joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140100100
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x140]
sub rsp, 0x240
mov rax, qword [0x14032aa00]
xor rax, rsp
mov qword [rbp + 0x130], rax
lea rsi, [rcx + 0xf0]
mov rdx, rcx
lea rcx, [rbp + 0x40]
call fcn.1400d70e0
nop
cmp qword [rsi + 0x20], 0
je 0x1401002c8
mov rcx, qword [rsi + 0x28]
mov rax, qword [rcx + 0x18]
mov edi, 0xffffffff
test rax, rax
je 0x14010018e
lea rcx, [0x1400b5c90]
mov qword [rsp + 0x30], rcx
lea rcx, [rbp + 0x40]
mov qword [rsp + 0x38], rcx
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
lea rdx, [rsp + 0x30]
mov rcx, rsi
call rax
jmp 0x140100258
mov r14, qword [rcx + 0x10]
lea rdx, [rbp + 0x40]
lea rcx, [rsp + 0x50]
call fcn.1400d70e0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
mov ecx, dword [0x1403509d8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1401001c1
mov rdx, qword [rax + 8]
jmp 0x1401001c3
xor edx, edx
mov r9d, 8
mov r8d, 0x100
movzx ecx, byte [rsp + 0x20]
call fcn.1400aa770
mov rbx, rax
lea rcx, [rax + 8]
lea rdx, [rsp + 0x50]
call fcn.1400d70e0
lea rax, [0x1400b5cd0]
mov qword [rbx], rax
mov qword [rsp + 0x28], rbx
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x140100214
mov eax, edi
lock xadd dword [rcx + 0xc], eax
cmp eax, 1
jne 0x140100214
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
cmp byte [rbp - 0x40], 0
je 0x14010022f
cmp qword [rbp - 0x58], 0
je 0x14010022f
mov rax, qword [rbp - 0x60]
mov rdx, qword [rax]
lea rcx, [rbp - 0x78]
call rdx
nop
lea rcx, [rsp + 0x68]
call fcn.1400e1380
nop
lea rdx, [rsp + 0x28]
mov rcx, rsi
call r14
nop
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x140100258
mov rax, qword [rcx]
xor edx, edx
call rax
nop
mov rcx, qword [rbp + 0xd0]
test rcx, rcx
je 0x140100274
lock xadd dword [rcx + 0xc], edi
cmp edi, 1
jne 0x140100274
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
cmp byte [rbp + 0xb0], 0
je 0x140100298
cmp qword [rbp + 0x98], 0
je 0x140100298
mov rax, qword [rbp + 0x90]
mov rdx, qword [rax]
lea rcx, [rbp + 0x78]
call rdx
nop
lea rcx, [rbp + 0x58]
call fcn.1400e1380
mov rcx, qword [rbp + 0x130]
xor rcx, rsp
call fcn.1401ae6a0
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
lea rcx, [rsp + 0x30]
call fcn.1400d7910
nop
lea rcx, [rsp + 0x30]
call fcn.1400d01d0
int3
Function at 0x1401002e0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x150]
sub rsp, 0x250
mov rax, qword [0x14032aa00]
xor rax, rsp
mov qword [rbp + 0x140], rax
lea rsi, [rcx + 0xf8]
mov rdx, rcx
lea rcx, [rbp + 0x48]
call fcn.1400d72a0
nop
cmp qword [rsi + 0x20], 0
je 0x1401004ab
mov rcx, qword [rsi + 0x28]
mov rax, qword [rcx + 0x18]
mov edi, 0xffffffff
test rax, rax
je 0x14010036e
lea rcx, [0x1400b5dd0]
mov qword [rsp + 0x30], rcx
lea rcx, [rbp + 0x48]
mov qword [rsp + 0x38], rcx
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
lea rdx, [rsp + 0x30]
mov rcx, rsi
call rax
jmp 0x140100438
mov r14, qword [rcx + 0x10]
lea rdx, [rbp + 0x48]
lea rcx, [rsp + 0x50]
call fcn.1400d72a0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
mov ecx, dword [0x1403509d8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1401003a1
mov rdx, qword [rax + 8]
jmp 0x1401003a3
xor edx, edx
mov r9d, 8
mov r8d, 0x108
movzx ecx, byte [rsp + 0x20]
call fcn.1400aa770
mov rbx, rax
lea rcx, [rax + 8]
lea rdx, [rsp + 0x50]
call fcn.1400d72a0
lea rax, [0x1400b5e10]
mov qword [rbx], rax
mov qword [rsp + 0x28], rbx
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x1401003f4
mov eax, edi
lock xadd dword [rcx + 0xc], eax
cmp eax, 1
jne 0x1401003f4
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
cmp byte [rbp - 0x38], 0
je 0x14010040f
cmp qword [rbp - 0x50], 0
je 0x14010040f
mov rax, qword [rbp - 0x58]
mov rdx, qword [rax]
lea rcx, [rbp - 0x70]
call rdx
nop
lea rcx, [rsp + 0x70]
call fcn.1400e1380
nop
lea rdx, [rsp + 0x28]
mov rcx, rsi
call r14
nop
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x140100438
mov rax, qword [rcx]
xor edx, edx
call rax
nop
mov rcx, qword [rbp + 0xe0]
test rcx, rcx
je 0x140100454
lock xadd dword [rcx + 0xc], edi
cmp edi, 1
jne 0x140100454
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
cmp byte [rbp + 0xc0], 0
je 0x14010047b
cmp qword [rbp + 0xa8], 0
je 0x14010047b
mov rax, qword [rbp + 0xa0]
mov rdx, qword [rax]
lea rcx, [rbp + 0x88]
call rdx
nop
lea rcx, [rbp + 0x68]
call fcn.1400e1380
mov rcx, qword [rbp + 0x140]
xor rcx, rsp
call fcn.1401ae6a0
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
lea rcx, [rsp + 0x30]
call fcn.1400d7910
nop
lea rcx, [rsp + 0x30]
call fcn.1400d01d0
int3
Function at 0x14010a200
Capabilities:
Hash data using fnv

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x40
mov rbp, r8
mov r14, rdx
mov rsi, rcx
cmp rdx, r8
je 0x14010a405
mov rdx, qword [rcx + 0x18]
movabs r8, 0x100000001b3
mov qword [rsp + 0x60], rbx
movabs rax, 0xcbf29ce484222325
mov qword [rsp + 0x38], rdi
mov rbx, r14
mov qword [rsp + 0x30], r12
mov r12, qword [rcx + 8]
movzx ecx, byte [r14 + 0x10]
xor rcx, rax
mov qword [rsp + 0x28], r13
movzx eax, byte [r14 + 0x11]
mov r13, qword [r14 + 8]
imul rcx, r8
mov qword [rsp + 0x20], r15
xor rcx, rax
mov qword [rsp + 0x78], rdx
movzx eax, byte [r14 + 0x12]
imul rcx, r8
xor rcx, rax
movzx eax, byte [r14 + 0x13]
imul rcx, r8
xor rcx, rax
movzx eax, byte [r14 + 0x14]
imul rcx, r8
xor rcx, rax
movzx eax, byte [r14 + 0x15]
imul rcx, r8
xor rcx, rax
movzx eax, byte [r14 + 0x16]
imul rcx, r8
xor rcx, rax
movzx eax, byte [r14 + 0x17]
imul rcx, r8
xor rcx, rax
mov rax, qword [rsi + 0x30]
imul rcx, r8
and rax, rcx
shl rax, 4
add rax, rdx
mov qword [rsp + 0x68], rax
mov rcx, qword [rax]
mov r15, qword [rax + 8]
mov qword [rsp + 0x70], rcx
nop dword [rax + rax]
mov rcx, rbx
mov rdi, rbx
mov rbx, qword [rbx]
mov edx, 0x18
call fcn.1401ae118
dec qword [rsi + 0x10]
cmp rdi, r15
je 0x14010a319
cmp rbx, rbp
jne 0x14010a2e0
cmp qword [rsp + 0x70], r14
jne 0x14010a3e4
mov rcx, qword [rsp + 0x68]
mov qword [rcx], rbx
jmp 0x14010a3e4
mov rcx, qword [rsp + 0x68]
cmp qword [rsp + 0x70], r14
jne 0x14010a32d
mov qword [rcx], r12
mov rax, r12
jmp 0x14010a330
mov rax, r13
mov qword [rcx + 8], rax
cmp rbx, rbp
je 0x14010a3e4
nop dword [rax]
movzx r15d, byte [rbx + 0x10]
movabs rdx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r15, rax
movzx eax, byte [rbx + 0x11]
imul r15, rdx
xor r15, rax
movzx eax, byte [rbx + 0x12]
imul r15, rdx
xor r15, rax
movzx eax, byte [rbx + 0x13]
imul r15, rdx
xor r15, rax
movzx eax, byte [rbx + 0x14]
imul r15, rdx
xor r15, rax
movzx eax, byte [rbx + 0x15]
imul r15, rdx
xor r15, rax
movzx eax, byte [rbx + 0x16]
imul r15, rdx
xor r15, rax
movzx eax, byte [rbx + 0x17]
imul r15, rdx
xor r15, rax
imul r15, rdx
and r15, qword [rsi + 0x30]
shl r15, 4
add r15, qword [rsp + 0x78]
mov r14, qword [r15 + 8]
nop
mov rcx, rbx
mov rdi, rbx
mov rbx, qword [rbx]
mov edx, 0x18
call fcn.1401ae118
dec qword [rsi + 0x10]
cmp rdi, r14
je 0x14010a411
cmp rbx, rbp
jne 0x14010a3c0
mov qword [r15], rbx
mov r12, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov r15, qword [rsp + 0x20]
mov qword [r13], rbx
mov qword [rbx + 8], r13
mov r13, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x60]
mov rax, rbp
add rsp, 0x40
pop r14
pop rsi
pop rbp
ret
mov qword [r15], r12
mov qword [r15 + 8], r12
cmp rbx, rbp
jne 0x14010a340
jmp 0x14010a3e4
Function at 0x14010bd10
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x70
xor eax, eax
lea rbx, [rcx + 0x28]
test rcx, rcx
mov ecx, dword [0x1403509d8]
cmove rbx, rax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14010be45
cmp qword [rax], rbx
je 0x14010bd4c
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x14010bd38
add rsp, 0x70
pop rbx
ret
mov rbx, qword [rax + 8]
test rbx, rbx
je 0x14010be45
mov ecx, dword [rbx + 0x50]
test ecx, ecx
je 0x14010be09
cmp ecx, 1
jne 0x14010be45
xorps xmm0, xmm0
mov dword [rbx + 0x50], 2
lea rdx, [rbx + 0x58]
lea rcx, [rsp + 0x30]
movdqu xmmword [rsp + 0x30], xmm0
call fcn.1401ad328
xorps xmm0, xmm0
lea rax, vtable.asio::multiple_exceptions.0
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x58]
movups xmmword [rsp + 0x48], xmm0
movdqu xmmword [rsp + 0x58], xmm0
call fcn.1401ad328
lea rcx, [rsp + 0x30]
call fcn.1401ad408
xorps xmm0, xmm0
lea rcx, [rsp + 0x20]
movdqu xmmword [rsp + 0x20], xmm0
call fcn.1401ad37c
lea r8, [0x140318a40]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.1401ad350
lea rcx, [rsp + 0x58]
call fcn.1401ad408
lea rax, vtable.std::exception.0
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x40], rax
call fcn.1401b032c
jmp 0x14010be2d
xorps xmm0, xmm0
mov dword [rbx + 0x50], 1
lea rcx, [rsp + 0x20]
movdqu xmmword [rsp + 0x20], xmm0
call fcn.1401ad37c
lea rcx, [rsp + 0x20]
call fcn.1401ad388
lea rdx, [rsp + 0x20]
lea rcx, [rbx + 0x58]
call fcn.1401ad320
lea rcx, [rsp + 0x20]
call fcn.1401ad408
add rsp, 0x70
pop rbx
ret
Function at 0x14010c390
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x14010c410
mov rax, qword [rbx + 0x38]
mov rdx, qword [rbx + 8]
shr rax, 3
mov qword [rsp + 0x38], rdi
cmp rax, rcx
jbe 0x14010c3d0
mov r8, rdx
mov rcx, rbx
mov rdx, qword [rdx]
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
jmp 0x140109fe0
lea rcx, [rbx + 8]
call fcn.140092710
mov rax, qword [rbx + 8]
lea r8, [rsp + 0x30]
mov qword [rax], rax
mov rax, qword [rbx + 8]
mov qword [rax + 8], rax
mov qword [rbx + 0x10], 0
mov rax, qword [rbx + 8]
mov rdx, qword [rbx + 0x20]
mov rcx, qword [rbx + 0x18]
mov qword [rsp + 0x30], rax
call fcn.140009050
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret

Function at 0x14010c490
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [rcx]
mov rbx, rcx
test rax, rax
je 0x14010c514
mov rcx, qword [rax]
test rcx, rcx
je 0x14010c514
mov rax, qword [rcx]
lea rdx, [rsp + 0x20]
call qword [rax + reloc.WS2_32.dll_htonl]
mov ecx, dword [0x1403509d8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14010c4cb
mov rdx, qword [rax + 8]
jmp 0x14010c4cd
xor edx, edx
mov r9, qword [rsp + 0x28]
mov r8, qword [rsp + 0x20]
cmp r9, 0x3fc
ja 0x14010c502
test rdx, rdx
je 0x14010c502
mov ecx, 6
mov eax, ecx
nop dword [rax]
cmp qword [rdx + rax*8], 0
je 0x14010c51a
inc ecx
inc rax
cmp rax, 8
jl 0x14010c4f0
mov rcx, r8
call fcn.1401c23c4
mov rax, qword [rbx]
mov qword [rax], 0
add rsp, 0x30
pop rbx
ret
movzx eax, byte [r8 + r9]
mov byte [r8], al
movsxd rax, ecx
mov qword [rdx + rax*8], r8
mov rax, qword [rbx]
mov qword [rax], 0
add rsp, 0x30
pop rbx
ret
Function at 0x14010c730
Capabilities:
Set socket configuration

Disassembly:
mov r11, rsp
push rbp
push rdi
push r12
push r15
sub rsp, 0x48
xor r12d, r12d
mov rdi, r9
mov r15, rdx
mov rbp, rcx
cmp rcx, 0xffffffffffffffff
je 0x14010c87c
mov qword [r11 + 0x18], rsi
mov qword [r11 - 0x28], r14
test r8b, r8b
je 0x14010c79b
movzx eax, byte [rdx]
test al, 8
je 0x14010c79b
or al, 8
mov dword [r11 + 8], r12d
mov byte [rdx], al
lea r9, [r11 + 8]
mov edx, 0xffff
mov dword [rsp + 0x20], 4
mov r8d, 0x80
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x14010c79b
call fcn.14004cfa0
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_closesocket]
lea r14, [rdi + 8]
mov esi, eax
test eax, eax
jne 0x14010c7b6
mov dword [rdi], r12d
jmp 0x14010c841
mov qword [rsp + 0x78], rbx
call fcn.14004cfa0
mov rbx, rax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x38], rbx
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rdi], xmm0
call fcn.14004cfa0
mov rcx, qword [r14]
mov rax, qword [rax + 8]
cmp qword [rcx + 8], rax
jne 0x14010c7f4
cmp dword [rdi], 0x2733
je 0x14010c80e
call fcn.14004cfa0
mov rcx, qword [r14]
mov rax, qword [rax + 8]
cmp qword [rcx + 8], rax
jne 0x14010c878
cmp dword [rdi], 0x4d5
jne 0x14010c878
lea r8, [rsp + 0x70]
mov dword [rsp + 0x70], r12d
mov edx, 0x8004667e
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_ioctlsocket]
and byte [r15], 0xfc
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_closesocket]
mov esi, eax
test eax, eax
jne 0x14010c859
mov dword [rdi], r12d
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
mov r14, qword [rsp + 0x40]
add rsp, 0x48
pop r15
pop r12
pop rdi
pop rbp
ret
call fcn.14004cfa0
mov rbx, rax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x38], rbx
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rdi], xmm0
mov eax, esi
jmp 0x14010c83c
mov eax, r12d
add rsp, 0x48
pop r15
pop r12
pop rdi
pop rbp
ret
Function at 0x14010c890
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rbx, qword [rcx]
mov rdi, rcx
cmp rbx, 0xffffffffffffffff
je 0x14010c937
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_closesocket]
test eax, eax
je 0x14010c937
mov qword [rsp + 0x38], rbp
call fcn.14004cfa0
mov rbp, rax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
call fcn.14004cfa0
mov rcx, qword [rax + 8]
cmp qword [rbp + 8], rcx
jne 0x14010c8e8
cmp esi, 0x2733
je 0x14010c8ff
call fcn.14004cfa0
mov rax, qword [rax + 8]
cmp qword [rbp + 8], rax
jne 0x14010c932
cmp esi, 0x4d5
jne 0x14010c932
lea r8, [rsp + 0x30]
mov dword [rsp + 0x30], 0
mov edx, 0x8004667e
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_closesocket]
test eax, eax
je 0x14010c932
call fcn.14004cfa0
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rdi + 8]
cmp rbx, 0xffffffffffffffff
je 0x14010c9bf
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_closesocket]
test eax, eax
je 0x14010c9bf
call fcn.14004cfa0
mov rsi, rax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
call fcn.14004cfa0
mov rcx, qword [rax + 8]
cmp qword [rsi + 8], rcx
jne 0x14010c975
cmp edi, 0x2733
je 0x14010c98c
call fcn.14004cfa0
mov rax, qword [rax + 8]
cmp qword [rsi + 8], rax
jne 0x14010c9bf
cmp edi, 0x4d5
jne 0x14010c9bf
lea r8, [rsp + 0x30]
mov dword [rsp + 0x30], 0
mov edx, 0x8004667e
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_closesocket]
test eax, eax
je 0x14010c9bf
call fcn.14004cfa0
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x14010caa0
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, rdx
mov rbx, rcx
mov edx, dword [rdx]
sub edx, 0x79
je 0x14010cae7
sub edx, 0x450
je 0x14010cadd
sub edx, 6
je 0x14010cad3
cmp edx, 1
jne 0x14010cb01
mov dword [rsp + 0x30], 0x2751
jmp 0x14010caef
mov dword [rsp + 0x30], 0x2743
jmp 0x14010caef
mov dword [rsp + 0x30], 0x274d
jmp 0x14010caef
mov dword [rsp + 0x30], 0x274c
call fcn.14004cfa0
mov qword [rsp + 0x38], rax
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rdi], xmm0
cmp dword [rdi], 0
jne 0x14010cb80
cmp rbx, 0xffffffffffffffff
jne 0x14010cb31
mov dword [rsp + 0x30], 0x2719
call fcn.14004cfa0
mov qword [rsp + 0x38], rax
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rdi], xmm0
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
xor r9d, r9d
mov dword [rsp + 0x20], 0
mov edx, 0xffff
mov r8d, 0x7010
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jne 0x14010cb61
mov dword [rdi], eax
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
call fcn.14004cfa0
mov rbx, rax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x38], rbx
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rdi], xmm0
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x14010cde0
Capabilities:
Connect socket

Disassembly:
push rdi
sub rsp, 0x30
mov rdi, r9
cmp rcx, 0xffffffffffffffff
jne 0x14010ce14
mov dword [rsp + 0x20], 0x2719
call fcn.14004cfa0
mov qword [rsp + 0x28], rax
mov eax, 0xffffffff
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rdi], xmm0
add rsp, 0x30
pop rdi
ret
mov qword [rsp + 0x48], rsi
call qword [sym.imp.WS2_32.dll_connect]
mov esi, eax
test eax, eax
jne 0x14010ce32
mov rsi, qword [rsp + 0x48]
mov dword [rdi], eax
add rsp, 0x30
pop rdi
ret
mov qword [rsp + 0x40], rbx
call fcn.14004cfa0
mov rbx, rax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [rsp + 0x20], eax
mov eax, esi
mov rsi, qword [rsp + 0x48]
mov qword [rsp + 0x28], rbx
movups xmm0, xmmword [rsp + 0x20]
mov rbx, qword [rsp + 0x40]
movups xmmword [rdi], xmm0
add rsp, 0x30
pop rdi
ret

Function at 0x14011ad30
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov r10, rdx
lea rdi, [0x1402099d0]
movabs rax, 0xaaaaaaaaaaaaaaab
mov rbx, rcx
mul r8
mov r9, rcx
shr rdx, 1
mov r11, rdx
je 0x14011adc4
nop
movzx eax, byte [r10]
shr rax, 2
movzx eax, byte [rax + rdi]
mov byte [r9], al
movzx eax, byte [r10 + 1]
movsx ecx, byte [r10]
shr eax, 4
and ecx, 3
shl ecx, 4
add ecx, eax
movzx eax, byte [rcx + rdi]
mov byte [r9 + 1], al
movzx eax, byte [r10 + 2]
movsx ecx, byte [r10 + 1]
shr eax, 6
and ecx, 0xf
lea eax, [rax + rcx*4]
movzx eax, byte [rax + rdi]
mov byte [r9 + 2], al
movsx rax, byte [r10 + 2]
add r10, 3
and eax, 0x3f
movzx eax, byte [rax + rdi]
mov byte [r9 + 3], al
add r9, 4
sub r11, 1
jne 0x14011ad60
lea rax, [rdx + rdx*2]
sub r8, rax
sub r8, 1
je 0x14011ae19
cmp r8, 1
jne 0x14011ae45
movzx eax, byte [r10]
shr rax, 2
movzx eax, byte [rax + rdi]
mov byte [r9], al
movsx ecx, byte [r10]
movzx eax, byte [r10 + 1]
and ecx, 3
shr eax, 4
shl ecx, 4
add ecx, eax
movzx eax, byte [rcx + rdi]
mov byte [r9 + 1], al
movsx rax, byte [r10 + 1]
and eax, 0xf
movzx eax, byte [rdi + rax*4]
mov byte [r9 + 2], al
mov byte [r9 + 3], 0x3d
jmp 0x14011ae41
movzx eax, byte [r10]
shr rax, 2
movzx eax, byte [rax + rdi]
mov byte [r9], al
movsx rax, byte [r10]
and eax, 3
add rax, rax
movzx eax, byte [rdi + rax*8]
mov byte [r9 + 1], al
mov word [r9 + 2], 0x3d3d
add r9, 4
mov rdi, qword [rsp + 0x10]
sub r9, rbx
mov rbx, qword [rsp + 8]
mov rax, r9
ret
Function at 0x14011b110
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x28
movzx r8d, byte [rdx]
mov r10, rcx
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r8, rax
mov r11, rdx
movzx eax, byte [rdx + 1]
mov r9, qword [r10 + 8]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 2]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 3]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 4]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 5]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 6]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 7]
mov rdx, qword [r10 + 0x30]
imul r8, rcx
xor r8, rax
imul r8, rcx
and rdx, r8
shl rdx, 4
add rdx, qword [r10 + 0x18]
mov rcx, qword [rdx + 8]
cmp rcx, r9
je 0x14011b1c1
mov rax, qword [r11]
mov r8, qword [rdx]
cmp rax, qword [rcx + 0x10]
je 0x14011b1c3
nop
cmp rcx, r8
je 0x14011b1c1
mov rcx, qword [rcx + 8]
cmp rax, qword [rcx + 0x10]
jne 0x14011b1b0
jmp 0x14011b1c3
xor ecx, ecx
test rcx, rcx
je 0x14011b21e
mov rax, qword [rdx]
cmp qword [rdx + 8], rcx
jne 0x14011b1e9
cmp rax, rcx
jne 0x14011b1df
mov qword [rdx], r9
mov qword [rdx + 8], r9
jmp 0x14011b1f4
mov r9, qword [rcx + 8]
mov qword [rdx + 8], r9
jmp 0x14011b1f4
cmp rax, rcx
jne 0x14011b1f4
mov rax, qword [rcx]
mov qword [rdx], rax
mov rdx, qword [rcx]
dec qword [r10 + 0x10]
mov rax, qword [rcx + 8]
mov qword [rax], rdx
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
mov edx, 0x18
call fcn.1401ae118
mov eax, 1
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret
Function at 0x14011d370
Capabilities:
Contain obfuscated stackstrings
Encrypt data using salsa20 or chacha

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rax - 0x5f]
sub rsp, 0xd0
movaps xmmword [rax - 0x28], xmm6
movaps xmmword [rax - 0x38], xmm7
movaps xmmword [rax - 0x48], xmm8
movaps xmmword [rax - 0x58], xmm9
mov rax, qword [0x14032aa00]
xor rax, rsp
mov qword [rbp - 9], rax
mov eax, dword [rcx + 0x40]
mov rdi, rcx
mov dword [rbp - 0x39], eax
xor esi, esi
mov eax, dword [rcx + 0x44]
mov ebx, select
mov dword [rbp - 0x35], eax
mov eax, dword [rcx + 0x48]
lea r14, [rdi + 0x3c]
mov dword [rbp - 0x31], eax
mov eax, dword [rcx + 0x4c]
mov dword [rbp - 0x2d], eax
mov eax, dword [rcx + 0x50]
movdqu xmm9, xmmword [rbp - 0x39]
mov dword [rbp - 0x29], eax
mov eax, dword [rcx + 0x54]
mov dword [rbp - 0x25], eax
mov eax, dword [rcx + 0x58]
mov dword [rbp - 0x21], eax
mov eax, dword [rcx + 0x5c]
mov rcx, qword [rcx + 0x60]
mov dword [rbp - 0x1d], eax
mov rax, rcx
movdqu xmm8, xmmword [rbp - 0x29]
shr rax, 4
mov dword [rbp - 0x19], eax
lea rax, [rbp - 0xd]
shr rcx, 0x24
mov dword [rbp - 0x69], 0x61707865
mov dword [rbp - 0x65], 0x3320646e
mov dword [rbp - 0x61], 0x79622d32
mov dword [rbp - 0x5d], 0x6b206574
mov dword [rbp - 0x15], ecx
mov dword [rbp - 0xd], 0xdeadbeef
mov dword [rbp - 0x11], 0xdeadbeef
movdqu xmm7, xmmword [rbp - 0x19]
movdqu xmm6, xmmword [rbp - 0x69]
movdqu xmmword [rbp - 0x49], xmm6
cmp rdi, rax
ja 0x14011d479
lea rax, [rbp - 0x49]
cmp r14, rax
jb 0x14011d479
mov r8d, ebx
lea rdx, [rbp - 0x49]
sub r8, rsi
lea rcx, [rdi + rsi*4]
shl r8, 2
lea rdx, [rdx + rsi*4]
call fcn.1401e4900
mov rcx, rdi
call fcn.14010be50
jmp 0x14011d4a4
movups xmmword [rdi], xmm6
movups xmmword [rdi + 0x10], xmm9
movups xmmword [rdi + 0x20], xmm8
movups xmmword [rdi + 0x30], xmm7
mov rcx, rdi
call fcn.14010be50
lea rax, [rbp - 0xd]
cmp rdi, rax
ja 0x14011d4d1
lea rax, [rbp - 0x49]
cmp r14, rax
jb 0x14011d4d1
lea rdx, [rbp - 0x49]
mov rcx, rsi
sub rdx, rdi
lea rax, [rdi + rsi*4]
sub rbx, rcx
nop word [rax + rax]
mov ecx, dword [rdx + rax]
add dword [rax], ecx
lea rax, [rax + 4]
sub rbx, 1
jne 0x14011d4c0
jmp 0x14011d50b
movdqu xmm0, xmmword [rdi]
paddd xmm6, xmm0
movdqu xmmword [rdi], xmm6
movdqu xmm0, xmmword [rdi + 0x10]
paddd xmm9, xmm0
movdqu xmmword [rdi + 0x10], xmm9
movdqu xmm0, xmmword [rdi + 0x20]
paddd xmm8, xmm0
movdqu xmmword [rdi + 0x20], xmm8
movdqu xmm0, xmmword [rdi + 0x30]
paddd xmm7, xmm0
movdqu xmmword [rdi + 0x30], xmm7
mov rcx, qword [rbp - 9]
xor rcx, rsp
call fcn.1401ae6a0
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret