joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004c060
Capabilities:
Hash data using fnv

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rax, qword [0x1403295b8]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], rdx
movzx eax, dl
movabs rbx, 0xcbf29ce484222325
xor rbx, rax
movabs rax, 0x100000001b3
imul rbx, rax
movzx edi, dh
xor rdi, rbx
imul rdi, rax
mov ebx, edx
shr ebx, 0x10
movzx ebx, bl
xor rbx, rdi
imul rbx, rax
mov edi, edx
shr edi, 0x18
xor rdi, rbx
imul rdi, rax
mov rbx, rdx
shr rbx, 0x20
movzx ebx, bl
xor rbx, rdi
imul rbx, rax
mov rdi, rdx
shr rdi, 0x28
movzx edi, dil
xor rdi, rbx
imul rdi, rax
mov rbx, rdx
shr rbx, 0x30
movzx esi, bl
xor rsi, rdi
imul rsi, rax
mov rbx, rdx
shr rbx, 0x38
xor rbx, rsi
imul rbx, rax
and rbx, qword [rcx + 0xe8]
mov rdi, qword [rcx + 0xd0]
mov rax, rbx
shl rax, 4
mov rax, qword [rdi + rax + 8]
cmp rax, qword [rcx + 0xc0]
je 0x14004c18b
mov r15, r8
cmp qword [rax + 0x10], rdx
je 0x14004c14f
add rbx, rbx
mov rbx, qword [rdi + rbx*8]
nop word [rax + rax]
cmp rax, rbx
je 0x14004c18b
mov rax, qword [rax + 8]
cmp qword [rax + 0x10], rdx
jne 0x14004c140
add rcx, 0xb8
lea rdx, [rsp + 0x28]
lea r8, [rsp + 0x20]
call fcn.14004d390
mov rbx, qword [rsp + 0x28]
lea rax, [rbx + 0x18]
mov rcx, qword [rbx + 0x18]
mov qword [r15], rcx
cmp rax, r15
je 0x14004c1ce
mov rdi, qword [rbx + 0x30]
cmp qword [rbx + 0x38], 0x10
jb 0x14004c18f
mov r9, qword [rbx + 0x20]
jmp 0x14004c193
xor esi, esi
jmp 0x14004c1d8
lea r9, [rbx + 0x20]
lea r14, [r15 + 8]
mov rax, qword [r15 + 0x20]
cmp rax, rdi
jae 0x14004c1ad
mov rcx, r14
mov rdx, rdi
call fcn.140007bd0
jmp 0x14004c1ce
cmp rax, 0x10
jb 0x14004c1b7
mov r14, qword [r15 + 8]
mov qword [r15 + 0x18], rdi
mov rcx, r14
mov rdx, r9
mov r8, rdi
call fcn.14021e3b0
mov byte [r14 + rdi], 0
mov eax, dword [rbx + 0x40]
mov dword [r15 + 0x28], eax
mov sil, 1
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140141380
mov eax, esi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x14004d1a0
Capabilities:
Hash data using fnv

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
movabs rax, 0x800000000000001
cmp rdx, rax
jae 0x14004d37e
mov r14, rcx
dec rdx
or rdx, 1
bsr rcx, rdx
xor ecx, 0x3f
neg cl
mov esi, 1
shl rsi, cl
lea rax, [r14 + 0x18]
mov r15, qword [r14 + 8]
mov edx, 2
shl rdx, cl
mov rcx, rax
mov r8, r15
call fcn.1400298f0
lea rax, [rsi - 1]
mov qword [r14 + 0x30], rax
mov qword [r14 + 0x38], rsi
mov rax, qword [r14 + 8]
mov r11, qword [rax]
cmp r11, r15
je 0x14004d372
movabs r10, 0x100000001b3
movabs r8, 0xcbf29ce484222325
jmp 0x14004d241
mov qword [rsi + r9*8], rdx
mov qword [rsi + rbx*8], rdx
cmp r11, r15
je 0x14004d372
mov rdx, r11
movzx eax, byte [r11 + 0x10]
xor rax, r8
imul rax, r10
movzx ecx, byte [r11 + 0x11]
xor rcx, rax
imul rcx, r10
movzx eax, byte [r11 + 0x12]
xor rax, rcx
imul rax, r10
movzx ecx, byte [r11 + 0x13]
xor rcx, rax
imul rcx, r10
movzx eax, byte [r11 + 0x14]
xor rax, rcx
imul rax, r10
movzx ecx, byte [r11 + 0x15]
xor rcx, rax
imul rcx, r10
movzx eax, byte [r11 + 0x16]
xor rax, rcx
imul rax, r10
movzx ecx, byte [r11 + 0x17]
xor rcx, rax
imul rcx, r10
and rcx, qword [r14 + 0x30]
mov r11, qword [r11]
mov rsi, qword [r14 + 0x18]
lea r9, [rcx + rcx]
lea rbx, [rcx + rcx]
inc rbx
shl rcx, 4
mov rdi, qword [rsi + rcx]
cmp rdi, r15
je 0x14004d230
mov rax, qword [rsi + rbx*8]
mov rcx, qword [rdx + 0x10]
cmp rcx, qword [rax + 0x10]
jne 0x14004d310
mov rax, qword [rax]
cmp rax, rdx
je 0x14004d234
mov r9, qword [rdx + 8]
mov qword [r9], r11
mov rdi, qword [r11 + 8]
mov qword [rdi], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rdx
mov qword [rax + 8], rdi
mov qword [r11 + 8], r9
mov qword [rdx + 8], rcx
jmp 0x14004d234
cmp rdi, rax
je 0x14004d348
mov rax, qword [rax + 8]
cmp rcx, qword [rax + 0x10]
jne 0x14004d310
mov rax, qword [rax]
mov rcx, qword [rdx + 8]
mov qword [rcx], r11
mov rbx, qword [r11 + 8]
mov qword [rbx], rax
mov rdi, qword [rax + 8]
mov qword [rdi], rdx
mov qword [rax + 8], rbx
mov qword [r11 + 8], rcx
mov qword [rdx + 8], rdi
jmp 0x14004d238
mov rax, qword [rdx + 8]
mov qword [rax], r11
mov rcx, qword [r11 + 8]
mov qword [rcx], rdi
mov rbx, qword [rdi + 8]
mov qword [rbx], rdx
mov qword [rdi + 8], rcx
mov qword [r11 + 8], rax
mov qword [rdx + 8], rbx
mov qword [rsi + r9*8], rdx
jmp 0x14004d238
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
lea rcx, str.invalid_hash_bucket_count
call fcn.1401438a8
int3
Function at 0x14004d780
Capabilities:
Write file on windows

Disassembly:
push rsi
sub rsp, 0xb0
mov rax, qword [0x1403295b8]
xor rax, rsp
mov qword [rsp + 0xa8], rax
cmp qword [0x14032b2c0], 0
je 0x14004d81f
mov r9d, ecx
xorps xmm0, xmm0
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0xa0], 0
lea r8, str.km.left__d__r
lea rsi, [rsp + 0x30]
mov edx, pe_nt_image_headers64
mov rcx, rsi
call fcn.140005bb0
mov rcx, rsi
call fcn.14023e390
mov rcx, qword [0x14032b2c0]
mov qword [rsp + 0x20], 0
mov rdx, rsi
mov r8d, eax
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.140141380
nop
add rsp, 0xb0
pop rsi
ret
Function at 0x14004e210
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
sub rsp, 0xb8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x30], 0xfffffffffffffffe
mov qword [rbp + 0x28], rdx
mov rax, qword [rdx]
cmp dword [rax + 0x120], 8
jne 0x14004e382
cmp dword [rax + 0x1a4], 0x1021e357
je 0x14004e382
cmp qword [rax + 0x1a8], 0
je 0x14004e382
mov rdx, qword [rax + 0x78]
test rdx, rdx
je 0x14004e382
cmp qword [rdx + 8], 0
je 0x14004e382
cmp dword [rdx + 0x18], 0
jne 0x14004e382
mov edx, dword [rdx + 0x1c]
dec edx
cmp edx, 0x63
ja 0x14004e382
movzx r9d, byte [rcx + 0x80]
movzx ecx, byte [rcx + 0x83]
mov edx, r9d
or dl, cl
jne 0x14004e2c7
mov edx, 0x7543f30
add rdx, qword [rax + 0x10]
lea rax, [0x140321e08]
mov rcx, r8
mov r8, rax
mov r9d, 4
call fcn.140258730
jmp 0x14004e382
test r9b, r9b
je 0x14004e350
cmp qword [0x14032b2c0], 0
je 0x14004e343
xorps xmm0, xmm0
movaps xmmword [rbp + 0x10], xmm0
movaps xmmword [rbp], xmm0
movaps xmmword [rbp - 0x10], xmm0
movaps xmmword [rbp - 0x20], xmm0
movaps xmmword [rbp - 0x30], xmm0
movaps xmmword [rbp - 0x40], xmm0
movaps xmmword [rbp - 0x50], xmm0
mov qword [rbp + 0x20], 0
lea r8, str.km.left__d__r
lea rsi, [rbp - 0x50]
mov edx, pe_nt_image_headers64
mov rcx, rsi
xor r9d, r9d
call fcn.140005bb0
mov rcx, rsi
call fcn.14023e390
mov rcx, qword [0x14032b2c0]
mov qword [rsp + 0x20], 0
mov rdx, rsi
mov r8d, eax
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14004e382
test cl, cl
je 0x14004e382
mov ecx, 1
call fcn.1400eb9a0
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call fcn.1400eb1b0
mov ecx, 3
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call fcn.1400eb9a0
mov rax, qword [rbp + 0x28]
mov rsi, qword [rax + 8]
test rsi, rsi
je 0x14004e3ac
lock dec dword [rsi + 8]
jne 0x14004e3ac
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax]
lock dec dword [rsi + 0xc]
jne 0x14004e3ac
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + reloc.WS2_32.dll_htonl]
nop
add rsp, 0xb8
pop rsi
pop rbp
ret
Function at 0x14004e3f0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
sub rsp, 0xb8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x30], 0xfffffffffffffffe
mov qword [rbp + 0x28], rdx
mov rax, qword [rdx]
cmp dword [rax + 0x120], 8
jne 0x14004e557
cmp dword [rax + 0x1a4], 0x1021e357
je 0x14004e557
cmp qword [rax + 0x1a8], 0
je 0x14004e557
mov rdx, qword [rax + 0x78]
test rdx, rdx
je 0x14004e557
cmp qword [rdx + 8], 0
je 0x14004e557
cmp dword [rdx + 0x18], 0
jne 0x14004e557
mov edx, dword [rdx + 0x1c]
dec edx
cmp edx, 0x63
ja 0x14004e557
movzx r9d, byte [rcx + 0x80]
movzx ecx, byte [rcx + 0x83]
mov edx, r9d
or dl, cl
jne 0x14004e4a7
mov edx, 0x7543f90
add rdx, qword [rax + 0x10]
lea rax, reloc.WS2_32.dll_getsockname
mov rcx, r8
mov r8, rax
mov r9d, 4
call fcn.140258730
jmp 0x14004e557
test r9b, r9b
je 0x14004e534
cmp qword [0x14032b2c0], 0
je 0x14004e527
xorps xmm0, xmm0
movaps xmmword [rbp + 0x10], xmm0
movaps xmmword [rbp], xmm0
movaps xmmword [rbp - 0x10], xmm0
movaps xmmword [rbp - 0x20], xmm0
movaps xmmword [rbp - 0x30], xmm0
movaps xmmword [rbp - 0x40], xmm0
movaps xmmword [rbp - 0x50], xmm0
mov qword [rbp + 0x20], 0
lea r8, str.km.press__s__r
lea r9, [0x1402d69fa]
lea rsi, [rbp - 0x50]
mov edx, pe_nt_image_headers64
mov rcx, rsi
call fcn.140005bb0
mov rcx, rsi
call fcn.14023e390
mov rcx, qword [0x14032b2c0]
mov qword [rsp + 0x20], 0
mov rdx, rsi
mov r8d, eax
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14004e557
test cl, cl
je 0x14004e557
mov ecx, reloc.WS2_32.dll_setsockopt
call fcn.1400eb300
mov ecx, 3
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, reloc.WS2_32.dll_setsockopt
call fcn.1400eb6b0
mov rax, qword [rbp + 0x28]
mov rsi, qword [rax + 8]
test rsi, rsi
je 0x14004e581
lock dec dword [rsi + 8]
jne 0x14004e581
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax]
lock dec dword [rsi + 0xc]
jne 0x14004e581
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + reloc.WS2_32.dll_htonl]
nop
add rsp, 0xb8
pop rsi
pop rbp
ret
Function at 0x14004e5c0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
sub rsp, 0xc8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x40], 0xfffffffffffffffe
mov dword [rbp + 0x3c], r9d
mov qword [rbp + 0x30], rdx
mov rax, qword [rdx]
cmp dword [rax + 0x120], 8
jne 0x14004e767
cmp dword [rax + 0x1a4], 0x1021e357
je 0x14004e767
cmp qword [rax + 0x1a8], 0
je 0x14004e767
mov rdx, qword [rax + 0x78]
test rdx, rdx
je 0x14004e767
cmp qword [rdx + 8], 0
je 0x14004e767
cmp dword [rdx + 0x18], 0
jne 0x14004e767
mov edx, dword [rdx + 0x1c]
dec edx
cmp edx, 0x63
ja 0x14004e767
movzx r10d, byte [rcx + 0x80]
movzx r9d, byte [rcx + 0x83]
mov edx, r10d
or dl, r9b
jne 0x14004e67a
mov edx, 0x7544020
add rdx, qword [rax + 0x10]
lea rax, [rbp + 0x3c]
mov rcx, r8
mov r8, rax
mov r9d, 4
call fcn.140258730
jmp 0x14004e767
movsd xmm0, qword [rcx + 0x78]
xorpd xmm1, xmm1
ucomisd xmm0, xmm1
jne 0x14004e68b
jnp 0x14004e6a4
movsd xmm1, qword [rax + 0x1b8]
subsd xmm1, xmm0
ucomisd xmm1, qword [0x14025e2d0]
setae al
jmp 0x14004e6a6
mov al, 1
test r10b, r10b
je 0x14004e743
test al, al
je 0x14004e743
cmp qword [0x14032b2c0], 0
je 0x14004e736
xorpd xmm0, xmm0
movapd xmmword [rbp + 0x10], xmm0
movapd xmmword [rbp], xmm0
movapd xmmword [rbp - 0x10], xmm0
movapd xmmword [rbp - 0x20], xmm0
movapd xmmword [rbp - 0x30], xmm0
movapd xmmword [rbp - 0x40], xmm0
movapd xmmword [rbp - 0x50], xmm0
mov qword [rbp + 0x20], 0
lea r8, str.km.press__s__r
lea r9, [0x1402d83a4]
lea rsi, [rbp - 0x50]
mov edx, pe_nt_image_headers64
mov rcx, rsi
call fcn.140005bb0
mov rcx, rsi
call fcn.14023e390
mov rcx, qword [0x14032b2c0]
mov qword [rsp + 0x20], 0
mov rdx, rsi
mov r8d, eax
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14004e767
test r9b, r9b
je 0x14004e767
mov ecx, Ordinal_46
call fcn.1400eb300
mov ecx, 3
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, Ordinal_46
call fcn.1400eb6b0
mov rax, qword [rbp + 0x30]
mov rsi, qword [rax + 8]
test rsi, rsi
je 0x14004e791
lock dec dword [rsi + 8]
jne 0x14004e791
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax]
lock dec dword [rsi + 0xc]
jne 0x14004e791
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + reloc.WS2_32.dll_htonl]
nop
add rsp, 0xc8
pop rsi
pop rbp
ret
Function at 0x14004e7d0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0xd8
lea rbp, [rsp + 0x80]
movapd xmmword [rbp + 0x40], xmm6
mov qword [rbp + 0x38], 0xfffffffffffffffe
mov rsi, rcx
mov rdi, qword [rdx]
movsd xmm1, qword [rcx + 0x68]
xorpd xmm6, xmm6
ucomisd xmm1, xmm6
jne 0x14004e80b
jnp 0x14004e900
movzx ebx, byte [rsi + 0x80]
movzx eax, byte [rsi + 0x83]
mov ecx, ebx
or cl, al
je 0x14004e900
movsd xmm0, qword [rdi + 0x1b8]
movapd xmm2, xmm0
subsd xmm2, xmm1
test bl, bl
je 0x14004e8ce
ucomisd xmm2, qword [0x14025e2d0]
jb 0x14004e8ce
cmp qword [0x14032b2c0], 0
je 0x14004e8f3
mov qword [rbp + 0x30], rdx
xorpd xmm0, xmm0
movapd xmmword [rbp + 0x10], xmm0
movapd xmmword [rbp], xmm0
movapd xmmword [rbp - 0x10], xmm0
movapd xmmword [rbp - 0x20], xmm0
movapd xmmword [rbp - 0x30], xmm0
movapd xmmword [rbp - 0x40], xmm0
movapd xmmword [rbp - 0x50], xmm0
mov qword [rbp + 0x20], 0
lea r8, str.km.left__d__r
lea rbx, [rbp - 0x50]
mov edx, pe_nt_image_headers64
mov rcx, rbx
xor r9d, r9d
call fcn.140005bb0
mov rcx, rbx
call fcn.14023e390
mov rcx, qword [0x14032b2c0]
mov qword [rsp + 0x20], 0
mov rdx, rbx
mov r8d, eax
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x14004e8e7
test al, al
je 0x14004e900
ucomisd xmm2, qword [0x14025e2d8]
jb 0x14004e900
mov qword [rbp + 0x30], rdx
xor ecx, ecx
call fcn.1400eb1b0
movsd xmm0, qword [rdi + 0x1b8]
mov rdx, qword [rbp + 0x30]
movsd qword [rsi + 0x70], xmm0
mov qword [rsi + 0x68], 0
movsd xmm1, qword [rsi + 0x70]
ucomisd xmm1, xmm6
jne 0x14004e90d
jnp 0x14004e94b
movsd xmm0, qword [rdi + 0x1b8]
subsd xmm0, xmm1
cmp byte [rsi + 0x80], 0
je 0x14004e92c
ucomisd xmm0, qword [0x14025e2d0]
jae 0x14004e93f
cmp byte [rsi + 0x83], 0
je 0x14004e94b
ucomisd xmm0, qword [0x14025e2d8]
jb 0x14004e94b
add rsi, 0x68
xorpd xmm0, xmm0
movupd xmmword [rsi], xmm0
mov rsi, qword [rdx + 8]
test rsi, rsi
je 0x14004e971
lock dec dword [rsi + 8]
jne 0x14004e971
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax]
lock dec dword [rsi + 0xc]
jne 0x14004e971
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + reloc.WS2_32.dll_htonl]
movaps xmm6, xmmword [rbp + 0x40]
add rsp, 0xd8
pop rbx
pop rdi
pop rsi
pop rbp
ret
Function at 0x140051400
Capabilities:
Hash data using fnv

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x40]
mov qword [rbp], 0xfffffffffffffffe
mov qword [rbp - 8], r9
mov r12, r8
mov r14, rdx
mov r15, rcx
mov r13, qword [rbp + 0x70]
mov eax, dword [r8]
test rax, rax
je 0x1400514e0
mov rdx, rax
shr rdx, 0x18
mov ecx, eax
shr ecx, 0x10
movzx ebx, cl
movzx esi, ah
movzx edi, al
movabs rcx, 0xcbf29ce484222325
xor rcx, rdi
movabs rdi, 0x100000001b3
imul rcx, rdi
xor rcx, rsi
imul rcx, rdi
xor rcx, rbx
imul rcx, rdi
xor rcx, rdx
imul rcx, rdi
and rcx, qword [r13 + 0x30]
mov rbx, qword [r13 + 0x18]
mov rdx, rcx
shl rdx, 4
mov rdx, qword [rbx + rdx + 8]
cmp rdx, qword [r13 + 8]
je 0x1400514c0
cmp eax, dword [rdx + 0x10]
je 0x1400514e0
add rcx, rcx
mov rcx, qword [rbx + rcx*8]
nop word cs:[rax + rax]
cmp rdx, rcx
je 0x1400514c0
mov rdx, qword [rdx + 8]
cmp eax, dword [rdx + 0x10]
jne 0x1400514b0
jmp 0x1400514e0
lea rdx, [rbp - 0x20]
mov rcx, r13
mov r8, r12
call fcn.140044360
mov rcx, qword [rbp - 0x20]
add rcx, 0x18
mov rdx, qword [rbp - 8]
call fcn.140047ed0
xorps xmm0, xmm0
movaps xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], 0
mov rsi, qword [r13 + 8]
lea rdi, [rbp - 0x20]
mov rbx, rsi
jmp 0x14005150a
mov eax, dword [r8]
mov dword [rdx], eax
add qword [rbp - 0x18], 4
mov rbx, qword [rbx]
cmp rbx, rsi
je 0x14005152a
lea r8, [rbx + 0x10]
mov rdx, qword [rbp - 0x18]
cmp rdx, qword [rbp - 0x10]
jne 0x140051500
mov rcx, rdi
call fcn.14002f8b0
jmp 0x14005150a
mov rcx, r15
mov rdx, r14
mov r8, r12
call fcn.1400507b0
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x14005156e
mov rdx, qword [rbp - 0x10]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x140051569
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x140051589
add rdx, 0x27
mov rcx, rax
call fcn.140141034
mov rcx, qword [rbp - 8]
call fcn.14000ddf0
nop
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call fcn.140231990
int3

Function at 0x140051610
Capabilities:
Hash data using fnv

Disassembly:
movzx r8d, byte [rdx]
movabs rax, 0xcbf29ce484222325
xor rax, r8
movabs r9, 0x100000001b3
imul rax, r9
movzx r8d, byte [rdx + 1]
xor r8, rax
imul r8, r9
movzx eax, byte [rdx + 2]
xor rax, r8
imul rax, r9
movzx r8d, byte [rdx + 3]
xor r8, rax
imul r8, r9
and r8, qword [rcx + 0x30]
mov r9, qword [rcx + 0x18]
mov rax, r8
shl rax, 4
mov rax, qword [r9 + rax + 8]
cmp rax, qword [rcx + 8]
je 0x140051690
mov ecx, dword [rdx]
cmp ecx, dword [rax + 0x10]
je 0x140051692
add r8, r8
mov rdx, qword [r9 + r8*8]
nop word [rax + rax]
cmp rax, rdx
je 0x140051690
mov rax, qword [rax + 8]
cmp ecx, dword [rax + 0x10]
jne 0x140051680
jmp 0x140051692
xor eax, eax
test rax, rax
setne al
ret
Function at 0x140051ac0
Capabilities:
Hash data using fnv

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x40]
mov qword [rbp], 0xfffffffffffffffe
mov r13, r8
mov r14, rdx
mov r12, rcx
mov r15, qword [rbp + 0x70]
mov eax, dword [r8]
test rax, rax
je 0x140051b9d
mov rdx, rax
shr rdx, 0x18
mov ecx, eax
shr ecx, 0x10
movzx ebx, cl
movzx esi, ah
movzx edi, al
movabs rcx, 0xcbf29ce484222325
xor rcx, rdi
movabs rdi, 0x100000001b3
imul rcx, rdi
xor rcx, rsi
imul rcx, rdi
xor rcx, rbx
imul rcx, rdi
xor rcx, rdx
imul rcx, rdi
and rcx, qword [r15 + 0x30]
mov rbx, qword [r15 + 0x18]
mov rdx, rcx
shl rdx, 4
mov rdx, qword [rbx + rdx + 8]
cmp rdx, qword [r15 + 8]
je 0x140051b80
cmp eax, dword [rdx + 0x10]
je 0x140051b9d
add rcx, rcx
mov rcx, qword [rbx + rcx*8]
nop word cs:[rax + rax]
cmp rdx, rcx
je 0x140051b80
mov rdx, qword [rdx + 8]
cmp eax, dword [rdx + 0x10]
jne 0x140051b70
jmp 0x140051b9d
lea rdx, [rbp - 0x20]
mov rcx, r15
mov r8, r13
mov rsi, r9
call fcn.140044b60
mov rax, qword [rbp - 0x20]
movups xmm0, xmmword [rsi]
movups xmmword [rax + 0x14], xmm0
xorps xmm0, xmm0
movaps xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], 0
mov rsi, qword [r15 + 8]
lea rdi, [rbp - 0x20]
mov rbx, rsi
jmp 0x140051bca
mov eax, dword [r8]
mov dword [rdx], eax
add qword [rbp - 0x18], 4
mov rbx, qword [rbx]
cmp rbx, rsi
je 0x140051bea
lea r8, [rbx + 0x10]
mov rdx, qword [rbp - 0x18]
cmp rdx, qword [rbp - 0x10]
jne 0x140051bc0
mov rcx, rdi
call fcn.14002f8b0
jmp 0x140051bca
mov rcx, r12
mov rdx, r14
mov r8, r13
call fcn.1400507b0
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x140051c2e
mov rdx, qword [rbp - 0x10]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x140051c29
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x140051c40
add rdx, 0x27
mov rcx, rax
call fcn.140141034
nop
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call fcn.140231990
int3
Function at 0x140056830
Capabilities:
Create thread

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x40]
mov qword [rbp], 0xfffffffffffffffe
mov r13, r9
mov rbx, r8
mov r14, rdx
mov rsi, rcx
mov r15, qword [rbp + 0x70]
mov r12, qword [rbp + 0x78]
mov ecx, Ordinal_41
call fcn.140140ff0
mov rdi, rax
mov qword [rax], r12
mov qword [rax + 8], r15
mov qword [rax + 0x10], r13
mov rax, qword [rbx]
mov qword [rdi + 0x18], rax
mov rax, qword [r14]
mov qword [rdi + 0x20], rax
lea rbx, [rsi + 8]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0
lea r8, [0x14005aa80]
xor ecx, ecx
xor edx, edx
mov r9, rdi
call fcn.14022d310
mov qword [rsi], rax
test rax, rax
je 0x1400568c7
mov rax, rsi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov qword [rbp - 8], rdi
mov dword [rbx], 0
mov ecx, 6
call fcn.1401435a8
int3

Function at 0x140056990
Capabilities:
Create thread

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rdi, r8
mov r14, rdx
mov rsi, rcx
mov ecx, reloc.WS2_32.dll_recv
call fcn.140140ff0
mov rbx, rax
mov rax, qword [rdi]
mov qword [rbx], rax
mov rax, qword [r14]
mov qword [rbx + 8], rax
lea rdi, [rsi + 8]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0
lea r8, [0x14005aae0]
xor ecx, ecx
xor edx, edx
mov r9, rbx
call fcn.14022d310
mov qword [rsi], rax
test rax, rax
je 0x140056a04
mov rax, rsi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
mov qword [rbp - 0x10], rbx
mov dword [rdi], 0
mov ecx, 6
call fcn.1401435a8
int3
Function at 0x14005f250
Capabilities:
Hash data using fnv

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp], 0xfffffffffffffffe
mov r14, rcx
mov rax, qword [rdx]
movzx ecx, byte [r8 + 0x10]
movabs rdi, 0xcbf29ce484222325
xor rdi, rcx
movabs rcx, 0x100000001b3
imul rdi, rcx
movzx ebx, byte [r8 + 0x11]
xor rbx, rdi
imul rbx, rcx
movzx esi, byte [r8 + 0x12]
xor rsi, rbx
imul rsi, rcx
movzx edi, byte [r8 + 0x13]
xor rdi, rsi
imul rdi, rcx
and rdi, qword [rax + 0x68]
mov rbx, qword [rax + 0x50]
mov rcx, rdi
shl rcx, 4
mov rcx, qword [rbx + rcx + 8]
cmp rcx, qword [rax + 0x40]
je 0x14005f452
mov r15, r8
mov eax, dword [r8 + 0x10]
cmp eax, dword [rcx + 0x10]
je 0x14005f302
add rdi, rdi
mov rbx, qword [rbx + rdi*8]
nop word cs:[rax + rax]
cmp rcx, rbx
je 0x14005f452
mov rcx, qword [rcx + 8]
cmp eax, dword [rcx + 0x10]
jne 0x14005f2f0
mov qword [rbp - 8], rdx
mov dword [rsp + 0x20], 0
lea r8, vtable.type_info.0
lea r9, vtable.type_info.0
mov rcx, r15
xor edx, edx
call fcn.14021d988
mov rbx, rax
test rax, rax
je 0x14005f371
xor esi, esi
cmp qword [rbx + 8], 0
je 0x14005f3c2
cmp dword [rbx + 0x20], 0
mov rdx, qword [rbp - 8]
jne 0x14005f454
mov eax, dword [rbx + 0x24]
dec eax
cmp eax, 0x63
ja 0x14005f452
cmp byte [r14 + 0x12], 0
je 0x14005f3cb
cmp byte [r14 + 0x11], 0
je 0x14005f445
mov sil, 1
jmp 0x14005f454
mov dword [rsp + 0x20], 0
lea r8, vtable.type_info.0
lea r9, vtable.type_info.0
mov rcx, r15
xor edx, edx
call fcn.14021d988
xor esi, esi
test rax, rax
je 0x14005f3c2
cmp qword [rax + 8], 0
mov rdx, qword [rbp - 8]
je 0x14005f454
cmp dword [rax + 0x20], 0
jne 0x14005f454
mov eax, dword [rax + 0x24]
dec eax
cmp eax, 0x64
setb sil
jmp 0x14005f454
mov rdx, qword [rbp - 8]
jmp 0x14005f454
test r15, r15
je 0x14005f35e
mov rsi, qword [rdx]
cmp dword [rsi + 0x218], 0
je 0x14005f35e
mov dword [rsp + 0x20], 0
lea r8, vtable.type_info.0
lea r9, vtable.type_info.0
mov rcx, r15
xor edx, edx
call fcn.14021d988
test rax, rax
mov rdx, qword [rbp - 8]
je 0x14005f35e
cmp qword [rsi + 0x240], 0
je 0x14005f489
mov ecx, dword [rsi + 0x2c8]
cmp ecx, 0xbeae5e70
je 0x14005f431
cmp ecx, 0x5e38c54d
je 0x14005f431
cmp ecx, 0xd5d9a936
jne 0x14005f489
mov ecx, dword [rsi + 0x218]
xor ecx, dword [rax + 0x28]
test cl, 1
jne 0x14005f35e
jmp 0x14005f452
cmp dword [rbx + 0x108], 0
je 0x14005f369
xor esi, esi
mov rdi, qword [rdx + 8]
test rdi, rdi
je 0x14005f47a
lock dec dword [rdi + 8]
jne 0x14005f47a
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax]
lock dec dword [rdi + 0xc]
jne 0x14005f47a
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.WS2_32.dll_htonl]
mov eax, esi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
mov eax, dword [rax + 0x28]
cmp eax, dword [rsi + 0x218]
jne 0x14005f35e
jmp 0x14005f452
Function at 0x140064a90
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rbx, rcx
mov rax, qword [0x1403295b8]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov esi, dword [rcx + 0x60]
lea r8, [rdx + 0x8c]
lea rcx, [rdx + 0xc]
xor eax, eax
cmp esi, 2
setne r9b
cmove r8, rcx
test esi, esi
je 0x140064b77
mov al, r9b
shl rax, 7
or rax, 0xc
movzx ecx, byte [rdx + rax]
movabs rsi, 0xcbf29ce484222325
xor rsi, rcx
movabs r9, 0x100000001b3
imul rsi, r9
movzx ecx, byte [r8 + 1]
xor rcx, rsi
imul rcx, r9
movzx edi, byte [r8 + 2]
xor rdi, rcx
imul rdi, r9
movzx esi, byte [r8 + 3]
xor rsi, rdi
imul rsi, r9
and rsi, qword [rbx + 0x40]
mov r9, qword [rbx + 0x28]
mov rcx, rsi
shl rcx, 4
mov rcx, qword [r9 + rcx + 8]
cmp rcx, qword [rbx + 0x18]
je 0x140064b77
mov eax, dword [rdx + rax]
cmp eax, dword [rcx + 0x10]
je 0x140064b5e
add rsi, rsi
mov rdx, qword [r9 + rsi*8]
nop word cs:[rax + rax]
cmp rcx, rdx
je 0x140064b77
mov rcx, qword [rcx + 8]
cmp eax, dword [rcx + 0x10]
jne 0x140064b50
lea rcx, [rbx + 0x10]
lea rdx, [rsp + 0x28]
call fcn.140044b60
mov rax, qword [rsp + 0x28]
movups xmm0, xmmword [rax + 0x14]
jmp 0x140064b7a
movups xmm0, xmmword [rbx]
movups xmmword [rbx + 0x50], xmm0
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140141380
nop
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret