joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1403cb530
Capabilities:
Create thread
Get thread local storage value
Resume thread

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rbp, rcx
mov rdi, rdx
mov rsi, r8
mov r12, r9
call fcn.1403c9780
mov rbx, rax
test rax, rax
je 0x1403cb764
test rbp, rbp
je 0x1403cb56b
mov rax, qword [rax + 0x1d8]
mov qword [rbp], rax
mov r13, qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rbx + 0x44], 1
mov dword [rbx + 0xbc], 0
mov qword [rbx + 0x28], 0xffffffffffffffff
mov r14, r13
mov qword [rbx + 8], r12
mov r12, qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rbx + 0x10], rsi
xor esi, esi
xor r9d, r9d
xor r8d, r8d
mov edx, 1
xor ecx, ecx
call r12
mov qword [rbx + 0x30], rax
test rax, rax
jne 0x1403cb5e0
test esi, esi
jne 0x1403cb5d0
xor ecx, ecx
mov esi, 1
call r14
jmp 0x1403cb59f
add esi, 1
mov ecx, 0x14
call r13
cmp esi, 5
jne 0x1403cb59f
mov qword [rbx + 0x38], 0xffffffffffffffff
lea r12, [rbx + 0x68]
mov rcx, r12
call fcn.1403cd1d0
cmp eax, 1
je 0x1403cb7af
cmp qword [rbx + 0x30], 0
mov dword [rbx], 0xbab1f00d
mov qword [rbx + 0x68], 0xffffffffffffffff
mov dword [rbx + 0xc0], 0
mov dword [rbx + 0xb8], 0
je 0x1403cb74d
xor edx, edx
test rdi, rdi
je 0x1403cb64d
mov eax, dword [rdi]
mov rsi, qword [rdi + 0x10]
mov dword [rbx + 0x44], eax
test al, 8
jne 0x1403cb770
mov eax, dword [rdi + 0x18]
mov dword [rbx + 0xc0], eax
mov edx, esi
lea r8, [0x1403c9d20]
mov r9, rbx
xor ecx, ecx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 4
call qword [sym.imp.msvcrt.dll__beginthreadex]
mov rsi, rax
lea rax, [rax - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1403cb718
mov eax, dword [rbx + 0xc0]
mov edx, 0xfffffff1
cmp eax, 0xfffffff2
jge 0x1403cb6f0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
test byte [rbx + 0x44], 4
jne 0x1403cb6d0
mov qword [rbx + 0x28], rsi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ResumeThread]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov rcx, rsi
mov qword [rbx + 0x28], 0
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1403cb6b7
mov edx, 0xfffffffe
cmp eax, 0xffffffff
jl 0x1403cb691
mov edx, 2
cmp eax, edx
cmovle edx, eax
cmp eax, 0xf
mov eax, 0xf
cmovge edx, eax
jmp 0x1403cb691
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x1403cb727
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbx + 0x38]
call fcn.1403c9170
mov rcx, r12
call fcn.1403cd1d0
cmp eax, 1
je 0x1403cb7af
mov qword [rbx + 0x68], 0xffffffffffffffff
pxor xmm0, xmm0
movups xmmword [rbx + 0x28], xmm0
test rbp, rbp
je 0x1403cb75a
mov qword [rbp], 0
cmp qword [rbx + 0x1d0], 0
je 0x1403cb798
mov eax, 0xb
jmp 0x1403cb6c1
call fcn.1403c99f0
mov ecx, dword [0x14054b358]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1403cb7a8
mov eax, dword [rax + 0xc0]
jmp 0x1403cb645
mov rcx, rbx
call fcn.1403c9850
jmp 0x1403cb764
call fcn.1403c9aa0
jmp 0x1403cb786
call fcn.1403c95e0
nop
nop word cs:[rax + rax]
Function at 0x1403e3400
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.1403edab0
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.1403edab0
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop dword [rax]

Function at 0x1403e3470
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x1406a6634]
mov rbx, rcx
test esi, esi
jle 0x1403e35a0
mov rax, qword [0x1406a6638]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x1403e34bb
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x1403e3545
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x1403e34a0
mov rcx, rbx
call fcn.1403e3ee0
mov rdi, rax
test rax, rax
je 0x1403e35c2
mov rax, qword [0x1406a6638]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call fcn.1403e4020
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x1406a6638]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1403e35a7
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x1403e353e
lea edx, [rax - 0x40]
and edx, 0xffffffbf
jne 0x1403e3550
add dword [0x1406a6634], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x1406a6638]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1403e353e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.1403e3400
nop dword [rax]
xor esi, esi
jmp 0x1403e34c8
mov rax, qword [0x1406a6638]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.1403e3400
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call fcn.1403e3400
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x1403e3b50
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x1406a66a0]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1406a6680]
test rbx, rbx
je 0x1403e3bac
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test rsi, rsi
je 0x1403e3ba3
test eax, eax
jne 0x1403e3ba3
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x1403e3b88
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x1403e3ee0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x14061bee0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x1403e3f00
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x1403e3f08
ret
cmp word [r8 + 0x18], 0x20b
jne 0x1403e3f00
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x1403e3f5d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x1403e3f54
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x1403e3f00
add rax, 0x28
cmp rax, r9
jne 0x1403e3f40
xor eax, eax
ret

Function at 0x1403e3f60
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14061bee0]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x1403e3f7f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1403e3f88
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x1403e3f7f
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x1403e4020
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14061bee0]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x1403e403f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x1403e4048
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret

Function at 0x1403e4f40
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
mov ecx, 2
mov r8d, 0x2d
lea rdx, str._buffer_overflow_detected_:_terminated_n
call sub.msvcrt.dll__write
mov ecx, 0x17
call sub.KERNEL32.dll_IsProcessorFeaturePresent
test eax, eax
je 0x1403e4f70
mov ecx, 8
int 0x29
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x1403e4f90
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
mov ecx, 2
mov r8d, 0x2c
lea rdx, str._stack_smashing_detected_:_terminated_n
call sub.msvcrt.dll__write
mov ecx, 0x17
call sub.KERNEL32.dll_IsProcessorFeaturePresent
test eax, eax
je 0x1403e4fc0
mov ecx, 2
int 0x29
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x14040a680
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
xor r12d, r12d
mov rbx, qword [rcx + 0x10]
mov eax, dword [rbx]
lea rax, [rax + rax*4]
lea r13, [rbx + rax*8 + 0x10]
add rbx, 0x10
cmp rbx, r13
je 0x14040a830
movabs rdi, 0xe9b6294983b62ace
movabs rbp, 0xdf442d22ce4859b9
nop dword [rax + rax]
mov ecx, dword [rbx + 0x20]
mov r10, qword [rbx + 0x18]
movabs r9, 0x87eda3030300a6e3
mov r8, rcx
xor r8, rdi
cmp rcx, 7
jbe 0x14040a755
movabs r11, 0xe9b6294983b62ace
sub rcx, 8
movabs r14, 0x9e3779b97f4a7c15
mov r9, rcx
shr r9, 3
lea r15, [r10 + r9*8 + 8]
nop dword [rax]
mov rax, qword [r10]
add r11, r14
add r10, 8
add rax, r11
mul rbp
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rdx
xor rax, rdx
xor r8, rax
cmp r10, r15
jne 0x14040a710
mov rax, r9
imul r9, r14
neg rax
lea rcx, [rcx + rax*8]
movabs rax, 0x26251cbc824b22f8
add r9, rax
cmp rcx, 3
jbe 0x14040a848
mov eax, dword [r10 + rcx - 4]
mov edx, dword [r10]
lea rcx, [rcx*8 - 0x20]
shl rax, cl
or rax, rdx
add rax, r9
mul rbp
mov esi, 0x9e3779b9
mov rcx, rbx
movabs r15, 0xe9846af9b1a615d
xor r8, rax
xor r8, rdx
lea rax, [r8 + r9]
mul rbp
xor rax, rdx
add rax, rsi
mov r14, rax
shr r14, 0x20
xor r14, rax
imul r14, r15
mov rax, r14
shr rax, 0x20
xor r14, rax
imul r14, r15
mov rax, r14
shr rax, 0x1c
xor r14, rax
call fcn.140085a80
add rax, rsi
add r14, rax
mov rax, r14
shr rax, 0x20
xor rax, r14
imul rax, r15
mov rcx, rax
shr rcx, 0x20
xor rax, rcx
imul rax, r15
mov rcx, rax
shr rcx, 0x1c
xor rax, rcx
add rax, rsi
mov rdx, rax
shr rdx, 0x20
xor rax, rdx
imul rax, r15
mov rdx, rax
shr rdx, 0x20
xor rax, rdx
imul r15, rax
mov rax, r15
shr rax, 0x1c
add rbx, 0x28
xor r15, rax
add r12, r15
cmp r13, rbx
jne 0x14040a6c8
mov rax, r12
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rax, r9
test rcx, rcx
je 0x14040a778
lea rdx, [rcx - 1]
shr rcx, 1
movzx eax, byte [r10 + rcx]
shl rcx, 3
and edx, 2
shl rax, cl
movzx ecx, byte [r10]
movzx r10d, byte [r10 + rdx]
or rax, rcx
lea rcx, [rdx*8]
shl r10, cl
or rax, r10
add rax, r9
jmp 0x14040a778
Function at 0x1404162d0
Capabilities:
Get hostname

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x460
mov edx, 0x400
lea rsi, [rsp + 0x60]
mov rbx, rcx
mov dword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
mov rcx, rsi
mov qword [rsp + 0x30], 0
call qword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
jne 0x140416360
lea r12, [rbx + 0x10]
mov rcx, rsi
mov qword [rbx], r12
call sub.msvcrt.dll_strlen
mov rbp, rax
cmp rax, 0xf
ja 0x1404163f0
cmp rax, 1
je 0x140416440
test rax, rax
jne 0x140416403
mov qword [rbx + 8], rbp
mov byte [r12 + rbp], 0
mov rax, rbx
add rsp, 0x460
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rbp, str.C:include_boost_asio_ip_impl_host_name.ipp
lea rcx, str.std::string_boost::asio::ip::host_name__
mov r8, qword [0x140558b08]
cmp eax, 1
mov edx, 2
mov dword [rsp + 0x20], eax
movq xmm0, rbp
movq xmm1, rcx
lea rdi, [0x14054d5e0]
sbb rdx, 0xffffffffffffffff
mov qword [rsp + 0x50], r8
punpcklqdq xmm0, xmm1
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x30], rdx
movups xmmword [rsp + 0x40], xmm0
test eax, eax
je 0x1404163d0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.140419740
nop word [rax + rax]
lea rax, [rbx + 0x10]
mov qword [rbx + 8], 0
mov qword [rbx], rax
mov byte [rbx + 0x10], 0
jmp 0x140416349
lea rcx, [rax + 1]
call fcn.14053f0d0
mov qword [rbx + 0x10], rbp
mov qword [rbx], rax
mov r12, rax
cmp ebp, 8
jae 0x140416450
test bpl, 4
jne 0x140416481
test ebp, ebp
je 0x140416430
movzx edi, byte [rsp + 0x60]
mov byte [r12], dil
test bpl, 2
je 0x140416430
mov ecx, ebp
movzx edx, word [rsi + rcx - 2]
mov word [r12 + rcx - 2], dx
nop
mov r12, qword [rbx]
jmp 0x140416340
movzx r9d, byte [rsp + 0x60]
mov byte [rbx + 0x10], r9b
jmp 0x140416340
mov r8, qword [rsp + 0x60]
mov eax, ebp
lea rdi, [r12 + 8]
and rdi, 0xfffffffffffffff8
mov qword [r12], r8
mov r9, qword [rsi + rax - 8]
mov qword [r12 + rax - 8], r9
sub r12, rdi
lea ecx, [rbp + r12]
sub rsi, r12
shr ecx, 3
rep movsq qword [rdi], qword [rsi]
jmp 0x140416430
mov r10d, dword [rsp + 0x60]
mov r11d, ebp
mov dword [r12], r10d
mov esi, dword [rsi + r11 - 4]
mov dword [r12 + r11 - 4], esi
jmp 0x140416430
Function at 0x140416730
Capabilities:
Get socket status

Disassembly:
push rsi
push rbx
sub rsp, 0x488
lea rax, [rsp + 0x58]
mov qword [rsp + 0x68], rcx
mov rbx, rcx
mov rsi, rdx
mov qword [rsp + 0x278], rcx
xor edx, edx
lea ecx, [rcx + 1]
lea r9, [rsp + 0x270]
mov dword [rsp + 0x60], 1
lea r8, [rsp + 0x60]
mov dword [rsp + 0x270], 1
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_select]
mov edx, eax
xor eax, eax
test edx, edx
jne 0x1404167a0
add rsp, 0x488
pop rbx
pop rsi
ret
mov dword [rsp + 0x50], 0
cmp rbx, 0xffffffffffffffff
je 0x14041683a
lea rcx, [rsp + 0x54]
lea r9, [rsp + 0x50]
mov edx, 0xffff
mov dword [rsp + 0x54], 4
mov qword [rsp + 0x20], rcx
mov r8d, 0x1007
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x140416830
mov r8d, dword [rsp + 0x50]
mov qword [rsi + 8], 0
mov qword [rsi + 0x10], 0
test r8d, r8d
jne 0x140416810
mov dword [rsi], 0
mov eax, 1
add rsp, 0x488
pop rbx
pop rsi
ret
lea r9, [0x14054d5e0]
mov dword [rsi], r8d
mov qword [rsi + 8], r9
mov qword [rsi + 0x10], 3
jmp 0x140416801
mov rcx, rsi
call fcn.14004b220
jmp 0x140416801
lea rcx, [rsp + 0x30]
mov edx, 0x2719
call fcn.140416590
movdqu xmm0, xmmword [rsp + 0x30]
movups xmmword [rsi], xmm0
mov r10, qword [rsp + 0x40]
mov qword [rsi + 0x10], r10
jmp 0x140416801

Function at 0x140416860
Capabilities:
Set socket configuration

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x40
mov dword [rsp + 0x28], 1
mov edi, ecx
mov rbx, r9
xor r9d, r9d
mov dword [rsp + 0x20], 0
call qword [sym.imp.WS2_32.dll_WSASocketW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x1404168b8
mov dword [rbx], 0
mov qword [rbx + 8], 0
mov qword [rbx + 0x10], 0
cmp edi, 0x17
je 0x1404168d0
mov rax, rsi
add rsp, 0x40
pop rbx
pop rsi
pop rdi
ret
mov rcx, rbx
call fcn.140059940
mov rax, rsi
add rsp, 0x40
pop rbx
pop rsi
pop rdi
ret
mov dword [rsp + 0x3c], 0
lea r9, [rsp + 0x3c]
mov r8d, 0x1b
mov rcx, rax
mov dword [rsp + 0x20], 4
mov edx, 0x29
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rax, rsi
add rsp, 0x40
pop rbx
pop rsi
pop rdi
ret
Function at 0x1404348e0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x4b8
mov r13, qword [sym.imp.WS2_32.dll_WSARecv]
mov r12, qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rbp, [0x14054d5e0]
lea rax, [rsp + 0xb0]
mov dword [rsp + 0x40], 0x400
mov r15, rcx
lea rdi, [rsp + 0x70]
mov qword [rsp + 0x48], rax
lea r14, [rsp + 0x40]
lea rsi, [rsp + 0x90]
mov rcx, qword [r15]
mov rdx, r14
mov r9, rdi
mov r8d, 1
mov dword [rsp + 0x70], 0
mov dword [rsp + 0x90], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rsi
call r13
mov ebx, eax
call r12
mov edx, 2
mov qword [rsp + 0x58], rbp
cmp eax, 1
mov dword [rsp + 0x50], eax
sbb rdx, 0xffffffffffffffff
mov qword [rsp + 0x60], rdx
cmp eax, 0x40
je 0x140434a50
cmp eax, 0x4d2
je 0x140434a70
cmp eax, 0x2738
je 0x1404349b3
cmp eax, 0xea
je 0x1404349b3
test ebx, ebx
jne 0x1404349e3
mov ecx, dword [rsp + 0x70]
mov dword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x60], 0
cmp ecx, 0x400
je 0x140434932
test ecx, ecx
jg 0x140434a30
je 0x140434a2c
lea r15, [rsp + 0x50]
mov rdx, rdi
mov qword [rsp + 0x78], rbp
mov rcx, r15
mov dword [rsp + 0x70], 0x2733
mov qword [rsp + 0x80], 3
call fcn.140477f40
test al, al
jne 0x140434a30
mov edx, 0x4d5
mov rcx, rsi
call fcn.140416590
mov rdx, rsi
mov rcx, r15
call fcn.140477f40
test al, al
jne 0x140434a30
xor eax, eax
jmp 0x140434a35
mov eax, 1
add rsp, 0x4b8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov dword [rsp + 0x50], 0x2746
mov qword [rsp + 0x60], 3
jmp 0x1404349af
lea rcx, [rsp + 0x50]
mov edx, 0x274d
call fcn.140416590
jmp 0x1404349af
Function at 0x1404394f0
Capabilities:
Send data
Send data on socket

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
mov r10d, dword [rsp + 0x90]
mov rsi, qword [rsp + 0xa0]
mov rbx, rcx
mov rax, r8
mov rcx, qword [rcx + 8]
mov r8, r9
mov r9d, dword [rsp + 0x98]
lock add dword [rcx + 0x30], 1
test r9b, r9b
jne 0x1404395c0
mov rcx, qword [rdx]
cmp rcx, 0xffffffffffffffff
je 0x1404395a0
mov dword [rsp + 0x20], r10d
lea r9, [rsp + 0x4c]
mov rdx, rax
mov dword [rsp + 0x4c], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], rsi
call qword [sym.imp.WS2_32.dll_WSASend]
mov edi, eax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r8d, eax
cmp eax, 0x4d2
je 0x1404395f8
cmp eax, 0x3e5
setne dl
mov rcx, qword [rbx + 8]
test edi, edi
je 0x1404395e0
test dl, dl
je 0x1404395e0
mov r9d, dword [rsp + 0x4c]
mov rdx, rsi
call fcn.140426c00
nop
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
mov rcx, qword [rbx + 8]
xor r9d, r9d
mov r8d, 0x2719
mov rdx, rsi
add rsp, 0x50
pop rbx
pop rsi
pop rdi
jmp fcn.140426c00
mov rcx, qword [rbx + 8]
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
add rsp, 0x50
pop rbx
pop rsi
pop rdi
jmp fcn.140426c00
mov rdx, rsi
call fcn.140426b50
nop
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
mov edx, 1
mov r8d, 0x274d
jmp 0x14043957a
Function at 0x14044f360
Capabilities:
Hash data using fnv

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
mov rbx, qword [rdx + 0x10]
mov r9, qword [r8 + 8]
mov r11, rcx
mov rcx, qword [r8]
mov r8d, dword [rbx + 4]
cmp r8d, 0x12
ja 0x14044f430
mov eax, dword [rbx]
lea r10, [rbx + 0x10]
mov ebp, 0x2f
lea rax, [rax + rax*4]
lea rdi, [rbx + rax*8 + 0x10]
cmp rdi, r10
je 0x14044f410
nop dword [rax + rax]
mov rdx, qword [r10 + 0x18]
mov ebx, dword [r10 + 0x20]
add rbx, rdx
cmp rdx, rbx
je 0x14044f5a0
cmp r9, rcx
je 0x14044f407
mov rax, rcx
jmp 0x14044f3d7
cmp r8b, sil
jne 0x14044f407
add rdx, 1
add rax, 1
cmp rbx, rdx
je 0x14044f3fe
cmp r9, rax
je 0x14044f407
movzx r8d, byte [rax]
movzx esi, byte [rdx]
cmp r8b, 0x7e
jne 0x14044f3c0
cmp byte [rax + 1], 0x30
cmovne r8d, ebp
cmp r8b, sil
jne 0x14044f407
add rdx, 1
add rax, 2
cmp rbx, rdx
jne 0x14044f3d2
cmp r9, rax
je 0x14044f578
add r10, 0x28
cmp r10, rdi
jne 0x14044f3a0
mov rax, r11
mov qword [r11], 0
mov qword [r11 + 8], 0
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rdx, rcx
mov ebp, 0x2f
mov edi, 0x7e
movabs rax, 0xcbf29ce484222325
movabs r10, 0x100000001b3
add rax, qword [rbx + 8]
mov rsi, rax
cmp r9, rcx
jne 0x14044f537
nop dword [rax]
mov rax, rsi
xor edx, edx
mov r12d, 0x2f
div r8
lea rax, [r8 + r8*4]
shl rdx, 2
lea rax, [rdx + rax*8]
mov eax, dword [rbx + rax + 0x10]
cmp eax, 0xffffffff
je 0x14044f50b
nop
lea rax, [rax + rax*4]
lea rdi, [rbx + rax*8 + 0x10]
mov rdx, qword [rdi + 0x18]
mov r10d, dword [rdi + 0x20]
add r10, rdx
cmp rdx, r10
je 0x14044f590
cmp r9, rcx
je 0x14044f503
mov rax, rcx
jmp 0x14044f4d7
cmp r8b, bpl
jne 0x14044f503
add rdx, 1
add rax, 1
cmp r10, rdx
je 0x14044f4fe
cmp r9, rax
je 0x14044f503
movzx r8d, byte [rax]
movzx ebp, byte [rdx]
cmp r8b, 0x7e
jne 0x14044f4c0
cmp byte [rax + 1], 0x30
cmovne r8d, r12d
cmp r8b, bpl
jne 0x14044f503
add rdx, 1
add rax, 2
cmp r10, rdx
jne 0x14044f4d2
cmp r9, rax
je 0x14044f560
mov eax, dword [rdi + 0x24]
cmp eax, 0xffffffff
jne 0x14044f490
mov rax, r11
mov qword [r11], 0
mov qword [r11 + 8], rsi
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
xor rax, rsi
add rdx, 1
imul rax, r10
mov rsi, rax
cmp r9, rdx
je 0x14044f468
movsx rax, byte [rdx]
cmp al, 0x7e
jne 0x14044f520
cmp byte [rdx + 1], 0x30
mov rax, rdi
cmovne rax, rbp
add rdx, 2
xor rax, rsi
imul rax, r10
mov rsi, rax
jmp 0x14044f52e
mov rax, r11
mov qword [r11], rdi
mov qword [r11 + 8], rsi
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rax, r11
mov qword [r11], r10
mov qword [r11 + 8], 0
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rax, rcx
cmp r9, rax
jne 0x14044f503
jmp 0x14044f560
mov rax, rcx
cmp r9, rax
jne 0x14044f407
jmp 0x14044f578
Function at 0x14044f5b0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rsi, qword [rdx + 0x10]
mov r13, qword [r8]
mov rbp, qword [r8 + 8]
mov r8d, dword [rsi + 4]
mov r12, rcx
cmp r8d, 0x12
ja 0x14044f620
mov eax, dword [rsi]
lea rbx, [rsi + 0x10]
lea rax, [rax + rax*4]
lea rsi, [rsi + rax*8 + 0x10]
cmp rsi, rbx
je 0x14044f606
test rbp, rbp
je 0x14044f708
mov eax, dword [rbx + 0x20]
cmp rbp, rax
je 0x14044f768
add rbx, 0x28
cmp rsi, rbx
jne 0x14044f5f1
mov qword [r12], 0
mov qword [r12 + 8], 0
jmp 0x14044f730
movabs rax, 0xcbf29ce484222325
lea rcx, [r13 + rbp]
add rax, qword [rsi + 8]
mov rbx, rax
cmp rcx, r13
je 0x14044f667
movabs r9, 0x100000001b3
mov rdx, r13
nop dword [rax + rax]
movsx rax, byte [rdx]
add rdx, 1
xor rax, rbx
imul rax, r9
mov rbx, rax
cmp rdx, rcx
jne 0x14044f650
mov ecx, r8d
mov rax, rbx
xor edx, edx
div rcx
lea rax, [rcx + rcx*4]
shl rdx, 2
lea rax, [rdx + rax*8]
mov eax, dword [rsi + rax + 0x10]
cmp eax, 0xffffffff
je 0x14044f6a9
test rbp, rbp
je 0x14044f6c0
lea rax, [rax + rax*4]
lea rdi, [rsi + rax*8 + 0x10]
mov eax, dword [rdi + 0x20]
cmp rbp, rax
je 0x14044f740
mov eax, dword [rdi + 0x24]
cmp eax, 0xffffffff
jne 0x14044f68c
mov qword [r12], 0
mov qword [r12 + 8], rbx
jmp 0x14044f730
lea rax, [rax + rax*4]
lea rdi, [rsi + rax*8 + 0x10]
mov eax, dword [rdi + 0x20]
test eax, eax
je 0x14044f6e8
mov eax, dword [rdi + 0x24]
cmp eax, 0xffffffff
je 0x14044f6a9
lea rax, [rax + rax*4]
lea rdi, [rsi + rax*8 + 0x10]
mov eax, dword [rdi + 0x20]
test eax, eax
jne 0x14044f6d0
mov qword [r12], rdi
mov qword [r12 + 8], rbx
mov rax, r12
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov edx, dword [rbx + 0x20]
test edx, edx
je 0x14044f723
add rbx, 0x28
cmp rbx, rsi
je 0x14044f606
mov edx, dword [rbx + 0x20]
test edx, edx
jne 0x14044f70f
mov qword [r12], rbx
mov qword [r12 + 8], 0
mov rax, r12
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov rdx, qword [rdi + 0x18]
mov r8, rbp
mov rcx, r13
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x14044f6a1
mov qword [r12], rdi
mov qword [r12 + 8], rbx
jmp 0x14044f6f1
mov rdx, qword [rbx + 0x18]
mov r8, rbp
mov rcx, r13
call sub.msvcrt.dll_memcmp
test eax, eax
je 0x14044f723
jmp 0x14044f5fd
Function at 0x1404f03b0
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov r12, qword [sym.imp.msvcrt.dll__errno]
mov rdi, rcx
mov rsi, rdx
mov ebx, r8d
mov rcx, qword [rdi]
call sub.msvcrt.dll__fileno_1
mov ecx, eax
mov r8d, ebx
mov rdx, rsi
call sub.msvcrt.dll__read
movsxd rbp, eax
cmp eax, 0xffffffff
je 0x1404f03f8
mov rax, rbp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call r12
cmp dword [rax], 4
je 0x1404f03ca
mov rax, rbp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret