joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18004bd50
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Set socket configuration

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rdi, rdx
mov rsi, rcx
mov rax, qword [rdx + 0x10]
mov qword [rcx + 0x48], rax
movups xmm0, xmmword [rdx]
movups xmmword [rcx + 0x38], xmm0
cmp qword [rdx], 0
mov rcx, qword [rcx + 0x30]
jne 0x18004be12
cmp word [rdi + 8], 0
jne 0x18004be12
cmp word [rdi + 0xa], 0xffff
jne 0x18004be12
cmp rcx, 0xffffffffffffffff
jne 0x18004bdc6
mov ecx, 2
mov edx, 1
mov r8d, 6
call qword [sym.imp.WS2_32.dll_socket]
mov rcx, rax
mov qword [rsi + 0x30], rax
cmp rax, 0xffffffffffffffff
je 0x18004be55
mov dword [rbp - 0x24], 1
lea r8, [rbp - 0x24]
mov edx, 0x8004667e
call qword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
jne 0x18004be55
mov qword [rbp - 0x1c], 0
mov word [rbp - 0x24], 2
movzx eax, word [rdi + 0x10]
mov word [rbp - 0x22], ax
mov eax, dword [rdi + 0xc]
mov dword [rbp - 0x20], eax
mov rcx, qword [rsi + 0x30]
lea rdx, [rbp - 0x24]
mov r8d, reloc.WS2_32.dll_recv
call qword [sym.imp.WS2_32.dll_connect]
jmp 0x18004be91
cmp rcx, 0xffffffffffffffff
jne 0x18004be3b
mov ecx, reloc.WS2_32.dll_socket
mov edx, 1
mov r8d, 6
call qword [sym.imp.WS2_32.dll_socket]
mov rcx, rax
mov qword [rsi + 0x30], rax
cmp rax, 0xffffffffffffffff
je 0x18004be55
mov dword [rbp - 0x24], 1
lea r8, [rbp - 0x24]
mov edx, 0x8004667e
call qword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
je 0x18004be59
xor eax, eax
jmp 0x18004be93
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], 0
mov word [rbp - 0x24], reloc.WS2_32.dll_socket
movzx eax, word [rdi + 0x10]
mov word [rbp - 0x22], ax
movups xmm0, xmmword [rdi]
movups xmmword [rbp - 0x1c], xmm0
mov rcx, qword [rsi + 0x30]
lea rdx, [rbp - 0x24]
mov r8d, 0x1c
call qword [sym.imp.WS2_32.dll_connect]
mov al, 1
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x18004c0f0
Capabilities:
Set socket configuration

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x60
lea rbp, [rsp + 0x60]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rbx, r9
mov r14d, r8d
mov edi, edx
mov rsi, rcx
mov rcx, qword [rcx + 0x30]
cmp rcx, 0xffffffffffffffff
jne 0x18004c14c
cmp edi, 1
mov eax, 6
mov r8d, reloc.WS2_32.dll_recvfrom
cmove r8d, eax
mov ecx, reloc.WS2_32.dll_socket
mov edx, edi
call qword [sym.imp.WS2_32.dll_socket]
mov rcx, rax
mov qword [rsi + 0x30], rax
cmp rax, 0xffffffffffffffff
je 0x18004c1f7
rol r14w, 8
xorps xmm0, xmm0
movups xmmword [rsi + 0x38], xmm0
mov word [rsi + 0x48], r14w
movups xmmword [rbp - 0x28], xmm0
mov qword [rbp - 0x18], 0
mov word [rbp - 0x2c], reloc.WS2_32.dll_socket
mov word [rbp - 0x2a], r14w
movups xmm0, xmmword [rbx]
movups xmmword [rbp - 0x24], xmm0
mov dword [rbp - 0xc], 1
mov dword [rsp + 0x20], 4
lea r9, [rbp - 0xc]
mov edx, 0xffff
mov r8d, 4
call qword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x18004c1f7
mov rcx, qword [rsi + 0x30]
lea rdx, [rbp - 0x2c]
mov r8d, 0x1c
call qword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
je 0x18004c1f7
cmp edi, 1
jne 0x18004c1d6
mov rcx, qword [rsi + 0x30]
mov edx, 0x64
call qword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
je 0x18004c1f7
mov dword [rbp - 0x10], 1
mov rcx, qword [rsi + 0x30]
lea r8, [rbp - 0x10]
mov edx, 0x8004667e
call qword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
sete al
jmp 0x18004c1f9
xor eax, eax
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret

Function at 0x18004c2a0
Capabilities:
Set socket configuration

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rbx, r9
mov r14d, r8d
mov edi, edx
mov rsi, rcx
mov rcx, qword [rcx + 0x30]
cmp rcx, 0xffffffffffffffff
jne 0x18004c2fc
cmp edi, 1
mov eax, 6
mov r8d, reloc.WS2_32.dll_recvfrom
cmove r8d, eax
mov ecx, 2
mov edx, edi
call qword [sym.imp.WS2_32.dll_socket]
mov rcx, rax
mov qword [rsi + 0x30], rax
cmp rax, 0xffffffffffffffff
je 0x18004c3a2
rol r14w, 8
xorps xmm0, xmm0
movups xmmword [rsi + 0x38], xmm0
mov word [rsi + 0x48], r14w
mov qword [rbp - 0x18], 0
mov word [rbp - 0x20], 2
mov word [rbp - 0x1e], r14w
mov eax, dword [rbx + 0xc]
mov dword [rbp - 0x1c], eax
mov dword [rbp - 0xc], 1
mov dword [rsp + 0x20], 4
lea r9, [rbp - 0xc]
mov edx, 0xffff
mov r8d, 4
call qword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x18004c3a2
mov rcx, qword [rsi + 0x30]
lea rdx, [rbp - 0x20]
mov r8d, reloc.WS2_32.dll_recv
call qword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
je 0x18004c3a2
cmp edi, 1
jne 0x18004c381
mov rcx, qword [rsi + 0x30]
mov edx, 0x64
call qword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
je 0x18004c3a2
mov dword [rbp - 0x10], 1
mov rcx, qword [rsi + 0x30]
lea r8, [rbp - 0x10]
mov edx, 0x8004667e
call qword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
sete al
jmp 0x18004c3a4
xor eax, eax
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
Function at 0x18004c470
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
mov r9, rdx
cmp qword [rdx], 0
jne 0x18004c493
cmp word [r9 + 8], 0
jne 0x18004c493
cmp word [r9 + 0xa], 0xffff
jne 0x18004c493
mov edx, 2
jmp fcn.18004c2a0
mov edx, 2
jmp fcn.18004c0f0

Function at 0x18004f3e0
Capabilities:
Send data
Send data on socket

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rsi, rcx
mov rax, qword [rcx + 0xc0]
cmp rax, qword [rcx + 0xc8]
je 0x18004f416
mov rcx, rsi
add rsp, 0x50
pop rdi
pop rsi
pop rbp
jmp fcn.18004f570
mov rdi, qword [r8 + 0x10]
mov eax, edi
rol ax, 8
mov byte [rbp - 0x28], dl
mov word [rbp - 0x27], 0x303
mov word [rbp - 0x25], ax
mov qword [rbp - 0x23], 0
mov dword [rbp - 0x1c], 0
mov qword [rbp - 0x18], 5
mov qword [rbp - 0x10], recvfrom
cmp qword [r8 + 0x18], 0x10
jb 0x18004f456
mov r8, qword [r8]
cmp rdi, 0xa
jbe 0x18004f480
mov qword [rsp + 0x20], rdi
lea rcx, [rbp - 0x28]
mov rdx, rdi
mov r9, r8
call fcn.18000a810
mov edi, dword [rbp - 0x18]
cmp qword [rbp - 0x10], 0x10
jb 0x18004f4a6
mov rdx, qword [rbp - 0x28]
jmp 0x18004f4aa
lea rcx, [rbp - 0x23]
lea rax, [rdi + 5]
mov qword [rbp - 0x18], rax
mov rdx, r8
mov r8, rdi
call fcn.1800d5310
mov byte [rbp + rdi - 0x23], 0
mov edi, dword [rbp - 0x18]
cmp qword [rbp - 0x10], 0x10
jae 0x18004f47a
lea rdx, [rbp - 0x28]
mov rcx, qword [rsi + 0x30]
mov r8d, edi
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_send]
mov esi, eax
mov rax, qword [rbp - 0x10]
cmp rax, 0x10
jb 0x18004f4f7
mov rcx, qword [rbp - 0x28]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x18004f4f2
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x18004f504
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.1800a77d0
cmp esi, edi
sete al
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
call fcn.1800b109c
int3
Function at 0x18004f570
Capabilities:
Send data
Send data on socket

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x80
lea rbp, [rsp + 0x80]
mov qword [rbp - 8], 0xfffffffffffffffe
mov r9, r8
mov bl, dl
mov rsi, rcx
add rcx, 0xb8
lea rdx, [rbp - 0x58]
mov r8d, ebx
call fcn.180081640
mov word [rbp - 0xd], 0x303
mov byte [rbp - 0xe], bl
mov rdi, qword [rbp - 0x50]
sub rdi, qword [rbp - 0x58]
mov word [rbp - 0xa], di
add rdi, 5
mov rcx, rdi
call fcn.180088000
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], 0
mov qword [rbp - 0x18], rdi
mov byte [rbp - 0x38], 0
lea rcx, method.std::codecvt_char__char__struct__Mbstatet_.virtual_0
mov qword [rbp - 0x40], rcx
lea rcx, [rbp - 0x28]
mov qword [rbp - 0x30], rcx
test rdi, rdi
je 0x18004f70d
xor ecx, ecx
lea rdx, [rbp - 0xd]
mov byte [rax + rcx], bl
inc qword [rbp - 0x20]
mov rax, qword [rbp - 0x40]
lea rcx, [rbp - 0x40]
mov r8d, 1
call qword [rax + ioctlsocket]
test al, al
je 0x18004f669
lea rdx, [rbp - 0xc]
mov rax, qword [rbp - 0x40]
lea rcx, [rbp - 0x40]
mov r8d, 1
call qword [rax + ioctlsocket]
test al, al
je 0x18004f669
cmp byte [rbp - 0x38], 0
je 0x18004f648
lea rdx, [rbp - 0xa]
mov rax, qword [rbp - 0x40]
lea rcx, [rbp - 0x40]
jmp 0x18004f660
movzx eax, word [rbp - 0xa]
rol ax, 8
mov word [rbp - 0x10], ax
mov rax, qword [rbp - 0x40]
lea rcx, [rbp - 0x40]
lea rdx, [rbp - 0x10]
mov r8d, 2
call qword [rax + ioctlsocket]
mov rbx, qword [rbp - 0x58]
mov rdi, qword [rbp - 0x50]
sub rdi, rbx
mov rax, qword [rbp - 0x28]
mov rcx, qword [rbp - 0x20]
lea rdx, [rdi + rcx]
cmp qword [rbp - 0x18], rdx
jb 0x18004f72f
add rcx, rax
mov rdx, rbx
mov r8, rdi
call fcn.1800d5310
add rdi, qword [rbp - 0x20]
mov qword [rbp - 0x20], rdi
mov rdx, qword [rbp - 0x28]
mov rcx, qword [rsi + 0x30]
mov r8d, edi
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_send]
mov esi, eax
mov rcx, qword [rbp - 0x28]
test rcx, rcx
je 0x18004f6c4
call fcn.1800b4450
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x18004f6fa
mov rdx, qword [rbp - 0x48]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x18004f6f5
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x18004f754
add rdx, 0x27
mov rcx, rax
call fcn.1800a77d0
cmp esi, edi
sete al
add rsp, 0x80
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
mov edx, 1
mov rcx, rax
call fcn.180088050
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x18], 1
mov rcx, qword [rbp - 0x20]
jmp 0x18004f5fb
mov r14, rdx
shr r14, 1
add r14, rdx
mov rcx, rax
mov rdx, r14
call fcn.180088050
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x18], r14
mov rcx, qword [rbp - 0x20]
jmp 0x18004f68a
call fcn.1800b109c
int3
Function at 0x18004fa90
Capabilities:
Send data
Send data on socket

Disassembly:
push rbp
push rsi
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov qword [rbp], 0xfffffffffffffffe
mov r8, rdx
mov rax, qword [rcx + 0xc0]
cmp rax, qword [rcx + 0xc8]
je 0x18004fac3
mov dl, reloc.WS2_32.dll_socket
add rsp, 0x28
pop rsi
pop rbp
jmp fcn.18004f570
mov esi, dword [r8 + 0x10]
cmp qword [r8 + 0x18], 0x10
jb 0x18004fad1
mov r8, qword [r8]
mov rcx, qword [rcx + 0x30]
mov rdx, r8
mov r8d, esi
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_send]
cmp eax, esi
sete al
add rsp, 0x28
pop rsi
pop rbp
ret

Function at 0x18004fc60
Capabilities:
Create udp socket
Send data
Send data on socket

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [rdx + 0x10]
mov qword [rcx + 0x48], rax
movups xmm0, xmmword [rdx]
movups xmmword [rcx + 0x38], xmm0
cmp qword [rcx + 0x30], 0xffffffffffffffff
jne 0x18004fcd8
movzx eax, word [rdi]
or ax, word [rdi + 2]
movzx ecx, word [rdi + 0xa]
not ecx
or cx, word [rdi + 8]
or cx, word [rdi + 6]
or cx, word [rdi + 4]
or cx, ax
mov eax, 2
mov ecx, reloc.WS2_32.dll_socket
cmove ecx, eax
mov edx, 2
mov r8d, reloc.WS2_32.dll_recvfrom
call qword [sym.imp.WS2_32.dll_socket]
mov qword [rbx + 0x30], rax
cmp rax, 0xffffffffffffffff
je 0x18004fcee
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop rbp
jmp fcn.18004fd20
xor eax, eax
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop rbp
ret

Function at 0x18004fd20
Capabilities:
Send data
Send data on socket

Disassembly:
push rbp
push rsi
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, r8
cmp qword [rdx], 0
jne 0x18004fda1
cmp word [rdx + 8], 0
jne 0x18004fda1
cmp word [rdx + 0xa], 0xffff
jne 0x18004fda1
mov qword [rbp - 0x14], 0
mov word [rbp - 0x1c], 2
movzx eax, word [rdx + 0x10]
mov word [rbp - 0x1a], ax
mov eax, dword [rdx + 0xc]
mov dword [rbp - 0x18], eax
mov r8d, dword [rsi + 0x10]
cmp qword [rsi + 0x18], 0x10
mov rdx, rsi
jb 0x18004fd77
mov rdx, qword [rsi]
mov rcx, qword [rcx + 0x30]
lea rax, [rbp - 0x1c]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], reloc.WS2_32.dll_recv
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_sendto]
cdqe
cmp qword [rsi + 0x10], rax
je 0x18004fdfc
xor eax, eax
jmp 0x18004fdfe
xorps xmm0, xmm0
movups xmmword [rbp - 0x18], xmm0
mov qword [rbp - 8], 0
mov word [rbp - 0x1c], reloc.WS2_32.dll_socket
movups xmm0, xmmword [rdx]
movups xmmword [rbp - 0x14], xmm0
movzx eax, word [rdx + 0x10]
mov word [rbp - 0x1a], ax
mov r8d, dword [rsi + 0x10]
cmp qword [rsi + 0x18], 0x10
mov rdx, rsi
jb 0x18004fdd6
mov rdx, qword [rsi]
mov rcx, qword [rcx + 0x30]
lea rax, [rbp - 0x1c]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 0x1c
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_sendto]
cdqe
cmp qword [rsi + 0x10], rax
jne 0x18004fd9d
mov al, 1
add rsp, 0x58
pop rsi
pop rbp
ret
Function at 0x180050c80
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx + 0x30]
lea rdx, [rsp + 0x27]
mov r8d, 1
mov r9d, 2
call qword [sym.imp.WS2_32.dll_recv]
cmp eax, 1
sete al
add rsp, 0x28
ret

Function at 0x180050d00
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x60
lea rbp, [rsp + 0x60]
mov qword [rbp - 8], 0xfffffffffffffffe
xorps xmm0, xmm0
movaps xmmword [rbp - 0x20], xmm0
movaps xmmword [rbp - 0x30], xmm0
test r8d, r8d
js 0x180050edc
mov edi, r8d
mov rsi, rdx
mov rbx, rcx
movsxd r14, r8d
cmp r8d, 0xf
ja 0x180050d74
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x18], recvfrom
lea rcx, [rbp - 0x30]
xor edx, edx
mov r8, r14
call fcn.1800d5a50
lea r15, [r14 + rbp]
add r15, 0xffffffffffffffd0
mov byte [r15], 0
cmp qword [rbp - 0x18], 0x10
jb 0x180050de1
mov rdx, qword [rbp - 0x30]
jmp 0x180050de5
mov rax, r14
or rax, 0xf
cmp rax, 0x17
mov r12d, socket
cmovae r12, rax
cmp r12, 0xfff
jb 0x180050dad
lea rcx, [r12 + 0x28]
call fcn.1800a77e0
mov r15, rax
add r15, 0x27
and r15, 0xffffffffffffffe0
mov qword [r15 - 8], rax
jmp 0x180050dba
lea rcx, [r12 + 1]
call fcn.1800a77e0
mov r15, rax
mov qword [rbp - 0x30], r15
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x18], r12
mov rcx, r15
xor edx, edx
mov r8, r14
call fcn.1800d5a50
add r15, r14
mov byte [r15], 0
cmp qword [rbp - 0x18], 0x10
jae 0x180050d6e
lea rdx, [rbp - 0x30]
mov rcx, qword [rbx + 0x30]
mov r8d, edi
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x180050e2f
mov edi, eax
mov rcx, qword [rbp - 0x20]
mov r8, rdi
sub r8, rcx
jbe 0x180050e82
mov rax, qword [rbp - 0x18]
mov rdx, rax
sub rdx, rcx
cmp rdx, r8
jae 0x180050e93
mov byte [rsp + 0x20], 0
lea rcx, [rbp - 0x30]
mov rdx, r8
mov r9, r8
call fcn.180019d60
jmp 0x180050ebb
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], 0
mov qword [rsi + 0x18], recvfrom
mov rax, qword [rbp - 0x18]
cmp rax, 0x10
jb 0x180050eca
mov rcx, qword [rbp - 0x30]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x180050e7b
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x180050ee1
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.1800a77d0
jmp 0x180050eca
mov qword [rbp - 0x20], rdi
cmp qword [rbp - 0x18], 0x10
jb 0x180050ea3
mov rbx, qword [rbp - 0x30]
jmp 0x180050eb7
mov qword [rbp - 0x20], rdi
cmp rax, 0x10
jb 0x180050ea9
mov rbx, qword [rbp - 0x30]
jmp 0x180050ead
lea rbx, [rbp - 0x30]
jmp 0x180050eb7
lea rbx, [rbp - 0x30]
add rcx, rbx
xor edx, edx
call fcn.1800d5a50
mov byte [rbx + rdi], 0
movaps xmm0, xmmword [rbp - 0x30]
movaps xmm1, xmmword [rbp - 0x20]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rax, rsi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
call fcn.180009080
call fcn.1800b109c
int3
Function at 0x180056b80
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 0x18
movdqa xmmword [rsp], xmm6
mov eax, dword [rcx]
cmp eax, 0x138
jne 0x180056c1e
movq xmm0, qword [rcx + 8]
pshufd xmm3, xmm0, 0x44
mov rax, 0xfffffffffffffec8
movaps xmm0, xmmword [0x1800d8ef0]
movaps xmm1, xmmword [0x1800d8f00]
movdqa xmm2, xmmword [0x1800d8f10]
nop dword [rax]
movups xmm4, xmmword [rcx + rax*8 + 0x9d0]
shufps xmm3, xmm4, 0x4e
andps xmm3, xmm0
movaps xmm5, xmm4
andps xmm5, xmm1
orps xmm5, xmm3
psrlq xmm5, 1
pshufd xmm3, xmm4, 0xa0
pslld xmm3, 0x1f
psrad xmm3, 0x1f
pand xmm3, xmm2
movdqu xmm6, xmmword [rcx + rax*8 + 0xea8]
pxor xmm6, xmm3
pxor xmm6, xmm5
movdqu xmmword [rcx + rax*8 + 0x1388], xmm6
movdqa xmm3, xmm4
add rax, 2
jne 0x180056bc0
mov eax, 0x138
jmp 0x180056dab
cmp eax, 0x270
jb 0x180056dab
movq xmm0, qword [rcx + 0x9c8]
pshufd xmm3, xmm0, 0x44
mov rax, 0xffffffffffffff64
movaps xmm0, xmmword [0x1800d8ef0]
movaps xmm1, xmmword [0x1800d8f00]
movdqa xmm2, xmmword [0x1800d8f10]
nop word cs:[rax + rax]
movups xmm4, xmmword [rcx + rax*8 + 0xeb0]
shufps xmm3, xmm4, 0x4e
andps xmm3, xmm0
movaps xmm5, xmm4
andps xmm5, xmm1
orps xmm5, xmm3
psrlq xmm5, 1
pshufd xmm3, xmm4, 0xa0
pslld xmm3, 0x1f
psrad xmm3, 0x1f
pand xmm3, xmm2
movdqu xmm6, xmmword [rcx + rax*8 + 0x1388]
pxor xmm6, xmm3
pxor xmm6, xmm5
movdqu xmmword [rcx + rax*8 + 0x4e8], xmm6
movdqa xmm3, xmm4
add rax, 2
jne 0x180056c60
movq xmm3, qword [rcx + 0xea8]
pshufd xmm3, xmm3, 0x44
xor eax, eax
nop word cs:[rax + rax]
movdqa xmm4, xmm3
movups xmm3, xmmword [rcx + rax*8 + 0xeb0]
shufps xmm4, xmm3, 0x4e
andps xmm4, xmm0
movaps xmm5, xmm3
andps xmm5, xmm1
orps xmm5, xmm4
psrlq xmm5, 1
pshufd xmm4, xmm3, 0xa0
pslld xmm4, 0x1f
psrad xmm4, 0x1f
pand xmm4, xmm2
movdqu xmm6, xmmword [rcx + rax*8 + 8]
pxor xmm6, xmm4
pxor xmm6, xmm5
movdqu xmmword [rcx + rax*8 + 0x4e8], xmm6
add rax, 2
cmp rax, 0x9a
jne 0x180056cd0
pshufd xmm0, xmm3, 0xee
movq rax, xmm0
and rax, 0xffffffff80000000
mov rdx, qword [rcx + 0x1380]
mov r8d, edx
and r8d, 0x7ffffffe
or r8, rax
shr r8, 1
mov eax, edx
and eax, 1
neg rax
movabs r9, 0xb5026f5aa96619e9
and rax, r9
xor rax, qword [rcx + 0x4d8]
xor rax, r8
mov qword [rcx + 0x9b8], rax
and rdx, 0xffffffff80000000
mov rax, qword [rcx + 8]
mov r8d, eax
and r8d, 0x7ffffffe
or r8, rdx
and eax, 1
neg rax
and rax, r9
xor rax, qword [rcx + 0x4e0]
shr r8, 1
xor rax, r8
mov qword [rcx + 0x9c0], rax
xor eax, eax
lea edx, [rax + 1]
mov dword [rcx], edx
mov eax, eax
mov rax, qword [rcx + rax*8 + 8]
mov rdx, rax
shr rdx, 0x1d
and rdx, qword [rcx + 0x1388]
xor rdx, rax
mov rax, rdx
shl rax, 0x11
movabs rcx, 0x71d67fffeda60000
and rcx, rax
xor rcx, rdx
mov edx, ecx
and edx, 0x7ffbf77
shl rdx, 0x25
xor rdx, rcx
mov rax, rdx
shr rax, 0x2b
xor rax, rdx
movaps xmm6, xmmword [rsp]
add rsp, 0x18
ret
Function at 0x1800623c0
Capabilities:
Convert ip address from string

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov qword [rbp], 0xfffffffffffffffe
mov rdi, rdx
mov rsi, rcx
mov r8, qword [rdx + 0x10]
test r8, r8
je 0x18006241f
cmp qword [rdi + 0x18], 0x10
mov rbx, rdi
jb 0x1800623f1
mov rbx, qword [rdi]
mov rcx, rbx
mov edx, 0x3a
call fcn.1800d5990
test rax, rax
je 0x18006241f
sub rax, rbx
cmp rax, 0xffffffffffffffff
je 0x18006241f
mov ecx, reloc.WS2_32.dll_socket
mov rdx, rbx
mov r8, rsi
call qword [sym.imp.WS2_32.dll_inet_pton]
jmp 0x18006244c
mov qword [rsi], 0
mov dword [rsi + 8], 0xffff0000
add rsi, 0xc
cmp qword [rdi + 0x18], 0x10
jb 0x18006243b
mov rdi, qword [rdi]
mov ecx, 2
mov rdx, rdi
mov r8, rsi
call qword [sym.imp.WS2_32.dll_inet_pton]
cmp eax, 1
sete al
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop rbp
ret
Function at 0x180066030
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, rdx
mov r15, rcx
lea rcx, [rdx + 0x68]
lea r8, [0x18014d2d8]
lea rbx, [rbp - 0x28]
mov rdx, rbx
call fcn.180066b90
mov rdi, qword [rbp - 0x28]
mov r14, qword [rbp - 0x18]
mov r12, qword [rbp - 0x10]
cmp r12, 0x10
cmovae rbx, rdi
test r14, r14
je 0x1800660a7
mov eax, r14d
and eax, 3
movabs rcx, 0x100000001b3
cmp r14, 4
jae 0x1800660b6
movabs r8, 0xcbf29ce484222325
xor edx, edx
jmp 0x18006610c
movabs r9, 0xcbf29ce484222325
jmp 0x180066137
mov r9, r14
and r9, 0xfffffffffffffffc
movabs r8, 0xcbf29ce484222325
xor edx, edx
nop dword [rax]
movzx r10d, byte [rbx + rdx]
xor r10, r8
imul r10, rcx
movzx r8d, byte [rbx + rdx + 1]
xor r8, r10
imul r8, rcx
movzx r10d, byte [rbx + rdx + 2]
xor r10, r8
imul r10, rcx
movzx r8d, byte [rbx + rdx + 3]
xor r8, r10
imul r8, rcx
add rdx, 4
cmp r9, rdx
jne 0x1800660d0
mov r9, r8
test rax, rax
je 0x180066137
add rdx, rbx
xor r10d, r10d
nop word [rax + rax]
movzx r9d, byte [rdx + r10]
xor r9, r8
imul r9, rcx
inc r10
mov r8, r9
cmp rax, r10
jne 0x180066120
and r9, qword [r15 + 0x30]
mov r13, qword [r15 + 8]
mov rax, qword [r15 + 0x18]
mov rcx, r9
shl rcx, 4
mov r15, qword [rax + rcx + 8]
cmp r15, r13
je 0x1800661c2
mov qword [rbp - 8], rsi
add r9, r9
mov rsi, qword [rax + r9*8]
cmp r14, qword [r15 + 0x20]
jne 0x180066193
nop word cs:[rax + rax]
cmp qword [r15 + 0x28], 0x10
jb 0x180066180
mov rdx, qword [r15 + 0x10]
jmp 0x180066184
lea rdx, [r15 + 0x10]
mov rcx, rbx
mov r8, r14
call fcn.1800d5df0
test eax, eax
je 0x1800661a7
cmp r15, rsi
je 0x1800661a4
mov r15, qword [r15 + 8]
cmp r14, qword [r15 + 0x20]
je 0x180066170
jmp 0x180066193
xor r15d, r15d
mov rsi, qword [rbp - 8]
test r15, r15
cmove r15, r13
cmp r12, 0x10
jae 0x1800661d2
cmp r15, r13
jne 0x180066208
jmp 0x180066259
xor r15d, r15d
test r15, r15
cmove r15, r13
cmp r12, 0x10
jb 0x1800661b8
lea rdx, [r12 + 1]
cmp rdx, 0x1000
jb 0x1800661fb
mov rax, qword [rdi - 8]
add rdi, 0xfffffffffffffff8
sub rdi, rax
cmp rdi, 0x20
jae 0x18006626c
add r12, 0x28
mov rdx, r12
mov rdi, rax
mov rcx, rdi
call fcn.1800a77d0
cmp r15, r13
je 0x180066259
cmp byte [r15 + 0xc9], 0
setne al
cmp byte [rsi + 0x99], 0
setne cl
xor cl, al
jne 0x180066259
lea rcx, [r15 + 0xd0]
lea rdx, [rsi + 0xa0]
call fcn.1800740c0
test al, al
je 0x180066259
add r15, 0xf0
add rsi, 0xc0
mov rcx, r15
mov rdx, rsi
call fcn.1800740c0
mov ecx, eax
mov al, 1
test cl, cl
jne 0x18006625b
xor eax, eax
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call fcn.1800b109c
int3
Function at 0x1800662a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rdx
mov rdi, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x1800662bc
mov rsi, qword [rsi]
test rdi, rdi
je 0x1800662e5
mov eax, edi
and eax, 3
movabs rdx, 0x100000001b3
cmp rdi, 4
jae 0x1800662f4
movabs r9, 0xcbf29ce484222325
xor r8d, r8d
jmp 0x18006634c
movabs r10, 0xcbf29ce484222325
jmp 0x180066377
mov r10, rdi
and r10, 0xfffffffffffffffc
movabs r9, 0xcbf29ce484222325
xor r8d, r8d
nop dword [rax + rax]
movzx r11d, byte [rsi + r8]
xor r11, r9
imul r11, rdx
movzx r9d, byte [rsi + r8 + 1]
xor r9, r11
imul r9, rdx
movzx r11d, byte [rsi + r8 + 2]
xor r11, r9
imul r11, rdx
movzx r9d, byte [rsi + r8 + 3]
xor r9, r11
imul r9, rdx
add r8, 4
cmp r10, r8
jne 0x180066310
mov r10, r9
test rax, rax
je 0x180066377
add r8, rsi
xor r11d, r11d
nop word [rax + rax]
movzx r10d, byte [r8 + r11]
xor r10, r9
imul r10, rdx
inc r11
mov r9, r10
cmp rax, r11
jne 0x180066360
and r10, qword [rcx + 0x30]
mov rbx, qword [rcx + 8]
mov rax, qword [rcx + 0x18]
mov rcx, r10
shl rcx, 4
mov r14, qword [rax + rcx + 8]
cmp r14, rbx
je 0x1800663e4
add r10, r10
mov r15, qword [rax + r10*8]
cmp rdi, qword [r14 + 0x20]
jne 0x1800663d3
nop word cs:[rax + rax]
cmp qword [r14 + 0x28], 0x10
jb 0x1800663c0
mov rdx, qword [r14 + 0x10]
jmp 0x1800663c4
lea rdx, [r14 + 0x10]
mov rcx, rsi
mov r8, rdi
call fcn.1800d5df0
test eax, eax
je 0x1800663e7
cmp r14, r15
je 0x1800663e4
mov r14, qword [r14 + 8]
cmp rdi, qword [r14 + 0x20]
je 0x1800663b0
jmp 0x1800663d3
xor r14d, r14d
test r14, r14
cmove r14, rbx
lea rcx, [r14 + 0x30]
xor eax, eax
cmp r14, rbx
cmovne rax, rcx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret