joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140019120
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x518
mov rax, qword [0x14008f060]
xor rax, rsp
mov qword [rsp + 0x500], rax
mov dword [rsp + 0xe0], 0x30
xor edx, edx
mov r8d, 0x204
lea rcx, [rsp + 0xe4]
call fcn.140039940
mov dword [rsp + 0x2f0], 0x30
xor edx, edx
mov r8d, 0x204
lea rcx, [rsp + 0x2f4]
call fcn.140039940
mov r8d, 0x104
lea rdx, [rsp + 0xe0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rsp + 0xe0]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea r9, str.DataUpdate.exe
lea r8, [rsp + 0xe0]
lea rdx, str._s_s
lea rcx, [rsp + 0x2f0]
call fcn.140006c40
mov dword [rsp + 0x70], WSAGetLastError
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
movups xmmword [rsp + 0x88], xmm0
movups xmmword [rsp + 0x98], xmm0
movups xmmword [rsp + 0xa8], xmm0
movups xmmword [rsp + 0xb8], xmm0
movups xmmword [rsp + 0xc8], xmm0
xor eax, eax
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rax
mov rcx, qword [0x140093d78]
test rcx, rcx
je 0x140019225
lea r9, str.Create_Process___DataUpdate.exe
lea r8, str.CServiceInstance::CreateDataUpdate
xor edx, edx
call fcn.140003290
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x2f0]
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov rcx, qword [0x140093d78]
test eax, eax
je 0x1400192a4
test rcx, rcx
je 0x14001928c
lea r9, str.Create_Process___DataUpdate.exe_successful
lea r8, str.CServiceInstance::CreateDataUpdate
xor edx, edx
call fcn.140003290
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400192be
test rcx, rcx
je 0x1400192be
lea r9, str.Create_Process___DataUpdate.exe_failed
lea r8, str.CServiceInstance::CreateDataUpdate
xor edx, edx
call fcn.140003290
mov rcx, qword [0x140093d78]
test rcx, rcx
je 0x1400192e0
lea r9, [0x14007a9b8]
lea r8, str.CServiceInstance::CreateDataUpdate
xor edx, edx
call fcn.140003290
nop
mov rcx, qword [rsp + 0x500]
xor rcx, rsp
call fcn.140036cc0
add rsp, 0x518
ret
Function at 0x140019300
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x15a0]
mov eax, 0x16a0
call fcn.140037780
sub rsp, rax
mov rax, qword [0x14008f060]
xor rax, rsp
mov qword [rbp + 0x1590], rax
mov r13, rcx
xor edx, edx
lea rcx, [rbp + 0x1380]
mov r8d, 0x208
call fcn.140039940
xor edx, edx
lea rcx, [rbp + 0xf60]
mov r8d, 0x208
call fcn.140039940
mov r8d, 0x104
lea rdx, [rbp + 0xf60]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rbp + 0xf60]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea r8, [0x14007d148]
mov edx, 0x104
lea rcx, [rbp + 0xf60]
call fcn.14004c450
lea r12, str.ADESv2BW.exe
mov edx, 0x104
mov r8, r12
lea rcx, [rbp + 0xf60]
call fcn.14004c450
mov r9d, WSAStartup
lea r8, [rsp + 0x40]
lea rcx, [rbp + 0xf60]
call fcn.140014fc0
xor r15d, r15d
nop dword [rax + rax]
lea r8, [rsp + 0x38]
mov edx, 0x1000
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_K32EnumProcesses]
mov r14d, dword [rsp + 0x38]
xor edi, edi
shr r14d, 2
test r14d, r14d
je 0x1400194c7
lea rsi, [rsp + 0x60]
nop
movups xmm0, xmmword [str._unknown_]
mov eax, dword [0x14007d828]
lea rcx, [rbp + 0x1184]
xor edx, edx
mov dword [rbp + 0x1180], eax
mov r8d, 0x1f4
movaps xmmword [rbp + 0x1170], xmm0
call fcn.140039940
mov r8d, dword [rsi]
test r8d, r8d
je 0x140019493
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140019493
lea r9, [rsp + 0x3c]
mov r8d, 8
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
test eax, eax
je 0x140019493
mov rdx, qword [rsp + 0x30]
lea r8, [rbp + 0x1170]
mov r9d, 0x104
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_K32GetModuleBaseNameW]
lea rax, [rbp + 0x1170]
mov r8, r12
sub r8, rax
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x1400194b4
add rax, 2
test ecx, ecx
jne 0x1400194a0
test edx, edx
je 0x140019512
inc edi
add rsi, 4
cmp edi, r14d
jb 0x140019410
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [r13 + 8]
test rcx, rcx
je 0x1400194ec
mov r9, r12
lea r8, str.LaunchADESv2BWOnStart
xor edx, edx
call fcn.140003290
mov r9d, WSAStartup
lea r8, [rsp + 0x40]
lea rcx, [rbp + 0xf60]
call fcn.140014fc0
inc r15d
cmp r15d, 0x14
jl 0x1400193e0
jmp 0x140019517
mov eax, 1
test eax, eax
lea rcx, str.success
lea r9, str.fail
mov r8, r12
cmovne r9, rcx
lea rdx, str.Launch__s_is__s
lea rcx, [rbp + 0x1380]
call fcn.140006c40
mov rcx, qword [0x140093d78]
test rcx, rcx
je 0x140019562
lea r9, [rbp + 0x1380]
xor edx, edx
lea r8, str.CServiceInstance::LaunchADESv2BWOnStart
call fcn.140003290
mov rcx, qword [rbp + 0x1590]
xor rcx, rsp
call fcn.140036cc0
lea r11, [rsp + 0x16a0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x14001eea0
Capabilities:
Set socket configuration

Disassembly:
push rbx
push rsi
push rdi
push r12
push r15
sub rsp, 0x40
mov rax, qword [0x14008f060]
xor rax, rsp
mov qword [rsp + 0x38], rax
cmp qword [rdx + 0x18], 0x10
movzx r12d, r8w
mov rsi, qword [0x140093dd0]
mov rdi, rdx
mov rbx, rdx
jb 0x14001eed6
mov rbx, qword [rdx]
mov r8, qword [rdx + 0x10]
test r8, r8
je 0x14001eefe
mov edx, 0x3a
mov rcx, rbx
call fcn.140039ae0
test rax, rax
je 0x14001eefe
sub rax, rbx
cmp rax, 0xffffffffffffffff
je 0x14001eefe
xor al, al
jmp 0x14001ef00
mov al, 1
mov edx, reloc.WS2_32.dll_socket
mov qword [rsp + 0x70], rbp
test al, al
mov ecx, 2
cmove ecx, edx
xor r8d, r8d
lea edx, [r8 + 1]
call qword [sym.imp.WS2_32.dll_socket]
mov r15, rax
cmp rax, 0xffffffffffffffff
jne 0x14001ef34
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
jmp 0x14001ef6c
xor ebx, ebx
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x30]
mov dword [rsp + 0x30], ebx
mov rcx, r15
lea edx, [rbx + 0x29]
lea r8d, [rbx + 0x1b]
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x14001ef65
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
jmp 0x14001ef67
mov ebp, ebx
test r15, r15
jns 0x14001ef95
call fcn.14001f020
mov rcx, rax
mov dword [rsp + 0x20], ebp
lea r9, str.create_socket_failed._err:_d
mov r8d, 0x5e
lea rdx, str.D:GitADESv2_acerdeviceenablingservicev2AcerDeviceEnablingServiceCppNetcppnetcppnet_base.cpp
call fcn.1400219d0
xor al, al
jmp 0x14001f002
mov rax, qword [rsi + 0x1a0]
sub rax, qword [rsi + 0x198]
sar rax, 4
test rax, rax
je 0x14001f000
mov qword [rsp + 0x88], r14
mov r14, rbx
nop word [rax + rax]
mov rcx, qword [rsi + 0x198]
movzx r9d, r12w
mov r8, rdi
mov rdx, r15
mov rcx, qword [r14 + rcx]
call fcn.1400229d0
mov rax, qword [rsi + 0x1a0]
lea r14, [r14 + 0x10]
sub rax, qword [rsi + 0x198]
inc rbx
sar rax, 4
cmp rbx, rax
jb 0x14001efc0
mov r14, qword [rsp + 0x88]
mov al, 1
mov rbp, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140036cc0
add rsp, 0x40
pop r15
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x140020420
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x30
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x140020442
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rdi
je 0x1400204bc
mov rdi, r14
mov rcx, rbx
call fcn.140006100
test rax, rax
jle 0x140020494
mov rdx, qword [rbx + 0x38]
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov r8, rbp
mov rdx, qword [rdx]
call fcn.140039270
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x1400204ac
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x1400204b4
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x140020456
sub r14, rdi
jmp 0x1400205a9
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x1400204d3
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x1400204d5
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14002050a
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.140039270
mov rax, qword [rbx + 0x50]
sub rbp, rdi
add rsi, rdi
mov r8, rbp
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x1400205a6
mov r9, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r9], rax
jne 0x140020545
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r9], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rdi, r8
cmp r8, 0xfff
jbe 0x140020581
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.14004d39c
sub rbp, rax
add rsi, rax
mov rdi, rbp
cmp rax, 0xfff
jne 0x1400205bf
cmp rbp, rax
ja 0x140020551
mov r8, rdi
test rdi, rdi
je 0x1400205a6
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.14004d39c
mov r8, rdi
sub r8, rax
sub r14, r8
mov rbp, qword [rsp + 0x28]
mov rax, r14
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
sub r14, rbp
jmp 0x1400205a9
Function at 0x140023330
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x90
mov rax, qword [0x14008f060]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov ebx, edx
mov rsi, rcx
call sub.KERNEL32.dll_GetCurrentThreadId
cmp eax, dword [rsi + 0xf0]
jne 0x1400234b1
mov edi, ebx
shr rbx, 0x18
mov r14d, edi
shr r14, 0x10
mov ebp, edi
shr rbp, 8
mov rax, qword gs:[0x58]
mov r12, qword [rax]
mov r13d, socket
cmp byte [r12 + r13], 0
jne 0x1400233a8
call fcn.140037524
mov r15d, 0x130
add r15, r12
movzx edx, dil
movabs rax, 0xcbf29ce484222325
xor rdx, rax
movabs rcx, 0x100000001b3
imul rdx, rcx
movzx eax, bpl
xor rdx, rax
imul rdx, rcx
movzx eax, r14b
xor rdx, rax
imul rdx, rcx
xor rdx, rbx
movabs rax, 0xcaee32a7d4f6a63
imul rdx, rax
mov rcx, qword [r15 + 0x30]
and rcx, rdx
add rcx, rcx
mov rax, qword [r15 + 0x18]
mov rbx, qword [rax + rcx*8 + 8]
mov rdx, qword [r15 + 8]
xor ebp, ebp
cmp rbx, rdx
je 0x140023431
mov rax, qword [rax + rcx*8]
cmp rdi, qword [rbx + 0x10]
je 0x140023434
nop
cmp rbx, rax
je 0x140023431
mov rbx, qword [rbx + 8]
cmp rdi, qword [rbx + 0x10]
jne 0x140023420
jmp 0x140023434
mov rbx, rbp
test rbx, rbx
cmove rbx, rdx
cmp byte [r12 + r13], bpl
jne 0x140023446
call fcn.140037524
cmp rbx, qword [r15 + 8]
je 0x140023503
mov r8, qword [rsi + 0xf8]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x20], xmm0
mov rdx, qword [rbx + 0x20]
test rdx, rdx
je 0x140023486
mov rax, qword [rbx + 0x18]
lea rcx, [rax + 0x38]
test rax, rax
cmove rcx, rbp
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rdx
lock inc dword [rdx + 0xc]
mov rax, qword [r8]
lea rdx, [rsp + 0x20]
mov rcx, r8
call qword [rax + reloc.WS2_32.dll_htonl]
cmp byte [r12 + r13], bpl
jne 0x14002349f
call fcn.140037524
mov r8, rbx
lea rdx, [rsp + 0x30]
mov rcx, r15
call fcn.140023a00
jmp 0x140023503
mov dword [rsp + 0x20], ebx
mov qword [rsp + 0x28], rsi
lea rax, vtable.std::_Func_impl_no_alloc_class__lambda_98e20d6d9c5b4480d003f21efeaecb1d___void___.0
mov qword [rsp + 0x40], rax
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rsp + 0x48], xmm0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x78], rax
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.140022eb0
nop
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x140023503
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140036cc0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140023a00
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rdi
push r14
sub rsp, 0x20
mov r14, rdx
mov rbx, r8
mov r8, rcx
movabs rax, 0xcbf29ce484222325
movabs rcx, 0x100000001b3
movzx edx, byte [rbx + 0x10]
xor rdx, rax
movzx eax, byte [rbx + 0x11]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rbx + 0x12]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rbx + 0x13]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rbx + 0x14]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rbx + 0x15]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rbx + 0x16]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rbx + 0x17]
imul rdx, rcx
xor rdx, rax
imul rdx, rcx
mov rcx, qword [r8 + 0x30]
and rcx, rdx
mov rdx, qword [r8 + 0x18]
shl rcx, 4
add rdx, rcx
mov rax, qword [rdx]
cmp qword [rdx + 8], rbx
jne 0x140023ab9
cmp rax, rbx
jne 0x140023aaf
mov rax, qword [r8 + 8]
mov qword [rdx], rax
mov qword [rdx + 8], rax
jmp 0x140023ac4
mov rax, qword [rbx + 8]
mov qword [rdx + 8], rax
jmp 0x140023ac4
cmp rax, rbx
jne 0x140023ac4
mov rax, qword [rbx]
mov qword [rdx], rax
mov rbp, qword [rbx]
dec qword [r8 + 0x10]
mov rax, qword [rbx + 8]
mov qword [rax], rbp
mov rax, qword [rbx + 8]
mov qword [rbp + 8], rax
mov rdi, qword [rbx + 0x20]
test rdi, rdi
je 0x140023b19
mov qword [rsp + 0x50], rsi
mov esi, 0xffffffff
mov eax, esi
lock xadd dword [rdi + 8], eax
cmp eax, 1
jne 0x140023b14
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax]
lock xadd dword [rdi + 0xc], esi
cmp esi, 1
jne 0x140023b14
mov rdx, qword [rdi]
mov rcx, rdi
call qword [rdx + reloc.WS2_32.dll_htonl]
mov rsi, qword [rsp + 0x50]
mov edx, 0x28
mov rcx, rbx
call fcn.140036d1c
mov rbx, qword [rsp + 0x58]
mov rax, r14
mov qword [r14], rbp
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
Function at 0x1400241a0
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x28
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x14002437f
lea rax, [rdx - 1]
mov qword [rsp + 0x50], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x20], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.140023810
mov rcx, qword [rsi + 8]
lea rax, [rdi - 1]
mov qword [rsi + 0x30], rax
mov qword [rsi + 0x38], rdi
mov rcx, qword [rcx]
mov rdx, rcx
cmp rcx, rbx
je 0x140024348
mov qword [rsp + 0x58], rbp
movabs rdi, 0x100000001b3
movabs rbp, 0xcbf29ce484222325
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rcx + 0x11]
movzx r9d, byte [rcx + 0x10]
mov r11, qword [rsi + 0x30]
xor r9, rbp
mov rdx, qword [rdx]
imul r9, rdi
xor r9, rax
movzx eax, byte [rcx + 0x12]
imul r9, rdi
xor r9, rax
movzx eax, byte [rcx + 0x13]
imul r9, rdi
xor r9, rax
movzx eax, byte [rcx + 0x14]
imul r9, rdi
xor r9, rax
movzx eax, byte [rcx + 0x15]
imul r9, rdi
xor r9, rax
movzx eax, byte [rcx + 0x16]
imul r9, rdi
xor r9, rax
movzx eax, byte [rcx + 0x17]
imul r9, rdi
xor r9, rax
imul r9, rdi
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r10, qword [r11]
cmp r10, rbx
jne 0x1400242bc
mov qword [r11], rcx
mov qword [r11 + 8], rcx
jmp 0x140024337
mov rax, qword [r11 + 8]
mov r9, qword [rcx + 0x10]
cmp r9, qword [rax + 0x10]
jne 0x1400242f9
mov r10, qword [rax]
cmp r10, rcx
je 0x1400242f3
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
mov qword [r11 + 8], rcx
jmp 0x140024337
mov r8, rax
cmp r10, rax
je 0x140024313
mov rax, qword [rax + 8]
mov r8, rax
cmp r9, qword [rax + 0x10]
je 0x140024359
cmp r10, rax
jne 0x140024301
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], r8
mov rax, qword [r8 + 8]
mov qword [rax], rcx
mov qword [r8 + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], rax
mov qword [r11], rcx
mov rcx, rdx
cmp rdx, rbx
jne 0x140024240
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov r14, qword [rsp + 0x20]
add rsp, 0x28
pop rdi
pop rsi
ret
mov r10, qword [rax]
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
jmp 0x140024337
lea rcx, str.invalid_hash_bucket_count
call fcn.140034fcc
int3
Function at 0x140024460
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov edi, dword [rcx + 8]
mov r15, rcx
mov rax, qword gs:[0x58]
mov ebx, edi
mov r13d, socket
mov ebp, edi
mov esi, edi
shr rbx, 0x18
shr rbp, 0x10
mov r12, qword [rax]
shr rsi, 8
cmp byte [r12 + r13], 0
jne 0x1400244b2
call fcn.140037524
movabs rcx, 0x100000001b3
movzx edx, dil
movabs rax, 0xcbf29ce484222325
mov r14d, 0x130
xor rdx, rax
add r14, r12
imul rdx, rcx
movzx eax, sil
xor esi, esi
xor rdx, rax
movzx eax, bpl
imul rdx, rcx
xor rdx, rax
movabs rax, 0xcaee32a7d4f6a63
imul rdx, rcx
mov rcx, qword [r14 + 0x30]
xor rdx, rbx
imul rdx, rax
mov rax, qword [r14 + 0x18]
and rcx, rdx
mov rdx, qword [r14 + 8]
add rcx, rcx
mov rbx, qword [rax + rcx*8 + 8]
cmp rbx, rdx
je 0x140024541
mov rax, qword [rax + rcx*8]
cmp rdi, qword [rbx + 0x10]
je 0x140024544
nop dword [rax]
cmp rbx, rax
je 0x140024541
mov rbx, qword [rbx + 8]
cmp rdi, qword [rbx + 0x10]
jne 0x140024530
jmp 0x140024544
mov rbx, rsi
test rbx, rbx
cmove rbx, rdx
cmp byte [r12 + r13], sil
jne 0x140024556
call fcn.140037524
cmp rbx, qword [r14 + 8]
je 0x1400245bd
mov rax, qword [r15 + 0x10]
xorps xmm0, xmm0
mov r8, qword [rbx + 0x20]
mov rcx, qword [rax + 0xf8]
movdqu xmmword [rsp + 0x20], xmm0
test r8, r8
je 0x140024597
mov rax, qword [rbx + 0x18]
test rax, rax
mov qword [rsp + 0x28], r8
lea rdx, [rax + 0x38]
cmove rdx, rsi
mov qword [rsp + 0x20], rdx
lock inc dword [r8 + 0xc]
mov rax, qword [rcx]
lea rdx, [rsp + 0x20]
call qword [rax + reloc.WS2_32.dll_htonl]
cmp byte [r12 + r13], sil
jne 0x1400245ad
call fcn.140037524
mov r8, rbx
lea rdx, [rsp + 0x30]
mov rcx, r14
call fcn.140023a00
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140025c90
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x14008f060]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rbx, rcx
mov edx, 0x7fffffff
mov rcx, qword [rcx + 8]
call qword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
jne 0x140025cc2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rbx + 8]
lea r8, [rsp + 0x20]
mov edx, 0x8004667e
mov dword [rsp + 0x20], 1
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x18]
mov al, 1
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140036cc0
add rsp, 0x30
pop rbx
ret
Function at 0x14002b180
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
movzx r8d, byte [rdx]
mov r9, rcx
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r8, rax
mov r11, rdx
movzx eax, byte [rdx + 1]
mov rdi, qword [r9 + 0x18]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 2]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 3]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 4]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 5]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 6]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 7]
mov rdx, qword [r9 + 8]
imul r8, rcx
xor r8, rax
imul r8, rcx
and r8, qword [r9 + 0x30]
mov r10, r8
add r10, r10
mov rsi, qword [rdi + r10*8 + 8]
mov rbx, rsi
cmp rsi, rdx
je 0x14002b2ed
mov rax, qword [r11]
mov rcx, qword [rdi + r10*8]
cmp rax, qword [rsi + 0x10]
je 0x14002b244
cmp rbx, rcx
je 0x14002b2ed
mov rbx, qword [rbx + 8]
cmp rax, qword [rbx + 0x10]
jne 0x14002b231
test rbx, rbx
je 0x14002b2ed
add r8, r8
mov rax, qword [rdi + r8*8]
cmp rsi, rbx
jne 0x14002b274
cmp rax, rbx
jne 0x14002b269
mov qword [rdi + r8*8], rdx
mov qword [rdi + r10*8 + 8], rdx
jmp 0x14002b280
mov rdx, qword [rbx + 8]
mov qword [rdi + r10*8 + 8], rdx
jmp 0x14002b280
cmp rax, rbx
jne 0x14002b280
mov rax, qword [rbx]
mov qword [rdi + r8*8], rax
mov rcx, qword [rbx]
dec qword [r9 + 0x10]
mov rax, qword [rbx + 8]
mov qword [rax], rcx
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
mov rdi, qword [rbx + 0x20]
test rdi, rdi
je 0x14002b2cb
mov esi, 0xffffffff
mov eax, esi
lock xadd dword [rdi + 8], eax
cmp eax, 1
jne 0x14002b2cb
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax]
lock xadd dword [rdi + 0xc], esi
cmp esi, 1
jne 0x14002b2cb
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.WS2_32.dll_htonl]
mov edx, 0x28
mov rcx, rbx
call fcn.140036d1c
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x40]
xor eax, eax
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x140032430
Capabilities:
Hash data using fnv

Disassembly:
movzx r9d, dx
mov r8, rcx
mov rcx, qword [rcx + 0x88]
movabs rax, 0xcbf29ce484222325
movzx edx, r9b
xor rdx, rax
movabs rax, 0x100000001b3
imul rdx, rax
mov eax, r9d
shr rax, 8
xor rdx, rax
movabs rax, 0x8a97b0004e7feab
imul rdx, rax
and rcx, rdx
mov rdx, qword [r8 + 0x60]
shl rcx, 4
add rcx, qword [r8 + 0x70]
mov rax, qword [rcx + 8]
cmp rax, rdx
je 0x1400324c3
mov rcx, qword [rcx]
cmp r9d, dword [rax + 0x10]
je 0x1400324a5
cmp rax, rcx
je 0x1400324c3
mov rax, qword [rax + 8]
cmp r9d, dword [rax + 0x10]
jne 0x140032496
test rax, rax
cmove rax, rdx
cmp rax, rdx
je 0x1400324c3
cmp qword [rax + 0x20], 0
je 0x1400324c3
mov rax, qword [rax + 0x18]
mov rax, qword [rax]
mov eax, dword [rax + 0x20]
ret
xor eax, eax
ret
Function at 0x140033260
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x28
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x14003341e
lea rax, [rdx - 1]
mov qword [rsp + 0x50], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x20], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.140023810
mov rcx, qword [rsi + 8]
lea rax, [rdi - 1]
mov qword [rsi + 0x30], rax
mov qword [rsi + 0x38], rdi
mov rcx, qword [rcx]
mov rdx, rcx
cmp rcx, rbx
je 0x1400333e7
mov qword [rsp + 0x58], rbp
movabs rdi, 0x100000001b3
movabs rbp, 0xcbf29ce484222325
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rcx + 0x11]
movzx r9d, byte [rcx + 0x10]
mov r11, qword [rsi + 0x30]
xor r9, rbp
mov rdx, qword [rdx]
imul r9, rdi
xor r9, rax
movzx eax, byte [rcx + 0x12]
imul r9, rdi
xor r9, rax
movzx eax, byte [rcx + 0x13]
imul r9, rdi
xor r9, rax
imul r9, rdi
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r10, qword [r11]
cmp r10, rbx
jne 0x140033353
mov qword [r11], rcx
mov qword [r11 + 8], rcx
jmp 0x1400333d6
mov rax, qword [r11 + 8]
mov r9d, dword [rcx + 0x10]
cmp r9d, dword [rax + 0x10]
jne 0x140033390
mov r10, qword [rax]
cmp r10, rcx
je 0x14003338a
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
mov qword [r11 + 8], rcx
jmp 0x1400333d6
mov r8, rax
cmp r10, rax
je 0x1400333b2
nop dword [rax + rax]
mov rax, qword [rax + 8]
mov r8, rax
cmp r9d, dword [rax + 0x10]
je 0x1400333f8
cmp r10, rax
jne 0x1400333a0
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], r8
mov rax, qword [r8 + 8]
mov qword [rax], rcx
mov qword [r8 + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], rax
mov qword [r11], rcx
mov rcx, rdx
cmp rdx, rbx
jne 0x140033300
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov r14, qword [rsp + 0x20]
add rsp, 0x28
pop rdi
pop rsi
ret
mov r10, qword [rax]
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
jmp 0x1400333d6
lea rcx, str.invalid_hash_bucket_count
call fcn.140034fcc
int3