joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140163100
Capabilities:
Get thread local storage value

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rsi
mov rbx, rdx
mov rdi, rcx
mov ecx, dword [0x14051f06c]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
xor esi, esi
test rax, rax
je 0x140163138
mov rdx, qword [rax + 8]
jmp 0x14016313b
mov rdx, rsi
mov r8d, 0x48
movzx ecx, byte [rsp + 0x40]
call fcn.140158030
mov qword [rax + 0x20], rsi
lea rcx, [0x140161690]
mov qword [rax + 0x28], rcx
mov qword [rax], rsi
mov qword [rax + 8], rsi
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rsi
mov dword [rax + 0x30], esi
mov rcx, qword [rbx]
mov qword [rax + 0x38], rcx
mov qword [rbx], rsi
mov rcx, qword [rdi + 0x18]
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rcx + 0x10]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
jmp fcn.1401632a0

Function at 0x140163330
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rbp, rcx
mov ebx, r9d
xor ecx, ecx
mov rdi, r8
mov rsi, rdx
call qword [sym.imp.WS2_32.dll_WSASetLastError]
xor r14d, r14d
mov dword [rsp + 0x80], ebx
mov qword [rsp + 0x30], r14
lea rax, [rsp + 0x80]
mov qword [rsp + 0x28], r14
lea r9, [rsp + 0x88]
mov r8d, edi
mov qword [rsp + 0x20], rax
mov rdx, rsi
mov dword [rsp + 0x88], r14d
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_WSARecv]
mov ebx, eax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov rdx, qword [rsp + 0x90]
test eax, eax
mov dword [rsp + 0x40], eax
lea rax, [0x1403ea628]
setne byte [rsp + 0x44]
mov qword [rsp + 0x48], rax
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rdx], xmm0
mov ecx, dword [rdx]
cmp ecx, 0x40
jne 0x1401633d6
mov dword [rsp + 0x40], 0x2746
jmp 0x1401633e6
cmp ecx, 0x4d2
jne 0x1401633fa
mov dword [rsp + 0x40], 0x274d
mov byte [rsp + 0x44], 1
mov qword [rsp + 0x48], rax
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rdx], xmm0
jmp 0x14016340a
cmp ecx, 0x2738
je 0x140163415
cmp ecx, 0xea
je 0x140163415
test ebx, ebx
je 0x140163415
mov eax, 0xffffffff
jmp 0x140163433
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x88]
mov dword [rsp + 0x40], r14d
mov byte [rsp + 0x44], r14b
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rdx], xmm0
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
Function at 0x140164150
Capabilities:
Get thread local storage value

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x40], rbx
mov rdi, rcx
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x14016418a
mov r8, qword [rax + 0x38]
test r8, r8
je 0x140164182
xor edx, edx
mov rcx, r8
call qword [r8]
nop
mov qword [rdi + 0x10], 0
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x1401641df
mov ecx, dword [0x14051f06c]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1401641cf
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x1401641cf
cmp qword [rcx], 0
jne 0x1401641cf
movzx eax, byte [rbx + 0x48]
mov byte [rbx], al
mov qword [rcx], rbx
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rcx, rbx
call fcn.14038bb0c
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x140164790
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rdi
sub rsp, 0x60
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rsi
mov rsi, rdx
mov rbx, rcx
xor edi, edi
mov eax, edi
lock xadd dword [rcx + 0x30], eax
test eax, eax
jne 0x1401647f0
call fcn.140165070
mov dword [rsp + 0x28], edi
mov byte [rsp + 0x2c], dil
lea rax, [0x1403ea628]
mov qword [rsp + 0x30], rax
movups xmm0, xmmword [rsp + 0x28]
movups xmmword [rsi], xmm0
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rdi
lea rax, [rcx + 0x28]
test rbx, rbx
cmove rax, rdi
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
mov ecx, dword [0x14051f06c]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x38], rax
lea rdx, [rsp + 0x28]
mov ecx, dword [0x14051f06c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
mov r8, rsi
mov edx, 0xffffffff
mov rcx, rbx
call fcn.1401617f0
test rax, rax
je 0x140164874
lea rax, [rdi + 1]
cmp rdi, 0xffffffffffffffff
cmove rax, rdi
mov rdi, rax
mov r8, rsi
mov edx, 0xffffffff
mov rcx, rbx
call fcn.1401617f0
test rax, rax
jne 0x140164850
mov rdx, qword [rsp + 0x38]
mov ecx, dword [0x14051f06c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
lea rbx, [rsp + 0x40]
mov esi, 3
mov rcx, qword [rbx]
test rcx, rcx
je 0x14016489d
call fcn.14038bb0c
add rbx, 8
sub rsi, 1
jne 0x140164890
mov rax, rdi
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret

Function at 0x1401648c0
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rbp, rcx
mov ebx, r9d
xor ecx, ecx
mov rdi, r8
mov rsi, rdx
call qword [sym.imp.WS2_32.dll_WSASetLastError]
xor r14d, r14d
lea r9, [rsp + 0x88]
mov qword [rsp + 0x30], r14
mov r8d, edi
mov qword [rsp + 0x28], r14
mov rdx, rsi
mov rcx, rbp
mov dword [rsp + 0x20], ebx
mov dword [rsp + 0x88], r14d
call qword [sym.imp.WS2_32.dll_WSASend]
mov ebx, eax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov rcx, qword [rsp + 0x90]
test eax, eax
mov dword [rsp + 0x40], eax
lea rax, [0x1403ea628]
setne byte [rsp + 0x44]
mov qword [rsp + 0x48], rax
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rcx], xmm0
mov edx, dword [rcx]
cmp edx, 0x40
jne 0x140164956
mov dword [rsp + 0x40], 0x2746
jmp 0x140164966
cmp edx, 0x4d2
jne 0x140164978
mov dword [rsp + 0x40], 0x274d
mov byte [rsp + 0x44], 1
mov qword [rsp + 0x48], rax
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rcx], xmm0
test ebx, ebx
je 0x140164983
mov eax, 0xffffffff
jmp 0x1401649a1
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x88]
mov dword [rsp + 0x40], r14d
mov byte [rsp + 0x44], r14b
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rcx], xmm0
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
Function at 0x140164d50
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov esi, ecx
mov rbp, r9
xor ecx, ecx
mov ebx, r8d
mov edi, edx
call qword [sym.imp.WS2_32.dll_WSASetLastError]
xor r9d, r9d
mov dword [rsp + 0x28], 1
mov r8d, ebx
mov dword [rsp + 0x20], 0
mov edx, edi
mov ecx, esi
call qword [sym.imp.WS2_32.dll_WSASocketW]
mov rbx, rax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
mov dword [rsp + 0x30], eax
lea rdi, [0x1403ea628]
setne byte [rsp + 0x34]
mov qword [rsp + 0x38], rdi
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rbp], xmm0
cmp rbx, 0xffffffffffffffff
jne 0x140164dca
mov rax, rbx
jmp 0x140164e12
cmp esi, 0x17
jne 0x140164df4
lea r9, [rsp + 0x68]
mov dword [rsp + 0x68], 0
lea edx, [rsi + 0x12]
mov dword [rsp + 0x20], 4
lea r8d, [rsi + 4]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_setsockopt]
mov dword [rsp + 0x30], 0
mov rax, rbx
mov byte [rsp + 0x34], 0
mov qword [rsp + 0x38], rdi
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rbp], xmm0
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x140165210
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
push rbp
push rdi
push r12
push r13
lea rbp, [rsp - 0x188]
sub rsp, 0x288
mov rax, r9
mov r10, r8
movzx r13d, dl
mov r12, rcx
cmp rcx, 0xffffffffffffffff
jne 0x14016527a
mov rax, qword [rbp + 0x1e0]
lea rdi, [0x1403ea628]
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x30], 0x2719
mov byte [rsp + 0x34], 1
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rax], xmm0
xor eax, eax
add rsp, 0x288
pop r13
pop r12
pop rdi
pop rbp
ret
mov qword [rsp + 0x278], r14
mov qword [rsp + 0x270], r15
movzx r15d, r13b
and r15b, 0x10
cmp byte [rbp + 0x1d8], 0
je 0x1401652cf
test r15b, r15b
je 0x1401652cf
mov rax, qword [rbp + 0x1e0]
lea rdi, [0x1403ea628]
xor r14d, r14d
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x30], r14d
mov byte [rsp + 0x34], r14b
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rax], xmm0
xor eax, eax
jmp 0x140165428
mov r9d, dword [rbp + 0x1d0]
mov r8, rax
mov qword [rsp + 0x2b0], rbx
mov rdx, r10
mov rbx, qword [rbp + 0x1e0]
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x280], rsi
call fcn.140163330
test eax, eax
jg 0x140165416
lea rdi, [0x1403ea628]
xor r14d, r14d
movabs rsi, 0x8fafd21e25c5e09b
test r15b, r15b
je 0x140165326
test eax, eax
je 0x140165446
test r13b, 1
jne 0x140165492
mov ecx, dword [rbx]
cmp ecx, 0x2733
jne 0x140165344
mov rax, qword [rbx + 8]
cmp qword [rax + 8], rsi
je 0x14016535e
cmp ecx, 0x4d5
jne 0x140165492
mov rax, qword [rbx + 8]
cmp qword [rax + 8], rsi
jne 0x140165492
xor ecx, ecx
mov qword [rsp + 0x68], r12
mov dword [rsp + 0x60], 1
call qword [sym.imp.WS2_32.dll_WSASetLastError]
lea ecx, [r12 + 1]
mov qword [rsp + 0x20], r14
xor r9d, r9d
lea rdx, [rsp + 0x60]
xor r8d, r8d
call qword [sym.imp.WS2_32.dll_select]
mov esi, eax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x38], rdi
setne byte [rsp + 0x34]
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rbx], xmm0
test esi, esi
jne 0x1401653cb
mov dword [rsp + 0x50], r14d
mov byte [rsp + 0x54], r14b
mov qword [rsp + 0x58], rdi
movups xmm0, xmmword [rsp + 0x50]
movups xmmword [rbx], xmm0
jmp 0x1401653ec
jle 0x1401653e4
mov dword [rsp + 0x40], r14d
mov byte [rsp + 0x44], r14b
mov qword [rsp + 0x48], rdi
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rbx], xmm0
test esi, esi
js 0x140165492
mov r9d, dword [rbp + 0x1d0]
mov rcx, r12
mov r8, qword [rbp + 0x1c8]
mov rdx, qword [rbp + 0x1c0]
mov qword [rsp + 0x20], rbx
call fcn.140163330
test eax, eax
jle 0x14016530f
cdqe
mov rsi, qword [rsp + 0x280]
mov rbx, qword [rsp + 0x2b0]
mov r14, qword [rsp + 0x278]
mov r15, qword [rsp + 0x270]
add rsp, 0x288
pop r13
pop r12
pop rdi
pop rbp
ret
call fcn.14012d690
mov rdi, rax
mov dword [rsp + 0x40], 2
mov rax, qword [rax + 8]
cmp rax, rsi
je 0x14016547f
movabs rcx, 0xb2ab117a257edf0d
cmp rax, rcx
je 0x14016547f
mov r8, qword [rdi]
mov edx, 2
mov rcx, rdi
call qword [r8 + gethostbyaddr]
jmp 0x140165481
mov al, 1
mov byte [rsp + 0x44], al
mov qword [rsp + 0x48], rdi
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rbx], xmm0
xor eax, eax
jmp 0x140165418
Function at 0x14016afe0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
mov r15, rdx
lea r14, [rdx - 1]
mov rsi, rcx
xor r12d, r12d
nop word [rax + rax]
mov rdi, r12
mov rbp, r12
test r14, r14
je 0x14016b1f6
mov rdx, qword [rsi + 8]
nop dword [rax]
nop word [rax + rax]
lea ecx, [rdx + 0xff]
shl rdi, cl
add rdi, rdi
nop dword [rax]
mov r10, qword [rsi]
mov ecx, dword [r10]
cmp ecx, 0x270
jne 0x14016b0a4
lea rax, [r10 + 8]
mov r9d, ecx
nop word [rax + rax]
mov r8d, dword [rax - 4]
xor r8d, dword [rax]
lea rax, [rax + 4]
btr r8d, 0x1f
xor r8d, dword [rax - 8]
mov ecx, r8d
and cl, 1
neg cl
sbb edx, edx
shr r8d, 1
and edx, 0x9908b0df
xor edx, dword [rax + 0x62c]
xor edx, r8d
mov dword [rax + 0x9b8], edx
sub r9, 1
jne 0x14016b060
mov ecx, dword [r10]
jmp 0x14016b187
cmp ecx, 0x4e0
jb 0x14016b187
lea r11, [r10 + 0x9c4]
mov ebx, 0xe3
mov eax, dword [r11]
nop
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x14016b0c0
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop word [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x14016b110
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
mov ecx, r12d
mov dword [r10], r12d
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
mov r8, qword [rsi + 0x10]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and edx, 0xffffdf8c
shl edx, 0xf
mov ecx, edx
xor rcx, rax
mov rax, rcx
shr rax, 0x12
xor rax, rcx
cmp rax, r8
ja 0x14016b040
mov rdx, qword [rsi + 8]
or rdi, rax
lea ecx, [rdx + 0xff]
shl rbp, cl
add rbp, rbp
or rbp, r8
cmp rbp, r14
jb 0x14016b030
xor edx, edx
mov rax, rbp
div r15
mov rcx, rax
mov r8, rdx
xor edx, edx
mov rax, rdi
div r15
cmp rax, rcx
jb 0x14016b21a
cmp r8, r14
jne 0x14016b010
mov rbx, qword [rsp + 0x20]
mov rax, rdi
mov rbp, qword [rsp + 0x28]
xor edx, edx
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
div r15
mov rax, rdx
pop r15
pop r14
pop r12
ret
Function at 0x14016b240
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
mov rax, qword [rcx + 8]
xor r14d, r14d
mov edi, r14d
mov ebp, r14d
mov rsi, rcx
nop word [rax + rax]
lea ecx, [rax + 0xff]
shl rdi, cl
add rdi, rdi
nop dword [rax]
mov r10, qword [rsi]
mov ecx, dword [r10]
cmp ecx, 0x270
jne 0x14016b2e4
lea rax, [r10 + 8]
mov r9d, ecx
nop word [rax + rax]
mov r8d, dword [rax - 4]
xor r8d, dword [rax]
lea rax, [rax + 4]
btr r8d, 0x1f
xor r8d, dword [rax - 8]
mov ecx, r8d
and cl, 1
neg cl
sbb edx, edx
shr r8d, 1
and edx, 0x9908b0df
xor edx, dword [rax + 0x62c]
xor edx, r8d
mov dword [rax + 0x9b8], edx
sub r9, 1
jne 0x14016b2a0
mov ecx, dword [r10]
jmp 0x14016b3c7
cmp ecx, 0x4e0
jb 0x14016b3c7
lea r11, [r10 + 0x9c4]
mov ebx, 0xe3
mov eax, dword [r11]
nop
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x14016b300
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop word [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x14016b350
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
mov ecx, r14d
mov dword [r10], r14d
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov ecx, edx
mov dword [r10], eax
mov eax, dword [r10 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and edx, 0xffffdf8c
shl edx, 0xf
mov ecx, edx
xor rcx, rax
mov rdx, rcx
shr rdx, 0x12
xor rdx, rcx
cmp rdx, qword [rsi + 0x10]
ja 0x14016b280
mov rax, qword [rsi + 8]
or rdi, rdx
add rbp, rax
cmp rbp, 0x40
jb 0x14016b270
mov rbx, qword [rsp + 0x10]
mov rax, rdi
mov rdi, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
pop r14
ret
Function at 0x14016b450
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister
Resolve dns

Disassembly:
push rbp
lea rbp, [rsp - 0x1340]
mov eax, 0x1440
call fcn.14038bb30
sub rsp, rax
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x1458], rbx
mov qword [rsp + 0x1460], rsi
mov qword [rsp + 0x1468], rdi
mov rdi, r8
mov rsi, rdx
mov rcx, qword [rcx]
call fcn.140169c90
test al, al
jne 0x14016b636
movdqa xmm0, xmmword [0x1403f2c70]
movdqu xmmword [rsp + 0x40], xmm0
xor ebx, ebx
mov qword [rsp + 0x50], rbx
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], rbx
cmp qword [rdi + 0x18], 0x10
jb 0x14016b4cb
mov rdi, qword [rdi]
lea r9, [rbp + 0x1350]
lea r8, [rsp + 0x40]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
jne 0x14016b5f6
mov rax, qword [rbp + 0x1350]
test rax, rax
je 0x14016b50c
nop word [rax + rax]
inc rbx
mov rax, qword [rax + 0x28]
test rax, rax
jne 0x14016b500
call fcn.14036d94c
mov r9d, 0xffffffff
mov dword [rbp + 0x1334], r9d
mov dword [rbp - 0x4c], eax
mov r8d, 1
mov edx, r8d
nop word [rax + rax]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, r8d
mov dword [rbp + rdx*4 - 0x4c], eax
inc r8d
inc rdx
cmp rdx, 0x270
jl 0x14016b530
mov dword [rbp - 0x50], 0x270
lea rax, [rbp - 0x50]
mov qword [rsp + 0x20], rax
mov ecx, 0x40
mov rax, 0xffffffffffffffff
nop
dec rcx
shr rax, 1
cmp rax, r9
ja 0x14016b570
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x20]
test rbx, rbx
jne 0x14016b596
call fcn.14016b240
jmp 0x14016b59e
mov rdx, rbx
call fcn.14016afe0
mov rbx, qword [rbp + 0x1350]
test rax, rax
je 0x14016b5ba
nop word [rax + rax]
mov rbx, qword [rbx + 0x28]
sub rax, 1
jne 0x14016b5b0
mov rax, qword [rbx + 0x20]
mov ecx, dword [rax + 4]
call qword [sym.imp.WS2_32.dll_ntohl]
mov edx, eax
mov rcx, rsi
call fcn.14016c950
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
mov rax, rsi
lea r11, [rsp + 0x1440]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
mov edx, eax
lea rcx, [rsp + 0x70]
call fcn.14016c550
nop
mov r8, rax
lea rdx, str.Ipv4Resolver::resolve__getaddrinfo_failed_
lea rcx, [rbp - 0x70]
call fcn.14013ef60
nop
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.14012c4c0
lea rdx, [0x140507b98]
lea rcx, [rsp + 0x20]
call fcn.1403a8b10
nop
xor eax, eax
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x20]
call fcn.14012c210
lea rdx, [0x140507c98]
lea rcx, [rsp + 0x20]
call fcn.1403a8b10
int3
Function at 0x140170770
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov qword [rax - 0x38], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov r12, r9
movzx r15d, r8b
mov r14, rdx
mov r10, rcx
mov r13, qword [rcx]
mov rsi, r13
mov rbx, qword [r13 + 8]
mov dil, 1
cmp byte [rbx + 0x19], 0
jne 0x1401707fe
mov rsi, rbx
test r15b, r15b
je 0x1401707d3
lea rcx, [rbx + 0x20]
mov rdx, r12
call fcn.1401467f0
mov edi, eax
shr edi, 0x1f
xor dil, 1
jmp 0x1401707e5
lea rdx, [rbx + 0x20]
mov rcx, r12
call fcn.1401467f0
shr eax, 0x1f
movzx edi, al
test dil, dil
je 0x1401707ef
mov rbx, qword [rbx]
jmp 0x1401707f3
mov rbx, qword [rbx + 0x10]
cmp byte [rbx + 0x19], 0
je 0x1401707b4
mov r10, qword [rsp + 0x70]
mov rbx, rsi
mov rcx, rsi
test dil, dil
je 0x1401708c0
cmp rsi, qword [r13]
jne 0x14017084a
movzx eax, byte [rsp + 0x90]
mov byte [rsp + 0x28], al
mov qword [rsp + 0x20], r12
mov r9, rsi
mov r8b, 1
lea rdx, [rsp + 0x70]
mov rcx, r10
call fcn.1401704e0
mov rax, qword [rax]
mov qword [r14], rax
mov byte [r14 + 8], 1
mov rax, r14
jmp 0x140170915
cmp byte [rsi + 0x19], 0
je 0x140170856
mov rbx, qword [rsi + 0x10]
jmp 0x1401708bd
mov rax, qword [rsi]
cmp byte [rax + 0x19], 0
je 0x14017089f
mov rax, qword [rsi + 8]
cmp byte [rax + 0x19], 0
jne 0x140170891
mov rdx, rsi
nop dword [rax]
mov r8, rax
mov r9, rax
mov rcx, rdx
cmp rdx, qword [rax]
jne 0x140170891
mov rbx, rax
mov rax, qword [rax + 8]
mov rdx, rbx
mov rcx, rbx
cmp byte [rax + 0x19], 0
je 0x140170870
cmp byte [rbx + 0x19], 0
jne 0x1401708c0
mov rbx, rax
mov rcx, rax
jmp 0x1401708c0
mov rbx, rax
mov rax, qword [rax + 0x10]
cmp byte [rax + 0x19], 0
jne 0x1401708bd
nop dword [rax]
mov rbx, rax
mov rax, qword [rax + 0x10]
cmp byte [rax + 0x19], 0
je 0x1401708b0
mov rcx, rbx
add rcx, 0x20
mov rdx, r12
call fcn.1401467f0
shr eax, 0x1f
test al, al
je 0x14017090a
movzx eax, byte [rsp + 0x90]
mov byte [rsp + 0x28], al
mov qword [rsp + 0x20], r12
mov r9, rsi
movzx r8d, dil
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x70]
call fcn.1401704e0
mov rax, qword [rax]
mov qword [r14], rax
mov byte [r14 + 8], 1
mov rax, r14
jmp 0x140170915
mov qword [r14], rbx
mov byte [r14 + 8], 0
mov rax, r14
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140178550
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp qword [r8 + 0x28], 0x10
lea r11, [r8 + 0x10]
mov rbx, qword [r11 + 0x10]
mov rsi, rdx
mov rdi, rcx
jb 0x140178577
mov r11, qword [r11]
xor r9d, r9d
movabs r10, 0xcbf29ce484222325
test rbx, rbx
je 0x1401785b4
movabs rcx, 0x100000001b3
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r9 + r11]
inc r9
xor r10, rax
imul r10, rcx
cmp r9, rbx
jb 0x1401785a0
mov rdx, qword [rdi + 0x30]
mov rcx, qword [rdi + 0x18]
and rdx, r10
shl rdx, 4
add rcx, rdx
mov rax, qword [rcx]
cmp qword [rcx + 8], r8
jne 0x1401785f4
cmp rax, r8
jne 0x1401785ea
mov rax, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rdi + 0x18]
mov rax, qword [rdi + 8]
mov qword [rdx + rcx + 8], rax
jmp 0x1401785ff
mov rax, qword [r8 + 8]
mov qword [rcx + 8], rax
jmp 0x1401785ff
cmp rax, r8
jne 0x1401785ff
mov rax, qword [r8]
mov qword [rcx], rax
mov rax, qword [r8 + 8]
lea rcx, [rdi + 8]
mov rbx, qword [r8]
mov qword [rax], rbx
mov rdx, qword [r8]
mov rax, qword [r8 + 8]
mov qword [rdx + 8], rax
mov rdx, r8
dec qword [rcx + 8]
call fcn.140178870
mov qword [rsi], rbx
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret