joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400b38e0
Capabilities:
Get file size
Read file on windows
Read file via mapping

Disassembly:
push rbx
push rbp
sub rsp, 0x48
mov rbp, rdx
mov rbx, rcx
test rcx, rcx
jne 0x1400b38fc
lea eax, [rcx + 0x28]
add rsp, 0x48
pop rbp
pop rbx
ret
mov qword [rsp + 0x68], rsi
xor r9d, r9d
mov qword [rsp + 0x40], r14
mov edx, 0x80000000
xor r14d, r14d
mov rcx, rbp
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
lea r8d, [r14 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x1400b3950
mov r14, qword [rsp + 0x40]
lea eax, [rsi + 2]
mov rsi, qword [rsp + 0x68]
add rsp, 0x48
pop rbp
pop rbx
ret
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x78], rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1400b3a75
mov rax, qword [rsp + 0x70]
cmp rax, 0x7fffffff
jg 0x1400b3a75
test rax, rax
je 0x1400b3a75
xor r9d, r9d
mov qword [rsp + 0x28], r14
xor edx, edx
mov dword [rsp + 0x20], r14d
mov rcx, rsi
lea r8d, [r9 + 2]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov rdi, rax
test rax, rax
je 0x1400b3a75
mov ecx, dword [rsp + 0x70]
xor r9d, r9d
mov dword [rbx + 8], ecx
xor r8d, r8d
mov rcx, rax
mov dword [rbx + 0xc], r14d
mov qword [rsp + 0x20], r14
lea edx, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rcx, rdi
mov qword [rbx], rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rbx], r14
je 0x1400b39ea
lea rax, [0x1400b3ad0]
jmp 0x1400b3a43
mov rcx, qword [rbx + 0x30]
xor edx, edx
movsxd r8, dword [rbx + 8]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbx], rax
test rax, rax
je 0x1400b3a75
mov edi, r14d
nop dword [rax + rax]
mov r8d, dword [rbx + 8]
lea r9, [rsp + 0x60]
mov edx, edi
sub r8d, edi
add rdx, qword [rbx]
mov rcx, rsi
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400b3a63
add edi, dword [rsp + 0x60]
cmp edi, dword [rbx + 8]
jne 0x1400b3a10
lea rax, [0x1400b3aa0]
mov rcx, rsi
mov qword [rbx + 0x28], rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rbx]
mov qword [rbx + 0x10], rax
xor eax, eax
mov qword [rbx + 0x18], rbp
mov qword [rbx + 0x20], r14
jmp 0x1400b3a8a
mov rcx, qword [rbx + 0x30]
xor edx, edx
mov r8, qword [rbx]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x51
mov qword [rbx], r14
mov qword [rbx + 8], r14
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x68]
mov r14, qword [rsp + 0x40]
add rsp, 0x48
pop rbp
pop rbx
ret
Function at 0x1400b5060
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov r9, rdx
test rdx, rdx
jne 0x1400b506b
xor eax, eax
ret
lea r11, [0x1400d9590]
not ecx
cmp r8d, 8
jb 0x1400b5141
mov r10d, r8d
shr r10, 3
nop word [rax + rax]
movzx edx, byte [r9]
mov eax, ecx
xor rdx, rax
shr ecx, 8
movzx eax, dl
add r8d, 0xfffffff8
movzx edx, byte [r9 + 1]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 2]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 3]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 4]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 5]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 6]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 7]
add r9, 8
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
xor ecx, dword [r11 + rax*4]
sub r10, 1
jne 0x1400b5090
test r8d, r8d
je 0x1400b516d
nop word [rax + rax]
movzx edx, byte [r9]
lea r9, [r9 + 1]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
xor ecx, dword [r11 + rax*4]
add r8d, 0xffffffff
jne 0x1400b5150
not ecx
mov eax, ecx
ret
Function at 0x1400b9c40
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400b9c8a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400b9c8a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400b9c8a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400b9c8a
cmp dword [rcx + 0x84], 0xe
jbe 0x1400b9c8a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400b9c8c
xor al, al
add rsp, 0x28
ret

Function at 0x1400b9e80
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x1400b9eba
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x1400b9ebf
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x1400b9f08
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x1400d9d70]
cmp byte [rcx + rax], 0
je 0x1400b9f08
dec r8
sub rdx, 1
jne 0x1400b9eee
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x14001a95c
Capabilities:
Hide graphical window

Disassembly:
mov r11, rsp
sub rsp, 0x68
and qword [r11 - 0x10], 0
mov rax, qword [0x1400e44b8]
lea rdx, str.516823_v3
mov qword [r11 - 0x18], rax
and qword [r11 - 0x20], 0
and qword [r11 - 0x28], 0
mov eax, 0x80000000
mov dword [rsp + 0x38], 0x64
mov dword [rsp + 0x30], 0x12c
mov dword [rsp + 0x28], eax
mov r9d, 0xcf0000
mov r8, rdx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_CreateWindowExW]
and qword [rsp + 0x58], 0
mov rcx, qword [0x1400e44b8]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], 1
mov qword [rsp + 0x40], rax
and dword [rsp + 0x38], 0
and dword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
lea rdx, [0x1400ab2e0]
mov r9d, 0x50b008c4
xor r8d, r8d
xor ecx, ecx
mov qword [0x1400e4510], rax
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov rcx, qword [0x1400e4510]
xor edx, edx
mov qword [0x1400e4508], rax
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x1400e4510]
xor edx, edx
add rsp, 0x68
jmp qword [sym.imp.USER32.dll_ShowWindow]
Function at 0x14001ab60
Capabilities:
Create process on windows
Get common file path
Set current directory

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r15
lea rbp, [rsp - 0x1ff70]
mov eax, 0x20070
call fcn.140038c40
sub rsp, rax
lea rcx, [rsp + 0x50]
mov rsi, rdx
call fcn.14001e640
lea rdx, [rsp + 0x70]
xor bl, bl
mov ecx, 0x7fff
mov byte [rbp + 0x1ffa0], bl
xor dil, dil
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea r8, [rbp + 0x1ffb0]
mov rdx, rsi
call fcn.14001a624
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x14004f0da
mov eax, dword [0x1400e4570]
test eax, eax
je 0x14001acf2
mov r15d, 1
lea rcx, [0x1400e6320]
cmp eax, r15d
je 0x14004f0fc
lea rax, [rbp + 0x1ffa0]
lea r8, [0x1400e4570]
lea rdx, [0x1400e4598]
mov qword [rsp + 0x20], rax
call fcn.14001cb64
test al, al
je 0x14001acfb
mov al, byte [0x1400e6320]
mov rcx, qword [0x1400e4598]
mov dil, byte [0x1400e6321]
lea r9, [rbp + 0x1ffb8]
lea r8, [rbp + 0xff70]
mov edx, 0x7fff
mov byte [0x1400e4574], al
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
mov rdx, qword [rbp + 0x1ffb8]
lea rcx, [0x1400e4550]
call fcn.14001edf8
mov bl, byte [rbp + 0x1ffa0]
mov r8d, dword [0x1400e4570]
lea rdx, [0x1400e4598]
call fcn.14000bdc0
test eax, eax
jne 0x14004f120
cmp dil, r15b
je 0x14004f143
call fcn.14001aa30
call fcn.14001a95c
cmp byte [0x1400e4574], 0
jne 0x14001ac9f
lea rcx, [0x1400e4f50]
call fcn.14000175c
lea rcx, [0x1400e45c0]
mov edx, r15d
call fcn.14000bea0
cmp byte [0x1400e4574], 0
jne 0x14001acc3
lea rcx, [0x1400e4f50]
call fcn.1400018ac
lea rcx, [0x1400e6320]
call fcn.14001cbfc
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea rcx, [rsp + 0x50]
call fcn.14001c29c
add rsp, 0x20070
pop r15
pop rdi
pop rsi
pop rbx
pop rbp
ret
or dword [0x1400e44c0], 0xffffffff
jmp 0x14001accf
mov dword [0x1400e44c0], r15d
jmp 0x14001accf
lea r8, [0x1400cf2a4]
lea rdx, str.This_is_a_third_party_compiled_516823_script.
mov r9d, reloc.WSOCK32.dll_recv
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
nop
jmp 0x14001acda
mov r8, qword [0x1400e4578]
or r9d, 0xffffffff
mov edx, r15d
call fcn.14001cab8
mov al, byte [0x1400e44c8]
mov byte [0x1400e6322], al
jmp 0x14001ac5c
lea rcx, [0x1400e6320]
call fcn.14001cbfc
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov dword [0x1400e44c0], r15d
jmp 0x14001acda
call fcn.1400749b0
test al, al
jne 0x14001ac80
cmp byte [rbp + 0x1ffb0], al
jne 0x14001ac80
lea rcx, [rsp + 0x50]
call fcn.14001a3c8
lea rdx, [0x1400cb8a0]
lea rcx, [rsp + 0x30]
call fcn.14001f0bc
lea rcx, [rsp + 0x30]
test bl, bl
je 0x14004f1ab
lea rdx, [0x1400cf2d8]
call fcn.14001ef20
lea rdx, [0x1400e4598]
lea rcx, [rsp + 0x30]
call fcn.14001ec60
lea rdx, [0x1400cf2d8]
lea rcx, [rsp + 0x30]
jmp 0x14004f1ae
mov rdx, rsi
call fcn.14001ef20
mov rbx, qword [rsp + 0x30]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r8, qword [rsp + 0x50]
mov rcx, rax
lea rax, [rsp + 0x70]
lea rdx, str.runas
mov r9, rbx
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rcx, [rsp + 0x30]
call fcn.14001c29c
nop
jmp 0x14001acc3
Function at 0x140b4c6d9
Capabilities:
Execute anti-debugging instructions

Disassembly:
add rsi, 4
call fcn.140b7450f
xor r9w, 0xe882
mov edx, 0x70bc42aa
neg r9w
not r9w
sal dx, 0xe8
setnp dl
call fcn.140b451a1
call fcn.140b7eccd
mov eax, 0xf710341e
sub ax, ax
mov esi, dword [rbp + riz]
mov eax, dword [rbp + 4]
jae 0x140b696b3
mul esi
mov dword [rbp + riz], edx
call fcn.140b84028
sub edx, edx
adc dx, word [r10 + rdx*8]
call fcn.140b44dc6
mov ebx, 0x47ac9a0c
mov eax, 0x1a8fe0a2
mov edx, dword [rsi + rax*2 - 0x351fc144]
inc ebx
mov eax, dword [rsi + rbx - 0x47ac9a09]
jnp 0x140b83997
mov edi, 0x3b95fdad
movsx r11d, di
call fcn.140b4b9cb
lea rbx, [rbx*4 + 0x310efa14]
mov ebx, dword [rsi + 8]
jg 0x140b4c6a9
sbb dil, 0xa8
and dword [rsp + rax*2 - 0x54aedff6], eax
inc al
and dword [rsp + rax - 0x2a576ffe], 0xdc23060d
rol dil, 1
shl qword [rsp + rax - 0x2a577001], 0xfa
neg dil
pop rax
not dil
add ax, ax
neg ax
xor r8b, dil
call fcn.140b69e9c

Function at 0x140b502e2
Capabilities:
Execute anti-debugging instructions

Disassembly:
not rcx
jne 0x140b5fa43
jmp 0x140b58bd8
not r11
and rcx, r11
mov qword [rbx], rcx
lea rsp, [rsp + 0x18]
jmp fcn.140b53edd

Function at 0x140b7375c
Capabilities:
Encode data using xor

Disassembly:
push rdi
lea r10, [0x140b83348]
movzx edi, byte [r9]
push 0xffffffffe28a92ae
xor edi, eax
and edi, 0xff
dec qword [rsp]
sal word [rsp], 0xef
mov edi, dword [r10 + rdi*4]
shr eax, 8
xor eax, edi
inc r9
sal dword [rsp + 4], 0xea
not byte [rsp + 4]
xor eax, 0x603e90af
dec rdx
lea rsp, [rsp + 8]
jne 0x140b55d89
push 0xffffffffd19485a2
call fcn.140b5590c
add rbx, 0xc
xor eax, eax
mov qword [rsp], 0xffffffffb89f1907
test rdx, rdx
lea rsp, [rsp + 8]
je 0x140b627c2
mov r10d, 0x5397b596
jmp 0x140b55d81

Function at 0x140b79725
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
push 0xeaa5e9a
test rcx, rcx
push 0xffffffffea1b8d84
lea rsp, [rsp + 0x18]
je 0x140b69bac
lea r10, [0x140b64528]
movzx eax, byte [rdx]
push 0x63a311a1
xor eax, r9d
and eax, 0xff
mov eax, dword [r10 + rax*4]
shr r9d, 8
xor r9d, eax
inc rdx
push 0x25bd4c11
add qword [rsp + 1], 0xffffffffddbb1c9d
xor r9d, 0x281210c
dec rcx
lea rsp, [rsp + 0x10]
jne 0x140b69b6b
jmp 0x140b755d0
add rdi, 0xc
jmp 0x140b69b49
Function at 0x1800130ec
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
xor r9d, r9d
movabs r8, 0xcbf29ce484222325
test rdx, rdx
je 0x18001311c
movzx eax, byte [rcx + r9]
movabs r10, 0x100000001b3
xor r8, rax
inc r9
imul r8, r10
cmp r9, rdx
jb 0x1800130fe
mov rax, r8
ret

Function at 0x1800157b8
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0x90
mov rax, qword [0x180162100]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov ecx, dword [0x180167828]
mov rax, qword gs:[0x58]
mov rbx, qword [rax + rcx*8]
mov r15d, 0x14
cmp byte [r15 + rbx], 0
jne 0x18001580a
call fcn.1800a1418
mov r12d, 0x138
mov rdi, qword [r12 + rbx + 8]
call fcn.180063160
sub rdi, rax
cmp byte [r15 + rbx], 0
jne 0x180015829
call fcn.1800a1418
mov rsi, qword [r12 + rbx + 8]
cmp byte [r15 + rbx], 0
jne 0x18001583a
call fcn.1800a1418
mov r9, rdi
mov r8, rsi
mov edx, dword [r12 + rbx]
lea rcx, str.Fatal_error__0x_08X__at_0x_p__0x_p_._nA_minidump_has_been_written._n
call fcn.180067638
xorps xmm0, xmm0
movups xmmword [rbp - 0x29], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x19], xmm1
or r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x180015863
mov rdx, rax
lea rcx, [rbp - 0x29]
call fcn.180013390
nop
lea rax, vtable.std::_Func_impl_no_alloc_class__void___cdecl_utilities::thread::suspend_other_threads_void_::_2::_lambda_1___void__void____ptr64_.0
mov qword [rbp - 9], rax
lea rax, [rbp - 9]
mov qword [rbp + 0x2f], rax
lea rcx, [rbp - 9]
call fcn.18006cde8
nop
mov rcx, qword [rbp + 0x2f]
test rcx, rcx
je 0x1800158b0
mov rax, qword [rcx]
lea rdx, [rbp - 9]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
mov ecx, 1
call qword [sym.imp.USER32.dll_ShowCursor]
test eax, eax
js 0x1800158b0
lea rdx, [rbp - 0x29]
cmp qword [rbp - 0x11], 0xf
cmova rdx, qword [rbp - 0x29]
mov r9d, 0x10
lea r8, str.Project_BO4_ERROR
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
cmp byte [r15 + rbx], 0
jne 0x1800158ee
call fcn.1800a1418
mov ebx, dword [r12 + rbx]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, ebx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
mov rdx, qword [rbp - 0x11]
cmp rdx, 0xf
jbe 0x18001593b
inc rdx
mov rcx, qword [rbp - 0x29]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180015936
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180015964
call fcn.1800a0de0
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.1800a0dc0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r12
pop rbp
ret
call fcn.1800a80ec
int3
Function at 0x180024cfc
Capabilities:
Manipulate console buffer

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x180162100]
xor rax, rsp
mov qword [rsp + 0x38], rax
xor eax, eax
mov ebx, ecx
xorps xmm0, xmm0
mov dword [rsp + 0x30], eax
mov ecx, 0xfffffff5
mov word [rsp + 0x34], ax
movups xmmword [rsp + 0x20], xmm0
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
mov ecx, 0xfffffff5
mov word [rsp + 0x24], bx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, dword [rsp + 0x24]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1800a0dc0
add rsp, 0x40
pop rbx
ret
Function at 0x180025770
Capabilities:
Hide graphical window
Set console window title

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x180162100]
xor rax, rsp
mov qword [rbp - 8], rax
and dword [rbp - 0x50], 0
call qword [sym.imp.KERNEL32.dll_AllocConsole]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_AttachConsole]
xor ecx, ecx
call fcn.1800a8d38
mov r9, rax
lea r8, [0x1801258c8]
lea rdx, str.CONOUT_
lea rcx, [rbp - 0x48]
call fcn.1800a8c00
mov ecx, 1
call fcn.1800a8d38
mov r9, rax
lea r8, [0x1801258d8]
lea rdx, str.CONOUT_
lea rcx, [rbp - 0x48]
call fcn.1800a8c00
mov ecx, 2
call fcn.1800a8d38
mov r9, rax
lea r8, [0x1801258d8]
lea rdx, str.CONOUT_
lea rcx, [rbp - 0x48]
call fcn.1800a8c00
lea rcx, str.Project_Bo4:
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
lea r8, [0x1800256d0]
lea rdx, [fcn.1800261a8]
lea rcx, [0x18016bde0]
call fcn.1800664ac
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [0x180163cd8], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
mov qword [rbp - 0x18], 7
mov qword [rbp - 0x10], 0xf
mov rax, qword [str.Console]
mov dword [rbp - 0x28], eax
movzx eax, word [0x1801258f4]
mov word [rbp - 0x24], ax
mov al, byte [0x1801258f6]
mov byte [rbp - 0x22], al
mov byte [rbp - 0x21], 0
mov ecx, 1
call fcn.1800a0de8
mov qword [rbp - 0x30], rax
mov dword [rbp - 0x50], 2
lea rcx, [rbp - 0x38]
mov qword [rsp + 0x28], rcx
and dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x180026000]
xor edx, edx
xor ecx, ecx
call fcn.1800ac4b0
mov qword [rbp - 0x40], rax
test rax, rax
je 0x18002595d
mov dword [rbp - 0x50], 3
lea rdx, [rbp - 0x28]
mov rcx, rax
call fcn.18006cc3c
cmp dword [0x180163cd0], 0
jne 0x18002596c
xorps xmm0, xmm0
movaps xmm1, xmmword [rbp - 0x40]
movdqa xmmword [rbp - 0x40], xmm0
movdqu xmmword [0x180163cc8], xmm1
mov rdx, qword [rbp - 0x10]
cmp rdx, 0xf
jbe 0x180025942
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18002593d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180025957
call fcn.1800a0de0
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1800a0dc0
add rsp, 0x80
pop rbp
ret
call fcn.1800a80ec
nop
and dword [rbp - 0x38], 0
mov ecx, 6
call fcn.18009fb1c
nop
call fcn.1800a8adc
int3

Function at 0x180026ac4
Capabilities:
Convert ip address from string

Disassembly:
push rbx
sub rsp, 0x20
and dword [rsp + 0x30], 0
mov rbx, rcx
cmp qword [rcx + 0x18], 0xf
mov rdx, rcx
jbe 0x180026adf
mov rdx, qword [rcx]
lea r8, [rsp + 0x30]
mov ecx, 2
call qword [sym.imp.WS2_32.dll_inet_pton]
cmp eax, 1
jne 0x180026b00
mov eax, dword [rsp + 0x30]
mov dword [0x180168560], eax
jmp 0x180026b28
mov dword [0x180168560], 0x100007f
cmp qword [rbx + 0x18], 0xf
jbe 0x180026b14
mov rbx, qword [rbx]
mov r8, rbx
lea rdx, str.__network__:_wrong_dw_server_address_specified:__s
mov ecx, 3
call fcn.180046ecc
add rsp, 0x20
pop rbx
ret
Function at 0x180026ffc
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x30
mov r12, r8
mov r14, rdx
xor ecx, ecx
movabs r15, 0xcbf29ce484222325
movzx eax, byte [r8 + rcx]
xor r15, rax
movabs rdx, 0x100000001b3
imul r15, rdx
inc rcx
cmp rcx, 8
jb 0x18002702b
mov rax, qword [0x180176110]
and rax, r15
add rax, rax
mov rcx, qword [0x1801760f8]
mov rbx, qword [rcx + rax*8 + 8]
mov rbp, qword [0x1801760e8]
cmp rbx, rbp
jne 0x1800270d7
mov rbx, rbp
mov rsi, rbp
movabs rax, 0x7ffffffffffffff
cmp qword [0x1801760f0], rax
je 0x180027255
lea rax, [0x1801760e8]
mov qword [rsp + 0x20], rax
and qword [rsp + 0x28], 0
mov ecx, 0x20
call fcn.1800a0de8
mov rdi, rax
mov qword [rsp + 0x28], rax
mov rcx, qword [r12]
mov qword [rax + 0x10], rcx
and qword [rax + 0x18], 0
mov r8, qword [0x1801760f0]
lea rcx, [r8 + 1]
xorps xmm0, xmm0
test rcx, rcx
js 0x18002711b
cvtsi2ss xmm0, rcx
jmp 0x180027130
mov rdx, qword [rcx + rax*8]
mov rax, qword [r8]
jmp 0x1800270e9
cmp rbx, rdx
je 0x180027111
mov rbx, qword [rbx + 8]
cmp rax, qword [rbx + 0x10]
jne 0x1800270e0
mov rbp, qword [rbx]
mov rsi, rbp
mov rax, rbx
mov rbx, rbp
test rax, rax
je 0x180027075
mov qword [r14], rax
mov byte [r14 + 8], 0
jmp 0x180027233
mov rbp, rbx
xor eax, eax
mov rsi, rbx
jmp 0x1800270fb
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rcx, qword [0x180176118]
xorps xmm1, xmm1
test rcx, rcx
js 0x180027146
cvtsi2ss xmm1, rcx
jmp 0x18002715b
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
comiss xmm0, dword [0x1801760e0]
seta al
test al, al
je 0x1800271ca
call fcn.180027280
mov rcx, qword [0x180176110]
and rcx, r15
add rcx, rcx
mov rdx, qword [0x1801760f8]
mov rax, qword [rdx + rcx*8 + 8]
mov rbx, qword [0x1801760e8]
cmp rax, rbx
je 0x1800271b6
mov r8, qword [rdx + rcx*8]
mov rcx, qword [rdi + 0x10]
jmp 0x1800271ad
mov rbx, rax
cmp rax, r8
je 0x18002720d
mov rax, qword [rax + 8]
cmp rcx, qword [rax + 0x10]
jne 0x1800271a1
mov rbx, qword [rax]
mov qword [rsp + 0x20], rbx
mov rsi, rbx
mov rbp, qword [rsp + 0x20]
mov r8, qword [0x1801760f0]
mov rdx, qword [rbx + 8]
inc r8
mov qword [0x1801760f0], r8
mov qword [rdi], rbp
mov qword [rdi + 8], rdx
mov qword [rdx], rdi
mov qword [rbx + 8], rdi
mov rax, qword [0x180176110]
and rax, r15
add rax, rax
mov rcx, qword [0x1801760f8]
mov r8, qword [rcx + rax*8]
cmp r8, qword [0x1801760e8]
jne 0x180027214
mov qword [rcx + rax*8], rdi
jmp 0x180027226
mov qword [rsp + 0x20], rax
jmp 0x1800271bb
cmp r8, rsi
jne 0x18002721f
mov qword [rcx + rax*8], rdi
jmp 0x18002722b
cmp qword [rcx + rax*8 + 8], rdx
jne 0x18002722b
mov qword [rcx + rax*8 + 8], rdi
mov qword [r14], rdi
mov byte [r14 + 8], 1
mov rax, r14
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
ret
lea rcx, str.unordered_map_set_too_long
call fcn.18009e38c
int3
Function at 0x180027280
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rcx, qword [0x1801760f0]
xorps xmm0, xmm0
add rcx, 1
js 0x1800272a1
cvtsi2ss xmm0, rcx
jmp 0x1800272b6
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [0x1801760e0]
call fcn.1800cbc78
movss xmm1, dword [0x18014cb10]
xor ecx, ecx
comiss xmm0, xmm1
jb 0x1800272e8
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x1800272e8
movabs rax, 0x8000000000000000
mov rcx, rax
mov rdx, qword [0x180176118]
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rdx, rcx
jae 0x18002731d
cmp rdx, 0x200
jae 0x18002731a
shl rdx, 3
cmp rdx, rcx
jae 0x18002731d
mov rdx, rcx
movabs rax, 0xfffffffffffffff
bsr rcx, rax
mov eax, 1
shl rax, cl
cmp rdx, rax
ja 0x180027496
mov rbx, qword [0x1801760e8]
lea rax, [rdx - 1]
or rax, 1
mov edi, 1
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x1801760f8]
lea rdx, [rdi + rdi]
call fcn.180012af8
mov rax, qword [0x1801760e8]
lea r9, [rdi - 1]
mov qword [0x180176110], r9
mov qword [0x180176118], rdi
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x18002748b
mov rcx, qword [rcx]
movabs r11, 0xcbf29ce484222325
xor r8d, r8d
movzx edx, byte [rax + r8 + 0x10]
movabs r10, 0x100000001b3
xor r11, rdx
inc r8
imul r11, r10
cmp r8, 8
jb 0x1800273a4
mov rdi, qword [0x1801760f8]
and r11, r9
add r11, r11
cmp qword [rdi + r11*8], rbx
jne 0x1800273e2
mov qword [rdi + r11*8], rax
mov qword [rdi + r11*8 + 8], rax
jmp 0x180027451
mov r10, qword [rdi + r11*8 + 8]
mov rdx, qword [rax + 0x10]
cmp rdx, qword [r10 + 0x10]
jne 0x180027426
mov r10, qword [r10]
cmp r10, rax
je 0x1800273db
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x1800273db
mov r10, qword [r10 + 8]
cmp rdx, qword [r10 + 0x10]
je 0x180027465
cmp qword [rdi + r11*8], r10
jne 0x18002741c
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [rdi + r11*8], rax
mov rax, rcx
cmp rcx, rbx
je 0x18002748b
mov r9, qword [0x180176110]
jmp 0x180027394
mov r10, qword [r10]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x180027451
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea rcx, str.invalid_hash_bucket_count
call fcn.18009e38c
int3