joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400395d0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x140039600
imul rax, rax, 0x64
jmp 0x14003961e
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
imul rcx, rcx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
movabs rcx, 0x7fffffffc46535ff
cmp rax, rcx
jge 0x140039635
add rax, 0x3b9aca00
jmp 0x14003963f
movabs rax, 0x7fffffffffffffff
lea rcx, [rbp + 0x10]
mov qword [rbp + 0x10], rax
call fcn.1400704e0
mov rbx, qword [0x14019fcf8]
xor edi, edi
xorps xmm0, xmm0
mov word [rbp - 0x2e], di
xor ecx, ecx
mov dword [rbp - 0x18], edi
movdqu xmmword [rbp - 0x3e], xmm0
movzx eax, byte [rbx + 0x6480]
lea edx, [rdi + 0x41]
lea r8d, [rdi + 1]
mov byte [rbp - 0x3f], al
movdqu xmmword [rbp - 0x28], xmm0
mov qword [rbp - 0xc], rdi
mov byte [rbp - 0x40], 3
mov dword [rbp - 0x2c], 0x4fc
mov dword [rbp - 0x14], 0x63
mov dword [rbp - 0x10], Ordinal_60
call fcn.140009d00
movups xmm0, xmmword [rbp - 0x40]
mov edx, dword [rbp - 8]
xor ecx, ecx
movups xmm1, xmmword [rbp - 0x30]
mov r8, qword [rax + 0x10]
mov dword [r8], 4
movups xmmword [r8 + 4], xmm0
movups xmm0, xmmword [rbp - 0x20]
movups xmmword [r8 + 0x14], xmm1
movsd xmm1, qword [rbp - 0x10]
movups xmmword [r8 + 0x24], xmm0
movsd qword [r8 + 0x34], xmm1
mov dword [r8 + 0x3c], edx
mov rdx, rax
mov byte [r8 + 0x40], cl
mov r8b, 1
mov rcx, rbx
call fcn.140098680
mov rbx, qword [0x14019fcf8]
lea edx, [rdi + 0x41]
xorps xmm0, xmm0
mov word [rbp - 0x2e], di
lea r8d, [rdi + 1]
mov dword [rbp - 0x18], edi
xor ecx, ecx
mov qword [rbp - 0xc], rdi
movzx eax, byte [rbx + 0x6480]
mov byte [rbp - 0x3f], al
movdqu xmmword [rbp - 0x3e], xmm0
mov byte [rbp - 0x40], 8
movdqu xmmword [rbp - 0x28], xmm0
mov dword [rbp - 0x2c], 0x4fc
mov dword [rbp - 0x14], 0x63
mov dword [rbp - 0x10], Ordinal_60
call fcn.140009d00
movups xmm0, xmmword [rbp - 0x40]
mov edx, dword [rbp - 8]
xor ecx, ecx
movups xmm1, xmmword [rbp - 0x30]
mov r8, qword [rax + 0x10]
mov dword [r8], 4
movups xmmword [r8 + 4], xmm0
movups xmm0, xmmword [rbp - 0x20]
movups xmmword [r8 + 0x14], xmm1
movsd xmm1, qword [rbp - 0x10]
movups xmmword [r8 + 0x24], xmm0
movsd qword [r8 + 0x34], xmm1
mov dword [r8 + 0x3c], edx
mov rdx, rax
mov byte [r8 + 0x40], cl
mov r8b, 1
mov rcx, rbx
mov rbx, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
add rsp, 0x60
pop rbp
jmp fcn.140098680
Function at 0x1400397a0
Capabilities:
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x80
mov rbx, qword [0x14019fcf8]
xor eax, eax
mov qword [rsp + 0x21], rax
mov edx, 0x41
mov word [rsp + 0x29], ax
xor ecx, ecx
mov byte [rsp + 0x2b], al
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x40], rax
lea r8d, [rdx - 0x40]
mov dword [rsp + 0x48], eax
mov qword [rsp + 0x54], rax
mov byte [rsp + 0x20], al
cvttss2si rax, dword [rbx + 0x6488]
mov dword [rsp + 0x34], 0x336
movaps xmmword [rsp + 0x70], xmm6
movaps xmm6, xmm0
mov dword [rsp + 0x4c], eax
cvttss2si rax, dword [rbx + 0x648c]
movaps xmmword [rsp + 0x60], xmm7
movaps xmm7, xmm1
mov dword [rsp + 0x50], eax
mov eax, dword [reloc.WLDAP32.dll_Ordinal_32]
mov dword [rsp + 0x2c], eax
call fcn.140009d00
movups xmm0, xmmword [rsp + 0x20]
mov r9, rax
xor r8d, r8d
movups xmm1, xmmword [rsp + 0x30]
mov rdx, qword [rax + 0x10]
mov rcx, rbx
mov eax, dword [rsp + 0x58]
shufps xmm1, xmm1, 0xd2
movss xmm1, xmm6
mov dword [rdx], 4
movups xmmword [rdx + 4], xmm0
movups xmm0, xmmword [rsp + 0x40]
shufps xmm1, xmm1, 0x27
movss xmm1, xmm7
shufps xmm1, xmm1, 0x39
movups xmmword [rdx + 0x14], xmm1
movsd xmm1, qword [rsp + 0x50]
movups xmmword [rdx + 0x24], xmm0
movsd qword [rdx + 0x34], xmm1
mov dword [rdx + 0x3c], eax
xor eax, eax
mov byte [rdx + 0x40], al
mov rdx, r9
movaps xmm6, xmmword [rsp + 0x70]
movaps xmm7, xmmword [rsp + 0x60]
add rsp, 0x80
pop rbx
jmp fcn.140098680

Function at 0x1400398a0
Capabilities:
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x60
mov rbx, qword [0x14019fcf8]
xor eax, eax
xorps xmm0, xmm0
mov word [rsp + 0x32], ax
mov edx, 0x41
mov dword [rsp + 0x48], eax
mov qword [rsp + 0x54], rax
xor ecx, ecx
movzx eax, byte [rbx + 0x6480]
mov byte [rsp + 0x21], al
lea r8d, [rdx - 0x40]
mov byte [rsp + 0x20], 3
movdqu xmmword [rsp + 0x22], xmm0
mov dword [rsp + 0x34], 8
movdqu xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x4c], 0x63
mov dword [rsp + 0x50], Ordinal_60
call fcn.140009d00
movups xmm0, xmmword [rsp + 0x20]
mov edx, dword [rsp + 0x58]
xor ecx, ecx
movups xmm1, xmmword [rsp + 0x30]
mov r8, qword [rax + 0x10]
mov dword [r8], 4
movups xmmword [r8 + 4], xmm0
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [r8 + 0x14], xmm1
movsd xmm1, qword [rsp + 0x50]
movups xmmword [r8 + 0x24], xmm0
movsd qword [r8 + 0x34], xmm1
mov dword [r8 + 0x3c], edx
mov rdx, rax
mov byte [r8 + 0x40], cl
mov r8b, 1
mov rcx, rbx
add rsp, 0x60
pop rbx
jmp fcn.140098680
Function at 0x140053fb0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x240
mov rax, qword [0x14015d460]
xor rax, rsp
mov qword [rsp + 0x230], rax
imul r8d, dword [rcx + 0x30], 0x64
movabs r10, 0x100000001b3
mov rsi, qword [0x14019fcf8]
xor edi, edi
add r8d, dword [rcx + 0x2c]
movabs rcx, 0xcbf29ce484222325
mov rbp, qword [rsi + 0x6518]
mov eax, r8d
shr eax, 8
movzx edx, al
movzx eax, r8b
xor rax, rcx
mov r9d, r8d
imul rax, r10
xor rdx, rax
mov eax, r8d
imul rdx, r10
shr eax, 0x10
movzx ecx, al
xor rdx, rcx
mov eax, r8d
mov rcx, qword [rsi + 0x6540]
imul rdx, r10
shr rax, 0x18
xor rdx, rax
mov rax, qword [rsi + 0x6528]
imul rdx, r10
and rcx, rdx
add rcx, rcx
mov rbx, qword [rax + rcx*8 + 8]
cmp rbx, rbp
je 0x140054081
mov rax, qword [rax + rcx*8]
cmp r9d, dword [rbx + 0x10]
je 0x140054084
nop word [rax + rax]
cmp rbx, rax
je 0x140054081
mov rbx, qword [rbx + 8]
cmp r8d, dword [rbx + 0x10]
jne 0x140054070
jmp 0x140054084
mov rbx, rdi
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
lea rdx, [rsi + 0x6408]
lea rcx, [rsp + 0x20]
call fcn.1400537c0
test rbx, rbx
mov r8d, pe_nt_image_headers64
mov edx, 0xffdd
cmove rbx, rbp
movzx ecx, word [rbx + 0x1e]
movzx eax, cx
sub ax, r8w
test dx, ax
jne 0x1400540d3
mov eax, 0xa2
cmp cx, ax
jne 0x1400540d7
movzx edi, r8w
lea rcx, [rsp + 0x1e8]
mov word [rbx + 0x1e], di
call fcn.140053f40
lea rcx, [rsp + 0x1a8]
call fcn.140053ed0
lea rcx, [rsp + 0x168]
call fcn.140053e50
lea rcx, [rsp + 0x128]
call fcn.140053dd0
lea rcx, [rsp + 0xd0]
call fcn.1400076a0
lea rcx, [rsp + 0xb0]
call fcn.1400076a0
lea rcx, [rsp + 0x78]
call fcn.1400076a0
lea rcx, [rsp + 0x58]
call fcn.1400076a0
lea rcx, [rsp + 0x40]
call fcn.140068b00
lea rcx, [rsp + 0x20]
call fcn.1400076a0
xor al, al
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140106d80
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140054180
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x240
mov rax, qword [0x14015d460]
xor rax, rsp
mov qword [rsp + 0x230], rax
imul r8d, dword [rcx + 0x30], 0x64
movabs r10, 0x100000001b3
mov rsi, qword [0x14019fcf8]
xor edi, edi
add r8d, dword [rcx + 0x2c]
movabs rcx, 0xcbf29ce484222325
mov rbp, qword [rsi + 0x6518]
mov eax, r8d
shr eax, 8
movzx edx, al
movzx eax, r8b
xor rax, rcx
mov r9d, r8d
imul rax, r10
xor rdx, rax
mov eax, r8d
imul rdx, r10
shr eax, 0x10
movzx ecx, al
xor rdx, rcx
mov eax, r8d
mov rcx, qword [rsi + 0x6540]
imul rdx, r10
shr rax, 0x18
xor rdx, rax
mov rax, qword [rsi + 0x6528]
imul rdx, r10
and rcx, rdx
add rcx, rcx
mov rbx, qword [rax + rcx*8 + 8]
cmp rbx, rbp
je 0x140054251
mov rax, qword [rax + rcx*8]
cmp r9d, dword [rbx + 0x10]
je 0x140054254
nop word [rax + rax]
cmp rbx, rax
je 0x140054251
mov rbx, qword [rbx + 8]
cmp r8d, dword [rbx + 0x10]
jne 0x140054240
jmp 0x140054254
mov rbx, rdi
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
lea rdx, [rsi + 0x6408]
lea rcx, [rsp + 0x20]
call fcn.1400537c0
test rbx, rbx
cmove rbx, rbp
movzx eax, word [rbx + 0x1e]
sub ax, 0x40
cmp ax, 0x30
ja 0x14005429c
movabs rcx, 0x1000101010005
bt rcx, rax
jb 0x1400542a1
mov edi, 0x40
lea rcx, [rsp + 0x1e8]
mov word [rbx + 0x1e], di
call fcn.140053f40
lea rcx, [rsp + 0x1a8]
call fcn.140053ed0
lea rcx, [rsp + 0x168]
call fcn.140053e50
lea rcx, [rsp + 0x128]
call fcn.140053dd0
lea rcx, [rsp + 0xd0]
call fcn.1400076a0
lea rcx, [rsp + 0xb0]
call fcn.1400076a0
lea rcx, [rsp + 0x78]
call fcn.1400076a0
lea rcx, [rsp + 0x58]
call fcn.1400076a0
lea rcx, [rsp + 0x40]
call fcn.140068b00
lea rcx, [rsp + 0x20]
call fcn.1400076a0
xor al, al
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140106d80
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140054f40
Capabilities:
Create thread
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x60
mov rax, qword [0x14015d460]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, rcx
mov r8, qword [0x14019fcf8]
cmp byte [r8 + 0x64f0], 0
je 0x140055163
cmp byte [rdx], 0
jne 0x140054f89
mov eax, dword [rdx + 0xc]
cmp eax, 0x20
je 0x140054f83
cmp eax, 0x30
jne 0x140054f89
mov dword [reloc.WLDAP32.dll_Ordinal_32], eax
movabs rsi, 0x1000100010001
cmp byte [0x14019d148], 0
je 0x14005508e
mov ecx, reloc.WS2_32.dll_recvfrom
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140055087
cmp byte [rbx], 0
jne 0x140055087
mov eax, dword [rbx + 0xc]
cmp eax, 0xc00
je 0x140054fef
cmp eax, 0xa80
je 0x140054fef
cmp eax, 0xa90
je 0x140054fef
add eax, 0xfffff600
cmp eax, 0x30
ja 0x140055087
cdqe
bt rsi, rax
jae 0x140055087
mov ecx, reloc.WS2_32.dll_recv
call fcn.140106da0
mov ecx, dword [rbx + 0x30]
mov dword [rax], ecx
mov ecx, dword [rbx + 0x2c]
mov dword [rax + 4], ecx
lea rcx, [0x14002ed60]
mov qword [rax + 8], rcx
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x140074170]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1400550f1
cmp dword [rsp + 0x38], 0
jne 0x14005505b
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
je 0x14005507e
mov ecx, eax
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_]
int3
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x30], xmm0
mov r8, qword [0x14019fcf8]
cmp byte [r8 + 0x63b0], 0
je 0x140055105
cmp byte [0x14019d149], 0
je 0x140055105
cmp byte [rbx], 0
jne 0x140055105
mov ecx, dword [rbx + 0xc]
cmp ecx, 0xc00
je 0x1400550e2
cmp ecx, 0xa80
je 0x1400550e2
cmp ecx, 0xa90
je 0x1400550e2
lea eax, [rcx - 0xa00]
cmp eax, 0x30
ja 0x1400550d4
cdqe
bt rsi, rax
jb 0x1400550e2
cmp ecx, 0xc20
je 0x1400550e2
cmp dword [rbx + 0x14], 0
jle 0x140055105
mov edx, dword [rbx + 0x30]
mov ecx, dword [rbx + 0x2c]
call fcn.14009aef0
mov al, 1
jmp 0x140055165
mov dword [rsp + 0x38], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
movss xmm1, dword [rbx + 0x18]
movss xmm0, dword [rbx + 0x1c]
movss dword [r8 + 0x6488], xmm1
movss dword [r8 + 0x648c], xmm0
cmp byte [0x14019d153], 0
lea rcx, str._CLIENT_1_:_local_pos:__.0f__.0f__People_cant_see_you_move_because_Ghost_Mode_is_on__n
jne 0x140055138
lea rcx, str._CLIENT_1_:_local_pos:__.0f__.0f_n
movss xmm2, dword [rbx + 0x1c]
cvtps2pd xmm2, xmm2
movss xmm1, dword [rbx + 0x18]
cvtps2pd xmm1, xmm1
movq r8, xmm2
movq rdx, xmm1
call fcn.14000b010
cmp byte [0x14019d153], 0
setne al
jmp 0x140055165
xor al, al
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140106d80
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rsi
ret
Function at 0x140055180
Capabilities:
Create thread
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x60
mov rax, qword [0x14015d460]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, rcx
mov r8, qword [0x14019fcf8]
cmp byte [r8 + 0x64f0], 0
je 0x1400553a3
cmp byte [rdx], 0
jne 0x1400551c9
mov eax, dword [rdx + 0xc]
cmp eax, 0x20
je 0x1400551c3
cmp eax, 0x30
jne 0x1400551c9
mov dword [reloc.WLDAP32.dll_Ordinal_32], eax
movabs rsi, 0x1000100010001
cmp byte [0x14019d148], 0
je 0x1400552ce
mov ecx, reloc.WS2_32.dll_recvfrom
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x1400552c7
cmp byte [rbx], 0
jne 0x1400552c7
mov eax, dword [rbx + 0xc]
cmp eax, 0xc00
je 0x14005522f
cmp eax, 0xa80
je 0x14005522f
cmp eax, 0xa90
je 0x14005522f
add eax, 0xfffff600
cmp eax, 0x30
ja 0x1400552c7
cdqe
bt rsi, rax
jae 0x1400552c7
mov ecx, reloc.WS2_32.dll_recv
call fcn.140106da0
mov ecx, dword [rbx + 0x30]
mov dword [rax], ecx
mov ecx, dword [rbx + 0x2c]
mov dword [rax + 4], ecx
lea rcx, [0x14002ed60]
mov qword [rax + 8], rcx
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x140074170]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140055331
cmp dword [rsp + 0x38], 0
jne 0x14005529b
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
je 0x1400552be
mov ecx, eax
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_]
int3
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x30], xmm0
mov r8, qword [0x14019fcf8]
cmp byte [r8 + 0x63b0], 0
je 0x140055345
cmp byte [0x14019d149], 0
je 0x140055345
cmp byte [rbx], 0
jne 0x140055345
mov ecx, dword [rbx + 0xc]
cmp ecx, 0xc00
je 0x140055322
cmp ecx, 0xa80
je 0x140055322
cmp ecx, 0xa90
je 0x140055322
lea eax, [rcx - 0xa00]
cmp eax, 0x30
ja 0x140055314
cdqe
bt rsi, rax
jb 0x140055322
cmp ecx, 0xc20
je 0x140055322
cmp dword [rbx + 0x14], 0
jle 0x140055345
mov edx, dword [rbx + 0x30]
mov ecx, dword [rbx + 0x2c]
call fcn.140099190
mov al, 1
jmp 0x1400553a5
mov dword [rsp + 0x38], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
movss xmm1, dword [rbx + 0x18]
movss xmm0, dword [rbx + 0x1c]
movss dword [r8 + 0x64e0], xmm1
movss dword [r8 + 0x64e4], xmm0
cmp byte [0x14019d153], 0
lea rcx, str._CLIENT_:_local_pos:__.0f__.0f__People_cant_see_you_move_because_Ghost_Mode_is_on__n
jne 0x140055378
lea rcx, str._CLIENT_:__CLIENT_2_:_local_pos:__.0f__.0f_n
movss xmm2, dword [rbx + 0x1c]
cvtps2pd xmm2, xmm2
movss xmm1, dword [rbx + 0x18]
cvtps2pd xmm1, xmm1
movq r8, xmm2
movq rdx, xmm1
call fcn.14000b010
cmp byte [0x14019d153], 0
setne al
jmp 0x1400553a5
xor al, al
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140106d80
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rsi
ret
Function at 0x140063200
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
imul r9d, dword [rcx + 0x30], 0x64
mov r11, rcx
mov r8, qword [0x14019fcf8]
movabs rbx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
add r9d, dword [rcx + 0x2c]
movzx edx, r9b
xor rdx, rax
mov r10d, r9d
imul rdx, rbx
mov eax, r9d
shr eax, 8
movzx ecx, al
mov eax, r9d
xor rdx, rcx
shr eax, 0x10
imul rdx, rbx
movzx ecx, al
xor rdx, rcx
mov eax, r9d
mov rcx, qword [r8 + 0x6540]
imul rdx, rbx
shr rax, 0x18
xor rdx, rax
imul rdx, rbx
and rcx, rdx
mov rdx, qword [r8 + 0x6518]
shl rcx, 4
add rcx, qword [r8 + 0x6528]
xor r8d, r8d
mov rax, qword [rcx + 8]
cmp rax, rdx
je 0x1400632b1
mov rcx, qword [rcx]
cmp r10d, dword [rax + 0x10]
je 0x1400632b4
nop dword [rax]
cmp rax, rcx
je 0x1400632b1
mov rax, qword [rax + 8]
cmp r9d, dword [rax + 0x10]
jne 0x1400632a0
jmp 0x1400632b4
mov rax, r8
cmp dword [r11 + 8], 0xffffffff
jne 0x1400632c7
test rax, rax
cmove rax, rdx
mov word [rax + 0x18], r8w
mov rbx, qword [rsp + 8]
xor al, al
ret
Function at 0x1400635c0
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x70
mov rax, qword [0x14015d460]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rbx, rcx
mov rcx, qword [0x14019fcf8]
add rcx, 0x6590
call fcn.140065a30
nop
mov ecx, reloc.WS2_32.dll_recv
call fcn.140106da0
mov qword [rax], rbx
lea rcx, [0x1400635a0]
mov qword [rax + 8], rcx
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x1400741b0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140063691
cmp dword [rsp + 0x38], 0
jne 0x14006364b
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
je 0x14006366e
mov ecx, eax
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_]
nop
mov rax, qword [0x14019fcf8]
mov byte [rax + 0x64f0], 1
xor al, al
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140106d80
add rsp, 0x70
pop rbx
ret
mov dword [rsp + 0x38], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x140065b00
Capabilities:
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
movzx r8d, byte [rdx]
mov r9, rcx
movabs rcx, 0x100000001b3
mov r10, rdx
movabs rax, 0xcbf29ce484222325
xor r8, rax
movzx eax, byte [rdx + 1]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 2]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 3]
mov rdx, qword [r9 + 0x30]
imul r8, rcx
xor r8, rax
imul r8, rcx
and rdx, r8
mov r8, qword [r9 + 8]
shl rdx, 4
add rdx, qword [r9 + 0x18]
mov r11, qword [rdx + 8]
mov rbx, r11
cmp r11, r8
je 0x140065b87
mov eax, dword [r10]
mov rcx, qword [rdx]
cmp eax, dword [r11 + 0x10]
je 0x140065b89
cmp rbx, rcx
je 0x140065b87
mov rbx, qword [rbx + 8]
cmp eax, dword [rbx + 0x10]
jne 0x140065b77
jmp 0x140065b89
xor ebx, ebx
test rbx, rbx
je 0x140065bf0
mov rax, qword [rdx]
cmp r11, rbx
jne 0x140065bae
cmp rax, rbx
jne 0x140065ba4
mov qword [rdx], r8
mov qword [rdx + 8], r8
jmp 0x140065bb9
mov r8, qword [rbx + 8]
mov qword [rdx + 8], r8
jmp 0x140065bb9
cmp rax, rbx
jne 0x140065bb9
mov rax, qword [rbx]
mov qword [rdx], rax
mov rcx, qword [rbx]
dec qword [r9 + 0x10]
mov rax, qword [rbx + 8]
mov qword [rax], rcx
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
lea rcx, [rbx + 0x28]
call fcn.140068f80
mov edx, 0x48
mov rcx, rbx
call fcn.140106ddc
mov eax, 1
add rsp, 0x20
pop rbx
ret
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x14006a1c0
Capabilities:
Resolve dns
Set socket configuration

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 7]
sub rsp, 0xa0
mov rax, qword [0x14015d460]
xor rax, rsp
mov qword [rbp - 1], rax
mov rbx, rdx
mov rsi, qword [rbp + 0x77]
mov qword [rbp - 0x69], rsi
mov r15, qword [rbp + 0x7f]
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x21], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x11], xmm1
mov qword [rbp - 0x29], 1
xor r12d, r12d
movzx eax, byte [rdx]
test al, al
je 0x14006a220
mov qword [rbp - 0x31], 4
jmp 0x14006a228
mov dword [rbp - 0x2d], r9d
mov dword [rbp - 0x31], r12d
test al, al
cmove rbx, rcx
mov edx, r8d
lea rcx, [rbp - 0x51]
call fcn.140005f10
nop
lea rdx, [rbp - 0x51]
cmp qword [rbp - 0x39], 0x10
cmovae rdx, qword [rbp - 0x51]
lea r9, [rbp - 0x61]
lea r8, [rbp - 0x31]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
jne 0x14006a365
mov rbx, qword [rbp - 0x61]
test rbx, rbx
je 0x14006a35b
movzx r14d, byte [rbp + 0x6f]
nop dword [rax]
nop dword [rax + rax]
mov dword [rsp + 0x28], 0x81
mov dword [rsp + 0x20], r12d
xor r9d, r9d
mov r8d, dword [rbx + 0xc]
mov edx, dword [rbx + 8]
mov ecx, dword [rbx + 4]
call qword [sym.imp.WS2_32.dll_WSASocketW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x14006a2c6
mov r8d, dword [rbx + 0xc]
mov edx, dword [rbx + 8]
mov ecx, dword [rbx + 4]
call qword [sym.imp.WS2_32.dll_socket]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14006a34a
test r14b, r14b
je 0x14006a2f0
mov dword [rbp - 0x59], 1
mov dword [rsp + 0x20], 4
lea r9, [rbp - 0x59]
mov edx, 6
lea r8d, [rdx - 5]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rcx, qword [rsi + 0x38]
test rcx, rcx
je 0x14006a307
mov qword [rbp - 0x59], rdi
mov rax, qword [rcx]
lea rdx, [rbp - 0x59]
call qword [rax + reloc.WS2_32.dll_recv]
cmp dword [rbx + 4], 0x17
jne 0x14006a32f
mov dword [rbp - 0x59], r12d
mov dword [rsp + 0x20], 4
lea r9, [rbp - 0x59]
mov edx, reloc.WLDAP32.dll_Ordinal_41
lea r8d, [rdx - 0xe]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_setsockopt]
mov r8, rbx
mov rdx, rdi
mov rcx, r15
call fcn.1400158e0
test al, al
jne 0x14006a3ad
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
mov rbx, qword [rbx + 0x28]
test rbx, rbx
jne 0x14006a280
mov rbx, qword [rbp - 0x61]
mov rcx, rbx
call qword [0x1401189c8]
nop
lea rcx, [rbp - 0x51]
call fcn.1400076a0
nop
mov rcx, qword [rsi + 0x38]
test rcx, rcx
je 0x14006a388
cmp rcx, rsi
mov rax, qword [rcx]
setne dl
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
mov qword [rsi + 0x38], r12
mov rax, 0xffffffffffffffff
mov rcx, qword [rbp - 1]
xor rcx, rsp
call fcn.140106d80
add rsp, 0xa0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov rcx, qword [rbp - 0x61]
call qword [0x1401189c8]
nop
lea rcx, [rbp - 0x51]
call fcn.1400076a0
nop
mov rcx, qword [rsi + 0x38]
test rcx, rcx
je 0x14006a3db
mov rax, qword [rcx]
cmp rcx, rsi
setne dl
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
mov qword [rsi + 0x38], r12
mov rax, rdi
jmp 0x14006a38f