joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000e7c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov r11, rsp
push r14
sub rsp, 0x50
mov r14, rcx
movabs r10, 0x7fffffffffffffff
mov rcx, qword [rcx + 0x10]
mov r8, rdx
mov rax, rcx
and rax, r10
cmp rdx, rax
jbe 0x14000e97f
mov qword [r11 + 8], rbx
mov rdx, rcx
shr rdx, 1
movabs r9, 0x3fffffffffffffff
and rdx, r9
mov qword [r11 + 0x10], rbp
add rdx, rax
mov qword [r11 + 0x18], rsi
mov qword [r11 - 0x10], rdi
cmp rdx, r8
mov rax, rcx
mov qword [r11 - 0x18], r12
cmovb rdx, r8
mov qword [r11 - 0x20], r13
xor rax, rdx
mov qword [r11 - 0x28], r15
and rax, r10
mov r9d, 0x811c9dc5
xor rax, rcx
lea rcx, [0x1401263e9]
mov qword [r14 + 0x10], rax
movzx eax, byte [str.._AUHandlerRecord_VoiceClientRequestHandler__]
test eax, eax
je 0x14000e866
nop dword [rax]
xor eax, r9d
lea rcx, [rcx + 1]
imul r9d, eax, 0x1000193
movzx eax, byte [rcx - 1]
test eax, eax
jne 0x14000e850
lea rcx, [rdx + rdx*4]
xor r13d, r13d
shl rcx, 3
lea r8, str.._AUHandlerRecord_VoiceClientRequestHandler__
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], 0xfffffffa
lea edx, [r13 + 0xb]
call fcn.140025e30
mov rsi, qword [r14]
lea r12, [fcn.140002a40]
mov rcx, qword [r14 + 8]
mov r15, rax
lea rdx, [rcx + rcx*4]
lea rbp, [rsi + rdx*8]
cmp rsi, rbp
je 0x14000e8f7
lea rbx, [rsi + 0x10]
lea rdi, [rax + 0x10]
lea rcx, [rdi - 0x10]
test rcx, rcx
je 0x14000e8e6
mov eax, dword [rsi]
lea rdx, [rbx + 8]
mov dword [rcx], eax
mov r8d, 2
lea rcx, [rdi + 8]
call qword [rbx]
mov rax, qword [rbx - 8]
mov qword [rdi - 8], rax
mov rax, qword [rbx]
mov qword [rdi], rax
mov qword [rbx - 8], r13
mov qword [rbx], r12
add rdi, 0x28
add rsi, 0x28
add rbx, 0x28
cmp rsi, rbp
jne 0x14000e8b4
mov rbx, qword [r14]
mov rax, qword [r14 + 8]
mov r13, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x68]
lea rcx, [rax + rax*4]
lea rdi, [rbx + rcx*8]
cmp rbx, rdi
je 0x14000e93d
nop word [rax + rax]
mov rax, qword [rbx + 0x10]
cmp rax, r12
je 0x14000e934
lea rcx, [rbx + 0x18]
xor r8d, r8d
xor edx, edx
call rax
add rbx, 0x28
cmp rbx, rdi
jne 0x14000e920
cmp qword [r14 + 0x10], 0
mov r12, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x60]
jl 0x14000e969
mov rcx, qword [r14]
lea rdx, str.._AUHandlerRecord_VoiceClientRequestHandler__
xor r9d, r9d
lea r8d, [r9 - 6]
call fcn.140025f00
movabs rax, 0x7fffffffffffffff
mov qword [r14], r15
and qword [r14 + 0x10], rax
mov r15, qword [rsp + 0x30]
add rsp, 0x50
pop r14
ret
Function at 0x14000f100
Capabilities:
Register raw input devices

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
push rbp
sub rsp, 0xe0
xor ebp, ebp
mov qword [r11 + 8], rsi
cmp qword [0x140128980], rbp
mov rbx, rcx
lea esi, [rbp + 1]
jne 0x14000f274
cmp byte [reloc.WS2_32.dll_accept], bpl
mov eax, reloc.WS2_32.dll_recv
mov ecx, 0x18
mov qword [r11 + 0x10], rdi
cmovne eax, ecx
mov qword [r11 - 0x58], rbp
xorps xmm0, xmm0
mov dword [0x14012897c], eax
xorps xmm1, xmm1
mov qword [r11 - 0x48], rbp
xor ecx, ecx
movdqa xmmword [r11 - 0x38], xmm0
movdqa xmmword [r11 - 0x28], xmm1
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0xa8], rax
lea rdi, str.Global_Key_Watcher_WoW_VoiceChat_Class
lea rax, [0x14000f860]
mov qword [rsp + 0xd0], rdi
lea rcx, [rsp + 0x90]
mov qword [rsp + 0x98], rax
call qword [sym.imp.USER32.dll_RegisterClassW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x58], rbp
xor r9d, r9d
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov qword [rsp + 0x48], rbp
mov rdx, rdi
mov qword [rsp + 0x40], 0xfffffffffffffffd
xor ecx, ecx
mov dword [rsp + 0x38], ebp
mov dword [rsp + 0x30], ebp
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], ebp
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov rcx, rax
mov qword [0x140128980], rax
mov edx, esi
call sub.WTSAPI32.dll_WTSRegisterSessionNotification
mov edx, 0x20
lea r9, [0x14000f0d0]
mov edi, 2
mov ecx, edx
mov dword [rsp + 0x30], edi
xor r8d, r8d
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], ebp
call qword [sym.imp.USER32.dll_SetWinEventHook]
lea r8d, [rbp + 0x10]
mov dword [rsp + 0x60], 0x60001
mov qword [0x140128988], rax
lea rcx, [rsp + 0x60]
mov rax, qword [0x140128980]
mov edx, edi
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x78], rax
mov dword [rsp + 0x64], 0x100
mov dword [rsp + 0x70], 0x20001
mov dword [rsp + 0x74], 0x100
call qword [sym.imp.USER32.dll_RegisterRawInputDevices]
mov rdi, qword [rsp + 0xf8]
test eax, eax
setne al
mov byte [0x140128990], al
jmp 0x14000f27b
movzx eax, byte [0x140128990]
test al, al
je 0x14000f2e6
call fcn.14000f560
lea rdx, [0x140110018]
mov rcx, rbx
call fcn.1400069a0
xor r9d, r9d
mov dword [rsp + 0x20], esi
xor r8d, r8d
lea rcx, [rsp + 0x60]
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x14000f2e6
nop
cmp eax, 0xffffffff
je 0x14000f2cb
lea rcx, [rsp + 0x60]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x60]
call qword [sym.imp.USER32.dll_DispatchMessageW]
xor r9d, r9d
mov dword [rsp + 0x20], esi
xor r8d, r8d
lea rcx, [rsp + 0x60]
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x14000f2b0
movzx edx, byte [reloc.WS2_32.dll_accept]
mov rcx, rbx
call fcn.140006eb0
cmp byte [0x140128978], bpl
mov rsi, qword [rsp + 0xf0]
je 0x14000f31e
xor edx, edx
mov byte [0x140128978], bpl
mov rcx, rbx
mov qword [0x140110020], rbp
call fcn.1400072f0
mov rbx, qword [rsp + 0x100]
add rsp, 0xe0
pop rbp
ret
Function at 0x14000f390
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rdi, qword [rcx]
movzx r10d, r8b
mov rax, qword [rcx + 8]
mov rbx, rcx
mov esi, edx
mov rcx, rdi
lea r8, [rdi + rax*4]
cmp rdi, r8
je 0x14000f3cd
nop dword [rax + rax]
cmp dword [rcx], esi
je 0x14000f3cd
add rcx, 4
cmp rcx, r8
jne 0x14000f3c0
test r9b, r9b
je 0x14000f526
cmp rcx, r8
jne 0x14000f526
mov r8, qword [rbx + 0x10]
mov qword [rsp + 0x40], rbp
mov rdx, r8
movabs rbp, 0x7fffffffffffffff
and rdx, rbp
cmp rax, rdx
jne 0x14000f502
lea r9, [rdx + 1]
cmp r9, rdx
jbe 0x14000f502
movabs rax, 0x3fffffffffffffff
mov rcx, r8
shr rcx, 1
mov r10d, 1
and rcx, rax
lea rax, [rdx + rcx]
cmp rax, r9
mov r9d, 0x811c9dc5
cmovae r10, rcx
lea rcx, [0x1401262b9]
add r10, rdx
mov rax, r10
xor rax, r8
and rax, rbp
xor rax, r8
mov qword [rbx + 0x10], rax
movzx eax, byte [0x1401262b8]
test eax, eax
je 0x14000f476
nop dword [rax]
xor eax, r9d
lea rcx, [rcx + 1]
imul r9d, eax, 0x1000193
movzx eax, byte [rcx - 1]
test eax, eax
jne 0x14000f460
lea rcx, [r10*4]
mov dword [rsp + 0x28], 0
lea r8, [0x1401262b8]
mov dword [rsp + 0x20], 0xfffffffa
mov edx, ntohs
call fcn.140025e30
mov r10, qword [rbx]
mov rdi, rax
mov r9, rax
mov rax, qword [rbx + 8]
lea r11, [r10 + rax*4]
cmp r10, r11
je 0x14000f4da
nop word [rax + rax]
mov ecx, dword [r10]
add r10, 4
mov dword [r9], ecx
lea r9, [r9 + 4]
cmp r10, r11
jne 0x14000f4c0
mov r10, qword [rbx]
mov rax, qword [rbx + 8]
cmp qword [rbx + 0x10], 0
jl 0x14000f4fb
xor r9d, r9d
lea rdx, [0x1401262b8]
mov rcx, r10
lea r8d, [r9 - 6]
call fcn.140025f00
mov rax, qword [rbx + 8]
and qword [rbx + 0x10], rbp
mov qword [rbx], rdi
mov rbp, qword [rsp + 0x40]
lea rcx, [rdi + rax*4]
test rcx, rcx
je 0x14000f512
mov dword [rcx], esi
inc qword [rbx + 8]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
test r10b, r10b
je 0x14000f544
cmp rcx, r8
je 0x14000f544
lea rdx, [rcx + 4]
sub r8, rdx
and r8, 0xfffffffffffffffc
call fcn.1400bddc0
dec qword [rbx + 8]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x14000fbd0
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x28
xor r8d, r8d
lea rcx, str.Logs
xor edx, edx
call fcn.140016fa0
lea r8, [0x1401289a0]
xor edx, edx
lea rcx, str.LogsVoice.log
call fcn.14002ab20
mov rcx, qword [0x1401289a0]
test rcx, rcx
je 0x14000fc1e
lea rdx, str.Voice_Log_Initialize.
call fcn.14002b410
mov rcx, qword [0x1401289a0]
call fcn.14002b030
lea r9, [0x14000fce0]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
add rsp, 0x28
jmp 0x140036000
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov ebp, 0x811c9dc5
lea rsi, [0x1400e1941]
mov ebx, 0x44
mov r15, r9
mov r9d, ebp
mov r10, rsi
mov eax, ebx
mov r14, r8
mov r12d, edx
mov r13, rcx
xor eax, r9d
lea r10, [r10 + 1]
imul r9d, eax, 0x1000193
movzx eax, byte [r10 - 1]
test eax, eax
jne 0x140036041
lea r8, str.D:BuildServerDworkpackage_cache_bnlbase1.4.6.2_source_baseDiag.cpp
mov dword [rsp + 0x20], 0x165
lea edx, [rax + 9]
lea ecx, [rax + 0x28]
call fcn.140025410
mov rdi, rax
test rax, rax
je 0x14003611a
mov qword [rax], r13
mov dword [rax + 8], r12d
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], r15
mov qword [rax + 0x20], 0
test r14, r14
je 0x14003611c
mov rax, 0xffffffffffffffff
nop word [rax + rax]
cmp byte [r14 + rax + 1], 0
lea rax, [rax + 1]
jne 0x1400360b0
nop dword [rax]
xor ebx, ebp
lea rsi, [rsi + 1]
imul ebp, ebx, 0x1000193
movzx ebx, byte [rsi - 1]
test ebx, ebx
jne 0x1400360c0
lea rbx, [rax + 1]
mov dword [rsp + 0x20], 0x38
mov rcx, rbx
lea r8, str.D:BuildServerDworkpackage_cache_bnlbase1.4.6.2_source_baseDiag.cpp
mov r9d, ebp
mov edx, 9
call fcn.140025410
mov rcx, qword [rdi + 0x10]
mov qword [rdi + 0x10], rax
test rcx, rcx
je 0x140036109
call fcn.140025570
mov rcx, qword [rdi + 0x10]
mov r8, rbx
mov rdx, r14
call fcn.1400bddc0
jmp 0x14003611c
xor edi, edi
lea rcx, [0x1401d0cb0]
call fcn.140036280
test rax, rax
je 0x140036135
mov rcx, rax
call sub.KERNEL32.dll_AcquireSRWLockExclusive
cmp byte [0x1401d0cd4], 0
jne 0x140036153
xor edx, edx
lea rcx, [0x140035e50]
call fcn.140036e30
mov byte [0x1401d0cd4], 1
mov rax, qword [0x1401d0cc0]
lea rcx, [0x1401d0cb0]
mov qword [rdi + 0x20], rax
mov qword [0x1401d0cc0], rdi
call fcn.140036280
test rax, rax
je 0x14003617e
mov rcx, rax
call fcn.1400b80f0
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140013140
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
push r14
sub rsp, 0x30
mov r14, rcx
lea rdx, [0x1400dccf1]
mov r9d, 0x811c9dc5
mov eax, 0x44
xor eax, r9d
lea rdx, [rdx + 1]
imul r9d, eax, 0x1000193
movzx eax, byte [rdx - 1]
test eax, eax
jne 0x140013160
lea r8, str.D:BuildServerDworkpackage_cache_blz3.11.14include_blzmem_unique_ptr.h
mov qword [rsp + 0x50], rdi
lea edx, [rax + 0xb]
mov dword [rsp + 0x20], 0x20e
mov ecx, 0x110
call fcn.140025410
mov rbx, rax
test rax, rax
je 0x1400132bb
mov qword [rsp + 0x40], rbp
lea rcx, [rax + 0xc]
xor edx, edx
mov qword [rsp + 0x48], rsi
mov r8d, 0x104
call fcn.1400be550
xorps xmm0, xmm0
lea rdx, str.VoiceChat
xor edi, edi
mov esi, 9
mov qword [rbx], rdi
mov rax, rdx
mov qword [rbx + 8], rdi
mov ecx, esi
movups xmmword [rbx + 0x10], xmm0
movups xmmword [rbx + 0x20], xmm0
movups xmmword [rbx + 0x30], xmm0
movups xmmword [rbx + 0x40], xmm0
nop dword [rax + rax]
dec rcx
cmp byte [rax], dil
je 0x140013202
inc rax
test rcx, rcx
jne 0x1400131f0
jmp 0x14001320d
test rax, rax
je 0x14001320d
mov rsi, rax
sub rsi, rdx
mov eax, 0x3f
lea rcx, [rbx + 0x10]
cmp rsi, rax
cmova rsi, rax
mov r8, rsi
call fcn.1400bddc0
mov byte [rsi + rbx + 0x10], dil
lea rcx, [rbx + 0x10]
xor r8d, r8d
mov byte [rbx + 0x4f], dil
mov dword [rbx + 8], 9
lea edx, [r8 + 9]
call fcn.1400b6e20
mov dword [rbx + 0xc], eax
lea rcx, [rbx + 0x60]
mov qword [rbx + 0x50], rdi
xorps xmm0, xmm0
mov qword [rbx + 0x58], rdi
xor r8d, r8d
movups xmmword [rcx], xmm0
movups xmmword [rcx + 0x10], xmm0
movups xmmword [rcx + 0x20], xmm0
movups xmmword [rcx + 0x30], xmm0
movups xmmword [rcx + 0x40], xmm0
movups xmmword [rcx + 0x50], xmm0
movups xmmword [rcx + 0x60], xmm0
mov edx, dword [rbx + 0x58]
call fcn.1400b6e20
lea rcx, [rbx + 0xd0]
mov dword [rbx + 0x5c], eax
lea rdx, str.BlizzServiceRegistry
call fcn.140013c10
mov rsi, qword [rsp + 0x48]
mov rax, r14
mov rbp, qword [rsp + 0x40]
mov byte [rbx + 0x108], 1
mov qword [r14], rbx
mov rdi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
mov rbx, qword [rsp + 0x58]
xor edi, edi
mov qword [r14], rdi
mov rax, r14
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r14
ret
Function at 0x140014f50
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rsi, rdx
lea r8, [0x1400dcd61]
mov rdi, rcx
mov r9d, 0x811c9dc5
mov eax, 0x44
nop word [rax + rax]
xor eax, r9d
lea r8, [r8 + 1]
imul r9d, eax, 0x1000193
movzx eax, byte [r8 - 1]
test eax, eax
jne 0x140014f80
lea r8, str.D:BuildServerDworkpackage_cache_blz3.11.14include_blzmem_shared_ptr.h
mov dword [rsp + 0x20], 0x398
lea edx, [rax + 0xb]
mov ecx, pe_nt_image_headers64
call fcn.140025410
test rax, rax
je 0x140014fc8
mov rdx, rsi
mov rcx, rax
call fcn.140014c00
mov rcx, rax
jmp 0x140014fca
xor ecx, ecx
mov rbx, qword [rdi + 0x10]
lea rax, [rcx + 0x10]
mov qword [rdi + 8], rax
mov qword [rdi + 0x10], rcx
mov edi, 0xffffffff
test rbx, rbx
je 0x14001500e
mov eax, edi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x14001500e
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_recv]
mov eax, edi
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x14001500e
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x18]
mov rbx, qword [rsi + 8]
test rbx, rbx
je 0x140015041
mov eax, edi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x140015041
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_recv]
lock xadd dword [rbx + 0xc], edi
lea eax, [rdi - 1]
test eax, eax
jne 0x140015041
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x18]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x140016d20
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push r13
push r14
push r15
sub rsp, 0x30
mov r14, qword [rcx + 8]
mov rsi, rcx
mov rbx, r8
mov rbp, r9
mov r15, rdx
movabs r13, 0x7fffffffffffffff
mov rdx, qword [rcx]
lea r8, [r14 + r9]
mov r9, qword [rcx + 0x10]
mov qword [rcx + 8], r8
mov rcx, r9
and rcx, r13
cmp r8, rcx
ja 0x140016e31
mov r8, rbx
lea r9, [r14*4]
sub r8, rdx
lea rcx, [r9 + rdx]
sar r8, 2
add r8, rbp
cmp r8, r14
jae 0x140016deb
sub r14, rbp
mov r8, rcx
lea rdx, [rdx + r14*4]
cmp rdx, rcx
je 0x140016db1
nop word [rax + rax]
mov eax, dword [rdx]
add rdx, 4
mov dword [rcx], eax
lea rcx, [rcx + 4]
cmp rdx, r8
jne 0x140016da0
mov rax, qword [rsi]
lea rcx, [rax + r14*4]
lea rdx, [r9 + rax]
cmp rcx, rbx
je 0x140016de2
nop dword [rax]
nop word [rax + rax]
mov eax, dword [rcx - 4]
lea rdx, [rdx - 4]
sub rcx, 4
mov dword [rdx], eax
cmp rcx, rbx
jne 0x140016dd0
lea rcx, [rbx + rbp*4]
mov rax, rcx
jmp 0x140016e1c
lea r10, [r8*4]
lea r8, [r10 + rdx]
mov rdx, rbx
cmp rbx, rcx
je 0x140016e12
nop
mov eax, dword [rdx]
add rdx, 4
mov dword [r8], eax
lea r8, [r8 + 4]
cmp rdx, rcx
jne 0x140016e00
mov rax, qword [rsi]
lea rcx, [rax + r10]
add rax, r9
mov qword [r15], rbx
mov qword [r15 + 8], rax
mov eax, reloc.WS2_32.dll_recv
mov qword [rax + r15], rcx
jmp 0x140016f4c
mov rax, r9
mov qword [rsp + 0x60], rdi
shr rax, 1
movabs rdx, 0x3fffffffffffffff
and rax, rdx
mov qword [rsp + 0x68], r12
add rax, rcx
lea rcx, [0x1401262b9]
cmp rax, r8
cmovae r8, rax
mov rax, r8
xor rax, r9
and rax, r13
xor rax, r9
mov r9d, 0x811c9dc5
mov qword [rsi + 0x10], rax
movzx eax, byte [0x1401262b8]
test eax, eax
je 0x140016e96
xor eax, r9d
lea rcx, [rcx + 1]
imul r9d, eax, 0x1000193
movzx eax, byte [rcx - 1]
test eax, eax
jne 0x140016e80
lea rcx, [r8*4]
mov dword [rsp + 0x28], 0
lea r8, [0x1401262b8]
mov dword [rsp + 0x20], 0xfffffffa
mov edx, ntohs
call fcn.140025e30
mov rdx, qword [rsi]
mov r12, rax
mov rdi, rax
cmp rdx, rbx
je 0x140016ee1
nop dword [rax]
mov ecx, dword [rdx]
add rdx, 4
mov dword [rdi], ecx
add rdi, 4
cmp rdx, rbx
jne 0x140016ed0
mov rax, qword [rsi]
lea rbp, [rdi + rbp*4]
lea r9, [rax + r14*4]
cmp rbx, r9
je 0x140016f0e
mov rcx, rbp
sub rcx, rbx
nop word [rax + rax]
mov eax, dword [rbx]
mov dword [rcx + rbx], eax
add rbx, 4
cmp rbx, r9
jne 0x140016f00
cmp qword [rsi + 0x10], 0
jl 0x140016f2b
mov rcx, qword [rsi]
lea rdx, [0x1401262b8]
xor r9d, r9d
lea r8d, [r9 - 6]
call fcn.140025f00
and qword [rsi + 0x10], r13
mov eax, reloc.WS2_32.dll_recv
mov qword [rsi], r12
mov qword [r15], rdi
mov qword [r15 + 8], rdi
mov qword [rax + r15], rbp
mov r12, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x70]
mov rax, r15
add rsp, 0x30
pop r15
pop r14
pop r13
pop rsi
pop rbp
ret
Function at 0x140016fa0
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x350
xor r14d, r14d
movzx edi, r8b
mov rbp, rcx
test dl, dl
je 0x14001709e
lea rdx, [rsp + 0x30]
mov r9, rcx
mov r10d, 0x103
nop dword [rax]
movzx eax, byte [r9]
lea r9, [r9 + 1]
mov byte [rdx], al
lea rdx, [rdx + 1]
test al, al
je 0x140017000
sub r10, 1
jne 0x140016fe0
mov byte [rdx], r14b
nop dword [rax + rax]
lea rcx, [rsp + 0x30]
call fcn.140017600
mov eax, eax
lea rcx, [rsp + 0x30]
add rcx, rax
lea rdx, [0x1400de320]
call fcn.1400c20e0
mov rbx, rax
test rax, rax
je 0x14001709e
nop dword [rax + rax]
movzx esi, byte [rbx]
lea r8, [rsp + 0x30]
mov qword [rsp + 0x28], r14
lea rcx, [rsp + 0x140]
mov r9d, 0x7fffffff
mov byte [rbx], r14b
mov edx, 0x104
mov qword [rsp + 0x20], r14
call fcn.14002b9c0
xor edx, edx
lea rcx, [rsp + 0x140]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x140017083
test dil, dil
jne 0x1400170ec
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1400170ec
lea rcx, [rbx + 1]
mov byte [rbx], sil
lea rdx, [0x1400de320]
call fcn.1400c20e0
mov rbx, rax
test rax, rax
jne 0x140017030
mov qword [rsp + 0x28], r14
lea rcx, [rsp + 0x140]
mov r9d, 0x7fffffff
mov qword [rsp + 0x20], r14
mov r8, rbp
mov edx, 0x104
call fcn.14002b9c0
xor edx, edx
lea rcx, [rsp + 0x140]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1400170f0
test dil, dil
jne 0x1400170ec
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
sete al
jmp 0x1400170f2
xor al, al
jmp 0x1400170f2
mov al, 1
lea r11, [rsp + 0x350]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret

Function at 0x1400171b0
Capabilities:
Delete file

Disassembly:
sub rsp, 0x248
xor eax, eax
mov r8, rcx
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
mov r9d, 0x7fffffff
mov qword [rsp + 0x20], rax
mov edx, 0x104
call fcn.14002b9c0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne al
add rsp, 0x248
ret

Function at 0x140017270
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, r9
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test rbx, rbx
je 0x140017298
mov ecx, dword [rsp + 0x58]
mov dword [rbx], ecx
test eax, eax
setne al
add rsp, 0x30
pop rbx
ret
Function at 0x140017360
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rdi
sub rsp, 0xa50
mov rdi, rcx
mov qword [rsp + 0xa68], rsi
mov rcx, qword [rcx]
call fcn.1400b7800
mov rbx, 0xffffffffffffffff
mov ebp, 0x7fff
test al, al
jne 0x1400173da
mov edx, 0x104
lea rcx, [rsp + 0x30]
call fcn.1400b8100
mov r9, qword [rdi]
lea r8, [rsp + 0x30]
mov edx, 0x104
lea rcx, [rsp + 0x140]
call fcn.1400b7510
mov r8d, 0x104
lea rdx, str.no_command___main_not_yet_called
lea rcx, [rsp + 0x140]
call fcn.140017b10
jmp 0x140017406
mov rdx, qword [rdi]
mov rdi, rbx
inc rdi
cmp byte [rdx + rdi], 0
jne 0x1400173e0
cmp rdi, rbp
lea rsi, str.no_command___main_not_yet_called
mov rcx, rsi
cmova rdi, rbp
mov r8, rdi
call fcn.1400bddc0
mov byte [rdi + rsi], 0
mov byte [str.unknown_params___main_not_yet_called], 0
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea r8, [0x1400de34c]
mov qword [rsp + 0x28], 0
test rax, rax
lea rcx, [rsp + 0x250]
mov edx, 0x800
mov r9d, 0x7fffffff
cmovne r8, rax
lea rax, [rsp + 0xa60]
mov qword [rsp + 0x20], rax
call fcn.14002b790
mov rsi, qword [rsp + 0xa68]
lea rax, [rsp + 0x250]
nop
inc rbx
cmp byte [rax + rbx], 0
jne 0x140017460
cmp rbx, rbp
lea rdi, str.unknown_params___main_not_yet_called
lea rdx, [rsp + 0x250]
mov rcx, rdi
cmova rbx, rbp
mov r8, rbx
call fcn.1400bddc0
lea r11, [rsp + 0xa50]
mov byte [rbx + rdi], 0
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140019a30
Capabilities:
Hash data using murmur3

Disassembly:
sub rsp, 0x28
lea rax, [0x1400de508]
mov qword [rcx], rax
mov ecx, 0xf014f55c
call fcn.1400acac0
mov ecx, 0x26e5ae6e
call fcn.1400acac0
mov ecx, 0x636b9417
call fcn.1400acac0
mov ecx, 0xc2a2d4d3
call fcn.1400acac0
mov ecx, 0x2e781640
call fcn.1400acac0
mov ecx, 0xc6364d65
call fcn.1400acac0
mov ecx, 0x4557434
call fcn.1400acac0
mov ecx, 0xab2b766
call fcn.1400acac0
mov ecx, 0xf6f9d307
call fcn.1400acac0
mov ecx, 0x138a2dda
call fcn.1400acac0
mov ecx, 0x62b9e0a1
call fcn.1400acac0
mov ecx, 0xc4d6f890
call fcn.1400acac0
mov ecx, 0x9806394
call fcn.1400acac0
mov ecx, 0xab7cfe3b
call fcn.1400acac0
mov ecx, 0x97491fa1
call fcn.1400acac0
mov ecx, 0x4e7f6f14
call fcn.1400acac0
mov ecx, 0xab1fdebe
call fcn.1400acac0
mov ecx, 0xa0a0600d
call fcn.1400acac0
mov ecx, 0x291704c8
call fcn.1400acac0
mov ecx, 0x6b0917cd
call fcn.1400acac0
mov ecx, 0x79f57b4
call fcn.1400acac0
mov ecx, 0x1f285a54
call fcn.1400acac0
mov ecx, 0xb6bc991
call fcn.1400acac0
mov ecx, 0xd283ed44
call fcn.1400acac0
mov ecx, 0xa4bd3001
call fcn.1400acac0
mov ecx, 0xf7c4dee5
call fcn.1400acac0
mov ecx, 0x2b2d69cd
call fcn.1400acac0
mov ecx, 0xd71c9474
call fcn.1400acac0
mov ecx, 0xa1990b71
call fcn.1400acac0
mov ecx, 0xafc8e5c
call fcn.1400acac0
mov ecx, 0xce7d20d8
call fcn.1400acac0
mov ecx, 0x5395520b
call fcn.1400acac0
mov ecx, 0x10623267
call fcn.1400acac0
mov ecx, 0xe7298fef
call fcn.1400acac0
mov ecx, 0xb56d199a
call fcn.1400acac0
mov ecx, 0x883d2d6f
call fcn.1400acac0
mov ecx, 0xcbea97d7
call fcn.1400acac0
mov ecx, 0x1d25746c
call fcn.1400acac0
mov ecx, 0x2f501937
call fcn.1400acac0
mov ecx, 0x80e16e23
call fcn.1400acac0
mov ecx, 0xe34a3b2b
add rsp, 0x28
jmp fcn.1400acac0
Function at 0x14001cfb0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
sub rsp, 0x30
mov r9, qword [rcx + 0x10]
mov rsi, rdx
mov rax, qword [rcx + 8]
mov r8, r9
mov qword [rsp + 0x40], rbp
mov rbx, rcx
movabs rbp, 0x7fffffffffffffff
and r8, rbp
cmp rax, r8
jne 0x14001d0f6
lea rdx, [r8 + 1]
cmp rdx, r8
jbe 0x14001d0f6
mov rcx, r9
mov qword [rsp + 0x48], rdi
shr rcx, 1
movabs rax, 0x3fffffffffffffff
and rcx, rax
mov r10d, 1
lea rax, [r8 + rcx]
cmp rax, rdx
lea rdx, [0x140126551]
cmovae r10, rcx
add r10, r8
mov rax, r10
xor rax, r9
and rax, rbp
xor rax, r9
mov r9d, 0x811c9dc5
mov qword [rbx + 0x10], rax
movzx eax, byte [str.._AU_WSABUF__]
test eax, eax
je 0x14001d066
nop word [rax + rax]
xor eax, r9d
lea rdx, [rdx + 1]
imul r9d, eax, 0x1000193
movzx eax, byte [rdx - 1]
test eax, eax
jne 0x14001d050
shl r10, 4
lea r8, str.._AU_WSABUF__
mov rcx, r10
mov dword [rsp + 0x28], 0
mov edx, ntohs
mov dword [rsp + 0x20], 0xfffffffa
call fcn.140025e30
mov rcx, qword [rbx]
mov rdi, rax
mov r9, rax
mov rax, qword [rbx + 8]
mov r10, rax
shl r10, 4
add r10, rcx
cmp rcx, r10
je 0x14001d0cc
nop word [rax + rax]
movups xmm0, xmmword [rcx]
add rcx, 0x10
lea r9, [r9 + 0x10]
movups xmmword [r9 - 0x10], xmm0
cmp rcx, r10
jne 0x14001d0b0
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
cmp qword [rbx + 0x10], 0
jl 0x14001d0ea
xor r9d, r9d
lea rdx, str.._AU_WSABUF__
lea r8d, [r9 - 6]
call fcn.140025f00
mov rax, qword [rbx + 8]
and qword [rbx + 0x10], rbp
mov qword [rbx], rdi
mov rdi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x40]
shl rax, 4
add rax, qword [rbx]
je 0x14001d10a
movups xmm0, xmmword [rsi]
movups xmmword [rax], xmm0
inc qword [rbx + 8]
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rsi
ret