joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400336b0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0xa0
mov rbx, r8
mov rbp, rdx
mov rdi, rcx
lea rsi, [rcx + 0x20]
mov qword [rsp + 0x40], rsi
mov byte [rsp + 0x48], 0
mov rcx, rsi
call fcn.1400e944c
test eax, eax
jne 0x1400337fd
mov byte [rsp + 0x48], 1
cmp dword [rdi + 0x18], eax
jne 0x140033805
lea rcx, [rdi + 0xf8]
cmp rcx, rbx
je 0x14003371e
mov rdx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x140033715
mov rdx, qword [rbx]
mov r8, qword [rbx + 0x10]
call fcn.1400056a0
mov dword [rdi + 0x18], 2
lea rcx, [rdi + 0x4a0]
call fcn.14003ba50
lea rax, [0x1400328b0]
mov qword [rsp + 0x50], rax
xor ebx, ebx
mov dword [rsp + 0x58], ebx
lea ecx, [rbx + 0x20]
call fcn.14010bf0c
test rax, rax
je 0x140033762
mov qword [rax], rbp
mov qword [rax + 8], rdi
movups xmm0, xmmword [rsp + 0x50]
movups xmmword [rax + 0x10], xmm0
jmp 0x140033765
mov rax, rbx
mov qword [rsp + 0xb0], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebx
mov r9, rax
lea r8, [0x140031270]
xor edx, edx
xor ecx, ecx
call fcn.14011c884
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1400337ee
cmp dword [rsp + 0x38], 0
je 0x14003383d
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x50], xmm0
lea rcx, [rsp + 0x50]
call fcn.1400e90ac
test eax, eax
jne 0x1400337e6
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x30], xmm0
mov rcx, rsi
call fcn.1400e94ac
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
mov ecx, eax
call fcn.1400e991c
nop
mov dword [rsp + 0x38], ebx
mov ecx, 6
call fcn.1400e9958
nop
mov ecx, eax
call fcn.1400e991c
nop
mov edx, 2
lea rcx, [rsp + 0x60]
call fcn.140033b80
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x50], xmm0
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x70]
call fcn.14002fe30
lea rdx, [0x14019afc0]
lea rcx, [rsp + 0x70]
call fcn.14010d400
nop
mov ecx, 1
call fcn.1400e9958
int3
Function at 0x140034380
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0xa0
movzx esi, r9b
movzx ebp, r8b
mov r14, rdx
mov rbx, rcx
cmp byte [rcx + 0x128], 0
je 0x1400343f0
mov dword [rsp + 0x40], reloc.WS2_32.dll_ntohl
lea rax, [0x14019e2d8]
mov qword [rsp + 0x48], rax
add rcx, 0x540
lea r8, [rsp + 0x40]
lea rdx, [fcn.140032294]
call fcn.140031430
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
lea rdi, [rcx + 0x20]
mov qword [rsp + 0x40], rdi
mov byte [rsp + 0x48], 0
mov rcx, rdi
call fcn.1400e944c
test eax, eax
jne 0x1400344e3
mov byte [rsp + 0x48], 1
cmp dword [rbx + 0x18], 1
jne 0x1400344eb
mov dword [rbx + 0x18], 3
mov rcx, rdi
call fcn.1400e94ac
lea rcx, [rbx + 0x4a0]
call fcn.14003ba50
lea rax, [0x140032c40]
mov qword [rsp + 0x40], rax
xor edi, edi
mov dword [rsp + 0x48], edi
lea ecx, [rdi + 0x28]
call fcn.14010bf0c
test rax, rax
je 0x140034471
mov byte [rax], sil
mov byte [rax + 1], bpl
mov qword [rax + 8], r14
mov qword [rax + 0x10], rbx
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rax + 0x18], xmm0
jmp 0x140034474
mov rax, rdi
mov qword [rsp + 0xc0], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], edi
mov r9, rax
lea r8, [0x1400312b0]
xor edx, edx
xor ecx, ecx
call fcn.14011c884
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1400344d4
cmp dword [rsp + 0x38], 0
je 0x140034523
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x50], xmm0
lea rcx, [rsp + 0x50]
call fcn.1400e90ac
test eax, eax
jne 0x1400344cc
jmp 0x1400343d8
mov ecx, eax
call fcn.1400e991c
nop
mov dword [rsp + 0x38], edi
mov ecx, 6
call fcn.1400e9958
nop
mov ecx, eax
call fcn.1400e991c
nop
mov edx, 3
lea rcx, [rsp + 0x60]
call fcn.140033b80
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x50], xmm0
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x70]
call fcn.14002fe30
lea rdx, [0x14019afc0]
lea rcx, [rsp + 0x70]
call fcn.14010d400
nop
mov ecx, 1
call fcn.1400e9958
int3

Function at 0x1400353f0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
cmp qword [rdx + 0x18], 0x10
mov r8, rdx
jb 0x1400353fd
mov r8, qword [rdx]
mov r9, qword [rdx + 0x10]
movabs rax, 0xcbf29ce484222325
xor edx, edx
test r9, r9
je 0x140035434
movabs r10, 0x100000001b3
nop dword [rax]
movzx ecx, byte [rdx + r8]
inc rdx
xor rax, rcx
imul rax, r10
cmp rdx, r9
jb 0x140035420
ret
Function at 0x14003ff50
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
mov r15, rdx
lea r14, [rdx - 1]
mov rdi, rcx
xor r12d, r12d
nop word [rax + rax]
mov rsi, r12
mov rbp, r12
test r14, r14
je 0x140040166
mov rdx, qword [rdi + 8]
nop dword [rax]
nop word [rax + rax]
lea ecx, [rdx + 0xff]
shl rsi, cl
add rsi, rsi
nop dword [rax]
mov r10, qword [rdi]
mov ecx, dword [r10]
cmp ecx, 0x270
jne 0x140040014
lea rax, [r10 + 8]
mov r9d, ecx
nop word [rax + rax]
mov r8d, dword [rax - 4]
xor r8d, dword [rax]
lea rax, [rax + 4]
btr r8d, 0x1f
xor r8d, dword [rax - 8]
mov ecx, r8d
and cl, 1
neg cl
sbb edx, edx
shr r8d, 1
and edx, 0x9908b0df
xor edx, dword [rax + 0x62c]
xor edx, r8d
mov dword [rax + 0x9b8], edx
sub r9, 1
jne 0x14003ffd0
mov ecx, dword [r10]
jmp 0x1400400f7
cmp ecx, 0x4e0
jb 0x1400400f7
lea r11, [r10 + 0x9c4]
mov ebx, 0xe3
mov eax, dword [r11]
nop
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, edx
xor ecx, dword [r11 + 0x634]
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x140040030
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop word [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x140040080
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
mov ecx, r12d
mov dword [r10], r12d
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
mov r8, qword [rdi + 0x10]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and edx, 0xffffdf8c
shl edx, 0xf
mov ecx, edx
xor rcx, rax
mov rax, rcx
shr rax, 0x12
xor rax, rcx
cmp rax, r8
ja 0x14003ffb0
mov rdx, qword [rdi + 8]
or rsi, rax
lea ecx, [rdx + 0xff]
shl rbp, cl
add rbp, rbp
or rbp, r8
cmp rbp, r14
jb 0x14003ffa0
xor edx, edx
mov rax, rbp
div r15
mov rcx, rax
mov r8, rdx
xor edx, edx
mov rax, rsi
div r15
cmp rax, rcx
jb 0x14004018a
cmp r8, r14
jne 0x14003ff80
mov rbx, qword [rsp + 0x20]
mov rax, rsi
mov rbp, qword [rsp + 0x28]
xor edx, edx
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
div r15
mov rax, rdx
pop r15
pop r14
pop r12
ret
Function at 0x1400409a0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
mov rax, qword [rcx + 8]
xor r14d, r14d
mov edi, r14d
mov ebp, r14d
mov rsi, rcx
nop word [rax + rax]
lea ecx, [rax + 0xff]
shl rdi, cl
add rdi, rdi
nop dword [rax]
mov r10, qword [rsi]
mov ecx, dword [r10]
cmp ecx, 0x270
jne 0x140040a44
lea rax, [r10 + 8]
mov r9d, ecx
nop word [rax + rax]
mov r8d, dword [rax - 4]
xor r8d, dword [rax]
lea rax, [rax + 4]
btr r8d, 0x1f
xor r8d, dword [rax - 8]
mov ecx, r8d
and cl, 1
neg cl
sbb edx, edx
shr r8d, 1
and edx, 0x9908b0df
xor edx, dword [rax + 0x62c]
xor edx, r8d
mov dword [rax + 0x9b8], edx
sub r9, 1
jne 0x140040a00
mov ecx, dword [r10]
jmp 0x140040b27
cmp ecx, 0x4e0
jb 0x140040b27
lea r11, [r10 + 0x9c4]
mov ebx, 0xe3
mov eax, dword [r11]
nop
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x140040a60
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x140040ab0
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
mov ecx, r14d
mov dword [r10], r14d
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov ecx, edx
mov dword [r10], eax
mov eax, dword [r10 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and edx, 0xffffdf8c
shl edx, 0xf
mov ecx, edx
xor rcx, rax
mov rdx, rcx
shr rdx, 0x12
xor rdx, rcx
cmp rdx, qword [rsi + 0x10]
ja 0x1400409e0
mov rax, qword [rsi + 8]
or rdi, rdx
add rbp, rax
cmp rbp, 0x40
jb 0x1400409d0
mov rbx, qword [rsp + 0x10]
mov rax, rdi
mov rdi, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
pop r14
ret
Function at 0x140056340
Capabilities:
Create thread

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x90
mov rdi, rdx
mov rsi, rcx
lea rbx, [rcx + 0x10]
mov qword [rsp + 0xc0], rbx
mov rcx, rbx
call fcn.1400e944c
test eax, eax
jne 0x140056520
cmp dword [rsi + 8], eax
je 0x1400563b1
mov dword [rsp + 0x30], 2
lea rax, [0x14019e2e8]
mov qword [rsp + 0x38], rax
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
mov rcx, qword [rdi + 0x38]
test rcx, rcx
je 0x140056528
mov rax, qword [rcx]
lea rdx, [rsp + 0x30]
call qword [rax + 0x10]
jmp 0x1400564f5
mov dword [rsi + 8], 1
mov byte [rsi + 0x1d8], 0
xor r14d, r14d
mov qword [rsi + 0x1e0], r14
mov dword [rsi + 0x1e8], r14d
mov dword [rsi + 0x1ec], r14d
movups xmm0, xmmword [0x1401aba70]
movups xmmword [rsi + 0x1f0], xmm0
movups xmm1, xmmword [0x1401aba80]
movups xmmword [rsi + 0x200], xmm1
lea rcx, [rsi + 0x218]
call fcn.1400536a0
mov qword [rsp + 0x40], rsi
lea rax, [rsp + 0x48]
mov qword [rsp + 0xd0], rax
mov qword [rsp + 0x80], r14
mov rcx, qword [rdi + 0x38]
test rcx, rcx
je 0x140056434
mov rax, qword [rcx]
lea rdx, [rsp + 0x48]
call qword [rax]
mov qword [rsp + 0x80], rax
mov ecx, 0x48
call fcn.14010bf0c
mov rdi, rax
mov qword [rsp + 0xd0], rax
test rax, rax
je 0x140056481
mov rax, qword [rsp + 0x40]
mov qword [rdi], rax
lea rbp, [rdi + 8]
mov qword [rsp + 0xd8], rbp
mov qword [rbp + 0x38], r14
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x14005647f
mov rax, qword [rcx]
mov rdx, rbp
call qword [rax]
mov qword [rbp + 0x38], rax
jmp 0x140056484
mov rdi, r14
mov qword [rsp + 0xd0], rdi
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r14d
mov r9, rdi
lea r8, [0x14004b6d0]
xor edx, edx
xor ecx, ecx
call fcn.14011c884
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140056510
cmp dword [rsi + 0xb0], 0
jne 0x14005650a
xorps xmm0, xmm0
movaps xmm1, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
movups xmmword [rsi + 0xa8], xmm1
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x1400564f5
mov rax, qword [rcx]
lea rdx, [rsp + 0x48]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
nop
mov rcx, rbx
add rsp, 0x90
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
jmp fcn.1400e94ac
call fcn.140119acc
nop
mov dword [rsp + 0x38], r14d
mov ecx, 6
call fcn.1400e9958
nop
mov ecx, eax
call fcn.1400e991c
nop
call fcn.1400e763c
int3
Function at 0x14005e860
Capabilities:
Create thread

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x90
mov rbx, rcx
cmp qword [rcx + 0x88], 0
je 0x14005e9d7
lea rax, vtable.std::_Func_impl_no_alloc_class__lambda_f011d44aa37b0eec249e7ffcacba470c___bool___.0
mov qword [r11 - 0x50], rax
mov qword [r11 - 0x48], rcx
lea rax, [r11 - 0x50]
mov qword [r11 - 0x18], rax
lea rdi, [rcx + 0x158]
mov qword [r11 - 0x68], rdi
mov byte [rsp + 0x38], 0
mov rcx, rdi
call fcn.1400e944c
test eax, eax
jne 0x14005e9fa
mov byte [rsp + 0x38], 1
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x14005ea02
mov rax, qword [rcx]
call qword [rax + 0x10]
test al, al
je 0x14005e8ff
mov dword [rbx + 0xdc], 2
lea rcx, [rbx + 0x1a8]
call fcn.1400e95ec
nop
mov rcx, rdi
call fcn.1400e94ac
xor dil, dil
jmp 0x14005e90a
mov rcx, rdi
call fcn.1400e94ac
mov dil, 1
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x14005e928
mov rax, qword [rcx]
lea rdx, [rsp + 0x48]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
test dil, dil
jne 0x14005ea08
mov ecx, 0x10
call fcn.14010bf0c
mov rdi, rax
mov qword [rsp + 0xa0], rax
test rax, rax
je 0x14005e997
mov ecx, 8
call fcn.14010bf0c
test rax, rax
je 0x14005e95d
mov qword [rax], rbx
mov qword [rsp + 0xa8], rax
lea rsi, [rdi + 8]
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x140058290]
xor edx, edx
xor ecx, ecx
call fcn.14011c884
mov qword [rdi], rax
test rax, rax
je 0x14005ea2b
jmp 0x14005e999
xor edi, edi
mov rcx, qword [rbx + 0xe0]
mov qword [rbx + 0xe0], rdi
test rcx, rcx
je 0x14005e9bc
cmp dword [rcx + 8], 0
jne 0x14005e9d1
mov edx, 0x10
call fcn.14010bf48
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.140119acc
int3
lea rdx, str.Cant_start__because_BlockchainSynchronizer_has_no_consumers
lea rcx, [rsp + 0x30]
call fcn.14000f510
lea rdx, [0x14019a638]
lea rcx, [rsp + 0x30]
call fcn.14010d400
nop
mov ecx, eax
call fcn.1400e991c
nop
call fcn.1400e763c
nop
lea rdx, str.BlockchainSynchronizer_already_started
lea rcx, [rsp + 0x30]
call fcn.14000f510
lea rdx, [0x14019a638]
lea rcx, [rsp + 0x30]
call fcn.14010d400
nop
mov dword [rsi], 0
mov ecx, 6
call fcn.1400e9958
int3
Function at 0x14007da40
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov ebx, 1
mov eax, ebx
shl rax, cl
cmp rdx, rax
ja 0x14007dc23
lea rax, [rdx - 1]
mov qword [rsp + 0x38], rdi
mov rdi, qword [rsi + 8]
or rax, rbx
bsr rcx, rax
mov r8, rdi
mov qword [rsp + 0x40], r14
inc ecx
shl rbx, cl
lea rcx, [rsi + 0x18]
lea rdx, [rbx + rbx]
call fcn.140037670
mov rdx, qword [rsi + 8]
lea rax, [rbx - 1]
mov qword [rsi + 0x30], rax
mov qword [rsi + 0x38], rbx
mov rdx, qword [rdx]
cmp rdx, rdi
je 0x14007dbe8
mov qword [rsp + 0x30], rbp
mov rcx, rdx
movabs rbp, 0xcbf29ce484222325
movabs rbx, 0x100000001b3
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rcx + 0x11]
movzx r9d, byte [rcx + 0x10]
mov r11, qword [rsi + 0x30]
xor r9, rbp
mov rdx, qword [rdx]
imul r9, rbx
xor r9, rax
movzx eax, byte [rcx + 0x12]
imul r9, rbx
xor r9, rax
movzx eax, byte [rcx + 0x13]
imul r9, rbx
xor r9, rax
movzx eax, byte [rcx + 0x14]
imul r9, rbx
xor r9, rax
movzx eax, byte [rcx + 0x15]
imul r9, rbx
xor r9, rax
movzx eax, byte [rcx + 0x16]
imul r9, rbx
xor r9, rax
movzx eax, byte [rcx + 0x17]
imul r9, rbx
xor r9, rax
imul r9, rbx
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r10, qword [r11]
cmp r10, rdi
jne 0x14007db5c
mov qword [r11], rcx
mov qword [r11 + 8], rcx
jmp 0x14007dbd7
mov rax, qword [r11 + 8]
mov r9, qword [rcx + 0x10]
cmp r9, qword [rax + 0x10]
jne 0x14007db99
mov r10, qword [rax]
cmp r10, rcx
je 0x14007db93
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
mov qword [r11 + 8], rcx
jmp 0x14007dbd7
mov r8, rax
cmp r10, rax
je 0x14007dbb3
mov rax, qword [rax + 8]
mov r8, rax
cmp r9, qword [rax + 0x10]
je 0x14007dbfd
cmp r10, rax
jne 0x14007dba1
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], r8
mov rax, qword [r8 + 8]
mov qword [rax], rcx
mov qword [r8 + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], rax
mov qword [r11], rcx
mov rcx, rdx
cmp rdx, rdi
jne 0x14007dae0
mov rbp, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov r14, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret
mov r10, qword [rax]
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
jmp 0x14007dbd7
lea rcx, str.invalid_hash_bucket_count
call fcn.1400e7680
int3
Function at 0x14009aef0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0x100
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
mov rcx, qword [rcx]
call fcn.140099210
test al, al
jne 0x14009b0a8
mov dword [rbp - 0x61], edi
mov qword [rbp - 0x59], rsi
xor esi, esi
mov dword [rbp + 0x67], esi
mov qword [rbp + 7], rsi
mov qword [rsp + 0x30], rsi
lea rax, [rbp - 0x11]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x67]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8d, [rsi + 1]
lea rdx, [rbp - 0x61]
mov rcx, qword [rbx + 8]
call qword [sym.imp.WS2_32.dll_WSARecv]
test eax, eax
je 0x14009af6e
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
jne 0x14009b0cf
mov rcx, qword [rbx]
call fcn.140099000
mov qword [rbp + 0xf], rax
mov byte [rbp + 0x17], sil
lea rax, [rbp - 0x11]
mov qword [rbx + 0x10], rax
mov rcx, qword [rbx]
call fcn.140099000
lea rdx, [rax + 0x70]
lea rcx, vtable.std::_Func_impl_no_alloc_class__lambda_ba592e99b77cc87b7eb140194ef6b88a___void___.0
mov qword [rbp - 0x51], rcx
mov qword [rbp - 0x49], rbx
lea rcx, [rbp - 0x51]
mov qword [rbp - 0x19], rcx
lea rcx, [rbp - 0x51]
call fcn.14009b110
mov rcx, qword [rbp - 0x19]
test rcx, rcx
je 0x14009afcb
mov rax, qword [rcx]
lea rdx, [rbp - 0x51]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
mov rcx, qword [rbx]
call fcn.140098d10
mov rcx, qword [rbx]
call fcn.140099000
lea rdi, [rax + 0x70]
mov rcx, qword [rdi + 0x38]
test rcx, rcx
je 0x14009aff8
mov rax, qword [rcx]
cmp rcx, rdi
setne dl
call qword [rax + 0x20]
mov qword [rdi + 0x38], rsi
mov qword [rbx + 0x10], rsi
lea rax, [rbp + 0x67]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rbp + 0x7f]
lea rdx, [rbp - 0x11]
mov rcx, qword [rbx + 8]
call qword [sym.imp.WS2_32.dll_WSAGetOverlappedResult]
cmp eax, 1
je 0x14009b02e
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e3
jne 0x14009b06b
jmp 0x14009b044
mov eax, dword [rbp + 0x7f]
mov rbx, qword [rsp + 0x128]
add rsp, 0x100
pop rdi
pop rsi
pop rbp
ret
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x79], xmm0
mov qword [rbp - 0x69], rax
lea rcx, [rbp - 0x79]
call fcn.140099910
lea rdx, [0x14019b2f0]
lea rcx, [rbp - 0x79]
call fcn.14010d400
int3
mov edx, eax
lea rcx, [rbp - 0x51]
call fcn.14009ca80
nop
mov r8, rax
lea rdx, str.TcpConnection::read__WSAGetOverlappedResult_failed_
lea rcx, [rbp + 0x1f]
call fcn.140006670
nop
mov rdx, rax
lea rcx, [rbp - 0x79]
call fcn.14000f4b0
lea rdx, [0x14019a638]
lea rcx, [rbp - 0x79]
call fcn.14010d400
nop
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x79], xmm0
mov qword [rbp - 0x69], rax
lea rcx, [rbp - 0x79]
call fcn.140099910
lea rdx, [0x14019b2f0]
lea rcx, [rbp - 0x79]
call fcn.14010d400
int3
mov edx, eax
lea rcx, [rbp + 0x1f]
call fcn.14009ca80
nop
mov r8, rax
lea rdx, str.TcpConnection::read__WSARecv_failed_
lea rcx, [rbp - 0x51]
call fcn.140006670
nop
mov rdx, rax
lea rcx, [rbp - 0x79]
call fcn.14000f4b0
lea rdx, [0x14019a638]
lea rcx, [rbp - 0x79]
call fcn.14010d400
int3
Function at 0x14009b900
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister
Resolve dns

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x1340]
mov eax, 0x1440
call fcn.14010c480
sub rsp, rax
mov rdi, r8
mov rsi, rdx
mov rcx, qword [rcx]
call fcn.140099210
test al, al
jne 0x14009bac6
movdqa xmm0, xmmword [0x14014f6b0]
movdqu xmmword [rsp + 0x38], xmm0
xor ebx, ebx
mov qword [rsp + 0x48], rbx
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rbx
cmp qword [rdi + 0x18], 0x10
jb 0x14009b968
mov rdi, qword [rdi]
lea r9, [rbp + 0x1350]
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
jne 0x14009ba86
mov rax, qword [rbp + 0x1350]
test rax, rax
je 0x14009b99f
inc rbx
mov rax, qword [rax + 0x28]
test rax, rax
jne 0x14009b993
call fcn.1400ea618
mov r8d, 0xffffffff
mov dword [rbp + 0x1334], r8d
mov dword [rbp - 0x4c], eax
mov edx, 1
nop dword [rax]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [rbp + rdx*4 - 0x4c], eax
inc rdx
cmp rdx, 0x270
jb 0x14009b9c0
mov dword [rbp - 0x50], 0x270
lea rax, [rbp - 0x50]
mov qword [rsp + 0x20], rax
mov ecx, 0x40
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
dec rcx
shr rax, 1
cmp rax, r8
ja 0x14009ba00
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x20]
test rbx, rbx
jne 0x14009ba26
call fcn.1400409a0
jmp 0x14009ba2e
mov rdx, rbx
call fcn.14003ff50
mov rbx, qword [rbp + 0x1350]
test rax, rax
je 0x14009ba4a
nop word [rax + rax]
mov rbx, qword [rbx + 0x28]
sub rax, 1
jne 0x14009ba40
mov rax, qword [rbx + 0x20]
mov ecx, dword [rax + 4]
call qword [sym.imp.WS2_32.dll_ntohl]
mov edx, eax
mov rcx, rsi
call fcn.14009c420
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
mov rax, rsi
lea r11, [rsp + 0x1440]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
mov edx, eax
lea rcx, [rsp + 0x68]
call fcn.14009ca80
nop
mov r8, rax
lea rdx, str.Ipv4Resolver::resolve__getaddrinfo_failed_
lea rcx, [rbp - 0x78]
call fcn.140006670
nop
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.14000f4b0
lea rdx, [0x14019a638]
lea rcx, [rsp + 0x20]
call fcn.14010d400
nop
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x20]
call fcn.140099910
lea rdx, [0x14019b2f0]
lea rcx, [rsp + 0x20]
call fcn.14010d400
int3
Function at 0x1400ac970
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
movzx edi, r9b
movzx esi, dl
mov rbx, rcx
add rcx, 0x18
cmp rcx, r8
je 0x1400ac9ad
mov rdx, r8
cmp qword [r8 + 0x18], 0x10
jb 0x1400ac9a4
mov rdx, qword [r8]
mov r8, qword [r8 + 0x10]
call fcn.1400056a0
mov byte [rbx + 0x38], dil
lea rdi, [rbx + 0x50]
xor ebp, ebp
mov eax, ebp
xchg byte [rdi], al
lea ecx, [rbp + 0x10]
call fcn.14010bf0c
test rax, rax
je 0x1400ac9d8
lea rcx, [0x1400ab510]
mov qword [rax], rcx
mov qword [rax + 8], rdi
jmp 0x1400ac9db
mov rax, rbp
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebp
mov r9, rax
lea r8, [0x1400aa320]
xor edx, edx
xor ecx, ecx
call fcn.14011c884
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1400acaad
cmp dword [rdi + 0x10], 0
jne 0x1400acaa7
movaps xmm0, xmmword [rsp + 0x40]
movups xmmword [rdi + 8], xmm0
test sil, sil
je 0x1400aca9d
mov ecx, 0x10
call fcn.14010bf0c
test rax, rax
je 0x1400aca46
lea rcx, [fcn.1400abdd0]
mov qword [rax], rcx
mov qword [rax + 8], rbx
jmp 0x1400aca49
mov rax, rbp
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebp
mov r9, rax
lea r8, [0x1400aa320]
xor edx, edx
xor ecx, ecx
call fcn.14011c884
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1400acac2
cmp dword [rbx + 0x10], 0
jne 0x1400acabc
movaps xmm0, xmmword [rsp + 0x30]
movups xmmword [rbx + 8], xmm0
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
mov rcx, rbx
call fcn.1400abdd0
jmp 0x1400aca88
call fcn.140119acc
nop
mov dword [rsp + 0x48], ebp
mov ecx, 6
call fcn.1400e9958
nop
call fcn.140119acc
nop
mov dword [rsp + 0x38], ebp
mov ecx, 6
call fcn.1400e9958
int3