joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180020830
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0xe0]
sub rsp, 0x1e0
mov rax, qword [0x18050b500]
xor rax, rsp
mov qword [rbp + 0xd0], rax
mov rbx, rcx
mov qword [rbp - 0x48], rcx
xor edi, edi
mov dword [rbp - 0x70], edi
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], rdi
mov qword [rcx + 0x18], 0xf
mov byte [rcx], dil
mov dword [rbp - 0x70], 1
mov dword [rsp + 0x40], 0xdf2ed4db
mov dword [rsp + 0x44], 0x24de2edb
mov dword [rsp + 0x48], 0xc6fbdeca
mov dword [rsp + 0x4c], 0xc6f5f8f4
mov dword [rsp + 0x50], 0x1ef0c9fc
mov dword [rsp + 0x54], 0xc3c0d6cc
mov dword [rsp + 0x58], 0xf4c2f4cf
mov dword [rsp + 0x5c], 0x47dff1ca
xor eax, eax
mov qword [rsp + 0x60], rax
mov word [rsp + 0x68], ax
mov byte [rsp + 0x6a], al
mov qword [rsp + 0x30], rdi
mov rax, qword [rsp + 0x30]
movabs r9, 0xfc30e3284a30b0d1
nop word [rax + rax]
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x30]
movzx edx, byte [rsp + rax + 0x40]
add rcx, r9
mov rax, rcx
and rax, rdx
imul r8, rax, 0xfffffffffffffffe
add r8, rcx
add r8, rdx
add r8b, 0x49
mov rax, qword [rsp + 0x30]
mov byte [rsp + rax + 0x40], r8b
mov rax, qword [rsp + 0x30]
inc rax
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp rax, 0x2b
jb 0x1800208f0
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
xor r8d, r8d
lea rdx, [rsp + 0x40]
mov rcx, 0xffffffff80000002
call qword [sym.imp.advapi32.dll_RegOpenKeyExA]
test eax, eax
jne 0x180020a76
mov dword [rbp - 0x38], 0x100
mov dword [rsp + 0x70], 0x6b61604d
mov dword [rsp + 0x74], 0x40636b6d
mov dword [rsp + 0x78], 0x8b6e607d
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x7c], xmm0
mov word [rbp - 0x74], ax
mov byte [rbp - 0x72], al
mov qword [rsp + 0x30], rdi
mov rax, qword [rsp + 0x30]
movabs r9, 0x6690cce85ca767c0
nop dword [rax + rax]
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x30]
movzx edx, byte [rsp + rax + 0x70]
add rcx, r9
mov rax, rcx
and rax, rdx
imul r8, rax, 0xfffffffffffffffe
add r8, rcx
add r8, rdx
sub r8b, 0x40
mov rax, qword [rsp + 0x30]
mov byte [rsp + rax + 0x70], r8b
mov rax, qword [rsp + 0x30]
inc rax
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp rax, 0x1f
jb 0x1800209b0
lea rax, [rbp - 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x70]
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.advapi32.dll_RegQueryValueExA]
test eax, eax
jne 0x180020a6c
xorps xmm0, xmm0
movups xmmword [rbp - 0x68], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x58], xmm1
lea rax, [rbp - 0x30]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180020a40
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x68]
call fcn.180015d20
lea rdx, [rbp - 0x68]
mov rcx, rbx
call fcn.18002fd50
lea rcx, [rbp - 0x68]
call fcn.180034e00
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.advapi32.dll_RegCloseKey]
mov rax, rbx
mov rcx, qword [rbp + 0xd0]
xor rcx, rsp
call fcn.180313c00
lea r11, [rsp + 0x1e0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x180036ef0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x60
mov rax, qword [0x18050b500]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rcx, qword [rcx + 8]
xor ebp, ebp
mov dword [rsp + 0x50], ebp
xorps xmm0, xmm0
mov qword [rsp + 0x38], 2
xorps xmm1, xmm1
mov rdi, rdx
movups xmmword [rsp + 0x20], xmm0
movdqu xmmword [rsp + 0x40], xmm1
cmp rcx, 0xffffffffffffffff
jne 0x180036f51
mov esi, 0x2719
mov dword [rsp + 0x20], esi
call fcn.18000eba0
mov qword [rsp + 0x28], rax
jmp 0x180036fef
lea r8, [rsp + 0x30]
mov dword [rsp + 0x30], 0x1c
lea rdx, [rsp + 0x38]
call qword [sym.imp.ws2_32.dll_getsockname]
movsxd rcx, dword [rsp + 0x30]
test eax, eax
jne 0x180036fc6
lea rax, [0x18050ca68]
mov qword [rsp + 0x28], rax
cmp rcx, 0x80
ja 0x180037012
movups xmm0, xmmword [rsp + 0x38]
mov eax, dword [rsp + 0x50]
movsd xmm1, qword [rsp + 0x48]
movups xmmword [rdi], xmm0
movsd qword [rdi + 0x10], xmm1
mov dword [rdi + 0x18], eax
mov rax, rdi
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180313c00
mov rbp, qword [rsp + 0x98]
add rsp, 0x60
pop r14
pop rdi
pop rsi
ret
mov qword [rsp + 0x90], rbx
call fcn.18000eba0
mov rbx, rax
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
mov qword [rsp + 0x28], rbx
mov esi, eax
mov rbx, qword [rsp + 0x90]
mov dword [rsp + 0x20], eax
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
mov qword [rdi + 8], rbp
mov qword [rdi + 0x10], rbp
mov dword [rdi + 0x18], ebp
mov qword [rdi], 2
test esi, esi
jne 0x18003703a
jmp 0x180036fa5
mov dword [rsp + 0x20], 0x2726
call fcn.18000eba0
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x20]
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
call fcn.18000eae0
int3
lea rdx, [0x1804c4640]
lea rcx, [rsp + 0x20]
call fcn.18000eb50
int3
Function at 0x180043b10
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r12, r8
mov rsi, rdx
movzx r15d, byte [r8]
movabs rax, 0xcbf29ce484222325
xor r15, rax
movabs rcx, 0x100000001b3
imul r15, rcx
movzx eax, byte [r8 + 1]
xor r15, rax
imul r15, rcx
movzx eax, byte [r8 + 2]
xor r15, rax
imul r15, rcx
movzx eax, byte [r8 + 3]
xor r15, rax
imul r15, rcx
mov rcx, qword [0x180519180]
and rcx, r15
add rcx, rcx
mov rax, qword [0x180519168]
mov rbx, qword [rax + rcx*8 + 8]
mov r14, qword [0x180519158]
cmp rbx, r14
jne 0x180043b9a
mov rbx, r14
mov rbp, r14
jmp 0x180043bd9
mov rcx, qword [rax + rcx*8]
mov eax, dword [r8]
cmp eax, dword [rbx + 0x10]
je 0x180043bb4
cmp rbx, rcx
je 0x180043bd3
mov rbx, qword [rbx + 8]
cmp eax, dword [rbx + 0x10]
jne 0x180043ba6
mov qword [rdx], rbx
mov byte [rdx + 8], 0
mov rax, rsi
mov rbx, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov r14, rbx
mov rbp, rbx
movabs rax, 0x492492492492492
cmp qword [0x180519160], rax
je 0x180043d6a
lea rax, [0x180519158]
mov qword [rsp + 0x20], rax
xor r13d, r13d
mov qword [rsp + 0x28], r13
lea ecx, [r13 + 0x38]
call fcn.180313d50
mov rdi, rax
mov qword [rsp + 0x28], rax
mov eax, dword [r12]
mov dword [rdi + 0x10], eax
xorps xmm0, xmm0
movups xmmword [rdi + 0x18], xmm0
mov qword [rdi + 0x28], r13
mov qword [rdi + 0x30], 0xf
mov byte [rdi + 0x18], r13b
mov rdx, qword [0x180519160]
lea rcx, [rdx + 1]
xorps xmm0, xmm0
test rcx, rcx
js 0x180043c4d
cvtsi2ss xmm0, rcx
jmp 0x180043c62
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rcx, qword [0x180519188]
xorps xmm1, xmm1
test rcx, rcx
js 0x180043c78
cvtsi2ss xmm1, rcx
jmp 0x180043c8d
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
comiss xmm0, dword [0x180519150]
seta al
test al, al
je 0x180043cfd
call fcn.180045ce0
mov rcx, qword [0x180519180]
and rcx, r15
add rcx, rcx
mov rdx, qword [0x180519168]
mov rax, qword [rdx + rcx*8 + 8]
mov rbx, qword [0x180519158]
cmp rax, rbx
je 0x180043ce9
mov rdx, qword [rdx + rcx*8]
mov ecx, dword [rdi + 0x10]
cmp ecx, dword [rax + 0x10]
je 0x180043ce6
mov rbx, rax
cmp rax, rdx
je 0x180043d40
mov rax, qword [rax + 8]
cmp ecx, dword [rax + 0x10]
jne 0x180043cd5
mov rbx, qword [rax]
mov qword [rsp + 0x20], rbx
mov rbp, rbx
mov r14, qword [rsp + 0x20]
mov rdx, qword [0x180519160]
mov r8, qword [rbx + 8]
inc rdx
mov qword [0x180519160], rdx
mov qword [rdi], r14
mov qword [rdi + 8], r8
mov qword [r8], rdi
mov qword [rbx + 8], rdi
mov rcx, qword [0x180519168]
mov rax, qword [0x180519180]
and rax, r15
add rax, rax
mov rdx, qword [rcx + rax*8]
cmp rdx, qword [0x180519158]
jne 0x180043d47
mov qword [rcx + rax*8], rdi
jmp 0x180043d59
mov qword [rsp + 0x20], rax
jmp 0x180043cee
cmp rdx, rbp
jne 0x180043d52
mov qword [rcx + rax*8], rdi
jmp 0x180043d5e
cmp qword [rcx + rax*8 + 8], r8
jne 0x180043d5e
mov qword [rcx + rax*8 + 8], rdi
mov qword [rsi], rdi
mov byte [rsi + 8], 1
jmp 0x180043bbb
lea rcx, [0x1804c4ee0]
call fcn.180312844
int3
Function at 0x180045ce0
Capabilities:
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
mov rcx, qword [0x180519160]
xorps xmm0, xmm0
add rcx, 1
mov rbx, qword [0x180519188]
js 0x180045d04
cvtsi2ss xmm0, rcx
jmp 0x180045d19
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [0x180519150]
call fcn.180334afc
movss xmm1, dword [0x1804c78b8]
xor ecx, ecx
comiss xmm0, xmm1
jb 0x180045d4b
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x180045d4b
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rbx, rcx
jae 0x180045d7d
cmp rbx, 0x200
jae 0x180045d7a
lea rbx, [rbx*8]
cmp rbx, rcx
jae 0x180045d7d
mov rbx, rcx
mov rdx, rbx
add rsp, 0x20
pop rbx
jmp 0x180047930
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x180047ade
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x180519158]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x180519168]
lea rdx, [rdi + rdi]
call fcn.180036720
mov rax, qword [0x180519158]
lea r9, [rdi - 1]
mov qword [0x180519180], r9
mov qword [0x180519188], rdi
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x180047ad3
mov qword [rsp + 0x40], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
nop word [rax + rax]
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rsi
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rdi
xor r11, rdx
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x180519168]
mov r9, qword [r11]
cmp r9, rbx
jne 0x180047a1f
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x180047a94
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x180047a5c
mov r10, qword [rdx]
cmp r10, rax
je 0x180047a56
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x180047a94
cmp r9, rdx
je 0x180047a70
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x180047aa8
cmp r9, rdx
jne 0x180047a61
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
je 0x180047ace
mov r9, qword [0x180519180]
jmp 0x1800479d0
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x180047a94
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea rcx, [0x1804c46a0]
call fcn.180312844
int3
Function at 0x180047930
Capabilities:
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
mov rcx, qword [0x180519160]
xorps xmm0, xmm0
add rcx, 1
mov rbx, qword [0x180519188]
js 0x180045d04
cvtsi2ss xmm0, rcx
jmp 0x180045d19
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [0x180519150]
call fcn.180334afc
movss xmm1, dword [0x1804c78b8]
xor ecx, ecx
comiss xmm0, xmm1
jb 0x180045d4b
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x180045d4b
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rbx, rcx
jae 0x180045d7d
cmp rbx, 0x200
jae 0x180045d7a
lea rbx, [rbx*8]
cmp rbx, rcx
jae 0x180045d7d
mov rbx, rcx
mov rdx, rbx
add rsp, 0x20
pop rbx
jmp 0x180047930
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x180047ade
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x180519158]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x180519168]
lea rdx, [rdi + rdi]
call fcn.180036720
mov rax, qword [0x180519158]
lea r9, [rdi - 1]
mov qword [0x180519180], r9
mov qword [0x180519188], rdi
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x180047ad3
mov qword [rsp + 0x40], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
nop word [rax + rax]
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rsi
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rdi
xor r11, rdx
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x180519168]
mov r9, qword [r11]
cmp r9, rbx
jne 0x180047a1f
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x180047a94
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x180047a5c
mov r10, qword [rdx]
cmp r10, rax
je 0x180047a56
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x180047a94
cmp r9, rdx
je 0x180047a70
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x180047aa8
cmp r9, rdx
jne 0x180047a61
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
je 0x180047ace
mov r9, qword [0x180519180]
jmp 0x1800479d0
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x180047a94
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea rcx, [0x1804c46a0]
call fcn.180312844
int3
Function at 0x180049d20
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov rax, qword [0x18050b500]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, rdx
xor edi, edi
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov cl, 1
call fcn.180312a5c
mov rcx, rax
mov qword [rsp + 0x28], rax
mov rdx, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x180049d76
mov rdx, qword [rbx]
mov r8, rdx
mov rsi, rdx
jmp 0x180049d7c
mov rsi, rbx
mov r8, rbx
mov rbp, qword [rbx + 0x10]
add rbp, r8
cmp rdx, rbp
je 0x180049ded
movabs r14, 0xcbf29ce484222325
movabs r15, 0x100000001b3
mov r12d, 0x9e3779b9
movzx ebx, byte [rsi]
lea rcx, [rsp + 0x20]
call fcn.18003d070
mov rcx, rax
mov rax, qword [rax]
movzx edx, bl
call qword [rax + 0x30]
movzx ecx, al
xor rcx, r14
imul rcx, r15
mov rax, rdi
shl rax, 6
mov rdx, rdi
shr rdx, 2
add rcx, rax
lea rax, [rdx + r12]
add rcx, rax
xor rdi, rcx
inc rsi
cmp rsi, rbp
jne 0x180049da2
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x180049e0b
mov rdx, qword [rcx]
call qword [rdx + 0x10]
test rax, rax
je 0x180049e0b
mov r8, qword [rax]
mov edx, 1
mov rcx, rax
call qword [r8]
mov rax, rdi
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.180313c00
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x18004de90
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov r12, r8
mov rsi, rdx
movzx r15d, byte [r8]
movabs rax, 0xcbf29ce484222325
xor r15, rax
movabs rcx, 0x100000001b3
imul r15, rcx
movzx eax, byte [r8 + 1]
xor r15, rax
imul r15, rcx
movzx eax, byte [r8 + 2]
xor r15, rax
imul r15, rcx
movzx eax, byte [r8 + 3]
xor r15, rax
imul r15, rcx
mov rcx, qword [0x180519180]
and rcx, r15
add rcx, rcx
mov rax, qword [0x180519168]
mov rbx, qword [rax + rcx*8 + 8]
mov r14, qword [0x180519158]
cmp rbx, r14
jne 0x18004df1c
mov rbx, r14
mov rbp, r14
jmp 0x18004df5d
mov rcx, qword [rax + rcx*8]
mov eax, dword [r8]
cmp eax, dword [rbx + 0x10]
je 0x18004df36
cmp rbx, rcx
je 0x18004df57
mov rbx, qword [rbx + 8]
cmp eax, dword [rbx + 0x10]
jne 0x18004df28
mov qword [rdx], rbx
mov byte [rdx + 8], 0
mov rax, rsi
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
mov r14, rbx
mov rbp, rbx
movabs rax, 0x492492492492492
cmp qword [0x180519160], rax
je 0x18004e0fe
lea rax, [0x180519158]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0
mov ecx, 0x38
call fcn.180313d50
mov rdi, rax
mov qword [rsp + 0x28], rax
mov eax, dword [r12]
mov dword [rdi + 0x10], eax
lea rcx, [rdi + 0x18]
lea rdx, [r12 + 8]
call fcn.18002ff50
nop
mov rdx, qword [0x180519160]
lea rcx, [rdx + 1]
xorps xmm0, xmm0
test rcx, rcx
js 0x18004dfcb
cvtsi2ss xmm0, rcx
jmp 0x18004dfe0
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rcx, qword [0x180519188]
xorps xmm1, xmm1
test rcx, rcx
js 0x18004dff6
cvtsi2ss xmm1, rcx
jmp 0x18004e00b
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
comiss xmm0, dword [0x180519150]
seta al
test al, al
je 0x18004e088
call fcn.180045ce0
mov rcx, qword [0x180519180]
and rcx, r15
add rcx, rcx
mov rdx, qword [0x180519168]
mov rax, qword [rdx + rcx*8 + 8]
mov rbx, qword [0x180519158]
cmp rax, rbx
jne 0x18004e052
mov qword [rsp + 0x28], 0
jmp 0x18004e074
mov rdx, qword [rdx + rcx*8]
mov ecx, dword [rdi + 0x10]
cmp ecx, dword [rax + 0x10]
je 0x18004e071
nop
mov rbx, rax
cmp rax, rdx
je 0x18004e0cb
mov rax, qword [rax + 8]
cmp ecx, dword [rax + 0x10]
jne 0x18004e060
mov rbx, qword [rax]
mov qword [rsp + 0x20], rbx
mov rbp, rbx
mov r14, qword [rsp + 0x20]
mov rdx, qword [0x180519160]
mov r8, qword [rbx + 8]
inc rdx
mov qword [0x180519160], rdx
mov qword [rdi], r14
mov qword [rdi + 8], r8
mov qword [r8], rdi
mov qword [rbx + 8], rdi
mov rcx, qword [0x180519168]
mov rax, qword [0x180519180]
and rax, r15
add rax, rax
mov rdx, qword [rcx + rax*8]
cmp rdx, qword [0x180519158]
jne 0x18004e0db
mov qword [rcx + rax*8], rdi
jmp 0x18004e0ed
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0
jmp 0x18004e079
cmp rdx, rbp
jne 0x18004e0e6
mov qword [rcx + rax*8], rdi
jmp 0x18004e0f2
cmp qword [rcx + rax*8 + 8], r8
jne 0x18004e0f2
mov qword [rcx + rax*8 + 8], rdi
mov qword [rsi], rdi
mov byte [rsi + 8], 1
jmp 0x18004df3d
lea rcx, [0x1804c4ee0]
call fcn.180312844
int3
Function at 0x180059480
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa0
mov rax, qword [0x18050b500]
xor rax, rsp
mov qword [rsp + 0x98], rax
mov dword [rsp + 0x68], r9d
mov r13, r8
mov r15, rdx
mov rsi, rcx
mov rbp, qword [rsp + 0x100]
mov r12, qword [rsp + 0x108]
mov qword [rsp + 0x40], rbp
mov rdx, rbp
mov ecx, 0xa8
call fcn.18000ee50
mov rbx, rax
mov rax, qword [r15 + 0x18]
xor r8d, r8d
mov r14d, r8d
mov ecx, r8d
test rax, rax
je 0x1800594f9
mov rcx, qword [r15 + 0x10]
mov r14, rax
lock inc dword [rax + 0xc]
movzx eax, byte [r15 + 8]
mov qword [rbx + 0x20], r8
lea rdx, [0x18005a9f0]
mov qword [rbx + 0x28], rdx
mov qword [rbx], r8
mov qword [rbx + 8], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], r8
mov dword [rbx + 0x30], r8d
mov byte [rbx + 0x38], al
mov qword [rbx + 0x40], r8
mov qword [rbx + 0x48], r8
test r14, r14
je 0x18005953d
mov qword [rbx + 0x40], rcx
mov qword [rbx + 0x48], r14
lock inc dword [r14 + 0xc]
movups xmm0, xmmword [r13]
movups xmmword [rbx + 0x50], xmm0
mov qword [rbx + 0x60], r8
mov qword [rbx + 0x68], r8
mov rax, qword [rbp]
mov qword [rbx + 0x60], rax
mov rax, qword [rbp + 8]
mov qword [rbx + 0x68], rax
mov qword [rbp], r8
mov qword [rbp + 8], r8
lea rcx, [rbx + 0x70]
mov r9, r12
call fcn.18005b720
test r14, r14
je 0x180059590
mov eax, 0xffffffff
lock xadd dword [r14 + 0xc], eax
cmp eax, 1
jne 0x180059590
mov rax, qword [r14]
mov rcx, r14
call qword [rax + 8]
movups xmm0, xmmword [r13]
movups xmmword [rsp + 0x58], xmm0
movq qword [rsp + 0x88], xmm0
movq xmm0, qword [r13 + 8]
movd dword [rsp + 0x80], xmm0
mov rax, qword [r13 + 8]
mov qword [rsp + 0x90], rax
test byte [r15 + 8], 0x10
je 0x1800595eb
test rax, rax
jne 0x1800595eb
mov rax, qword [rsi + 8]
lock inc dword [rax + 0x30]
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, qword [rsi + 8]
call fcn.180010130
xor ebp, ebp
jmp 0x18005969f
mov rax, qword [rsi + 8]
lock inc dword [rax + 0x30]
mov rcx, qword [r15]
cmp rcx, 0xffffffffffffffff
jne 0x180059618
xor r9d, r9d
mov r8d, 0x2719
mov rdx, rbx
mov rcx, qword [rsi + 8]
call fcn.180010130
xor ebp, ebp
jmp 0x18005969f
xor ebp, ebp
mov dword [rsp + 0x70], ebp
mov eax, dword [rsp + 0x68]
mov dword [rsp + 0x68], eax
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rbx
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x70]
lea r8d, [rbp + 1]
lea rdx, [rsp + 0x80]
call qword [sym.imp.ws2_32.dll_WSARecv]
mov edi, eax
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
cmp eax, 0x40
jne 0x180059665
mov eax, 0x2746
jmp 0x180059672
mov ecx, 0x274d
cmp eax, 0x4d2
cmove eax, ecx
test edi, edi
je 0x180059693
cmp eax, 0x3e5
je 0x180059693
mov r9d, dword [rsp + 0x70]
mov r8d, eax
mov rdx, rbx
mov rcx, qword [rsi + 8]
call fcn.180010130
jmp 0x18005969f
mov rdx, rbx
mov rcx, qword [rsi + 8]
call fcn.1800100a0
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x48], rbp
lea rcx, [rsp + 0x40]
call fcn.18005a930
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.180313c00
mov rbx, qword [rsp + 0xf0]
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x18005efe0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x10], 0
mov rbx, rcx
je 0x18005effc
mov qword [rcx + 0x10], 0
mov rdi, qword [rcx + 8]
test rdi, rdi
je 0x18005f048
mov ecx, dword [0x180519194]
call qword [sym.imp.kernel32.dll_TlsGetValue]
test rax, rax
je 0x18005f038
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x18005f038
mov ecx, 4
mov eax, ecx
cmp qword [rdx + rax*8], 0
je 0x18005f053
inc ecx
inc rax
cmp rax, 6
jl 0x18005f026
mov rcx, rdi
call fcn.1803141cc
mov qword [rbx + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rdi + 0x38]
mov byte [rdi], al
movsxd rax, ecx
mov qword [rdx + rax*8], rdi
mov qword [rbx + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x18005f080
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x10], 0
mov rbx, rcx
je 0x18005f09c
mov qword [rcx + 0x10], 0
mov rdi, qword [rcx + 8]
test rdi, rdi
je 0x18005f0e8
mov ecx, dword [0x180519194]
call qword [sym.imp.kernel32.dll_TlsGetValue]
test rax, rax
je 0x18005f0d8
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x18005f0d8
mov ecx, 4
mov eax, ecx
cmp qword [rdx + rax*8], 0
je 0x18005f0f3
inc ecx
inc rax
cmp rax, 6
jl 0x18005f0c6
mov rcx, rdi
call fcn.1803141cc
mov qword [rbx + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rdi + 0x28]
mov byte [rdi], al
movsxd rax, ecx
mov qword [rdx + rax*8], rdi
mov qword [rbx + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x18005f120
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x10], 0
mov rbx, rcx
je 0x18005f13c
mov qword [rcx + 0x10], 0
mov rdi, qword [rcx + 8]
test rdi, rdi
je 0x18005f188
mov ecx, dword [0x180519194]
call qword [sym.imp.kernel32.dll_TlsGetValue]
test rax, rax
je 0x18005f178
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x18005f178
mov ecx, 4
mov eax, ecx
cmp qword [rdx + rax*8], 0
je 0x18005f193
inc ecx
inc rax
cmp rax, 6
jl 0x18005f166
mov rcx, rdi
call fcn.1803141cc
mov qword [rbx + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rdi + 0x30]
mov byte [rdi], al
movsxd rax, ecx
mov qword [rdx + rax*8], rdi
mov qword [rbx + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret