joyce8/EMBER2024-capa huggingface dataset:
Function at 0x486620
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4866ea
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call sym.internal_bytealg.IndexByteString.abi0
xorps xmm15, xmm15
mov r14, qword [0x0069dc78]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x4866cf
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x00501880]
xor ebx, ebx
mov rcx, rdx
call sym.runtime.makeslice
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call sym.syscall.encodeWTF16
inc rbx
cmp rcx, rbx
jae 0x4866be
mov edi, 1
lea rsi, [0x00501880]
call sym.runtime.growslice
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x0055b438]
lea rsi, [0x0055aa90]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.syscall.UTF16FromString

Function at 0x4aba00
Capabilities:
Hash data using fnv

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ac13f
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
movabs rcx, 0xcbf29ce484222325
jmp 0x4aba2d
lea rax, [rdx + 0x10]
dec rbx
mov rcx, rsi
test rbx, rbx
jle 0x4abcb1
mov rdx, rax
mov rsi, qword [rax]
nop dword [rax]
test rsi, rsi
je 0x4abcdd
mov edi, dword [rsi + 0x10]
shr edi, 1
mov r8, qword [rax + 8]
and edi, 0x3f
lea rax, [0x0055d420]
jmp qword [rax + rdi*8]
mov rax, rcx
add rsp, 0x10
pop rbp
ret
lea rax, [0x00501780]
lea rbx, [0x0055b2d0]
call sym.runtime.gopanic
inc rax
cmp rax, r8
jge 0x4abd02
mov r9, qword [rsi + rax*8]
xor r10d, r10d
nop
jmp 0x4abd37
lea rdi, [0x00501800]
mov rsi, rcx
movabs rcx, 0x100000001b3
jmp 0x4aba23
movzx r11d, r9b
xor rcx, r11
inc r10
shr r9, 8
movabs r11, 0x100000001b3
imul rcx, r11
cmp r10, 8
jl 0x4abd1b
jmp 0x4abcf0
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp sym.internal_bisect.Hash

Function at 0x4ac2e0
Capabilities:
Hash data using fnv

Disassembly:
test byte [rax], al
mov rcx, rbx
and ebx, 0x7f
shl rbx, 5
lea rdx, [rax + rbx]
xor eax, eax
jmp 0x4ac2f7
inc rax
cmp rax, 4
jge 0x4ac30f
lea rbx, [rdx + rax*8]
mov rbx, qword [rbx]
cmp rbx, rcx
jne 0x4ac2f4
mov eax, 1
ret
xor eax, eax
movabs rbx, 0xcbf29ce484222325
jmp 0x4ac320
inc rax
cmp rax, 4
jge 0x4ac32e
mov rsi, qword [rdx + rax*8]
xor edi, edi
jmp 0x4ac357
and ebx, 3
lea rdx, [rdx + rbx*8]
xchg qword [rdx], rcx
xor eax, eax
ret
movzx r8d, sil
xor rbx, r8
inc rdi
shr rsi, 8
movabs r8, 0x100000001b3
imul rbx, r8
cmp rdi, 8
jl 0x4ac33b
jmp 0x4ac31d
Function at 0x4af000
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov ecx, 0x14
lea rax, str.expand_32_byte_k
vmovdqa xmm0, xmmword [rax]
vmovdqa xmm6, xmmword [rax + 0x10]
vmovdqa xmm5, xmmword [rax + 0x20]
vmovdqu xmm1, xmmword [rdi]
vmovdqu xmm2, xmmword [rdi + 0x10]
vmovdqu xmm3, xmmword [rsi]
vpaddd xmm0, xmm1, xmm0
vpxor xmm3, xmm0, xmm3
vpshufb xmm3, xmm3, xmm6
vpaddd xmm2, xmm3, xmm2
vpxor xmm1, xmm2, xmm1
vpslld xmm4, xmm1, 0xc
vpsrld xmm1, xmm1, 0x14
vpxor xmm1, xmm4, xmm1
vpaddd xmm0, xmm1, xmm0
vpxor xmm3, xmm0, xmm3
vpshufb xmm3, xmm3, xmm5
vpaddd xmm2, xmm3, xmm2
vpxor xmm1, xmm2, xmm1
vpslld xmm4, xmm1, 7
vpsrld xmm1, xmm1, 0x19
vpshufd xmm0, xmm0, 0x93
vpxor xmm1, xmm4, xmm1
vpshufd xmm3, xmm3, 0x4e
vpaddd xmm0, xmm1, xmm0
vpxor xmm3, xmm0, xmm3
vpshufb xmm3, xmm3, xmm6
vpshufd xmm2, xmm2, 0x39
vpaddd xmm2, xmm3, xmm2
vpxor xmm1, xmm2, xmm1
vpslld xmm4, xmm1, 0xc
vpsrld xmm1, xmm1, 0x14
vpxor xmm1, xmm4, xmm1
vpaddd xmm0, xmm1, xmm0
vpxor xmm3, xmm0, xmm3
vpshufb xmm3, xmm3, xmm5
vpaddd xmm2, xmm3, xmm2
vpxor xmm1, xmm2, xmm1
vpshufd xmm0, xmm0, 0x39
vpslld xmm4, xmm1, 7
vpshufd xmm3, xmm3, 0x4e
vpsrld xmm1, xmm1, 0x19
vpshufd xmm2, xmm2, 0x93
vpxor xmm1, xmm4, xmm1
sub ecx, 2
jne 0x4af036
vmovdqu xmmword [rdx], xmm0
vmovdqu xmmword [rdx + 0x10], xmm3
vzeroupper
ret
Function at 0x4afcc0
Capabilities:
Encode data using xor
Encrypt data using salsa20 or chacha

Disassembly:
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov ecx, 0x14
lea rax, str.expand_32_byte_k
movdqa xmm0, xmmword [rax]
movdqa xmm5, xmmword [rax + 0x10]
movdqa xmm6, xmmword [rax + 0x20]
movdqu xmm1, xmmword [rdi]
movdqu xmm2, xmmword [rdi + 0x10]
movdqu xmm3, xmmword [rsi]
paddd xmm0, xmm1
pxor xmm3, xmm0
pshufb xmm3, xmm5
paddd xmm2, xmm3
pxor xmm1, xmm2
movdqa xmm4, xmm1
pslld xmm1, 0xc
psrld xmm4, 0x14
pxor xmm1, xmm4
paddd xmm0, xmm1
pxor xmm3, xmm0
pshufb xmm3, xmm6
pshufd xmm0, xmm0, 0x93
paddd xmm2, xmm3
pshufd xmm3, xmm3, 0x4e
pxor xmm1, xmm2
pshufd xmm2, xmm2, 0x39
movdqa xmm4, xmm1
pslld xmm1, 7
psrld xmm4, 0x19
pxor xmm1, xmm4
sub rcx, 2
paddd xmm0, xmm1
pxor xmm3, xmm0
pshufb xmm3, xmm5
paddd xmm2, xmm3
pxor xmm1, xmm2
movdqa xmm4, xmm1
pslld xmm1, 0xc
psrld xmm4, 0x14
pxor xmm1, xmm4
paddd xmm0, xmm1
pxor xmm3, xmm0
pshufb xmm3, xmm6
pshufd xmm0, xmm0, 0x39
paddd xmm2, xmm3
pshufd xmm3, xmm3, 0x4e
pxor xmm1, xmm2
pshufd xmm2, xmm2, 0x93
movdqa xmm4, xmm1
pslld xmm1, 7
psrld xmm4, 0x19
pxor xmm1, xmm4
ja 0x4afcf6
movdqu xmmword [rdx], xmm0
movdqu xmmword [rdx + 0x10], xmm3
ret

Function at 0x4afe40
Capabilities:
Access peb ldr_data

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x38
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x60], rdi
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x30], r9
call sym.iox_crypto_chacha20_internal_hardware.hChaChaAVX2.abi0
xorps xmm15, xmm15
mov r14, qword [0x0069dc78]
mov r14, qword gs:[r14]
mov r14, qword [r14]
add rsp, 0x38
pop rbp
ret

Function at 0x4aff00
Capabilities:
Access peb ldr_data

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x38
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x60], rdi
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x30], r9
call sym.iox_crypto_chacha20_internal_hardware.hChaChaSSSE3.abi0
xorps xmm15, xmm15
mov r14, qword [0x0069dc78]
mov r14, qword gs:[r14]
mov r14, qword [r14]
add rsp, 0x38
pop rbp
ret
Function at 0x4c1bc0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c1d0e
push rbp
mov rbp, rsp
sub rsp, 0x68
movups xmmword [rsp + 0x40], xmm15
mov qword [rsp + 0x30], 0
mov rax, qword [0x0060fbb0]
call sym.internal_godebug._Setting_.Value
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x28], rbx
movups xmmword [rsp + 0x50], xmm15
mov qword [rsp + 0x60], 0
lea rcx, [sym.net.goDebugNetDNS.func1]
mov qword [rsp + 0x50], rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x58], rcx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x60], rcx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x2b
call sym.internal_bytealg.IndexByteString.abi0
xorps xmm15, xmm15
mov r14, qword [0x0069dc78]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rcx, qword [rsp + 0x18]
cmp rcx, 0xffffffffffffffff
je 0x4c1cd2
mov rdx, qword [rsp + 0x28]
nop dword [rax + rax]
cmp rdx, rcx
jb 0x4c1d08
mov qword [rsp + 0x20], rcx
mov rsi, qword [rsp + 0x50]
mov rax, qword [rsp + 0x38]
mov rbx, rcx
lea rdx, [rsp + 0x50]
call rsi
mov rax, qword [rsp + 0x20]
lea rcx, [rax + 1]
mov rbx, qword [rsp + 0x28]
cmp rbx, rcx
jb 0x4c1cfd
mov rsi, qword [rsp + 0x50]
sub rbx, rax
dec rbx
mov rdi, rbx
neg rdi
sar rdi, 0x3f
and rcx, rdi
mov rdi, qword [rsp + 0x38]
lea rax, [rdi + rcx]
lea rdx, [rsp + 0x50]
call rsi
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
add rsp, 0x68
pop rbp
ret
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x28]
lea rdx, [rsp + 0x50]
call rcx
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
add rsp, 0x68
pop rbp
ret
mov rax, rcx
mov rcx, rbx
call sym.runtime.panicSliceB
call sym.runtime.panicSliceAlen
nop
call sym.runtime.morestack_noctxt.abi0
jmp sym.net.goDebugNetDNS
Function at 0x4d06c0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d08a0
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x88], r8
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x60], rax
cmp rsi, 2
jne 0x4d0736
cmp word [rdi], 0x7069
jne 0x4d0792
mov qword [rsp], r8
mov qword [rsp + 8], r9
mov byte [rsp + 0x10], 0x3a
call sym.internal_bytealg.CountString.abi0
xorps xmm15, xmm15
mov r14, qword [0x0069dc78]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
setg al
mov rbx, qword [rsp + 0x68]
mov ecx, eax
mov rax, qword [rsp + 0x60]
jmp 0x4d0794
cmp rsi, 3
jne 0x4d0792
cmp word [rdi], 0x6374
jne 0x4d0749
cmp byte [rdi + 2], 0x70
je 0x4d0756
cmp word [rdi], 0x6475
jne 0x4d0792
cmp byte [rdi + 2], 0x70
jne 0x4d0792
mov qword [rsp], r8
mov qword [rsp + 8], r9
mov byte [rsp + 0x10], 0x5b
call sym.internal_bytealg.CountString.abi0
xorps xmm15, xmm15
mov r14, qword [0x0069dc78]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
setg al
mov rbx, qword [rsp + 0x68]
mov ecx, eax
mov rax, qword [rsp + 0x60]
jmp 0x4d0794
xor ecx, ecx
test cl, cl
je 0x4d07a5
mov rdx, rax
mov rcx, rbx
nop
jmp 0x4d0846
mov rsi, rax
mov rcx, rbx
jmp 0x4d07c8
mov rax, qword [rsp + 0x48]
add rax, 0x10
mov rbx, qword [rsp + 0x30]
dec rbx
mov rcx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
test rbx, rbx
jle 0x4d080b
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x48], rax
mov rcx, qword [rax]
mov qword [rsp + 0x20], rcx
mov rbx, qword [rax + 8]
mov qword [rsp + 0x38], rbx
mov rsi, qword [sym.net.isIPv4]
lea rdx, sym.net.isIPv4
mov rax, rcx
call rsi
test al, al
je 0x4d07ad
mov rcx, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x38]
jmp 0x4d0817
test rcx, rcx
jbe 0x4d0821
mov rcx, qword [rsi]
mov rbx, qword [rsi + 8]
mov rax, rcx
add rsp, 0x50
pop rbp
nop
ret
xor eax, eax
mov rcx, rax
call sym.runtime.panicIndex
mov rax, qword [rsp + 0x48]
add rax, 0x10
mov rbx, qword [rsp + 0x30]
dec rbx
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x60]
test rbx, rbx
jle 0x4d0880
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x48], rax
mov rcx, qword [rax]
mov qword [rsp + 0x28], rcx
mov rbx, qword [rax + 8]
mov qword [rsp + 0x40], rbx
mov rax, rcx
call sym.net.isIPv4
test al, al
jne 0x4d082b
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x40]
jmp 0x4d088c
test rcx, rcx
jbe 0x4d0895
mov rcx, qword [rdx]
mov rbx, qword [rdx + 8]
mov rax, rcx
add rsp, 0x50
pop rbp
ret
xor eax, eax
mov rcx, rax
call sym.runtime.panicIndex
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
jmp sym.net.addrList.forResolve
Function at 0x4e2160
Capabilities:
Check for software breakpoints

Disassembly:
lea r12, [rsp - 0x18]
cmp r12, qword [r14 + 0x10]
jbe 0x4e22e8
push rbp
mov rbp, rsp
sub rsp, 0x90
mov rsi, qword [rdx + 8]
mov qword [rsp + 0x58], rsi
mov rdi, qword [rdx + 0x18]
mov qword [rsp + 0x60], rdi
mov r8, qword [rdx + 0x10]
mov qword [rsp + 0x68], r8
mov rdx, qword [rdx + 0x20]
mov qword [rsp + 0x70], rdx
lea rax, [0x00501800]
mov ebx, 0xffe3
mov rcx, rbx
call sym.runtime.makeslice
mov qword [rsp + 0x78], rax
jmp 0x4e21bc
mov rax, rbx
mov rdx, qword [rsp + 0x58]
mov rsi, qword [rdx + 0x20]
mov rbx, rax
mov ecx, 0xffe3
mov rdi, rcx
mov rax, qword [rsp + 0x68]
call rsi
nop word [rax + rax]
test rax, rax
jle 0x4e22d0
cmp rax, 4
jne 0x4e220d
mov rbx, qword [rsp + 0x78]
cmp byte [rbx], 0xcc
jne 0x4e2212
cmp byte [rbx + 1], 0xdd
jne 0x4e2212
cmp byte [rbx + 2], 0xee
jne 0x4e2212
cmp byte [rbx + 3], 0xff
je 0x4e21b9
jmp 0x4e2212
mov rbx, qword [rsp + 0x78]
cmp rax, 0xffe3
ja 0x4e22da
mov rdx, qword [rsp + 0x60]
mov rsi, qword [rdx + 0x28]
mov rcx, rax
mov edi, 0xffe3
mov rax, qword [rsp + 0x70]
call rsi
test rax, rax
jle 0x4e22d0
movups xmmword [rsp + 0x80], xmm15
call sym.runtime.convT64
lea rcx, [0x005019c0]
mov qword [rsp + 0x80], rcx
mov qword [rsp + 0x88], rax
cmp byte [0x0069da48], 0
je 0x4e22d0
lea rax, [rsp + 0x38]
lea rbx, [0x005297f6]
mov ecx, 4
lea rdi, [0x0052c2de]
mov esi, 0x12
lea r8, [0x00559b90]
mov r9d, 1
call sym.runtime.concatstring3
mov rdx, qword [0x006183e8]
mov rcx, rax
mov rdi, rbx
lea rsi, [rsp + 0x80]
mov r8d, 1
mov r9, r8
lea rax, [0x0055b358]
mov rbx, rdx
call sym.fmt.Fprintf
lea rcx, [0x005019c0]
mov rbx, qword [rsp + 0x78]
jmp 0x4e21b9
mov rcx, rax
mov edx, 0xffe3
call sym.runtime.panicSliceAcap
nop
call sym.runtime.morestack.abi0
jmp sym.iox_netio.ForwardUDP.func2
Function at 0x4e2300
Capabilities:
Check for software breakpoints

Disassembly:
lea r12, [rsp - 0x18]
cmp r12, qword [r14 + 0x10]
jbe 0x4e2488
push rbp
mov rbp, rsp
sub rsp, 0x90
mov rsi, qword [rdx + 8]
mov qword [rsp + 0x60], rsi
mov rdi, qword [rdx + 0x18]
mov qword [rsp + 0x58], rdi
mov r8, qword [rdx + 0x10]
mov qword [rsp + 0x70], r8
mov rdx, qword [rdx + 0x20]
mov qword [rsp + 0x68], rdx
lea rax, [0x00501800]
mov ebx, 0xffe3
mov rcx, rbx
call sym.runtime.makeslice
mov qword [rsp + 0x78], rax
jmp 0x4e235c
mov rax, rbx
mov rdx, qword [rsp + 0x60]
mov rsi, qword [rdx + 0x20]
mov rbx, rax
mov ecx, 0xffe3
mov rdi, rcx
mov rax, qword [rsp + 0x70]
call rsi
nop word [rax + rax]
test rax, rax
jle 0x4e2470
cmp rax, 4
jne 0x4e23ad
mov rbx, qword [rsp + 0x78]
cmp byte [rbx], 0xcc
jne 0x4e23b2
cmp byte [rbx + 1], 0xdd
jne 0x4e23b2
cmp byte [rbx + 2], 0xee
jne 0x4e23b2
cmp byte [rbx + 3], 0xff
je 0x4e2359
jmp 0x4e23b2
mov rbx, qword [rsp + 0x78]
cmp rax, 0xffe3
ja 0x4e247a
mov rdx, qword [rsp + 0x58]
mov rsi, qword [rdx + 0x28]
mov rcx, rax
mov edi, 0xffe3
mov rax, qword [rsp + 0x68]
call rsi
test rax, rax
jle 0x4e2470
movups xmmword [rsp + 0x80], xmm15
call sym.runtime.convT64
lea rcx, [0x005019c0]
mov qword [rsp + 0x80], rcx
mov qword [rsp + 0x88], rax
cmp byte [0x0069da48], 0
je 0x4e2470
lea rax, [rsp + 0x38]
lea rbx, [0x005297f6]
mov ecx, 4
lea rdi, [0x0052c2de]
mov esi, 0x12
lea r8, [0x00559b90]
mov r9d, 1
call sym.runtime.concatstring3
mov rdx, qword [0x006183e8]
mov rcx, rax
mov rdi, rbx
lea rsi, [rsp + 0x80]
mov r8d, 1
mov r9, r8
lea rax, [0x0055b358]
mov rbx, rdx
call sym.fmt.Fprintf
lea rcx, [0x005019c0]
mov rbx, qword [rsp + 0x78]
jmp 0x4e2359
mov rcx, rax
mov edx, 0xffe3
call sym.runtime.panicSliceAcap
nop
call sym.runtime.morestack.abi0
jmp sym.iox_netio.ForwardUDP.func1
Function at 0x4e29e0
Capabilities:
Check for software breakpoints

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e2b00
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rsi, qword [rdx + 0x20]
mov qword [rsp + 0x40], rsi
mov rdi, qword [rdx + 0x28]
mov qword [rsp + 0x30], rdi
mov r8, qword [rdx + 8]
mov qword [rsp + 0x28], r8
mov r9, qword [rdx + 0x18]
mov qword [rsp + 0x68], r9
mov rdx, qword [rdx + 0x10]
mov qword [rsp + 0x38], rdx
lea rax, [0x00501800]
mov ebx, 0xffe3
mov rcx, rbx
call sym.runtime.makeslice
mov qword [rsp + 0x48], rax
mov rdx, qword [rsp + 0x28]
mov rsi, qword [rdx + 0x20]
mov rbx, rax
mov ecx, 0xffe3
mov rdi, rcx
mov rax, qword [rsp + 0x38]
call rsi
test rax, rax
jle 0x4e2ae8
mov rsi, qword [rsp + 0x68]
cmp byte [rsi], 0
jne 0x4e2a87
mov qword [rsp + 0x20], rax
mov byte [rsi], 1
mov rax, qword [rsp + 0x40]
lea rbx, [rsp + 0x20]
call sym.runtime.chansend1
mov rax, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x68]
cmp rax, 4
jne 0x4e2aaf
mov rdi, qword [rsp + 0x48]
cmp byte [rdi], 0xcc
jne 0x4e2ab4
cmp byte [rdi + 1], 0xdd
jne 0x4e2ab4
cmp byte [rdi + 2], 0xee
jne 0x4e2ab4
cmp byte [rdi + 3], 0xff
je 0x4e2a1f
jmp 0x4e2ab4
mov rdi, qword [rsp + 0x48]
cmp rax, 0xffe3
ja 0x4e2af2
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], 0xffe3
mov rax, qword [rsp + 0x30]
lea rbx, [rsp + 0x50]
call sym.runtime.chansend1
mov rsi, qword [rsp + 0x68]
jmp 0x4e2a1f
mov rsi, qword [rsp + 0x68]
jmp 0x4e2a1f
mov rcx, rax
mov edx, 0xffe3
call sym.runtime.panicSliceAcap
nop
call sym.runtime.morestack.abi0
jmp sym.iox_netio.ForwardUnconnectedUDP.func2

Function at 0x4e2b20
Capabilities:
Check for software breakpoints

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e2c40
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rsi, qword [rdx + 0x20]
mov qword [rsp + 0x40], rsi
mov rdi, qword [rdx + 0x28]
mov qword [rsp + 0x30], rdi
mov r8, qword [rdx + 8]
mov qword [rsp + 0x28], r8
mov r9, qword [rdx + 0x18]
mov qword [rsp + 0x68], r9
mov rdx, qword [rdx + 0x10]
mov qword [rsp + 0x38], rdx
lea rax, [0x00501800]
mov ebx, 0xffe3
mov rcx, rbx
call sym.runtime.makeslice
mov qword [rsp + 0x48], rax
mov rdx, qword [rsp + 0x28]
mov rsi, qword [rdx + 0x20]
mov rbx, rax
mov ecx, 0xffe3
mov rdi, rcx
mov rax, qword [rsp + 0x38]
call rsi
test rax, rax
jle 0x4e2c28
mov rsi, qword [rsp + 0x68]
cmp byte [rsi], 0
jne 0x4e2bc7
mov qword [rsp + 0x20], rax
mov byte [rsi], 1
mov rax, qword [rsp + 0x40]
lea rbx, [rsp + 0x20]
call sym.runtime.chansend1
mov rax, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x68]
cmp rax, 4
jne 0x4e2bef
mov rdi, qword [rsp + 0x48]
cmp byte [rdi], 0xcc
jne 0x4e2bf4
cmp byte [rdi + 1], 0xdd
jne 0x4e2bf4
cmp byte [rdi + 2], 0xee
jne 0x4e2bf4
cmp byte [rdi + 3], 0xff
je 0x4e2b5f
jmp 0x4e2bf4
mov rdi, qword [rsp + 0x48]
cmp rax, 0xffe3
ja 0x4e2c32
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], 0xffe3
mov rax, qword [rsp + 0x30]
lea rbx, [rsp + 0x50]
call sym.runtime.chansend1
mov rsi, qword [rsp + 0x68]
jmp 0x4e2b5f
mov rsi, qword [rsp + 0x68]
jmp 0x4e2b5f
mov rcx, rax
mov edx, 0xffe3
call sym.runtime.panicSliceAcap
nop
call sym.runtime.morestack.abi0
jmp sym.iox_netio.ForwardUnconnectedUDP.func1
Function at 0x18001b150
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub rsp, 0x38
cmp qword [rdx + 0x18], 7
mov r10, rdx
mov r11, qword [rdx + 0x10]
jbe 0x18001b165
mov r10, qword [rdx]
xor r8d, r8d
movabs r9, 0xcbf29ce484222325
add r11, r11
je 0x18001b1a9
mov qword [rsp + 0x30], rbx
movabs rbx, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [r8 + r10]
inc r8
xor r9, rax
imul r9, rbx
cmp r8, r11
jb 0x18001b190
mov rbx, qword [rsp + 0x30]
mov r8, rdx
lea rdx, [rsp + 0x20]
call fcn.180006d50
mov rax, qword [rsp + 0x28]
test rax, rax
je 0x18001b1c9
add rax, 0x30
add rsp, 0x38
ret
lea rcx, str.invalid_unordered_map_K__T__key
call sub.MSVCP140.dll_void___cdecl_std::_Xout_of_range_char_const____ptr64_
int3
Function at 0x18001d2e0
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov rbx, rdx
mov rdi, rcx
mov dword [rax + 0x20], 1
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
xor r15d, r15d
mov qword [rcx + 0x10], r15
mov qword [rcx + 0x18], 7
mov word [rcx], r15w
mov dword [rax + 0x20], 1
mov dword [rax - 0x58], r15d
xor r9d, r9d
xor r8d, r8d
lea edx, [r15 + 1]
lea rcx, str.HTTP_Request
call qword [sym.imp.WININET.dll_InternetOpenW]
mov r14, rax
test rax, rax
je 0x18001d45d
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], 0x80000000
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbx]
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetOpenUrlW]
mov rbp, rax
test rax, rax
jne 0x18001d37f
mov rcx, r14
call qword [sym.imp.WININET.dll_InternetCloseHandle]
jmp 0x18001d45d
mov ecx, 0x400
call fcn.180028dc0
mov rbx, rax
mov qword [rsp + 0x30], rax
lea rsi, [rax + 0x400]
mov qword [rsp + 0x40], rsi
xor edx, edx
mov r8d, 0x400
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x90], r15d
nop word [rax + rax]
lea r9, [rsp + 0x90]
mov r8d, 0x400
mov rdx, rbx
mov rcx, rbp
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x18001d400
mov r8d, dword [rsp + 0x90]
add r8, rbx
mov rdx, rbx
mov rcx, rdi
call fcn.18001c610
cmp dword [rsp + 0x90], 0
ja 0x18001d3c0
jmp 0x18001d415
mov rax, rdi
cmp qword [rdi + 0x18], 7
jbe 0x18001d40d
mov rax, qword [rdi]
mov qword [rdi + 0x10], r15
mov word [rax], r15w
mov rcx, rbp
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, r14
call qword [sym.imp.WININET.dll_InternetCloseHandle]
nop
test rbx, rbx
je 0x18001d45d
sub rsi, rbx
cmp rsi, 0x1000
jb 0x18001d451
add rsi, 0x27
mov rcx, qword [rbx - 8]
sub rbx, rcx
lea rax, [rbx - 8]
cmp rax, 0x1f
ja 0x18001d474
mov rbx, rcx
mov rdx, rsi
mov rcx, rbx
call fcn.180028dfc
nop
mov rax, rdi
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
int3

Function at 0x18001d650
Capabilities:
Read .ini file

Disassembly:
push rbx
sub rsp, 0x250
mov rax, qword [0x180058240]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rax, qword [rdx]
mov r11, r9
mov r10, r8
mov qword [rsp + 0x38], rcx
mov rbx, rcx
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
mov dword [rsp + 0x20], 0xff
mov rdx, qword [r11]
lea r8, [0x18002dae8]
mov rcx, qword [r10]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
xorps xmm0, xmm0
lea rax, [rsp + 0x40]
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], 0
mov r8, 0xffffffffffffffff
mov qword [rbx + 0x18], 0
inc r8
cmp word [rax + r8*2], 0
jne 0x18001d6c3
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.1800013b0
mov rax, rbx
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.180029320
add rsp, 0x250
pop rbx
ret
Function at 0x18001de00
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x180058240]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x18001ded5
cmp byte [rcx + 0x72], 0
je 0x18001ded5
mov rax, qword [rcx]
mov qword [rsp + 0x78], rdi
mov edi, 0xffff
mov edx, edi
call qword [rax + 0x18]
cmp di, ax
je 0x18001ded1
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_wchar_t__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x18001de96
sub eax, 1
je 0x18001de9a
cmp eax, 2
jne 0x18001ded1
mov byte [rbx + 0x72], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180029320
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x72], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x18001dec8
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x18001ded1
cmp byte [rbx + 0x72], 0
sete al
jmp 0x18001de7e
xor al, al
jmp 0x18001de7e
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180029320
add rsp, 0x60
pop rbx
ret