joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001d120
Capabilities:
Encode data using xor
Hash data using fnv
Hash data using murmur3

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rdi
push r13
push r14
push r15
sub rsp, 0x30
cmp qword [rcx + 8], 0
mov rbp, r8
mov rbx, rdx
mov rdi, rcx
jne 0x14001d151
mov rdx, qword [rcx]
call fcn.1400217e0
mov r9, qword [rbp]
movabs r13, 0xff51afd7ed558ccd
mov r8, qword [rdi]
mov rax, r9
mov r10, qword [rdi + 8]
shr rax, 0x21
xor rax, r9
imul rax, r13
mov rdx, rax
shr rdx, 0x21
xor rdx, rax
movabs rax, 0xc4ceb9fe1a85ec53
imul rdx, rax
lea rax, [r8 - 1]
mov rcx, rdx
shr rcx, 0x21
xor rcx, rdx
and rcx, rax
mov rax, qword [r10 + rcx*8]
lea r15, [r10 + rcx*8]
mov r14, r15
test rax, rax
je 0x14001d1c1
nop dword [rax]
cmp r9, qword [rax + 8]
je 0x14001d1c1
mov r14, rax
mov rax, qword [rax]
test rax, rax
jne 0x14001d1b0
mov rcx, qword [r14]
test rcx, rcx
je 0x14001d1e1
mov qword [rbx], rcx
lea rax, [r10 + r8*8]
mov qword [rbx + 8], r15
mov qword [rbx + 0x10], rax
mov byte [rbx + 0x18], 0
jmp 0x14001d31f
movzx eax, byte [str.._AU__chained_hash_node__K_blz__]
lea rcx, [0x140126491]
mov qword [rsp + 0x50], rsi
mov r9d, 0x811c9dc5
test eax, eax
je 0x14001d216
nop
xor eax, r9d
lea rcx, [rcx + 1]
imul r9d, eax, 0x1000193
movzx eax, byte [rcx - 1]
test eax, eax
jne 0x14001d200
mov edx, ntohs
mov dword [rsp + 0x28], 0
lea r8, str.._AU__chained_hash_node__K_blz__
mov dword [rsp + 0x20], 0xfffffffa
lea ecx, [rdx + 5]
call fcn.140025e30
mov rsi, rax
test rax, rax
je 0x14001d251
mov qword [rax], 0
mov rcx, qword [rbp]
mov qword [rax + 8], rcx
mov qword [r14], rsi
xorps xmm0, xmm0
inc qword [rdi + 0x10]
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi]
test rcx, rcx
js 0x14001d26e
cvtsi2ss xmm0, rcx
jmp 0x14001d283
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
xorps xmm1, xmm1
test rdx, rdx
js 0x14001d292
cvtsi2ss xmm1, rdx
jmp 0x14001d2aa
mov rax, rdx
mov rcx, rdx
shr rcx, 1
and eax, 1
or rcx, rax
cvtsi2ss xmm1, rcx
addss xmm1, xmm1
divss xmm0, xmm1
comiss xmm0, dword [rdi + 0x18]
jbe 0x14001d303
add rdx, rdx
mov rcx, rdi
call fcn.1400217e0
mov rcx, qword [rbp]
mov rdx, qword [rdi]
shr rcx, 0x21
xor rcx, qword [rbp]
imul rcx, r13
mov rax, rcx
shr rax, 0x21
xor rax, rcx
movabs rcx, 0xc4ceb9fe1a85ec53
imul rax, rcx
mov rcx, rax
shr rcx, 0x21
xor rcx, rax
lea rax, [rdx - 1]
and rcx, rax
mov rax, qword [rdi + 8]
lea r15, [rax + rcx*8]
mov rax, qword [rdi + 8]
mov qword [rbx], rsi
mov qword [rbx + 8], r15
lea rcx, [rax + rdx*8]
mov qword [rbx + 0x10], rcx
mov rsi, qword [rsp + 0x50]
mov byte [rbx + 0x18], 1
mov rbp, qword [rsp + 0x60]
mov rax, rbx
mov rbx, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r13
ret
Function at 0x14001d8c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov edi, ecx
lea rdx, [0x1400de7b1]
add ecx, 0x20
mov r9d, 0x811c9dc5
mov eax, 0x44
nop word [rax + rax]
xor eax, r9d
lea rdx, [rdx + 1]
imul r9d, eax, 0x1000193
movzx eax, byte [rdx - 1]
test eax, eax
jne 0x14001d8f0
xor esi, esi
lea r8, str.D:BuildServerDwork_gitwowWoWSourceWowConnectionWowConnection.cpp
mov dword [rsp + 0x28], esi
lea edx, [rax + 0x1c]
mov dword [rsp + 0x20], 0x53
call fcn.140025e30
mov rbx, rax
test rax, rax
je 0x14001d939
mov dword [rax + 0x10], esi
mov qword [rax + 0x18], rsi
mov qword [rax + 8], rsi
mov qword [rax], rsi
mov dword [rax + 0x14], edi
call fcn.1400d9fe0
mov rsi, qword [rsp + 0x48]
mov dword [rbx + 0x10], eax
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x14001e420
Capabilities:
Hash data using murmur3

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [rcx + 0x221], 0
mov rbx, rdx
je 0x14001e455
cmp byte [rcx + 0x225], 0
mov byte [rcx + 0x221], 0
je case.default.0x14001e44e
mov rcx, rdx
add rsp, 0x20
pop rbx
jmp qword [sym.imp.WS2_32.dll_closesocket]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_closesocket]
cmp rbx, 0xffffffffffffffff
je case.default.0x14001e44e
lea rcx, [0x140128aa0]
call sub.KERNEL32.dll_EnterCriticalSection
mov r8, qword [0x140120098]
test r8, r8
je 0x14001e51e
movabs rcx, 0xff51afd7ed558ccd
mov qword [rsp + 0x30], rdi
mov rax, rbx
shr rax, 0x21
xor rax, rbx
imul rax, rcx
mov rdx, rax
shr rdx, 0x21
xor rdx, rax
movabs rax, 0xc4ceb9fe1a85ec53
imul rdx, rax
mov rax, qword [0x140120090]
mov rcx, rdx
shr rcx, 0x21
xor rcx, rdx
dec rax
and rcx, rax
mov rax, qword [r8 + rcx*8]
lea rdi, [r8 + rcx*8]
test rax, rax
je 0x14001e4f1
nop dword [rax]
cmp rbx, qword [rax + 8]
je 0x14001e4f1
mov rdi, rax
mov rax, qword [rax]
test rax, rax
jne 0x14001e4e0
mov rcx, qword [rdi]
test rcx, rcx
je 0x14001e519
mov rbx, qword [rcx]
lea rdx, str.._AU__chained_hash_node__K_blz__
xor r9d, r9d
lea r8d, [r9 - 6]
call fcn.140025f00
mov qword [rdi], rbx
dec qword [0x1401200a0]
mov rdi, qword [rsp + 0x30]
lea rcx, [0x140128aa0]
add rsp, 0x20
pop rbx
jmp fcn.1400b8230
add rsp, 0x20
pop rbx
ret
add byte [rax], al
add byte [rax], al
adc byte [rdx], 0
adc al, byte [rax]
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al

Function at 0x14001e570
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov rsi, rcx
sub edx, 1
je 0x14001e59f
sub edx, 1
je 0x14001e598
cmp edx, 1
jne 0x14001e59f
mov ebx, edx
xor r8d, r8d
jmp 0x14001e5aa
mov ebx, reloc.WS2_32.dll_socket
jmp 0x14001e5a4
mov ebx, 2
mov r8d, 6
xor r9d, r9d
mov dword [rsp + 0x28], 0x81
mov ecx, ebx
mov dword [rsp + 0x20], 0
lea edx, [r9 + 1]
call fcn.140020c50
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x14001e5fc
cmp ebx, 0x17
jne 0x14001e64d
call sub.WS2_32.dll_WSAGetLastError
cmp eax, 0x273f
mov rax, rdi
jne 0x14001e64d
mov byte [rsi + 0x226], 1
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
lea r8, [rsp + 0x68]
mov dword [rsp + 0x68], 1
mov edx, 0x8004667e
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_ioctlsocket]
lea rcx, [0x140128aa0]
mov qword [rsp + 0x70], rdi
call sub.KERNEL32.dll_EnterCriticalSection
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x30]
lea rcx, [0x140120090]
call fcn.14001d120
lea rcx, [0x140128aa0]
call fcn.1400b8230
mov rax, rdi
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x14001faf0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
push r14
push r15
sub rsp, 0x30
cmp qword [0x140128ae0], 0
movzx r14d, r9b
mov esi, r8d
mov r15, rdx
mov rbp, rcx
jne 0x14001fc41
mov rax, qword [0x140120098]
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x60], r12
xor r12d, r12d
test rax, rax
je 0x14001fb93
cmp qword [0x140120090], r12
mov qword [rsp + 0x58], rdi
mov edi, r12d
jbe 0x14001fb8e
mov rcx, qword [rax + rdi*8]
test rcx, rcx
je 0x14001fb75
nop dword [rax]
mov rbx, qword [rcx]
lea rdx, str.._AU__chained_hash_node__K_blz__
xor r9d, r9d
lea r8d, [r9 - 6]
call fcn.140025f00
mov rcx, rbx
test rbx, rbx
jne 0x14001fb50
mov rax, qword [0x140120098]
mov qword [rax + rdi*8], r12
inc rdi
cmp rdi, qword [0x140120090]
jae 0x14001fb8e
mov rax, qword [0x140120098]
jmp 0x14001fb43
mov rdi, qword [rsp + 0x58]
mov qword [0x1401200a0], r12
call fcn.140021b10
mov ebx, 0x20
mov qword [0x140128a48], rbp
cmp esi, ebx
mov dword [0x140128ad0], r12d
mov r9d, 0x811c9dc5
lea rax, [0x1400de7b1]
cmovbe ebx, esi
mov ecx, 0x44
nop dword [rax]
xor r9d, ecx
movzx ecx, byte [rax]
imul r9d, r9d, 0x1000193
lea rax, [rax + 1]
test ecx, ecx
jne 0x14001fbd0
lea edx, [rcx + 3]
mov dword [rsp + 0x28], r12d
mov ecx, 0xcc8
mov dword [rsp + 0x20], 0x7d8
lea r8, str.D:BuildServerDwork_gitwowWoWSourceWowConnectionWowConnection.cpp
call fcn.140025e30
mov r9, qword [rsp + 0x70]
mov r8, r15
mov edx, ebx
mov rcx, rax
call fcn.140021f70
movzx edx, r14b
mov qword [0x140128ae0], rax
mov rcx, rax
call fcn.140022c90
mov rcx, qword [0x140128ae0]
call fcn.140022860
mov r12, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rsi
ret
Function at 0x1400216c0
Capabilities:
Get socket status

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x50
xor eax, eax
mov dword [r11 + 0x10], r8d
test r9b, r9b
mov dword [rsp + 0x30], 1
mov rsi, rdx
mov qword [r11 - 0x20], rdx
mov dword [rsp + 0x40], 1
lea r8, [r11 - 0x28]
mov qword [r11 - 0x10], rdx
cmove r8, rax
lea rdx, [r11 - 0x28]
mov dword [rsp + 0x6c], eax
cmovne rdx, rax
movzx ebx, r9b
lea rax, [r11 + 0x10]
movzx edi, cx
lea r9, [r11 - 0x18]
mov qword [r11 - 0x38], rax
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_select]
mov ebp, eax
cmp eax, 1
jl 0x14002177a
lea rdx, [rsp + 0x40]
mov rcx, rsi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x140021752
mov r8d, ebx
lea rcx, str.WaitForSocketEvent_2__failed:__hu__d
mov edx, edi
call fcn.14001e540
jmp 0x14002179e
lea rdx, [rsp + 0x30]
mov rcx, rsi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
jne 0x140021776
mov r8d, ebx
lea rcx, str.WaitForSocketEvent_3__failed:__hu__d
mov edx, edi
call fcn.14001e540
jmp 0x14002179e
mov al, 1
jmp 0x1400217a0
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r8d, ebx
lea rcx, str.WaitForSocketEvent_1__failed:__hu__d__d__d
mov edx, edi
mov dword [rsp + 0x20], eax
mov r9d, ebp
call fcn.14001e540
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
xor al, al
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x1400217e0
Capabilities:
Encode data using xor
Hash data using fnv
Hash data using murmur3

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x30
movss xmm3, dword [rcx + 0x18]
mov rsi, rcx
mov rcx, qword [rcx + 0x10]
mov r8, rdx
xorps xmm1, xmm1
test rcx, rcx
js 0x140021808
cvtsi2ss xmm1, rcx
jmp 0x14002181d
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
movss xmm2, dword [0x1400deb28]
movaps xmm0, xmm1
divss xmm0, xmm3
xor eax, eax
comiss xmm0, xmm2
jb 0x140021849
subss xmm0, xmm2
comiss xmm0, xmm2
jae 0x140021849
movabs rcx, 0x8000000000000000
mov rax, rcx
cvttss2si rdx, xmm0
xorps xmm0, xmm0
add rdx, rax
js 0x14002185d
cvtsi2ss xmm0, rdx
jmp 0x140021875
mov rax, rdx
mov rcx, rdx
shr rcx, 1
and eax, 1
or rcx, rax
cvtsi2ss xmm0, rcx
addss xmm0, xmm0
mulss xmm0, xmm3
lea rax, [rdx + 1]
mov ebx, 8
comiss xmm1, xmm0
cmovbe rax, rdx
cmp rax, r8
cmovb rax, r8
cmp rbx, rax
jae 0x14002189d
add rbx, rbx
cmp rbx, rax
jb 0x140021895
cmp rbx, qword [rsi]
jne 0x1400218ad
cmp qword [rsi + 8], 0
jne 0x1400219f4
movzx eax, byte [str..PEAU__chained_hash_node__K_blz__]
lea rcx, [0x140126519]
mov qword [rsp + 0x40], rbp
mov r9d, 0x811c9dc5
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], r14
test eax, eax
je 0x1400218f6
nop dword [rax]
nop dword [rax + rax]
xor eax, r9d
lea rcx, [rcx + 1]
imul r9d, eax, 0x1000193
movzx eax, byte [rcx - 1]
test eax, eax
jne 0x1400218e0
xor edi, edi
lea rbp, [rbx*8]
mov dword [rsp + 0x28], edi
lea r8, str..PEAU__chained_hash_node__K_blz__
mov rcx, rbp
mov dword [rsp + 0x20], 0xfffffffa
lea edx, [rdi + 0xb]
call fcn.140025e30
mov r14, rax
test rbx, rbx
je 0x140021937
and rbp, 0xfffffffffffffff8
xor edx, edx
mov r8, rbp
mov rcx, rax
call fcn.1400be550
mov rax, qword [rsi + 8]
mov rbp, qword [rsp + 0x40]
mov rcx, rax
test rax, rax
je 0x1400219d0
cmp qword [rsi], rdi
jbe 0x1400219d0
movabs r10, 0xff51afd7ed558ccd
movabs r11, 0xc4ceb9fe1a85ec53
nop dword [rax]
mov r8, qword [rax + rdi*8]
mov rcx, rax
test r8, r8
je 0x1400219c5
lea r9, [rbx - 1]
mov rcx, qword [r8 + 8]
shr rcx, 0x21
xor rcx, qword [r8 + 8]
imul rcx, r10
mov rax, rcx
shr rax, 0x21
xor rax, rcx
mov rcx, qword [r8]
imul rax, r11
mov rdx, rax
shr rdx, 0x21
xor rdx, rax
and rdx, r9
mov rax, qword [r14 + rdx*8]
mov qword [r8], rax
mov qword [r14 + rdx*8], r8
mov r8, rcx
test rcx, rcx
jne 0x140021980
mov rcx, qword [rsi + 8]
inc rdi
mov rax, rcx
cmp rdi, qword [rsi]
jb 0x140021970
xor r9d, r9d
lea rdx, str..PEAU__chained_hash_node__K_blz__
lea r8d, [r9 - 6]
call fcn.140025f00
mov rdi, qword [rsp + 0x48]
mov qword [rsi + 8], r14
mov r14, qword [rsp + 0x50]
mov qword [rsi], rbx
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rsi
ret
Function at 0x140021e00
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
movsxd r9, dword [rcx + 0x14]
mov rdi, rcx
movsxd rsi, edx
cmp r9d, esi
jl 0x140021e34
add dword [rcx + 0x10], esi
sub r9d, esi
sub qword [rcx], rsi
mov rax, qword [rcx]
mov dword [rcx + 0x14], r9d
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
movsxd r8, dword [rcx + 0x10]
mov ecx, dword [rcx + 0x18]
add ecx, r9d
cmp ecx, esi
jl 0x140021e72
mov rdx, qword [rdi]
mov rcx, rsi
sub rcx, r9
add rcx, rdx
call fcn.1400bddc0
movsxd rax, dword [rdi + 0x14]
sub qword [rdi], rax
add dword [rdi + 0x10], esi
mov rax, qword [rdi]
mov dword [rdi + 0x14], 0
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov qword [rsp + 0x40], rbx
lea rcx, [0x1400debd1]
mov qword [rsp + 0x48], rbp
mov r9d, 0x811c9dc5
mov ebp, 0x80
mov eax, 0x44
cmp esi, ebp
cmovl ebp, esi
add ebp, r8d
nop dword [rax + rax]
xor eax, r9d
lea rcx, [rcx + 1]
imul r9d, eax, 0x1000193
movzx eax, byte [rcx - 1]
test eax, eax
jne 0x140021ea0
mov dword [rsp + 0x28], eax
lea r8, str.D:BuildServerDwork_gitwowWoWSourceWowConnectionPacketPipe.cpp
movsxd rcx, ebp
lea edx, [rax + 3]
mov dword [rsp + 0x20], setsockopt
call fcn.140025e30
movsxd r8, dword [rdi + 0x10]
mov rbx, rax
mov rdx, qword [rdi]
lea rcx, [rax + rsi]
call fcn.1400bddc0
mov rcx, qword [rdi + 8]
lea rdx, str.D:BuildServerDwork_gitwowWoWSourceWowConnectionPacketPipe.cpp
xor r9d, r9d
lea r8d, [r9 + 0x16]
call fcn.140025f00
add dword [rdi + 0x10], esi
mov rax, rbx
sub ebp, dword [rdi + 0x10]
mov rsi, qword [rsp + 0x50]
mov dword [rdi + 0x18], ebp
mov rbp, qword [rsp + 0x48]
mov qword [rdi], rbx
mov qword [rdi + 8], rbx
mov rbx, qword [rsp + 0x40]
mov dword [rdi + 0x14], 0
add rsp, 0x30
pop rdi
ret

Function at 0x140022b60
Capabilities:
Send data
Send data on socket
Set socket configuration

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
sub rsp, 0x30
cmp qword [rdx + 0xa0], 0xffffffffffffffff
mov rbx, rdx
mov rsi, rcx
jne 0x140022bec
cmp byte [rdx + 0x221], 0
mov qword [rsp + 0x40], rdi
jne 0x140022bb3
mov rcx, qword [rbx + 0x98]
lea r9, [rsp + 0x48]
mov edx, 6
mov dword [rsp + 0x48], 1
mov dword [rsp + 0x20], 4
lea r8d, [rdx - 5]
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rcx, rbx
call fcn.14001d8b0
mov rax, qword [rbx + 0x98]
lea rdx, [rsp + 0x48]
xor r9d, r9d
mov qword [rbx + 0xa0], rax
mov rcx, qword [rsi + 0xcb8]
mov byte [rsp + 0x48], 1
lea r8d, [r9 + 1]
call qword [sym.imp.WS2_32.dll_send]
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rsi
ret

Function at 0x140022c00
Capabilities:
Send data
Send data on socket

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx + 0xcb8]
lea rdx, [rsp + 0x30]
xor r9d, r9d
mov byte [rsp + 0x30], 1
lea r8d, [r9 + 1]
call qword [sym.imp.WS2_32.dll_send]
add rsp, 0x28
ret
Function at 0x140022c90
Capabilities:
Initialize winsock library

Disassembly:
push rbx
sub rsp, 0x5d0
lea rbx, [rcx + 0xcb0]
mov qword [rbx], 0xffffffffffffffff
lea rdx, [rsp + 0x430]
mov qword [rcx + 0xcb8], 0xffffffffffffffff
mov byte [rcx + 0xcc0], 0
mov ecx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x140022d0b
mov edx, 0x400
lea rcx, [rsp + 0x30]
call fcn.1400d9ec0
lea rax, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, str._s:__s
lea rax, str.Unable_to_initialize_Winsock
xor edx, edx
mov ecx, 0x85100086
mov qword [rsp + 0x20], rax
call fcn.14002c760
mov rcx, rbx
call fcn.140020120
test al, al
jne 0x140022d52
mov edx, 0x400
lea rcx, [rsp + 0x30]
call fcn.1400d9ec0
lea rax, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, str._s:__s
lea rax, str.Unable_to_establish_signaling_pipe
xor edx, edx
mov ecx, 0x85100086
mov qword [rsp + 0x20], rax
call fcn.14002c760
add rsp, 0x5d0
pop rbx
ret

Function at 0x140022d60
Capabilities:
Send data
Send data on socket

Disassembly:
push rbx
sub rsp, 0x20
cmp qword [rdx + 0xa0], 0xffffffffffffffff
mov rbx, rcx
je 0x140022da4
mov rcx, rdx
mov qword [rdx + 0xa0], 0xffffffffffffffff
call fcn.140020880
mov rcx, qword [rbx + 0xcb8]
lea rdx, [rsp + 0x38]
xor r9d, r9d
mov byte [rsp + 0x38], 1
lea r8d, [r9 + 1]
call qword [sym.imp.WS2_32.dll_send]
add rsp, 0x20
pop rbx
ret
Function at 0x140023e10
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rbx, rcx
mov rsi, rdx
mov rcx, qword [rcx + 8]
cmp rdx, rcx
jae 0x140023e7d
mov rdi, qword [rbx]
lea rcx, [rcx*8]
lea rdx, [rcx + rdi]
lea rsi, [rdi + rsi*8]
cmp rsi, rdx
je 0x140023fbb
sub rdi, rdx
add rdi, rcx
mov rcx, rsi
and rdi, 0xfffffffffffffff8
mov r8, rdi
call fcn.1400bddc0
sub rdi, qword [rbx]
add rdi, rsi
sar rdi, 3
mov qword [rbx + 8], rdi
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
jbe 0x140023fbb
mov r8, qword [rbx + 0x10]
mov qword [rsp + 0x40], rbp
mov rax, r8
movabs rbp, 0x7fffffffffffffff
and rax, rbp
cmp rsi, rax
jbe 0x140023f92
movabs rcx, 0x3fffffffffffffff
mov rdx, r8
shr rdx, 1
mov r9d, 0x811c9dc5
and rdx, rcx
lea rcx, [0x140126671]
add rdx, rax
mov rax, r8
cmp rdx, rsi
cmovb rdx, rsi
xor rax, rdx
and rax, rbp
xor rax, r8
mov qword [rbx + 0x10], rax
movzx eax, byte [0x140126670]
test eax, eax
je 0x140023f06
nop word [rax + rax]
xor eax, r9d
lea rcx, [rcx + 1]
imul r9d, eax, 0x1000193
movzx eax, byte [rcx - 1]
test eax, eax
jne 0x140023ef0
lea rcx, [rdx*8]
mov dword [rsp + 0x28], 0
mov edx, ntohs
mov dword [rsp + 0x20], 0xfffffffa
lea r8, [0x140126670]
call fcn.140025e30
mov r10, qword [rbx]
mov rdi, rax
mov rcx, qword [rbx + 8]
mov r9, rax
lea r11, [r10 + rcx*8]
cmp r10, r11
je 0x140023f6a
nop word [rax + rax]
mov rcx, qword [r10]
add r10, 8
mov qword [r9], rcx
lea r9, [r9 + 8]
cmp r10, r11
jne 0x140023f50
mov r10, qword [rbx]
mov rcx, qword [rbx + 8]
cmp qword [rbx + 0x10], 0
jl 0x140023f8b
xor r9d, r9d
lea rdx, [0x140126670]
mov rcx, r10
lea r8d, [r9 - 6]
call fcn.140025f00
mov rcx, qword [rbx + 8]
and qword [rbx + 0x10], rbp
mov qword [rbx], rdi
mov rax, qword [rbx]
lea r8, [rsi*8]
xor edx, edx
lea rcx, [rax + rcx*8]
sub r8, rcx
add r8, rax
and r8, 0xfffffffffffffff8
call fcn.1400be550
mov rbp, qword [rsp + 0x40]
mov qword [rbx + 8], rsi
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x140024740
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov edi, 0x811c9dc5
lea r8, [0x1400dede1]
mov ebx, 0x44
mov r9d, edi
mov eax, ebx
mov rsi, rcx
nop dword [rax]
xor eax, r9d
lea r8, [r8 + 1]
imul r9d, eax, 0x1000193
movzx eax, byte [r8 - 1]
test eax, eax
jne 0x140024770
mov ecx, edx
lea r8, str.D:BuildServerDwork_gitwowWoWSourceWowServicesWebSocketConnection.cpp
lea edx, [rax + 3]
mov dword [rsp + 0x20], 0x22
call fcn.140025410
mov rbp, rax
mov qword [rsi], rax
lea rcx, [0x1400dcd61]
nop dword [rax]
xor ebx, edi
lea rcx, [rcx + 1]
imul edi, ebx, 0x1000193
movzx ebx, byte [rcx - 1]
test ebx, ebx
jne 0x1400247b0
mov r9d, edi
mov dword [rsp + 0x20], 0x261
lea r8, str.D:BuildServerDworkpackage_cache_blz3.11.14include_blzmem_shared_ptr.h
lea edx, [rbx + 0xb]
lea ecx, [rbx + 0x20]
call fcn.140025410
test rax, rax
je 0x140024808
lea rcx, [0x1400dee30]
mov dword [rax + 8], 1
mov qword [rax], rcx
mov dword [rax + 0xc], 1
mov qword [rax + 0x10], rbp
mov qword [rsi + 8], rax
jmp 0x140024810
mov qword [rsi + 8], 0
mov rbx, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x140026bd0
Capabilities:
Access peb ldr_data
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x170
mov r15, rcx
mov esi, r9d
lea rcx, [0x1401291e0]
mov rbp, r8
mov r14d, edx
call sub.KERNEL32.dll_GetLocalTime
call sub.KERNEL32.dll_GetCurrentProcessId
movzx r10d, word [0x1401291ec]
lea rcx, [0x1400df49c]
movzx r11d, word [0x1401291ea]
lea rdx, str._04d__02d__02d__02d._02d._02d__s____d._s
movzx ebx, word [0x1401291e8]
movzx edi, word [0x1401291e6]
movzx r9d, word [0x1401291e2]
movzx r8d, word [0x1401291e0]
mov qword [rsp + 0x50], rcx
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x48], eax
lea rax, str.exception_failed
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], r10d
mov dword [rsp + 0x30], r11d
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], edi
call fcn.140025310
lea r8, [rsp + 0x60]
mov edx, 0x208
lea rcx, [0x1401291f0]
call fcn.1400264c0
mov rax, qword gs:[0x58]
xor ebx, ebx
mov ecx, dword [0x1401d32c8]
mov r8d, 0x6220
mov rdx, qword [rax + rcx*8]
mov eax, dword [r8 + rdx]
cmp dword [0x140129400], eax
jg 0x140026da4
mov rcx, qword [0x1401293f8]
cmp rcx, 0xffffffffffffffff
je 0x140026d7d
lea r9, [0x140129404]
mov qword [rsp + 0x20], rbx
mov r8d, 0x18
lea rdx, str.Exception_handler_died_r_n
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [0x1401293f8]
lea r9, [0x140129404]
mov r8d, reloc.WS2_32.dll_setsockopt
mov qword [rsp + 0x20], rbx
lea rdx, str.Original_exception:_r_n
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [0x1401293f8]
lea r9, [0x140129404]
mov r8d, r14d
mov qword [rsp + 0x20], rbx
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [0x1401293f8]
lea r9, [0x140129404]
mov r8d, 2
mov qword [rsp + 0x20], rbx
lea rdx, [0x1400df950]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [0x1401293f8]
lea r9, [0x140129404]
mov r8d, esi
mov qword [rsp + 0x20], rbx
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [0x1401293f8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r11, [rsp + 0x170]
mov dword [0x140129074], 1
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
lea rcx, [0x140129400]
call fcn.1400bd364
cmp dword [0x140129400], 0xffffffff
jne 0x140026cb6
xor r9d, r9d
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x80
lea rcx, [0x1401291f0]
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
lea rcx, [0x140129400]
mov qword [0x1401293f8], rax
call fcn.1400bd304
jmp 0x140026cb6