joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001b30
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rdi, rcx
mov r14, r8
xor ecx, ecx
mov r15, rdx
test rdi, rdi
je 0x140001bb4
movsxd r9, dword [rdi + 0x3c]
lea rbx, [rdi + 0x18]
add rbx, r9
xor esi, esi
movzx eax, word [r9 + rdi + 0x14]
movzx ebp, word [r9 + rdi + 6]
add rbx, rax
test ebp, ebp
je 0x140001bb4
mov eax, dword [rbx]
cmp eax, 0x7865742e
jne 0x140001b87
cmp byte [rbx + 4], 0x74
je 0x140001b8e
cmp eax, 0x45474150
jne 0x140001baa
mov ecx, dword [rbx + 0xc]
mov r9, r14
mov edx, dword [rbx + 8]
add rcx, rdi
mov r8, r15
call fcn.140001bd0
mov rcx, rax
test rax, rax
jne 0x140001bb4
inc esi
add rbx, 0x28
cmp esi, ebp
jb 0x140001b78
mov rbx, qword [rsp + 0x40]
mov rax, rcx
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret

Function at 0x140001cc8
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xc0
and qword [rbp + 0x7f], 0
mov rsi, rdx
mov rdx, rcx
mov edi, r8d
lea rcx, [rbp - 1]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
and dword [rsp + 0x50], 0
lea rax, [rbp - 1]
and qword [rsp + 0x48], 0
lea r9, [rbp + 0xf]
and qword [rbp + 0x27], 0
lea r8, [rbp + 0x1f]
mov dword [rsp + 0x40], 0x20
lea rcx, [rbp + 0x7f]
mov qword [rbp + 0x2f], rax
xorps xmm0, xmm0
mov eax, 3
mov dword [rbp + 0x1f], 0x30
mov dword [rsp + 0x38], eax
mov edx, 0x10000000
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], 0x80
and qword [rsp + 0x20], 0
mov dword [rbp + 0x37], 0x240
movdqu xmmword [rbp + 0x3f], xmm0
call qword [sym.imp.ntoskrnl.exe_ZwCreateFile]
mov ebx, eax
test eax, eax
js 0x140001dad
mov rcx, qword [rbp + 0x7f]
xor eax, eax
and qword [rsp + 0x40], rax
xor r9d, r9d
mov qword [rbp - 9], rax
xor r8d, r8d
lea rax, [rbp - 9]
xor edx, edx
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0xf]
mov dword [rsp + 0x30], edi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwWriteFile]
mov rcx, qword [rbp + 0x7f]
mov ebx, eax
call qword [sym.imp.ntoskrnl.exe_ZwClose]
lea r11, [rsp + 0xc0]
mov eax, ebx
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x1400022f4
Capabilities:
Get file attributes
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xe0
mov rax, qword [0x1400107b0]
xor rax, rsp
mov qword [rbp + 0x4f], rax
and qword [rbp - 0x29], 0
xorps xmm0, xmm0
and dword [rbp + 0xb], 0
xorps xmm1, xmm1
and dword [rbp + 0x23], 0
mov rsi, rcx
mov ebx, 0xc0000001
movups xmmword [rbp - 9], xmm0
movups xmmword [rbp - 0x19], xmm1
test rcx, rcx
je 0x1400024b7
lea rdx, [0x1400028c0]
lea rcx, [rbp - 9]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
and dword [rsp + 0x50], 0
lea rax, [rbp - 9]
and qword [rsp + 0x48], 0
lea r9, [rbp - 0x19]
and qword [rbp + 0xf], 0
lea r8, [rbp + 7]
mov dword [rsp + 0x40], 0x20
lea rcx, [rbp - 0x29]
mov qword [rbp + 0x17], rax
xorps xmm0, xmm0
mov eax, 1
mov dword [rbp + 7], 0x30
mov dword [rsp + 0x38], eax
mov edx, 0x80000000
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], 0x80
and qword [rsp + 0x20], 0
mov dword [rbp + 0x1f], 0x240
movdqu xmmword [rbp + 0x27], xmm0
call qword [sym.imp.ntoskrnl.exe_ZwCreateFile]
mov ebx, eax
test eax, eax
js 0x1400024b7
mov rcx, qword [rbp - 0x29]
lea r8, [rbp + 0x37]
xor eax, eax
mov dword [rsp + 0x20], 5
xorps xmm0, xmm0
mov qword [rbp + 0x47], rax
lea rdx, [rbp - 0x19]
movups xmmword [rbp + 0x37], xmm0
lea r9d, [rax + 0x18]
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
mov ebx, eax
test eax, eax
js 0x1400024ad
cmp dword [rbp + 0x3f], 0x1000
jbe 0x1400024ad
mov ecx, dword [rbp + 0x3f]
call fcn.140001840
mov rdi, rax
test rax, rax
je 0x1400024ad
mov ecx, dword [rbp + 0x3f]
xor eax, eax
and qword [rsp + 0x40], rax
xor r9d, r9d
mov qword [rbp - 0x21], rax
xor r8d, r8d
lea rax, [rbp - 0x21]
xor edx, edx
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x19]
mov dword [rsp + 0x30], ecx
mov rcx, qword [rbp - 0x29]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
mov ebx, eax
test eax, eax
js 0x1400024a5
mov r8d, dword [rbp + 0x3f]
lea r9, [0x140002900]
mov rdx, rdi
mov rcx, rsi
call fcn.1400012d4
mov rdx, qword [0x1400107c0]
lea r9, [0x140002920]
mov rcx, rsi
mov qword [rdx + 0x60], rax
mov rdx, rdi
mov r8d, dword [rbp + 0x3f]
call fcn.1400012d4
mov rcx, qword [0x1400107c0]
mov qword [rcx + 0x68], rax
mov rcx, rdi
call fcn.1400019b4
mov rcx, qword [rbp - 0x29]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, ebx
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.1400025b0
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140001010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x140068b10]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x140068b20]
mov dword [rax], 1
mov rax, qword [0x140068b30]
mov dword [rax], 1
mov rax, qword [0x140068a90]
cmp word [rax], 0x5a4d
jne 0x14000105a
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400010c0
mov rax, qword [0x140068b00]
mov dword [0x14007100c], ecx
mov eax, dword [rax]
test eax, eax
je 0x1400010b0
mov ecx, 2
call sym.__set_app_type
call dbg.__p__fmode
mov rdx, qword [0x140068be0]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg.__p__commode
mov rdx, qword [0x140068bc0]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x140068a70]
cmp dword [rax], 1
je 0x1400010f8
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x140001077
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x140001110
cmp dx, 0x20b
jne 0x14000105a
cmp dword [rax + 0x84], 0xe
jbe 0x14000105a
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x14000105a
mov rcx, qword [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x14000105a
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x14000105a

Function at 0x140001480
Capabilities:
Encode data using base64

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
mov r10, rcx
mov r11, rdx
cmp r9, 2
jbe 0x1400015ef
cmp rdx, 3
jbe 0x140001602
mov ebx, 4
mov edx, 3
lea rcx, [0x14004e020]
jmp 0x1400014c8
lea rax, [rbx + 4]
cmp r11, rax
jb 0x14000159b
mov rbx, rax
movzx eax, byte [r8 + rdx - 3]
movzx esi, byte [r8 + rdx - 2]
movzx ebp, byte [r8 + rdx - 1]
shl esi, 8
shl eax, 0x10
or eax, esi
or ebp, eax
mov edi, eax
shr eax, 0xc
mov r12d, ebp
and ebp, 0x3f
mov esi, eax
shr edi, 0x12
shr r12d, 6
movzx eax, byte [rcx + rbp]
and esi, 0x3f
and r12d, 0x3f
movzx esi, byte [rcx + rsi]
movzx ebp, byte [rcx + r12]
shl eax, 8
or eax, ebp
shl eax, 8
or eax, esi
movzx esi, byte [rcx + rdi]
shl eax, 8
or eax, esi
mov dword [r10 + rbx - 4], eax
mov rax, rdx
lea rdx, [rdx + 3]
cmp r9, rdx
jae 0x1400014b8
lea rdx, [rax + 2]
lea rsi, [rax + 1]
cmp r9, rdx
jb 0x1400015a8
lea rcx, [rbx + 4]
cmp r11, rcx
jb 0x14000159b
movzx edx, byte [r8 + rax]
movzx eax, byte [r8 + rsi]
xor r9d, r9d
lea r8, [0x14004e020]
mov byte [r10 + rbx + 3], 0x3d
shl edx, 0x10
shl eax, 8
or eax, edx
shr edx, 0x12
mov edi, eax
shr eax, 0xc
mov r9b, byte [r8 + rdx]
and eax, 0x3f
movzx eax, byte [r8 + rax]
mov edx, r9d
mov dh, al
mov eax, edi
shr eax, 6
mov word [r10 + rbx], dx
and eax, 0x3c
movzx eax, byte [r8 + rax]
mov byte [r10 + rbx + 2], al
mov rbx, rcx
mov rax, rbx
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
cmp r9, rsi
jb 0x14000159b
lea r9, [rbx + 4]
cmp r11, r9
jb 0x14000159b
movzx eax, byte [r8 + rax]
lea r8, [0x14004e020]
xor edx, edx
mov ecx, eax
shl eax, 4
shr ecx, 2
and eax, 0x30
movzx eax, byte [r8 + rax]
mov dl, byte [r8 + rcx]
mov dh, al
mov eax, 0x3d3d
mov word [r10 + rbx], dx
mov word [r10 + rbx + 2], ax
mov rbx, r9
jmp 0x14000159b
mov esi, 1
mov edx, 2
xor ebx, ebx
xor eax, eax
jmp 0x140001538
xor ebx, ebx
jmp 0x14000159b
Function at 0x140001610
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
push rbp
push rdi
push rsi
push rbx
xor esi, esi
xor eax, eax
lea r10, [0x14004e080]
mov r11, rcx
mov rbx, rdx
cmp rsi, r9
jb 0x140001639
jmp 0x140001673
add rax, 1
cmp r9, rax
je 0x140001673
movzx edx, byte [r8 + rax]
mov rcx, rdx
movzx edx, byte [r10 + rdx]
cmp edx, 0x40
ja 0x140001630
cmp cl, 0x3d
jne 0x14000166a
jmp 0x140001673
movzx ecx, byte [r8 + rax]
mov rdi, rcx
movzx ecx, byte [r10 + rcx]
cmp ecx, 0x40
jbe 0x140001688
add rax, 1
cmp rax, r9
jb 0x140001658
cmp rsi, rbx
jae 0x14000167d
mov byte [r11 + rsi], 0
mov rax, rsi
pop rbx
pop rsi
pop rdi
pop rbp
ret
cmp dil, 0x3d
je 0x140001673
lea rbp, [rax + 1]
cmp rsi, rbx
jae 0x1400016af
mov edi, ecx
shl edx, 2
shr edi, 4
movzx edx, dl
and edi, 3
or edx, edi
mov byte [r11 + rsi], dl
add rsi, 1
cmp rbp, r9
jae 0x140001673
movzx edx, byte [r8 + rbp]
cmp dl, 0x3d
je 0x140001673
movsxd rdx, edx
movzx edx, byte [r10 + rdx]
nop word cs:[rax + rax]
cmp edx, 0x40
ja 0x1400016d0
lea rbp, [rax + 2]
cmp rsi, rbx
jae 0x1400016f6
mov edi, edx
shl ecx, 4
shr edi, 2
movzx ecx, cl
and edi, 0xf
or ecx, edi
mov byte [r11 + rsi], cl
add rsi, 1
cmp rbp, r9
jae 0x140001673
movzx ecx, byte [r8 + rbp]
cmp cl, 0x3d
je 0x140001673
movsxd rcx, ecx
movzx ecx, byte [r10 + rcx]
nop dword [rax]
cmp ecx, 0x40
ja 0x140001718
add rax, 3
cmp rsi, rbx
jae 0x140001736
shl edx, 6
movzx edx, dl
or edx, ecx
mov byte [r11 + rsi], dl
add rsi, 1
cmp rax, r9
jb 0x140001639
jmp 0x140001673
Function at 0x140001b20
Capabilities:
Encode data using xor
Encrypt data using des

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov r11, qword [rcx + 0x30]
mov rdi, qword [rcx + 0x40]
mov esi, dword [rcx + 0x20]
mov r9, qword [rcx + 0x18]
mov r8, r11
mov rax, rdx
and r8, rdx
mov rdx, qword [rcx + 0x28]
mov r12, rcx
mov qword [rsp + 8], rdi
mov ecx, edx
mov dword [rsp + 0x10], esi
mov dword [rsp + 0x14], edx
shr rax, cl
test esi, esi
je 0x140001c63
mov qword [rsp + 0x70], r12
mov r10d, 1
lea rbp, [0x14004e520]
lea rdi, [0x14004e720]
mov qword [rsp + 0x18], rdx
lea rsi, [0x14004e320]
lea r13, [0x14004e920]
lea r14, [0x14004e620]
lea r15, [0x14004ea20]
nop dword [rax + rax]
mov ecx, r10d
mov rdx, r9
lea rbx, [0x14004e820]
ror rdx, cl
xor rdx, rax
mov rcx, rdx
mov r12, rdx
shr rcx, 8
shr r12, 0x10
and r12d, 0x3f
and ecx, 0x3f
mov ecx, dword [rbp + rcx*4]
xor ecx, dword [rdi + r12*4]
mov r12, rdx
shr rdx, 0x18
and r12d, 0x3f
and edx, 0x3f
xor ecx, dword [rsi + r12*4]
xor ecx, dword [r13 + rdx*4]
mov rdx, r9
add rcx, r8
and rcx, r11
mov r8, rcx
lea ecx, [r10 + 1]
add r10d, 2
ror rdx, cl
xor rdx, r8
mov rcx, rdx
mov r12, rdx
shr rcx, 8
shr r12, 0x10
and r12d, 0x3f
and ecx, 0x3f
mov ecx, dword [r14 + rcx*4]
xor ecx, dword [rbx + r12*4]
mov r12, rdx
shr rdx, 0x18
and r12d, 0x3f
lea rbx, [0x14004e420]
and edx, 0x3f
xor ecx, dword [rbx + r12*4]
xor ecx, dword [r15 + rdx*4]
add rcx, rax
mov rax, qword [rsp + 8]
and rax, rcx
cmp dword [rsp + 0x10], r10d
jae 0x140001ba8
mov r12, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x18]
mov ecx, edx
mov r14, qword [r12]
shl rax, cl
add rax, r8
cmp rax, r14
jb 0x140001da3
mov qword [rsp + 0x18], r14
lea r13, [0x14004e520]
lea r12, [0x14004e720]
lea rbp, [0x14004e320]
lea rdi, [0x14004e920]
lea rsi, [0x14004e620]
lea rbx, [0x14004e820]
nop word [rax + rax]
movzx ecx, byte [rsp + 0x14]
mov rdx, r11
and rdx, rax
shr rax, cl
mov ecx, dword [rsp + 0x10]
test ecx, ecx
je 0x140001d8a
mov r8d, 1
mov ecx, r8d
mov r15, r9
lea r10, [0x14004e420]
ror r15, cl
mov rcx, r15
xor rcx, rax
mov r14, rcx
mov r15, rcx
shr r14, 8
shr r15, 0x10
and r15d, 0x3f
and r14d, 0x3f
mov r14d, dword [r13 + r14*4]
xor r14d, dword [r12 + r15*4]
mov r15, rcx
shr rcx, 0x18
and r15d, 0x3f
and ecx, 0x3f
xor r14d, dword [rbp + r15*4]
xor r14d, dword [rdi + rcx*4]
lea ecx, [r8 + 1]
mov r15, r9
add r14, rdx
ror r15, cl
add r8d, 2
mov rdx, r14
mov rcx, r15
and rdx, r11
xor rcx, rdx
mov r14, rcx
mov r15, rcx
shr r14, 8
shr r15, 0x10
and r15d, 0x3f
and r14d, 0x3f
mov r14d, dword [rsi + r14*4]
xor r14d, dword [rbx + r15*4]
mov r15, rcx
shr rcx, 0x18
and r15d, 0x3f
and ecx, 0x3f
xor r14d, dword [r10 + r15*4]
lea r10, [0x14004ea20]
xor r14d, dword [r10 + rcx*4]
add r14, rax
mov rax, qword [rsp + 8]
and rax, r14
cmp dword [rsp + 0x10], r8d
jae 0x140001cd0
movzx ecx, byte [rsp + 0x14]
shl rax, cl
add rax, rdx
mov rdx, qword [rsp + 0x18]
cmp rax, rdx
jae 0x140001cb0
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400093a0
Capabilities:
Read file on windows

Disassembly:
push r13
mov eax, 0x8078
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.140041200
sub rsp, rax
cmp qword [rcx + 0x10], 0
mov rsi, rcx
mov rdi, rdx
mov rbx, r8
je 0x1400093e0
xor eax, eax
add rsp, 0x8078
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov edx, 0x5b
mov rcx, rdi
call sym.strchr
test rax, rax
je 0x140009400
lea r9, [rax + 1]
movzx eax, byte [rax + 1]
xor ecx, ecx
test al, al
jne 0x140009422
xor r12d, r12d
jmp 0x14000943f
sub edx, 0x30
lea rax, [rcx + rcx*4]
add r9, 1
movsxd rdx, edx
lea rcx, [rdx + rax*2]
movzx eax, byte [r9]
test al, al
je 0x140009430
movsx edx, al
movzx eax, al
sub eax, 0x30
cmp eax, 9
jbe 0x140009408
mov r12d, ecx
cmp ecx, 0xffff
ja 0x1400094e8
lea rcx, [rsp + 0x28]
lea r8, [0x140051c24]
mov rdx, rbx
call qword [sym.imp.msvcrt.dll_fopen_s]
test eax, eax
jne 0x140009510
mov r9, qword [rsp + 0x28]
lea rbp, [rsp + 0x70]
mov r8d, 0x4000
mov edx, 1
mov rcx, rbp
call sym.fread
mov rdi, rax
test rax, rax
je 0x140009530
mov rcx, qword [rsp + 0x28]
lea r13, [rsp + 0x4070]
lea rbx, [rsp + 0x30]
call sym.fclose
mov r9, rdi
mov r8, rbp
mov rcx, r13
mov edx, 0x3fff
call dbg.base64_encode
mov rcx, rbx
mov r9d, r12d
mov edx, 0x40
lea r8, [0x140051c4c]
mov byte [rsp + rax + 0x4070], 0
call sym.snprintf
mov r8, r13
mov rdx, rbx
mov rcx, rsi
call dbg.masscan_set_parameter
jmp 0x1400093c5
mov ecx, 2
call qword [dbg.__acrt_iob_func]
mov r8, rdi
lea rdx, str._s:_bad_index_n
mov rcx, rax
call sym.fprintf_1
mov eax, 2
jmp 0x1400093c7
xor ecx, ecx
lea rdx, str._FAILED__could_not_read_hello_file_n
call dbg.LOG
mov rcx, rbx
call sym.perror
jmp 0x140009505
lea rdx, str._FAILED__could_not_read_hello_file_n
xor ecx, ecx
call dbg.LOG
mov rcx, rbx
call sym.perror
mov rcx, qword [rsp + 0x28]
call sym.fclose
jmp 0x140009505
Function at 0x14000a8b0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rsi, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x98]
mov ebx, dword [rsp + 0xa0]
mov qword [rsp + 0x28], rdx
mov r12, rdx
lea rdx, [rsp + 0x28]
mov r10, rcx
mov r13d, r9d
mov rbp, r8
mov rax, rdx
mov ecx, 0x811c9dc5
lea r9, [rsp + 0x30]
nop dword [rax + rax]
movzx r8d, byte [rax]
add rax, 1
xor ecx, r8d
imul ecx, ecx, 0x1000193
cmp r9, rax
jne 0x14000a900
mov qword [rsp + 0x28], rbp
mov rax, rdx
lea r9, [rsp + 0x30]
nop dword [rax + rax]
movzx r8d, byte [rax]
add rax, 1
xor ecx, r8d
imul ecx, ecx, 0x1000193
cmp r9, rax
jne 0x14000a928
movzx eax, r13b
mov qword [rsp + 0x28], rsi
lea r9, [rsp + 0x30]
xor eax, ecx
mov ecx, r13d
imul eax, eax, 0x1000193
movzx ecx, ch
xor eax, ecx
mov rcx, rdx
imul eax, eax, 0x1000193
nop dword [rax]
movzx r8d, byte [rcx]
add rcx, 1
xor eax, r8d
imul eax, eax, 0x1000193
cmp r9, rcx
jne 0x14000a968
mov qword [rsp + 0x28], rdi
lea r8, [rsp + 0x30]
nop dword [rax + rax]
movzx ecx, byte [rdx]
add rdx, 1
xor eax, ecx
imul eax, eax, 0x1000193
cmp r8, rdx
jne 0x14000a990
movzx edx, bl
xor eax, edx
movzx edx, bh
imul eax, eax, 0x1000193
xor eax, edx
xor edx, edx
imul eax, eax, 0x1000193
movzx eax, ax
lea rax, [rax + rax*4]
shl rax, 5
lea r14, [r10 + rax + 0x400000]
mov rax, r14
mov rcx, qword [rax + 8]
mov r8, qword [rax]
cmp rcx, rbp
jne 0x14000a9e3
cmp r8, r12
je 0x14000aa30
add edx, 1
add rax, 0x28
cmp edx, 4
jne 0x14000a9d2
lea rdx, [r14 + 0x4c]
lea rcx, [r14 + 0x24]
mov r8d, 0x54
call sym.memmove
mov qword [r14], r12
xor eax, eax
mov qword [r14 + 8], rbp
mov word [r14 + 0x20], r13w
mov qword [r14 + 0x10], rsi
mov qword [r14 + 0x18], rdi
mov word [r14 + 0x22], bx
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
movzx r9d, word [rax + 0x20]
cmp r13d, r9d
jne 0x14000a9e3
mov r9, qword [rax + 0x10]
mov r10, qword [rax + 0x18]
cmp r9, rsi
jne 0x14000a9e3
cmp r10, rdi
jne 0x14000a9e3
movzx r11d, word [rax + 0x22]
cmp ebx, r11d
jne 0x14000a9e3
test edx, edx
jne 0x14000aa61
mov eax, 1
jmp 0x14000aa1d
mov rdx, qword [r14 + 8]
shl ebx, 0x10
movd xmm2, dword [r14 + 0x20]
xor r8, qword [r14]
xor r9, qword [r14 + 0x10]
xor rdx, rcx
mov ecx, ebx
xor r10, qword [r14 + 0x18]
mov qword [r14], r8
or ecx, r13d
mov qword [r14 + 8], rdx
xor rdx, qword [rax + 8]
movd xmm0, ecx
mov qword [r14 + 0x10], r9
mov rcx, qword [rax]
pxor xmm0, xmm2
mov qword [r14 + 0x18], r10
xor r9, qword [rax + 0x10]
movd dword [r14 + 0x20], xmm0
movd xmm3, dword [rax + 0x20]
xor r10, qword [rax + 0x18]
xor rcx, r8
mov qword [rax], rcx
pxor xmm0, xmm3
mov qword [rax + 8], rdx
movd dword [rax + 0x20], xmm0
movd xmm1, dword [r14 + 0x20]
mov qword [rax + 0x10], r9
pxor xmm1, xmm0
mov qword [rax + 0x18], r10
xor qword [r14], rcx
xor qword [r14 + 8], rdx
xor qword [r14 + 0x10], r9
xor qword [r14 + 0x18], r10
movd dword [r14 + 0x20], xmm1
jmp 0x14000aa5a
Function at 0x140014d70
Capabilities:
Write file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x98
xor eax, eax
lea r8, str.masscan_1.1_ns:_u_n
lea rsi, [rsp + 0x20]
mov rbx, rcx
mov ecx, 0xc
mov rbp, rdx
mov rdi, rsi
mov r9d, dword [rbx + 0x228]
mov edx, 0x63
rep stosq qword [rdi], rax
xor eax, eax
mov rcx, rsi
mov word [rdi], ax
mov byte [rdi + 2], 0
call sym.snprintf.constprop.0_3
mov r9, rbp
mov edx, 1
mov rcx, rsi
mov r8d, 0x63
call sym.fwrite
cmp rax, 0x63
jne 0x140014de7
add qword [rbx + 0x258], 0x63
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea rcx, str.output
call sym.perror
mov ecx, 1
call sym.exit
nop
nop
Function at 0x140015480
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x238
mov r10, rdx
mov rdx, qword [rsp + 0x270]
mov rbx, rcx
mov eax, dword [rdx]
cmp byte [rdx + 0x10], 6
bswap eax
je 0x140015568
cmp r9d, 2
je 0x140015558
cmp r9d, 3
je 0x140015548
mov edx, 6
cmp r9d, 1
jne 0x140015538
mov dword [rsp + 0x36], eax
bswap r8d
lea rcx, [rsp + 0x30]
mov r9, r10
movzx eax, byte [rsp + 0x278]
mov byte [rsp + 0x30], dl
mov edx, 1
mov dword [rsp + 0x32], r8d
mov r8d, 0xf
mov byte [rsp + 0x3a], al
movzx eax, word [rsp + 0x280]
mov byte [rsp + 0x31], 0xd
rol ax, 8
mov word [rsp + 0x3b], ax
movzx eax, byte [rsp + 0x288]
mov byte [rsp + 0x3d], al
movzx eax, byte [rsp + 0x290]
mov byte [rsp + 0x3e], al
call sym.fwrite
cmp rax, 0xf
jne 0x140015662
add qword [rbx + 0x258], 0xf
add rsp, 0x238
pop rbx
pop rsi
ret
mov edx, 8
jmp 0x1400154c4
mov edx, 7
jmp 0x1400154c4
mov rsi, qword [rdx]
mov r11, qword [rdx + 8]
cmp r9d, 2
je 0x140015658
cmp r9d, 3
je 0x140015648
cmp r9d, 1
jne 0x140015538
mov eax, 0xa
mov byte [rsp + 0x130], al
movzx eax, byte [rsp + 0x278]
lea rdx, [rsp + 0x28]
bswap r8d
lea rcx, [rsp + 0x130]
mov dword [rsp + 0x132], r8d
mov r8, rsi
mov byte [rsp + 0x136], al
movzx eax, word [rsp + 0x280]
mov byte [rsp + 0x131], 0x1a
rol ax, 8
mov byte [rsp + 0x13b], 6
mov word [rsp + 0x137], ax
movzx eax, byte [rsp + 0x288]
mov qword [rsp + 0x28], 0xc
mov byte [rsp + 0x139], al
movzx eax, byte [rsp + 0x290]
mov byte [rsp + 0x13a], al
call sym._put_long.constprop.0
mov r8, r11
call sym._put_long.constprop.0
cmp qword [rsp + 0x28], 0x1c
jne 0x140015678
mov r9, r10
mov r8d, 0x1c
mov edx, 1
call sym.fwrite
cmp rax, 0x1c
jne 0x140015662
add qword [rbx + 0x258], 0x1c
jmp 0x140015538
mov eax, 0xc
jmp 0x14001558e
mov eax, 0xb
jmp 0x14001558e
lea rcx, str.output
call sym.perror
mov ecx, 1
call sym.exit
mov r8d, 0x8c
lea rdx, str.src_out_binary.c
lea rcx, str.offset__2__26
call qword [sym.imp.msvcrt.dll__assert]
nop
nop word cs:[rax + rax]
nop

Function at 0x1400156a0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x98
xor eax, eax
lea r8, str.masscan_1.1
lea rbx, [rsp + 0x20]
mov rsi, rcx
mov ecx, 0xc
mov rbp, rdx
mov rdi, rbx
mov edx, 0x63
rep stosq qword [rdi], rax
xor eax, eax
mov rcx, rbx
mov word [rdi], ax
mov byte [rdi + 2], 0
call sym.snprintf.constprop.0_3
mov r9, rbp
mov edx, 1
mov rcx, rbx
mov r8d, 0x63
call sym.fwrite
cmp rax, 0x63
jne 0x140015710
add qword [rsi + 0x258], 0x63
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea rcx, str.output
call sym.perror
mov ecx, 1
call sym.exit
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x1400167e0
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x420
xor r9d, r9d
mov r8d, 6
mov rsi, rdx
lea rdx, str.QUIT_r_n
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 6
jne 0x1400168d3
lea r12, [rsp + 0x20]
mov rdi, qword [sym.imp.WS2_32.dll_recv]
lea rbp, [rsp + 0x420]
mov rbx, r12
jmp 0x140016833
mov rbx, rax
xor r9d, r9d
mov r8d, 1
mov rdx, rbx
mov rcx, rsi
call rdi
test eax, eax
je 0x1400168bb
cmp byte [rbx], 0xa
lea rax, [rbx + 1]
je 0x1400168a0
cmp rax, rbp
jne 0x140016830
mov eax, 0x400
cmp dword [rsp + 0x20], 0xd4b4f2b
je 0x140016890
mov edx, 1
test edx, edx
je 0x14001687e
cmp rax, 4
je 0x14001687e
cmp dword [rsp + 0x20], 0xa0d303a
jne 0x1400168eb
add rsp, 0x420
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
xor edx, edx
cmp byte [rsp + 0x24], 0xa
jne 0x140016865
jmp 0x14001686a
sub rbx, r12
lea rax, [rbx + 1]
cmp rbx, 4
jne 0x14001685b
add rsp, 0x420
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
xor ecx, ecx
lea rdx, str.redis:_recv_line___failed_n
call dbg.LOG
mov ecx, 1
call sym.exit
xor ecx, ecx
lea rdx, str.redis:_send_quit__failed_n
call dbg.LOG
mov ecx, 1
call sym.exit
xor ecx, ecx
mov r8, r12
lea rdx, str.redis:_unexpected_response_from_redis_server:__s_n
call dbg.LOG
mov ecx, 1
call sym.exit
nop
nop word [rax + rax]
Function at 0x140016d80
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x420
xor r9d, r9d
mov r8d, 6
mov rsi, rdx
lea rdx, str.PING_r_n
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 6
jne 0x140016e6f
lea r12, [rsp + 0x20]
mov rdi, qword [sym.imp.WS2_32.dll_recv]
lea rbp, [rsp + 0x420]
mov rbx, r12
jmp 0x140016dd3
mov rbx, rax
xor r9d, r9d
mov r8d, 1
mov rdx, rbx
mov rcx, rsi
call rdi
test eax, eax
je 0x140016e57
cmp byte [rbx], 0xa
lea rax, [rbx + 1]
je 0x140016e40
cmp rax, rbp
jne 0x140016dd0
cmp dword [rsp + 0x20], 0x4e4f502b
je 0x140016e20
xor ecx, ecx
mov r8, r12
lea rdx, str.redis:_unexpected_response_from_redis_server:__s_n
call dbg.LOG
mov ecx, 1
call sym.exit
nop dword [rax + rax]
cmp dword [rsp + 0x23], 0xa0d474e
jne 0x140016e00
add rsp, 0x420
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
sub rbx, r12
cmp rbx, 6
jne 0x140016df6
add rsp, 0x420
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
xor ecx, ecx
lea rdx, str.redis:_recv_line___failed_n
call dbg.LOG
mov ecx, 1
call sym.exit
xor ecx, ecx
lea rdx, str.redis:_send_ping__failed_n
call dbg.LOG
mov ecx, 1
call sym.exit
nop
nop
nop
nop
nop
nop
nop
nop
nop