joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000fe30
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov r8, qword [0x1403b57d0]
lea r10, [0x140084db0]
movsxd r9, ecx
mov rbx, qword [r8 + 0x3e28]
add rbx, 0xc8
movsxd rdx, dword [rbx]
mov rax, qword [rbx + 8]
mov edi, dword [rax + rdx*4 - 4]
not edi
movzx eax, r9b
movzx ecx, dil
xor rcx, rax
shr edi, 8
mov eax, r9d
shr eax, 8
movzx edx, al
mov eax, r9d
xor edi, dword [r10 + rcx*4]
movzx ecx, dil
xor rdx, rcx
shr edi, 8
shr eax, 0x10
xor edi, dword [r10 + rdx*4]
movzx ecx, dil
shr edi, 8
movzx edx, al
xor rdx, rcx
mov eax, r9d
shr rax, 0x18
xor edi, dword [r10 + rdx*4]
movzx ecx, dil
shr edi, 8
xor rcx, rax
xor edi, dword [r10 + rcx*4]
not edi
cmp dword [r8 + 0x3e5c], edi
jne 0x14000fed5
mov r8, r9
mov edx, 4
mov ecx, edi
call fcn.140017fb0
mov r8d, dword [rbx]
mov ecx, dword [rbx + 4]
cmp r8d, ecx
jne 0x14000ff09
inc r8d
test ecx, ecx
je 0x14000fef2
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x14000fef7
mov eax, 8
cmp eax, r8d
mov rcx, rbx
cmovg r8d, eax
mov edx, r8d
call fcn.1400190a0
movsxd rcx, dword [rbx]
mov rax, qword [rbx + 8]
mov dword [rax + rcx*4], edi
inc dword [rbx]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140011980
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x1403b3040]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x1403b57d0]
mov edi, ecx
cmp byte [rbx + 0x41cd], 0
jne 0x1400119e1
cmp byte [rbx + 0x41ce], 0
jne 0x1400119e1
movsx r9d, word [rbx + 0x52ae]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.140003050
test dil, 1
je 0x140011b08
jmp 0x140011a6c
movss xmm1, dword [rbx + 0x3830]
lea r8, str.Tooltip__02d
movsx r9d, word [rbx + 0x52ae]
lea rcx, [rsp + 0x20]
movaps xmm0, xmm1
xor eax, eax
mulss xmm0, dword [0x1403a8a80]
mov edx, 0x10
mulss xmm1, dword [0x1403a8a64]
addss xmm0, dword [rbx + 0xd0c]
addss xmm1, dword [rbx + 0xd10]
mov qword [rbx + 0x3f48], rax
mov dword [rbx + 0x3f34], 1
movss dword [rbx + 0x3f40], xmm0
movss dword [rbx + 0x3f44], xmm1
movss xmm0, dword [rbx + 0x388c]
mulss xmm0, dword [0x1403a88c4]
or dword [rbx + 0x3f30], 0x41
movss dword [rbx + 0x3f90], xmm0
call fcn.140003050
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x140011ac0
lea r11, [0x140084db0]
nop dword [rax]
cmp r9b, 0x23
jne 0x140011aa3
cmp byte [r8], r9b
jne 0x140011aa3
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140011a90
not ecx
call fcn.14000aae0
test rax, rax
je 0x140011b08
cmp byte [rax + 0x8e], 0
je 0x140011b08
mov byte [rax + 0x95], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xb0], 1
lea rcx, [rsp + 0x20]
inc word [rbx + 0x52ae]
mov edx, 0x10
movsx r9d, word [rbx + 0x52ae]
call fcn.140003050
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20c0347
call fcn.14000d160
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140081820
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x140045b20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0xa0
mov rax, qword [0x1403b3040]
xor rax, rsp
mov qword [rsp + 0x90], rax
movzx eax, byte [rcx]
mov ebx, edx
mov r8, rcx
test al, al
je 0x140045b60
cmp al, 0x25
jne 0x140045b54
cmp byte [r8 + 1], al
jne 0x140045b60
inc r8
movzx eax, byte [r8 + 1]
inc r8
test al, al
jne 0x140045b47
movzx edx, byte [r8]
cmp dl, 0x25
jne 0x140045cbe
cmp byte [r8 + 1], dl
je 0x140045cbe
lea r11, [rsp + 0x28]
mov r9, r8
nop
lea eax, [rdx - 0x41]
movsx r10d, dl
cmp al, 0x19
ja 0x140045b9d
lea ecx, [r10 - 0x41]
mov eax, 1
shl eax, cl
test eax, 0x900
je 0x140045bc5
sub dl, 0x61
cmp dl, 0x19
ja 0x140045bb7
lea ecx, [r10 - 0x61]
mov eax, 1
shl eax, cl
test eax, 0x2480a80
je 0x140045bc5
movzx edx, byte [r9 + 1]
inc r9
test dl, dl
jne 0x140045b80
jmp 0x140045bc8
inc r9
cmp r8, r9
jae 0x140045bff
movabs rdx, 0x800000000000009
nop word [rax + rax]
movzx ecx, byte [r8]
inc r8
lea eax, [rcx - 0x24]
cmp al, 0x3b
ja 0x140045bf4
bt rdx, rax
jb 0x140045bfa
mov byte [r11], cl
inc r11
cmp r8, r9
jb 0x140045be0
xorps xmm3, xmm3
mov byte [r11], 0
cvtss2sd xmm3, xmm2
lea r8, [rsp + 0x28]
mov edx, 0x40
lea rcx, [rsp + 0x50]
movq r9, xmm3
call fcn.140003050
cmp byte [rsp + 0x50], 0x20
lea rcx, [rsp + 0x50]
jne 0x140045c38
nop
inc rcx
cmp byte [rcx], 0x20
je 0x140045c30
lea eax, [rbx - 8]
cmp eax, 1
jbe 0x140045cac
movzx r8d, byte [rcx]
movzx eax, r8b
cmp r8b, 0x2d
jne 0x140045c58
lea rax, [rcx + 1]
mov rcx, rax
movzx eax, byte [rax]
cmp al, 0x2b
lea rdx, [rcx + 1]
xorps xmm1, xmm1
cmovne rdx, rcx
movzx eax, byte [rdx]
cmp al, 0x30
jl 0x140045c9a
movss xmm2, dword [0x1403a8a6c]
cmp al, 0x39
ja 0x140045c9a
movsx eax, byte [rdx]
inc rdx
sub eax, 0x30
mulss xmm1, xmm2
movd xmm0, eax
movzx eax, byte [rdx]
cvtdq2ps xmm0, xmm0
addss xmm0, xmm1
movaps xmm1, xmm0
cmp al, 0x30
jge 0x140045c74
cmp r8b, 0x2d
jne 0x140045cb9
xorps xmm1, xmmword [0x1403a9210]
movaps xmm0, xmm1
jmp 0x140045cc1
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atof]
xorps xmm1, xmm1
cvtsd2ss xmm1, xmm0
movaps xmm0, xmm1
jmp 0x140045cc1
movaps xmm0, xmm2
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140081820
add rsp, 0xa0
pop rbx
ret
Function at 0x140046300
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0xa0
mov rax, qword [0x1403b3040]
xor rax, rsp
mov qword [rsp + 0x90], rax
movzx eax, byte [rcx]
mov ebx, edx
mov r8, rcx
test al, al
je 0x140046340
cmp al, 0x25
jne 0x140046334
cmp byte [r8 + 1], al
jne 0x140046340
inc r8
movzx eax, byte [r8 + 1]
inc r8
test al, al
jne 0x140046327
movzx edx, byte [r8]
cmp dl, 0x25
jne 0x140046498
cmp byte [r8 + 1], dl
je 0x140046498
lea r11, [rsp + 0x28]
mov r9, r8
nop
lea eax, [rdx - 0x41]
movsx r10d, dl
cmp al, 0x19
ja 0x14004637d
lea ecx, [r10 - 0x41]
mov eax, 1
shl eax, cl
test eax, 0x900
je 0x1400463a5
sub dl, 0x61
cmp dl, 0x19
ja 0x140046397
lea ecx, [r10 - 0x61]
mov eax, 1
shl eax, cl
test eax, 0x2480a80
je 0x1400463a5
movzx edx, byte [r9 + 1]
inc r9
test dl, dl
jne 0x140046360
jmp 0x1400463a8
inc r9
cmp r8, r9
jae 0x1400463df
movabs rdx, 0x800000000000009
nop word [rax + rax]
movzx ecx, byte [r8]
inc r8
lea eax, [rcx - 0x24]
cmp al, 0x3b
ja 0x1400463d4
bt rdx, rax
jb 0x1400463da
mov byte [r11], cl
inc r11
cmp r8, r9
jb 0x1400463c0
movaps xmm3, xmm2
mov byte [r11], 0
movq r9, xmm2
lea r8, [rsp + 0x28]
mov edx, 0x40
lea rcx, [rsp + 0x50]
call fcn.140003050
cmp byte [rsp + 0x50], 0x20
lea rcx, [rsp + 0x50]
jne 0x140046418
nop dword [rax + rax]
inc rcx
cmp byte [rcx], 0x20
je 0x140046410
lea eax, [rbx - 8]
cmp eax, 1
jbe 0x14004648a
movzx r8d, byte [rcx]
movzx eax, r8b
cmp r8b, 0x2d
jne 0x140046438
lea rax, [rcx + 1]
mov rcx, rax
movzx eax, byte [rax]
cmp al, 0x2b
lea rdx, [rcx + 1]
xorps xmm1, xmm1
cmovne rdx, rcx
movzx eax, byte [rdx]
cmp al, 0x30
jl 0x140046478
movsd xmm2, qword [0x1403a89e8]
cmp al, 0x39
ja 0x140046478
movsx eax, byte [rdx]
inc rdx
sub eax, 0x30
mulsd xmm1, xmm2
movd xmm0, eax
movzx eax, byte [rdx]
cvtdq2pd xmm0, xmm0
addsd xmm1, xmm0
cmp al, 0x30
jge 0x140046454
cmp r8b, 0x2d
jne 0x140046493
xorps xmm1, xmmword [0x1403a9200]
movaps xmm0, xmm1
jmp 0x14004649b
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atof]
movaps xmm1, xmm0
movaps xmm0, xmm1
jmp 0x14004649b
movaps xmm0, xmm2
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140081820
add rsp, 0xa0
pop rbx
ret
Function at 0x140058c50
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov ebp, ecx
lea rcx, [rdx + 0x20]
call fcn.140058bf0
mov rcx, qword [0x1403b5a90]
mov r15, rax
lea rdx, [rax + 0x18]
call fcn.14007e430
mov rcx, qword [0x1403b5a90]
mov rdi, rax
movzx r8d, al
sub r8, 0x29
lea rdx, [rax - 0x1a9]
and r8d, 0x7f
mov r9, qword [rcx + 0x21]
shr rdx, 7
and edx, 7
add rdx, r9
lea rbx, [r9 + 0x7b7eb2]
lea r14, [rbx + 8]
lea rdx, [rdx + r8*8]
add rdx, 0x3867900
call fcn.14007e430
movabs rcx, 0xb24459ff74d6ba57
mov rsi, rax
add rcx, rdi
xor rsi, rcx
xor rsi, rbx
cmp rbx, r14
jae 0x140058d0b
nop word [rax + rax]
mov rcx, qword [0x1403b5a90]
mov rdx, rbx
call fcn.14007e430
xor rsi, rax
add rbx, 8
cmp rbx, r14
jb 0x140058cf0
mov rcx, qword [0x1403b5a90]
lea rdx, [r15 + 0x10]
xor ebp, esi
xor ebp, r14d
xor ebp, 0x8b2945a8
mov r8d, ebp
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
jmp fcn.14007e5f0
Function at 0x1400824e4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14008252e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14008252e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14008252e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14008252e
cmp dword [rcx + 0x84], 0xe
jbe 0x14008252e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140082530
xor al, al
add rsp, 0x28
ret
Function at 0x140025af0
Capabilities:
Initialize winsock library

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x1d8
mov rsi, rcx
mov rax, qword [0x14035bae8]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
test dl, dl
mov eax, 0x6879d675
mov ebp, 0xbb3a05a3
cmovne ebp, eax
mov eax, 0x463d2204
lea r14, [0x14035dca0]
lea rbx, [rsp + 0x38]
mov r15, qword [sym.imp.WS2_32.dll_WSAStartup]
mov edi, 0x20f6e930
cmp eax, 0x45f90ab8
jle 0x140025c30
cmp eax, 0x45f90ab9
je 0x140025c4c
cmp eax, 0x6879d675
je 0x140025c53
cmp eax, 0x463d2204
jne 0x140025b40
mov eax, 0x77d2470b
nop dword [rax]
cmp eax, 0xa833eb42
jg 0x140025bb0
cmp eax, 0x8edaf88f
je 0x140025bde
cmp eax, 0x90ea418f
je 0x140025c65
cmp eax, 0xa2c6d28c
jne 0x140025b70
mov ecx, dword [rsp + 0x24]
mov rdx, rbx
call r15
xchg dword [0x14035dca4], eax
mov rax, qword [rsp + 0x28]
mov eax, 0x90ea418f
jmp 0x140025b70
cmp eax, 0x77d2470b
je 0x140025bfb
cmp eax, 0x20f6e930
je 0x140025c05
cmp eax, 0xa833eb43
jne 0x140025b70
mov eax, 1
lock xadd dword [0x14035dca0], eax
test eax, eax
mov eax, 0x90ea418f
cmove eax, edi
jmp 0x140025b70
mov rax, qword [rsp + 0x30]
shl eax, 8
movzx eax, ax
or eax, dword [rsp + 0x20]
mov dword [rsp + 0x24], eax
mov eax, 0xa2c6d28c
jmp 0x140025b70
mov eax, 0xa833eb43
jmp 0x140025b70
mov qword [rsp + 0x28], rbx
mov rax, qword [rsp + 0x28]
mov dword [rsp + 0x20], 2
mov qword [rsp + 0x30], 2
mov eax, 0x8edaf88f
jmp 0x140025b70
cmp eax, 0xbb3a05a3
je 0x140025c6f
cmp eax, 0xd9a098ba
jne 0x140025b40
mov eax, 0xbb3a05a3
jmp 0x140025b40
mov eax, ebp
jmp 0x140025b40
mov rcx, r14
call fcn.140054ac0
mov eax, 0xd9a098ba
jmp 0x140025b40
mov eax, 0x45f90ab9
jmp 0x140025b40
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.1402e6030
mov rax, rsi
add rsp, 0x1d8
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140062d10
Capabilities:
Terminate thread

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov rsi, rcx
mov rax, qword [0x14035bae8]
xor rax, rsp
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x38], rax
lea rbx, [rsi + 8]
mov eax, 0x837f7110
mov r15, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r12d, 0x31cd2304
mov r13, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdi, [method.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.virtual_8]
mov rbp, qword [sym.imp.KERNEL32.dll_QueueUserAPC]
mov r14, qword [sym.imp.KERNEL32.dll_TerminateThread]
jmp 0x140062d90
mov rax, qword [rsp + 0x48]
mov eax, 0x781f96ca
nop word cs:[rax + rax]
nop
cmp eax, 0x31cd2303
jg 0x140062de0
cmp eax, 0xfda73d96
jle 0x140062e10
cmp eax, 0xfda73d97
je 0x140062e60
cmp eax, 0x185e4dd
je 0x140062e6a
cmp eax, 0x1b18844d
jne 0x140062d90
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
mov edx, 0xffffffff
call r13
mov eax, 0xd0a3ab9f
jmp 0x140062d90
cmp eax, 0x5266c44f
jle 0x140062e30
cmp eax, 0x5266c450
je 0x140062d7a
cmp eax, 0x68801f96
jne 0x140062f2d
mov rcx, qword [rsp + 0x58]
xor edx, edx
call r14
mov eax, 0xfda73d97
jmp 0x140062d90
cmp eax, 0x837f7110
je 0x140062eaf
cmp eax, 0xd0a3ab9f
jne 0x140062d90
mov eax, 0x5266c450
jmp 0x140062d90
cmp eax, 0x31cd2304
je 0x140062efd
cmp eax, 0x47c5c2c6
jne 0x140062d90
mov rax, qword [rsp + 0x30]
mov rdx, qword [rax]
mov rcx, rdi
xor r8d, r8d
call rbp
mov eax, 0x1b18844d
jmp 0x140062d90
mov eax, 0x5266c450
jmp 0x140062d90
mov rcx, qword [rsp + 0x50]
call r15
mfence
mov eax, dword [0x14035dca8]
mov dword [rsp + 0x44], eax
mov ecx, 0xbf430f45
mov al, byte [rsp + 0x2f]
nop dword [rax + rax]
cmp ecx, 0xe769e722
je 0x140062f14
cmp ecx, 0xbf430f45
jne 0x140062e90
cmp dword [rsp + 0x44], 0
setne al
mov ecx, 0xe769e722
jmp 0x140062e90
mov rax, qword [rsi + 0x10]
mov rcx, qword [rsp + 0x38]
mov qword [rcx], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x30], rbx
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx]
mov qword [rax + 8], rcx
mov rdx, qword [rsp + 0x38]
mov ecx, 2
xor r8d, r8d
mov r9d, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov rax, qword [rsi + 0x10]
mov qword [rsp + 0x50], rax
mov eax, 0x185e4dd
jmp 0x140062d90
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x58], rax
mov eax, 0x68801f96
jmp 0x140062d90
and al, 1
mov byte [rsp + 0x2f], al
cmp byte [rsp + 0x2f], 0
mov eax, 0x47c5c2c6
cmovne eax, r12d
jmp 0x140062d90
cmp eax, 0x781f96ca
jne 0x140062d90
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1402e6030
nop
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14007da10
Capabilities:
Connect socket

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rsi, r9
mov r14, r8
mov r12, rdx
mov rdi, rcx
cmp rcx, 0xffffffffffffffff
mov eax, 0xfbdde373
mov ebx, 0xccc0e14e
cmove ebx, eax
mov eax, 0xf7ad5d99
mov r13d, 0xf927b769
mov r15d, 0x82bf0231
nop
cmp eax, 0xf7ad5d98
jle 0x14007db20
cmp eax, 0x4e2b83e0
jg 0x14007db60
cmp eax, 0xf7ad5d99
je 0x14007db7d
cmp eax, 0xfbdde373
jne 0x14007da50
mov eax, dword [0x14035dff8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
sete byte [rsp + 0x23]
mov ecx, dword [0x14035dffc]
mov eax, 0xab16c8e1
cmove eax, r13d
cmp ecx, 0xa
setl byte [rsp + 0x28]
cmovl eax, r13d
mov ecx, 0x2334ec52
nop dword [rax]
cmp ecx, 0xe40631bc
jle 0x14007daf0
cmp ecx, 0xe40631bd
je 0x14007db87
cmp ecx, 0xf927b769
je 0x14007db07
cmp ecx, 0x2334ec52
jne 0x14007dab0
movzx edx, byte [rsp + 0x23]
cmp byte [rsp + 0x28], 0
mov ecx, 0xab16c8e1
cmovne ecx, r15d
test dl, dl
cmovne ecx, r15d
jmp 0x14007dab0
cmp ecx, 0x82bf0231
je 0x14007db0e
cmp ecx, 0xab16c8e1
jne 0x14007dab0
mov ecx, 0x82bf0231
jmp 0x14007dab0
mov ecx, 0xe40631bd
jmp 0x14007dab0
mov ecx, eax
jmp 0x14007dab0
cmp eax, 0xaa61f56a
je 0x14007dc4f
cmp eax, 0xccc0e14e
je 0x14007dbd9
cmp eax, 0xd327ad9b
jne 0x14007da50
mov dl, byte [rsp + 0x22]
mov rcx, rsi
call fcn.14004d100
mov eax, 0xaa61f56a
mov ebp, dword [rsp + 0x24]
jmp 0x14007da50
cmp eax, 0x7e4b7922
je 0x14007dbf7
cmp eax, 0x4e2b83e1
jne 0x14007da50
mov eax, ebx
jmp 0x14007da50
mov eax, 0x4e2b83e1
jmp 0x14007da50
lea rax, [0x140352178]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov eax, 0x81f06290
nop word cs:[rax + rax]
nop dword [rax]
cmp eax, 0xdf872f88
je 0x14007dc06
cmp eax, 0x81f06290
jne 0x14007dbb0
mov r8, qword [rsp + 0x28]
lea rcx, [rsp + 0x30]
mov edx, 0x2719
call fcn.14004d720
mov eax, 0xdf872f88
jmp 0x14007dbb0
mov eax, 0x216bae2d
nop
cmp eax, 0x216bae2d
je 0x14007dbf0
cmp eax, 0x52ba214b
jne 0x14007dbe0
jmp 0x14007dc21
mov eax, 0x52ba214b
jmp 0x14007dbe0
mov eax, 0xaa61f56a
mov ebp, 0xffffffff
jmp 0x14007da50
mov rax, qword [rsp + 0x40]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rsi], xmm0
mov eax, 0x7e4b7922
jmp 0x14007da50
mov dword [rsp + 0x30], r14d
mov r8d, dword [rsp + 0x30]
mov rcx, rdi
mov rdx, r12
call qword [sym.imp.WS2_32.dll_connect]
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0
setne byte [rsp + 0x22]
mov eax, 0xd327ad9b
jmp 0x14007da50
mov eax, ebp
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400807d0
Capabilities:
Set socket configuration

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov rsi, r9
mov edi, r8d
mov ebx, edx
mov ebp, ecx
mov rax, qword [0x14035bae8]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov eax, 0x81baadef
mov r15, qword [sym.imp.WS2_32.dll_setsockopt]
mov r12d, 0x34b65a22
lea r13, [rsp + 0x4c]
mov r14d, 0xf66456cc
jmp 0x140080830
mov qword [rsp + 0x40], r13
mov rax, qword [rsp + 0x40]
mov dword [rsp + 0x4c], 0
mov eax, 0xb52fcde4
nop
cmp eax, 0xf66456cb
jg 0x140080880
cmp eax, 0xc210aa74
jg 0x1400808b0
cmp eax, 0x81baadef
je 0x140080906
cmp eax, 0xb52fcde4
jne 0x140080960
mov rcx, qword [rsp + 0x38]
mov r9, qword [rsp + 0x40]
mov dword [rsp + 0x20], 4
mov edx, 0x29
mov r8d, 0x1b
call r15
mov rax, qword [rsp + 0x40]
mov eax, 0xe3cb6581
jmp 0x140080830
cmp eax, 0x34b65a21
jg 0x1400808d0
cmp eax, 0xf66456cc
je 0x140080943
cmp eax, 0x154793c
jne 0x140080830
cmp ebp, 0x17
sete byte [rsp + 0x37]
mov eax, 0xc210aa75
jmp 0x140080830
cmp eax, 0xc210aa75
je 0x14008094d
cmp eax, 0xe3cb6581
jne 0x140080830
mov eax, 0xac5242e8
jmp 0x140080830
cmp eax, 0x34b65a22
je 0x140080818
cmp eax, 0x673a1639
jne 0x140080830
movzx edx, byte [rsp + 0x36]
mov rcx, rsi
call fcn.14004d100
cmp byte [rsp + 0x36], 0
mov eax, 0x154793c
cmovne eax, r14d
jmp 0x140080830
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0
mov ecx, ebp
mov edx, ebx
mov r8d, edi
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_WSASocketW]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp rax, 0xffffffffffffffff
sete byte [rsp + 0x36]
mov eax, 0x673a1639
jmp 0x140080830
mov eax, 0xac5242e8
jmp 0x140080830
cmp byte [rsp + 0x37], 0
mov eax, 0xe3cb6581
cmovne eax, r12d
jmp 0x140080830
cmp eax, 0xac5242e8
jne 0x140080830
mov rsi, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1402e6030
mov rax, rsi
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140082d00
Capabilities:
Resolve dns

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x60
mov r12, r9
mov r13, rcx
mov r15, qword [rsp + 0xc8]
mov r14, qword [rsp + 0xc0]
mov rax, qword [0x14035bae8]
xor rax, rsp
mov qword [rsp + 0x58], rax
test r8, r8
mov eax, 0x87049487
mov esi, 0x246b670b
cmove esi, eax
test rdx, rdx
mov eax, 0x9dc22725
mov ecx, 0x73b97cca
cmove ecx, eax
mov eax, 0xa2472efc
jmp 0x140082d70
mov eax, 0x87049487
mov rbx, qword [rsp + 0x30]
nop word cs:[rax + rax]
nop
cmp eax, 0x40a50c34
jle 0x140082db0
cmp eax, 0x73b97cc9
jle 0x140082dd0
cmp eax, 0x73b97cca
je 0x140082e15
cmp eax, 0x75de552b
je 0x140082d5b
cmp eax, 0x7704fc77
jne 0x140082d70
cmp byte [rsp + 0x2e], 0
mov edi, 0
cmovne rdi, rdx
mov eax, 0x9dc22725
jmp 0x140082d70
cmp eax, 0xbeac5225
jg 0x140082df0
cmp eax, 0x9dc22725
je 0x140082e26
cmp eax, 0xa2472efc
jne 0x140082e63
mov eax, 0x4109756c
jmp 0x140082d70
cmp eax, 0x40a50c35
je 0x140082e32
cmp eax, 0x4109756c
jne 0x140082d70
xor edi, edi
mov eax, ecx
jmp 0x140082d70
cmp eax, 0xbeac5226
je 0x140082e46
cmp eax, 0x246b670b
jne 0x140082d70
cmp byte [r8], 0
setne byte [rsp + 0x2f]
mov eax, 0xbeac5226
jmp 0x140082d70
movzx eax, byte [rdx]
mov byte [rsp + 0x2d], al
mov eax, 0x40a50c35
jmp 0x140082d70
mov r9, rdi
xor ebx, ebx
mov eax, esi
jmp 0x140082d70
cmp byte [rsp + 0x2d], 0
setne byte [rsp + 0x2e]
mov eax, 0x7704fc77
jmp 0x140082d70
cmp byte [rsp + 0x2f], 0
mov eax, 0
cmovne rax, r8
mov qword [rsp + 0x30], rax
mov eax, 0x75de552b
jmp 0x140082d70
cmp eax, 0x87049487
jne 0x140082d70
mov qword [rsp + 0x38], r9
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov rcx, qword [rsp + 0x38]
mov rdx, rbx
mov r8, r12
mov r9, r14
call qword [sym.imp.WS2_32.dll_getaddrinfo]
lea rcx, [rsp + 0x40]
mov edx, eax
call fcn.140083e80
mov rax, qword [rsp + 0x50]
mov qword [r15 + 0x10], rax
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [r15], xmm0
mov rax, qword [rsp + 0x50]
mov qword [r13 + 0x10], rax
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [r13], xmm0
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1402e6030
mov rax, r13
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14009c660
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov edi, edx
mov rsi, rcx
mov eax, 0x9fd65ff7
mov ebx, 0x7ddd5a7b
mov ebp, 0x47a543d5
nop dword [rax]
cmp eax, 0xfee8c3be
jle 0x14009c6e0
cmp eax, 0xfee8c3bf
je 0x14009c6f5
cmp eax, 0x47a543d5
je 0x14009c789
cmp eax, 0x7ddd5a7b
jne 0x14009c680
mov eax, 0x7ad2b2bc
nop word cs:[rax + rax]
nop
cmp eax, 0xcdc3c7df
je 0x14009c71b
cmp eax, 0x7ad2b2bc
jne 0x14009c6b0
mov dword [rsi + 0x1384], 0xffffffff
mov rcx, rsi
mov edx, edi
mov r8d, 0x6c078965
call fcn.1400a9a30
mov eax, 0xcdc3c7df
jmp 0x14009c6b0
cmp eax, 0x897a3be2
je 0x14009c741
cmp eax, 0x9fd65ff7
jne 0x14009c680
mov eax, 0xfee8c3bf
jmp 0x14009c680
mov eax, dword [0x14035ce20]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x897a3be2
cmove eax, ebx
cmp dword [0x14035ce24], 0xa
cmovl eax, ebx
jmp 0x14009c680
mov eax, dword [0x14035ce20]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x897a3be2
cmove eax, ebp
cmp dword [0x14035ce24], 0xa
cmovl eax, ebp
jmp 0x14009c680
mov eax, 0x7ad2b2bc
nop word cs:[rax + rax]
cmp eax, 0xcdc3c7df
je 0x14009c77f
cmp eax, 0x7ad2b2bc
jne 0x14009c750
mov dword [rsi + 0x1384], 0xffffffff
mov rcx, rsi
mov edx, edi
mov r8d, 0x6c078965
call fcn.1400a9a30
mov eax, 0xcdc3c7df
jmp 0x14009c750
mov eax, 0x7ddd5a7b
jmp 0x14009c680
mov rax, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x1400aa620
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rsi, rcx
mov qword [rsp + 0x40], rcx
mov eax, 0x8be284b8
mov ebp, 0xfa17b0fa
mov ebx, 0xd01b43c7
jmp 0x1400aa680
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
mov ecx, dword [rcx]
lea edx, [rcx + 1]
mov rdi, qword [rsp + 0x38]
mov dword [rdi], edx
mov eax, dword [rax + rcx*4 + 4]
mov ecx, eax
shr ecx, 0xb
and ecx, dword [rsi + 0x1384]
xor ecx, eax
mov dword [rsp + 0x34], ecx
mov eax, 0x33568f82
nop word cs:[rax + rax]
nop dword [rax + rax]
cmp eax, 0xfa17b0f9
jg 0x1400aa6c0
cmp eax, 0xc1f121ff
jle 0x1400aa6f0
cmp eax, 0xc1f12200
je 0x1400aa75c
cmp eax, 0xd01b43c7
je 0x1400aa76e
cmp eax, 0xf425b73a
jne 0x1400aa680
mov eax, dword [rsp + 0x30]
cmp eax, 0x4e0
setae byte [rsp + 0x2f]
mov eax, 0x5360f40f
jmp 0x1400aa680
cmp eax, 0x33568f81
jle 0x1400aa740
cmp eax, 0x485aa887
je 0x1400aa780
cmp eax, 0x5360f40f
jne 0x1400aa79c
cmp byte [rsp + 0x2f], 0
mov eax, 0x82af8ec8
cmovne eax, ebx
jmp 0x1400aa680
cmp eax, 0x82af8ec8
je 0x1400aa641
cmp eax, 0x8be284b8
jne 0x1400aa680
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov eax, dword [rax]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x30]
cmp eax, 0x270
sete byte [rsp + 0x2e]
mov eax, 0xc1f12200
jmp 0x1400aa680
cmp eax, 0xfa17b0fa
je 0x1400aa78a
cmp eax, 0x1535c95b
jne 0x1400aa680
mov eax, 0x82af8ec8
jmp 0x1400aa680
cmp byte [rsp + 0x2e], 0
mov eax, 0xf425b73a
cmovne eax, ebp
jmp 0x1400aa680
mov rcx, rsi
call fcn.1400aa950
mov eax, 0x485aa887
jmp 0x1400aa680
mov eax, 0x82af8ec8
jmp 0x1400aa680
mov rcx, rsi
call fcn.1400aa7e0
mov eax, 0x1535c95b
jmp 0x1400aa680
cmp eax, 0x33568f82
jne 0x1400aa680
mov eax, dword [rsp + 0x34]
shl eax, 7
and eax, 0x9d2c5680
xor eax, dword [rsp + 0x34]
mov ecx, eax
shl ecx, 0xf
and ecx, 0xefc60000
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
ret