mov rbp, qword [rsp + 0x68]
mov r15, qword [rsp + 0x50]
test rbx, rbx
je 0x140029360
cmp rbx, qword [r13 + 8]
je 0x140029360
mov rax, qword [rbx + 0x38]
test rax, rax
je 0x14002934f
lock inc dword [rax + 8]
mov rcx, qword [rbx + 0x38]
mov rax, qword [rbx + 0x30]
mov qword [r14], rax
mov qword [r14 + 8], rcx
jmp 0x140029367
mov qword [r14], r12
mov qword [r14 + 8], r12
mov rdx, qword [rsi + 0x18]
mov r13, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x90]
cmp rdx, 0xf
jbe 0x1400293af
mov rcx, qword [rsi]
inc rdx
cmp rdx, 0x1000
jb 0x1400293aa
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400293cb
mov rcx, r8
call fcn.14005b0bc
mov qword [rsi + 0x10], r12
mov rax, r14
mov qword [rsi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rsi], r12b
add rsp, 0x70
pop r14
pop r12
pop rsi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3

Function at 0x1400296a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x1400296d4
movabs r10, 0x100000001b3
nop
movzx ecx, byte [r9 + rdx]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x1400296c0
ret
Function at 0x1400303b0
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov dword [rcx + 0x74], 0
mov rbx, rcx
mov edi, 0x7fffffff
movsx ecx, byte [rbx + 0x78]
lea eax, [rcx - 0x30]
cmp al, 9
ja 0x14003047c
lea r8d, [rcx - 0x30]
cmp r8d, 0xffffffff
je 0x14003047c
mov r9d, dword [rbx + 0x74]
mov ecx, 0x7fffffff
sub ecx, r8d
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp r9d, edx
jg 0x140030495
lea eax, [r9 + r9*4]
dec edi
lea ecx, [r8 + rax*2]
mov rax, qword [rbx]
mov dword [rbx + 0x74], ecx
mov rcx, qword [rbx + 0x10]
cmp rax, rcx
je 0x14003046c
cmp byte [rax], 0x5c
jne 0x140030466
lea rdx, [rax + 1]
cmp rdx, rcx
je 0x140030466
mov r8d, dword [rbx + 0x80]
test r8b, 8
jne 0x140030452
movzx ecx, byte [rdx]
sub cl, 0x28
cmp cl, 1
jbe 0x140030463
test r8b, 0x10
jne 0x140030466
movzx ecx, byte [rdx]
sub cl, 0x7b
test cl, 0xfd
jne 0x140030466
mov rax, rdx
inc rax
mov qword [rbx], rax
mov rcx, rbx
call fcn.14002cda0
test edi, edi
jne 0x1400303d0
mov rbx, qword [rsp + 0x30]
cmp edi, 0x7fffffff
mov rsi, qword [rsp + 0x38]
setne al
add rsp, 0x20
pop rdi
ret
mov edx, esi
call fcn.14002cd90
int3

Function at 0x1400322f0
Capabilities:
Hash data using fnv

Disassembly:
mov r9, rcx
movzx r8d, dl
movabs rcx, 0x100000001b3
mov word [rsp + 0x10], dx
movabs rax, 0xcbf29ce484222325
xor r8, rax
movzx eax, byte [rsp + 0x11]
imul r8, rcx
xor r8, rax
imul r8, rcx
mov rcx, qword [r9 + 0x38]
and rcx, r8
mov r8, qword [r9 + 0x10]
shl rcx, 4
add rcx, qword [r9 + 0x20]
xor r9d, r9d
mov rax, qword [rcx + 8]
cmp rax, r8
je 0x140032361
mov rcx, qword [rcx]
cmp dx, word [rax + 0x10]
je 0x140032364
nop dword [rax + rax]
cmp rax, rcx
je 0x140032361
mov rax, qword [rax + 8]
cmp dx, word [rax + 0x10]
jne 0x140032350
jmp 0x140032364
mov rax, r9
test rax, rax
cmove rax, r8
cmp rax, r8
jne 0x140032375
movzx eax, r9w
ret
movzx eax, word [rax + 0x12]
ret
Function at 0x140035550
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push r14
sub rsp, 0x20
xor ebx, ebx
lea r14, [rcx + 0xf0]
mov rax, qword [r14]
mov rbp, rcx
lea r9d, [rbx + 1]
cmp rax, r14
je 0x14003559c
nop dword [rax + rax]
mov rbx, rax
cmp word [rax + 0x10], dx
jne 0x14003558f
cmp byte [rax + 0x29], r8b
je 0x140035597
mov rax, qword [rax]
cmp rax, r14
jne 0x140035580
cmp rax, r14
jne 0x140035606
lea rax, [rcx + 0x110]
mov rbx, qword [rax]
cmp rbx, rax
je 0x1400355d1
nop dword [rax + rax]
cmp byte [rbx + 0x28], 0
jge 0x1400355c9
cmp word [rbx + 0x26], r9w
jb 0x1400355d1
cmp word [rbx + 0x10], dx
jne 0x1400355c9
cmp byte [rbx + 0x29], r8b
je 0x140035603
mov rbx, qword [rbx]
cmp rbx, rax
jne 0x1400355b0
lea rax, [rcx + 0x100]
mov rbx, qword [rax]
cmp rbx, rax
je 0x140035601
cmp byte [rbx + 0x28], 0
jge 0x1400355f9
cmp word [rbx + 0x26], r9w
jb 0x140035601
cmp word [rbx + 0x10], dx
jne 0x1400355f9
cmp byte [rbx + 0x29], r8b
je 0x140035603
mov rbx, qword [rbx]
cmp rbx, rax
jne 0x1400355e0
xor ebx, ebx
xor r9d, r9d
test rbx, rbx
jne 0x14003561e
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
movzx eax, r8b
mov qword [rsp + 0x30], rsi
cmp rax, qword [rcx + 0x48]
jae 0x140035669
lea r8, [rax + rax*4]
shr dx, 0xc
shl r8, 4
add r8, qword [rcx + 0x40]
movzx eax, dx
lea rcx, [r8 + rax*2]
movzx eax, word [r8 + rax*2 + 6]
test ax, ax
je 0x140035669
sub ax, 1
mov word [rcx + 6], ax
jne 0x140035669
movzx ecx, word [r8 + 4]
movzx eax, dx
btr ecx, eax
mov word [r8 + 4], cx
mov rcx, qword [rbx + 8]
mov rax, qword [rbx]
movzx esi, byte [rbx + 0x28]
and esi, 0xf
mov qword [rcx], rax
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
cmp qword [rbx + 0x58], 0
je 0x1400356f2
test r9d, r9d
je 0x14003569b
movzx eax, word [rbx + 0x24]
sub dword [rbp + 0xd8], eax
mov rax, qword [rbx + 0x58]
dec qword [rax]
mov rax, qword [rbx + 0x58]
cmp qword [rax], 0
jne 0x1400356f2
or dword [rax + 8], 0x100
mov qword [rsp + 0x38], rdi
mov rdi, qword [rbx + 0x58]
test rdi, rdi
je 0x1400356ed
mov rax, qword [rdi + 0x20]
test rax, rax
je 0x1400356cf
mov rcx, rdi
call rax
test byte [rdi + 8], 4
jne 0x1400356e4
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x1400356e4
call qword [0x14007a1a8]
mov rcx, rdi
call qword [0x14007a1a8]
mov rdi, qword [rsp + 0x38]
mov rcx, rbx
call qword [0x14007a1a8]
mov rcx, qword [r14]
cmp rcx, r14
je 0x14003570c
mov eax, dword [rcx + 0x18]
add eax, dword [rcx + 0x14]
mov dword [rbp + 0x70], eax
mov rbx, qword [rsp + 0x40]
mov eax, esi
mov rsi, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x1400364b0
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp dword [r8 + 0x38], 1
mov rdi, r9
mov rbx, r8
mov r14, rdx
mov rbp, rcx
je 0x1400364df
xor eax, eax
jmp 0x1400366c8
mov ecx, dword [r9 + 0x10]
mov qword [rsp + 0x30], rsi
call qword [sym.imp.WS2_32.dll_ntohl]
mov esi, eax
lea rax, [rsi - 1]
cmp rax, 0xfe
ja 0x14003665f
mov ecx, dword [rdi + 0x1c]
call qword [sym.imp.WS2_32.dll_ntohl]
cmp eax, dword [rbx + 0xa4]
jne 0x14003665f
mov ecx, dword [rdi + 0x20]
call qword [sym.imp.WS2_32.dll_ntohl]
cmp eax, dword [rbx + 0x9c]
jne 0x14003665f
mov ecx, dword [rdi + 0x24]
call qword [sym.imp.WS2_32.dll_ntohl]
cmp eax, dword [rbx + 0xa0]
jne 0x14003665f
mov eax, dword [rbx + 0x1c]
cmp dword [rdi + 0x28], eax
jne 0x14003665f
mov edx, 1
mov r8b, 0xff
mov rcx, rbx
call fcn.140035550
cmp rsi, qword [rbx + 0x48]
jae 0x140036565
mov qword [rbx + 0x48], rsi
movzx ecx, word [rdi + 4]
call qword [sym.imp.WS2_32.dll_ntohs]
mov word [rbx + 0x18], ax
movzx eax, byte [rdi + 6]
mov byte [rbx + 0x21], al
movzx eax, byte [rdi + 7]
mov byte [rbx + 0x20], al
mov ecx, dword [rdi + 8]
call qword [sym.imp.WS2_32.dll_ntohl]
mov ecx, 0x240
mov esi, 0x1000
cmp eax, ecx
jb 0x14003659f
cmp eax, esi
mov ecx, eax
cmova ecx, esi
cmp ecx, dword [rbx + 0xd0]
jae 0x1400365ad
mov dword [rbx + 0xd0], ecx
mov ecx, dword [rdi + 0xc]
call qword [sym.imp.WS2_32.dll_ntohl]
cmp eax, esi
jb 0x1400365c6
mov ecx, 0x10000
mov esi, eax
cmp eax, ecx
cmova esi, ecx
cmp esi, dword [rbx + 0xd4]
jae 0x1400365d4
mov dword [rbx + 0xd4], esi
mov ecx, dword [rdi + 0x14]
call qword [sym.imp.WS2_32.dll_ntohl]
mov dword [rbx + 0x50], eax
mov ecx, dword [rdi + 0x18]
call qword [sym.imp.WS2_32.dll_ntohl]
mov dword [rbx + 0x54], eax
mov dword [rbp + 0x24], 1
mov eax, dword [rbx + 0x38]
test r14, r14
je 0x140036642
add eax, 0xfffffffb
cmp eax, 1
jbe 0x14003661f
cmp dword [rbx + 0x50], 0
je 0x140036614
mov rax, qword [rbx + 0x10]
inc qword [rax + 0x2af0]
mov rax, qword [rbx + 0x10]
inc qword [rax + 0x2ae8]
mov dword [rbx + 0x38], 5
mov dword [r14], 1
mov qword [r14 + 8], rbx
mov eax, dword [rbx + 0x1b8]
mov dword [r14 + 0x14], eax
xor eax, eax
jmp 0x1400366c3
xor r8d, r8d
mov rdx, rbx
cmp eax, 1
mov rcx, rbp
sete r8b
add r8d, 3
call fcn.140035310
xor eax, eax
jmp 0x1400366c3
mov eax, dword [rbx + 0x38]
xor r8d, r8d
sub eax, 5
mov dword [rbx + 0x1b8], r8d
cmp eax, 1
ja 0x140036690
cmp dword [rbx + 0x50], r8d
je 0x140036685
mov rax, qword [rbx + 0x10]
dec qword [rax + 0x2af0]
mov rax, qword [rbx + 0x10]
dec qword [rax + 0x2ae8]
test byte [rbx + 0x130], 1
mov dword [rbx + 0x38], 9
jne 0x1400366be
mov rax, qword [rbp + 0x50]
lea rcx, [rbp + 0x48]
mov qword [rbx + 8], rax
mov qword [rbx], rcx
mov qword [rax], rbx
mov qword [rcx + 8], rbx
or word [rbx + 0x130], 1
mov eax, 0xffffffff
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140038690
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push rbx
mov r10d, dword [0x140081040]
lea rbx, [0x140081040]
mov r9d, 0x138
cmp r10d, r9d
jne 0x140038709
lea r8, [0x140081050]
movabs r11, 0xb5026f5aa96619e9
nop dword [rax]
mov rdx, qword [r8]
xor rdx, qword [r8 - 8]
lea r8, [r8 + 8]
and rdx, 0xffffffff80000000
xor rdx, qword [r8 - 8]
movzx eax, dl
and al, 1
neg al
sbb rcx, rcx
shr rdx, 1
and rcx, r11
xor rcx, qword [r8 + 0x4d0]
xor rcx, rdx
mov qword [r8 + 0x9b0], rcx
sub r9, 1
jne 0x1400386c0
mov r10d, dword [0x140081040]
jmp 0x14003882c
cmp r10d, 0x270
jb 0x14003882c
mov qword [rsp + 0x10], rbp
xor r10d, r10d
mov qword [rsp + 0x18], rsi
lea rbp, [0x140081ee8]
mov qword [rsp + 0x20], rdi
lea rsi, [0x140081a08]
lea rdi, [0x140081048]
mov r9d, r10d
movabs r11, 0xb5026f5aa96619e9
mov r8d, 0x4e0
mov rax, qword [r9 + rbx + 0x9d0]
mov rdx, rax
xor rdx, qword [r9 + rsi]
and rdx, 0xffffffff80000000
xor rdx, rax
movzx eax, dl
and al, 1
neg al
sbb rcx, rcx
shr rdx, 1
and rcx, r11
xor rcx, qword [r9 + rbp]
xor rcx, rdx
mov qword [r9 + rdi], rcx
add r9, 8
cmp r9, r8
jb 0x140038750
mov rsi, qword [rsp + 0x18]
lea r9, [0x140081a10]
mov rbp, qword [rsp + 0x10]
nop
mov rdx, qword [r8 + r9]
xor rdx, qword [r8 + rbx + 0x9c8]
and rdx, 0xffffffff80000000
xor rdx, qword [r8 + r9]
movzx eax, dl
and al, 1
neg al
sbb rcx, rcx
shr rdx, 1
and rcx, r11
xor rcx, qword [r8 + rbx - 0x4d8]
xor rcx, rdx
mov qword [r8 + rdi], rcx
add r8, 8
cmp r8, 0x9b8
jb 0x1400387a0
mov rdx, qword [0x140081048]
xor rdx, qword [0x1400823c0]
mov rdi, qword [rsp + 0x20]
and rdx, 0xffffffff80000000
xor rdx, qword [0x140081048]
movzx eax, dl
mov dword [0x140081040], r10d
and al, 1
neg al
sbb rcx, rcx
shr rdx, 1
and rcx, r11
xor rcx, rdx
xor rcx, qword [0x140081520]
mov qword [0x140081a00], rcx
mov eax, r10d
movabs rdx, 0x38eb3ffff6d3
mov rcx, qword [rbx + rax*8 + 8]
inc eax
mov dword [0x140081040], eax
mov rax, rcx
shr rax, 0x1d
and rax, qword [0x1400823c8]
xor rcx, rax
mov rax, rcx
and rax, rdx
shl rax, 0x11
xor rcx, rax
mov rax, rcx
and rax, 0xffffffffffffbf77
shl rax, 0x25
xor rcx, rax
mov rax, rcx
shr rax, 0x2b
xor rax, rcx
pop rbx
ret
Function at 0x14003d060
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rdi, rdx
mov rbx, rcx
mov qword [rsp + 0x28], rcx
xor ebp, ebp
mov dword [rsp + 0x20], ebp
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], rbp
mov qword [rcx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rcx], bpl
mov dword [rsp + 0x20], 1
lea rsi, [rdx + 0x10]
mov rdx, qword [rsi]
call fcn.140048a20
lea r15d, [rbp - 6]
cmp qword [rdi + 0x18], 0xf
jbe 0x14003d0c4
mov r14, qword [rdi]
mov rcx, r14
mov rdi, r14
jmp 0x14003d0ca
mov r14, rdi
mov rcx, rdi
mov r13, qword [rsi]
add r13, rcx
cmp rdi, r13
je 0x14003d1c1
lea r8, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
shl ebp, 8
movzx eax, byte [r14]
add ebp, eax
add r15d, 8
js 0x14003d166
movsxd r12, ebp
movsxd rdi, r15d
lea ecx, [r15 + 6]
mov eax, 0xaaaaaaab
mul ecx
shr edx, 2
mov esi, edx
imul eax, edx, 0xfffffffa
add r15d, eax
nop dword [rax + rax]
mov rax, r12
mov rcx, rdi
sar rax, cl
and eax, 0x3f
movzx r9d, byte [rax + r8]
mov rax, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rax, rdx
jae 0x14003d14d
lea rcx, [rax + 1]
mov qword [rbx + 0x10], rcx
mov rcx, rbx
cmp rdx, 0xf
jbe 0x14003d142
mov rcx, qword [rbx]
mov byte [rcx + rax], r9b
mov byte [rcx + rax + 1], 0
jmp 0x14003d15c
mov rcx, rbx
call fcn.14000e170
lea r8, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
sub rdi, 6
sub rsi, 1
jne 0x14003d110
inc r14
cmp r14, r13
jne 0x14003d0e0
cmp r15d, 0xfffffffa
jle 0x14003d1c1
lea ecx, [r15 + 8]
shl ebp, 8
movsxd rax, ebp
sar rax, cl
and eax, 0x3f
movzx r9d, byte [rax + r8]
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x14003d1b9
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0xf
jbe 0x14003d1ae
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x14003d1c1
mov rcx, rbx
call fcn.14000e170
mov rcx, qword [rbx + 0x10]
test cl, 3
je 0x14003d209
nop word [rax + rax]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x14003d1f5
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0xf
jbe 0x14003d1ed
mov rax, qword [rbx]
mov word [rax + rcx], 0x3d
jmp 0x14003d200
mov r9b, 0x3d
mov rcx, rbx
call fcn.14000e170
mov rcx, qword [rbx + 0x10]
test cl, 3
jne 0x14003d1d0
mov rax, rbx
mov rbx, qword [rsp + 0x80]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140048020
Capabilities:
Convert ip address from string

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r15
sub rsp, 0x58
mov rax, qword [0x14007a040]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor ebx, ebx
mov qword [rsp + 0x28], rcx
cmp qword [rcx + 0x20], 0xf
lea rsi, [rcx + 8]
xorps xmm0, xmm0
mov byte [rsp + 0x20], 0
mov rbp, rdx
mov dword [rsp + 0x30], ebx
mov edi, 2
mov r15d, ebx
movups xmmword [rsp + 0x38], xmm0
mov rdx, rsi
jbe 0x140048070
mov rdx, qword [rsi]
lea r8, [rsp + 0x38]
mov ecx, reloc.WS2_32.dll_socket
call qword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
je 0x14004808c
mov r15d, reloc.WS2_32.dll_recv
jmp 0x1400480b0
cmp qword [rsi + 0x18], 0xf
jbe 0x140048096
mov rsi, qword [rsi]
lea r8, [rsp + 0x30]
mov rdx, rsi
mov ecx, edi
call qword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
je 0x1400480b5
mov r15d, 4
mov edi, 7
xor r9d, r9d
xor r8d, r8d
mov rcx, rbp
lea edx, [r9 + 0x55]
call qword [sym.imp.libcrypto_3_x64.dll_X509_get_ext_d2i]
mov r12, rax
test rax, rax
je 0x1400481a5
mov qword [rsp + 0xa0], r13
mov rcx, rax
mov qword [rsp + 0x50], r14
xor r13b, r13b
xor r14b, r14b
call qword [sym.imp.libcrypto_3_x64.dll_OPENSSL_sk_num]
mov dword [rsp + 0x24], eax
test eax, eax
jle 0x140048198
nop dword [rax]
test r14b, r14b
jne 0x140048193
mov edx, ebx
mov rcx, r12
call qword [sym.imp.libcrypto_3_x64.dll_OPENSSL_sk_value]
mov rsi, rax
cmp dword [rax], edi
jne 0x14004817d
mov rcx, qword [rax + 8]
call qword [sym.imp.libcrypto_3_x64.dll_ASN1_STRING_get0_data]
mov rcx, qword [rsi + 8]
mov rbp, rax
call qword [sym.imp.libcrypto_3_x64.dll_ASN1_STRING_length]
movsxd r8, eax
cmp edi, 2
je 0x14004816c
cmp edi, 7
jne 0x14004817d
mov r8, r15
lea rcx, [rsp + 0x38]
mov rdx, rbp
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140048167
mov r8, r15
lea rcx, [rsp + 0x30]
mov rdx, rbp
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14004817d
mov r13b, 1
jmp 0x14004817d
mov rcx, qword [rsp + 0x28]
mov rdx, rbp
call fcn.1400481d0
movzx r14d, al
inc ebx
cmp ebx, dword [rsp + 0x24]
jl 0x140048100
test r14b, r14b
jne 0x140048193
test r13b, r13b
je 0x140048198
mov byte [rsp + 0x20], 1
mov r13, qword [rsp + 0xa0]
mov r14, qword [rsp + 0x50]
mov rcx, r12
call qword [sym.imp.libcrypto_3_x64.dll_GENERAL_NAMES_free]
movzx eax, byte [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14005ac30
add rsp, 0x58
pop r15
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14004bae0
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov rax, qword [0x14007a040]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rbp, rcx
mov r15, r9
mov rcx, r8
mov rsi, r8
mov rdi, rdx
call qword [sym.imp.MSVCP140.dll__Mtx_lock]
test eax, eax
jne 0x14004bc79
mov eax, dword [rsi + 0x4c]
cmp eax, 0x7fffffff
je 0x14004bc37
mov rcx, rdi
call qword [sym.imp.libssl_3_x64.dll_SSL_new]
mov rcx, rsi
mov rdi, rax
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
test rdi, rdi
je 0x14004bbf6
lea r8, [rsp + 0x20]
mov dword [rsp + 0x20], 1
mov edx, 0x8004667e
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_ioctlsocket]
xor edx, edx
mov ecx, ebp
call qword [sym.imp.libcrypto_3_x64.dll_BIO_new_socket]
xor r9d, r9d
mov rcx, rax
mov r14, rax
lea edx, [r9 + 0x66]
lea r8d, [r9 + 1]
call qword [sym.imp.libcrypto_3_x64.dll_BIO_ctrl]
mov r8, r14
mov rdx, r14
mov rcx, rdi
call qword [sym.imp.libssl_3_x64.dll_SSL_set_bio]
mov r9, qword [rsp + 0x80]
add r9, 8
cmp qword [r9 + 0x18], 0xf
jbe 0x14004bba9
mov r9, qword [r9]
xor r8d, r8d
mov rcx, rdi
lea edx, [r8 + 0x37]
call qword [sym.imp.libssl_3_x64.dll_SSL_ctrl]
mov rdx, rdi
mov rcx, r15
call fcn.140047df0
cmp al, 1
jne 0x14004bc17
xor r9d, r9d
xor r8d, r8d
mov rcx, r14
lea edx, [r9 + 0x66]
call qword [sym.imp.libcrypto_3_x64.dll_BIO_ctrl]
lea r8, [rsp + 0x20]
mov dword [rsp + 0x20], 0
mov edx, 0x8004667e
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov rax, rdi
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14005ac30
mov rbx, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov rcx, rdi
call qword [sym.imp.libssl_3_x64.dll_SSL_shutdown]
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_lock]
test eax, eax
jne 0x14004bc79
mov eax, dword [rsi + 0x4c]
cmp eax, 0x7fffffff
jne 0x14004bc48
dec eax
mov ecx, 6
mov dword [rsi + 0x4c], eax
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov rcx, rdi
call qword [sym.imp.libssl_3_x64.dll_SSL_free]
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
lea r8, [rsp + 0x20]
mov dword [rsp + 0x20], 0
mov edx, 0x8004667e
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_ioctlsocket]
xor eax, eax
jmp 0x14004bbf9
mov ecx, 5
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3