joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000af5a
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenc xmm8, xmm1
aesenc xmm9, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
aesenc xmm6, xmm0
aesenc xmm7, xmm0
aesenc xmm8, xmm0
aesenc xmm9, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x14000af30
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenc xmm8, xmm1
aesenc xmm9, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
aesenclast xmm6, xmm0
aesenclast xmm7, xmm0
aesenclast xmm8, xmm0
aesenclast xmm9, xmm0
repz ret

Function at 0x14000aff0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
pxor xmm6, xmm0
lea rcx, [rcx + rax + 0x20]
neg rax
aesdec xmm2, xmm1
pxor xmm7, xmm0
pxor xmm8, xmm0
aesdec xmm3, xmm1
pxor xmm9, xmm0
movups xmm0, xmmword [rcx + rax]
add rax, 0x10
jmp 0x14000b04a
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
aesdec xmm8, xmm1
aesdec xmm9, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
aesdec xmm6, xmm0
aesdec xmm7, xmm0
aesdec xmm8, xmm0
aesdec xmm9, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x14000b040
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
aesdec xmm8, xmm1
aesdec xmm9, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
aesdeclast xmm6, xmm0
aesdeclast xmm7, xmm0
aesdeclast xmm8, xmm0
aesdeclast xmm9, xmm0
repz ret
Function at 0x14000d840
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
pxor xmm15, xmm9
movdqu xmm11, xmmword [rbx + r12]
movdqa xmm12, xmm10
movdqu xmm13, xmmword [rbx + r13]
movdqa xmm14, xmm10
pxor xmm10, xmm15
movdqu xmm15, xmmword [rbx + r14]
pxor xmm11, xmm10
pxor xmm8, xmm2
pxor xmm2, xmm10
pxor xmm12, xmm11
pxor xmm8, xmm3
pxor xmm3, xmm11
pxor xmm13, xmm12
pxor xmm8, xmm4
pxor xmm4, xmm12
pxor xmm14, xmm13
pxor xmm8, xmm5
pxor xmm5, xmm13
pxor xmm15, xmm14
pxor xmm8, xmm6
pxor xmm6, xmm14
pxor xmm8, xmm7
pxor xmm7, xmm15
movups xmm0, xmmword [r11 + 0x20]
lea r12, [r8 + 1]
lea r13, [r8 + 3]
lea r14, [r8 + 5]
add r8, 6
pxor xmm10, xmm9
bsf r12, r12
bsf r13, r13
bsf r14, r14
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
pxor xmm11, xmm9
pxor xmm12, xmm9
aesenc xmm6, xmm1
pxor xmm13, xmm9
pxor xmm14, xmm9
aesenc xmm7, xmm1
movups xmm1, xmmword [r11 + 0x30]
pxor xmm15, xmm9
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
aesenc xmm6, xmm0
aesenc xmm7, xmm0
movups xmm0, xmmword [r11 + 0x40]
shl r12, 4
shl r13, 4
jmp 0x14000d960
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
aesenc xmm6, xmm0
aesenc xmm7, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x14000d960
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
movups xmm1, xmmword [r11 + 0x10]
shl r14, 4
aesenclast xmm2, xmm10
movdqu xmm10, xmmword [rbx]
mov rax, r10
aesenclast xmm3, xmm11
aesenclast xmm4, xmm12
aesenclast xmm5, xmm13
aesenclast xmm6, xmm14
aesenclast xmm7, xmm15
repz ret

Function at 0x14000da00
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
pxor xmm15, xmm9
movdqu xmm11, xmmword [rbx + r12]
movdqa xmm12, xmm10
movdqu xmm13, xmmword [rbx + r13]
pxor xmm10, xmm15
pxor xmm11, xmm10
pxor xmm8, xmm2
pxor xmm2, xmm10
pxor xmm12, xmm11
pxor xmm8, xmm3
pxor xmm3, xmm11
pxor xmm13, xmm12
pxor xmm8, xmm4
pxor xmm4, xmm12
pxor xmm8, xmm5
pxor xmm5, xmm13
movups xmm0, xmmword [r11 + 0x20]
pxor xmm10, xmm9
pxor xmm11, xmm9
pxor xmm12, xmm9
pxor xmm13, xmm9
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
movups xmm1, xmmword [r11 + 0x30]
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
movups xmm0, xmmword [r11 + 0x40]
jmp 0x14000daa0
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x14000daa0
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
movups xmm1, xmmword [r11 + 0x10]
mov rax, r10
aesenclast xmm2, xmm10
aesenclast xmm3, xmm11
aesenclast xmm4, xmm12
aesenclast xmm5, xmm13
repz ret
Function at 0x14000db20
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
pxor xmm7, xmm15
pxor xmm7, xmm9
pxor xmm8, xmm2
pxor xmm2, xmm7
movups xmm0, xmmword [r11 + 0x20]
aesenc xmm2, xmm1
movups xmm1, xmmword [r11 + 0x30]
pxor xmm7, xmm9
aesenc xmm2, xmm0
movups xmm0, xmmword [r11 + 0x40]
jmp 0x14000db60
aesenc xmm2, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x14000db60
aesenc xmm2, xmm1
movups xmm1, xmmword [r11 + 0x10]
mov rax, r10
aesenclast xmm2, xmm7
repz ret

Function at 0x14000df60
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
pxor xmm15, xmm9
movdqu xmm11, xmmword [rbx + r12]
movdqa xmm12, xmm10
movdqu xmm13, xmmword [rbx + r13]
movdqa xmm14, xmm10
pxor xmm10, xmm15
movdqu xmm15, xmmword [rbx + r14]
pxor xmm11, xmm10
pxor xmm2, xmm10
pxor xmm12, xmm11
pxor xmm3, xmm11
pxor xmm13, xmm12
pxor xmm4, xmm12
pxor xmm14, xmm13
pxor xmm5, xmm13
pxor xmm15, xmm14
pxor xmm6, xmm14
pxor xmm7, xmm15
movups xmm0, xmmword [r11 + 0x20]
lea r12, [r8 + 1]
lea r13, [r8 + 3]
lea r14, [r8 + 5]
add r8, 6
pxor xmm10, xmm9
bsf r12, r12
bsf r13, r13
bsf r14, r14
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
pxor xmm11, xmm9
pxor xmm12, xmm9
aesdec xmm6, xmm1
pxor xmm13, xmm9
pxor xmm14, xmm9
aesdec xmm7, xmm1
movups xmm1, xmmword [r11 + 0x30]
pxor xmm15, xmm9
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
aesdec xmm6, xmm0
aesdec xmm7, xmm0
movups xmm0, xmmword [r11 + 0x40]
shl r12, 4
shl r13, 4
jmp 0x14000e060
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
aesdec xmm6, xmm0
aesdec xmm7, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x14000e060
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
movups xmm1, xmmword [r11 + 0x10]
shl r14, 4
aesdeclast xmm2, xmm10
movdqu xmm10, xmmword [rbx]
mov rax, r10
aesdeclast xmm3, xmm11
aesdeclast xmm4, xmm12
aesdeclast xmm5, xmm13
aesdeclast xmm6, xmm14
aesdeclast xmm7, xmm15
repz ret
Function at 0x14000e100
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
pxor xmm15, xmm9
movdqu xmm11, xmmword [rbx + r12]
movdqa xmm12, xmm10
movdqu xmm13, xmmword [rbx + r13]
pxor xmm10, xmm15
pxor xmm11, xmm10
pxor xmm2, xmm10
pxor xmm12, xmm11
pxor xmm3, xmm11
pxor xmm13, xmm12
pxor xmm4, xmm12
pxor xmm5, xmm13
movups xmm0, xmmword [r11 + 0x20]
pxor xmm10, xmm9
pxor xmm11, xmm9
pxor xmm12, xmm9
pxor xmm13, xmm9
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
movups xmm1, xmmword [r11 + 0x30]
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
movups xmm0, xmmword [r11 + 0x40]
jmp 0x14000e1a0
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x14000e1a0
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
movups xmm1, xmmword [r11 + 0x10]
mov rax, r10
aesdeclast xmm2, xmm10
aesdeclast xmm3, xmm11
aesdeclast xmm4, xmm12
aesdeclast xmm5, xmm13
repz ret

Function at 0x14000e220
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
pxor xmm7, xmm15
pxor xmm7, xmm9
pxor xmm2, xmm7
movups xmm0, xmmword [r11 + 0x20]
aesdec xmm2, xmm1
movups xmm1, xmmword [r11 + 0x30]
pxor xmm7, xmm9
aesdec xmm2, xmm0
movups xmm0, xmmword [r11 + 0x40]
jmp 0x14000e260
aesdec xmm2, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x14000e260
aesdec xmm2, xmm1
movups xmm1, xmmword [r11 + 0x10]
mov rax, r10
aesdeclast xmm2, xmm7
repz ret
Function at 0x14000ecd0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 8
call fcn.14000ed40
shl edx, 4
test eax, eax
jne 0x14000ed36
lea rcx, [r8 + rdx + 0x10]
movups xmm0, xmmword [r8]
movups xmm1, xmmword [rcx]
movups xmmword [rcx], xmm0
movups xmmword [r8], xmm1
lea r8, [r8 + 0x10]
lea rcx, [rcx - 0x10]
movups xmm0, xmmword [r8]
movups xmm1, xmmword [rcx]
aesimc xmm0, xmm0
aesimc xmm1, xmm1
lea r8, [r8 + 0x10]
lea rcx, [rcx - 0x10]
movups xmmword [rcx + 0x10], xmm0
movups xmmword [r8 - 0x10], xmm1
cmp rcx, r8
ja 0x14000ecfb
movups xmm0, xmmword [r8]
aesimc xmm0, xmm0
pxor xmm1, xmm1
movups xmmword [rcx], xmm0
pxor xmm0, xmm0
add rsp, 8
repz ret
Function at 0x14000fe00
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
vmovdqu xmm4, xmmword [rcx - 0x80]
vmovdqu xmm2, xmmword [r11 + 0x20]
lea r13, [rbp - 1]
vmovups xmm15, xmmword [rcx - 0x70]
lea r12, [rcx - 0x60]
vpxor xmm9, xmm1, xmm4
add ebx, 0x6000000
jb 0x14000ff20
vpaddb xmm10, xmm1, xmm2
vpaddb xmm11, xmm10, xmm2
vpxor xmm10, xmm10, xmm4
vpaddb xmm12, xmm11, xmm2
vpxor xmm11, xmm11, xmm4
vpaddb xmm13, xmm12, xmm2
vpxor xmm12, xmm12, xmm4
vpaddb xmm14, xmm13, xmm2
vpxor xmm13, xmm13, xmm4
vpaddb xmm1, xmm14, xmm2
vpxor xmm14, xmm14, xmm4
jmp 0x14000fe60
vaesenc xmm9, xmm9, xmm15
vaesenc xmm10, xmm10, xmm15
vaesenc xmm11, xmm11, xmm15
vaesenc xmm12, xmm12, xmm15
vaesenc xmm13, xmm13, xmm15
vaesenc xmm14, xmm14, xmm15
vmovups xmm15, xmmword [r12]
lea r12, [r12 + 0x10]
dec r13d
jne 0x14000fe60
vmovdqu xmm3, xmmword [r12]
vaesenc xmm9, xmm9, xmm15
vpxor xmm4, xmm3, xmmword [rdi]
vaesenc xmm10, xmm10, xmm15
vpxor xmm5, xmm3, xmmword [rdi + 0x10]
vaesenc xmm11, xmm11, xmm15
vpxor xmm6, xmm3, xmmword [rdi + 0x20]
vaesenc xmm12, xmm12, xmm15
vpxor xmm8, xmm3, xmmword [rdi + 0x30]
vaesenc xmm13, xmm13, xmm15
vpxor xmm2, xmm3, xmmword [rdi + 0x40]
vaesenc xmm14, xmm14, xmm15
vpxor xmm3, xmm3, xmmword [rdi + 0x50]
lea rdi, [rdi + 0x60]
vaesenclast xmm9, xmm9, xmm4
vaesenclast xmm10, xmm10, xmm5
vaesenclast xmm11, xmm11, xmm6
vaesenclast xmm12, xmm12, xmm8
vaesenclast xmm13, xmm13, xmm2
vaesenclast xmm14, xmm14, xmm3
vmovups xmmword [rsi], xmm9
vmovups xmmword [rsi + 0x10], xmm10
vmovups xmmword [rsi + 0x20], xmm11
vmovups xmmword [rsi + 0x30], xmm12
vmovups xmmword [rsi + 0x40], xmm13
vmovups xmmword [rsi + 0x50], xmm14
lea rsi, [rsi + 0x60]
repz ret
vpshufb xmm6, xmm1, xmm0
vmovdqu xmm5, xmmword [r11 + 0x30]
vpaddd xmm10, xmm6, xmmword [r11 + 0x40]
vpaddd xmm11, xmm6, xmm5
vpaddd xmm12, xmm10, xmm5
vpshufb xmm10, xmm10, xmm0
vpaddd xmm13, xmm11, xmm5
vpshufb xmm11, xmm11, xmm0
vpxor xmm10, xmm10, xmm4
vpaddd xmm14, xmm12, xmm5
vpshufb xmm12, xmm12, xmm0
vpxor xmm11, xmm11, xmm4
vpaddd xmm1, xmm13, xmm5
vpshufb xmm13, xmm13, xmm0
vpxor xmm12, xmm12, xmm4
vpshufb xmm14, xmm14, xmm0
vpxor xmm13, xmm13, xmm4
vpshufb xmm1, xmm1, xmm0
vpxor xmm14, xmm14, xmm4
jmp 0x14000fe60
Function at 0x14003e2c0
Capabilities:
Encode data using xor

Disassembly:
sub rdx, r8
sub rcx, r8
mov r10, r9
shr r9, 4
je 0x14003e2f5
nop
movdqu xmm0, xmmword [rdx + r8]
pxor xmm0, xmmword [r8]
movdqu xmmword [rcx + r8], xmm0
movdqa xmmword [r8], xmm0
lea r8, [r8 + 0x10]
dec r9
jne 0x14003e2d0
and r10, 0xf
je 0x14003e325
mov r9d, reloc.WS2_32.dll_recv
sub r9, r10
xor eax, eax
mov al, byte [rdx + r8]
xor al, byte [r8]
mov byte [rcx + r8], al
mov byte [r8], al
lea r8, [r8 + 1]
dec r10
jne 0x14003e300
xor eax, eax
mov byte [r8], al
lea r8, [r8 + 1]
dec r9
jne 0x14003e319
mov rax, r8
repz ret

Function at 0x14003e330
Capabilities:
Encode data using xor

Disassembly:
sub rdx, r8
sub rcx, r8
mov r10, r9
shr r9, 4
je 0x14003e36d
nop
movdqu xmm0, xmmword [rdx + r8]
movdqa xmm1, xmmword [r8]
pxor xmm1, xmm0
movdqu xmmword [rcx + r8], xmm1
movdqa xmmword [r8], xmm0
lea r8, [r8 + 0x10]
dec r9
jne 0x14003e340
pxor xmm1, xmm1
and r10, 0xf
je 0x14003e3a3
mov r9d, reloc.WS2_32.dll_recv
sub r9, r10
xor eax, eax
xor r11, r11
mov r11b, byte [rdx + r8]
mov al, byte [r8]
xor al, r11b
mov byte [rcx + r8], al
mov byte [r8], r11b
lea r8, [r8 + 1]
dec r10
jne 0x14003e37b
xor eax, eax
mov byte [r8], al
lea r8, [r8 + 1]
dec r9
jne 0x14003e397
mov rax, r8
repz ret
Function at 0x14012b490
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
mov qword [rsp + 8], rcx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x20
mov qword [rcx + 0x10], r9
lea rbx, [rdx + 0x20]
mov qword [rcx], rdx
mov rbp, rdx
mov qword [rcx + 8], r8
lea rdx, [rsp + 0x50]
mov rax, qword [r8]
mov rdi, rcx
mov byte [rsp + 0x58], r9b
mov rcx, r8
shr r9, 8
test r9b, r9b
sete byte [rsp + 0x59]
call qword [rax + reloc.WS2_32.dll_htonl]
xor r12d, r12d
mov r14d, 0x58
lea rsi, [rdi + 0x38]
mov ecx, dword [rax]
mov qword [rdi + 0x18], rbx
mov eax, dword [rbx]
mov dword [rdi + 0x20], eax
mov dword [rdi + 0x24], r12d
mov byte [rdi + 0x28], r12b
mov dword [rsp + 0x5c], ecx
mov rax, qword [rsp + 0x58]
mov ecx, dword [0x14039f4c0]
mov qword [rdi + 0x2c], rax
mov rax, qword [rdi]
mov rax, qword [rax + 0x60]
mov qword [rsp + 0x50], rax
mov rax, qword gs:[0x58]
movsd xmm0, qword [rsp + 0x50]
mov qword [rsi], r12
mov dword [rsi + 8], r12d
mov rbx, qword [rax + rcx*8]
mov qword [rsi + 0x10], 0xffffffffffffffff
movsd qword [rsi + 0x18], xmm0
cmp byte [r14 + rbx], r12b
jne 0x14012b550
call fcn.1402c5654
mov r15d, 8
mov rax, qword [r15 + rbx]
mov qword [rdi + 0x58], rax
cmp byte [r14 + rbx], r12b
jne 0x14012b569
call fcn.1402c5654
mov qword [r15 + rbx], rsi
mov qword [rdi + 0x60], r12
cmp byte [r14 + rbx], r12b
jne 0x14012b57c
call fcn.1402c5654
mov r15d, reloc.WS2_32.dll_getservbyport
lea rsi, [rbp + 0x40]
mov rax, qword [r15 + rbx]
mov qword [rdi + 0x68], rax
cmp qword [rsi + 0x18], 0xf
jbe 0x14012b598
mov rsi, qword [rsi]
cmp byte [r14 + rbx], r12b
jne 0x14012b5a3
call fcn.1402c5654
mov rcx, rdi
mov qword [r15 + rbx], rsi
call fcn.14014bff0
mov rbx, qword [rsp + 0x60]
mov rax, rdi
mov rbp, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret

Function at 0x14012df80
Capabilities:
Terminate process

Disassembly:
push rbx
mov eax, 0x2880
call fcn.1402c5820
sub rsp, rax
mov rax, qword [0x14039ac80]
xor rax, rsp
mov qword [rsp + 0x2870], rax
mov rbx, rcx
mov r8d, 0x2710
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x58]
call fcn.14012b8b0
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x20], xmm0
xor r8d, r8d
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.140154660
nop
mov rdx, qword [rbx]
lea rcx, [rsp + 0x30]
call fcn.140160510
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.14012fdf0
mov rcx, rax
call fcn.14012ffe0
mov rdx, rax
mov rcx, rbx
call fcn.140128660
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x14015bfe0
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x50
cmp byte [rcx + 8], 0
mov rbx, rdx
movzx eax, r8b
mov dword [rsp + 0x70], eax
je 0x14015c065
mov rcx, qword [rcx]
lea r8, [rsp + 0x70]
mov edx, 0x8004667e
call qword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
je 0x14015c057
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov qword [rsp + 0x48], 0x1d
lea rcx, str.Failed_to_change_socket_flags
mov qword [rsp + 0x40], rcx
mov r9d, eax
movaps xmm0, xmmword [rsp + 0x40]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x20], rcx
mov r8b, 1
mov rcx, rbx
movdqa xmmword [rsp + 0x40], xmm0
xor edx, edx
call fcn.14012b920
mov rax, rbx
add rsp, 0x50
pop rbx
ret
xor eax, eax
mov qword [rbx], rax
mov rax, rbx
add rsp, 0x50
pop rbx
ret
mov r8d, 0xbd
lea rdx, str.D:_a_ton_ton_tdutils_tdutilsportdetailNativeFd.cpp
lea rcx, str.is_socket_
call fcn.140153ae0
int3
Function at 0x14015f1e0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push r15
sub rsp, 0xc0
mov rax, qword [0x14039ac80]
xor rax, rsp
mov qword [rsp + 0xb0], rax
movzx ebx, dl
mov rsi, rcx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
xor r15d, r15d
mov ebp, dword [rax]
test bl, bl
je 0x14015f380
mov qword [rsp + 0xe8], rdi
xor ecx, ecx
mov qword [rsp + 0xf0], r14
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov r14d, 0x7fffffff
mov word [rsp + 0xa2], 0x205d
test eax, eax
lea r9, [rsp + 0xa2]
mov r8, rax
cmovs r8d, r14d
nop dword [rax]
nop dword [rax + rax]
mov eax, 0x66666667
lea r9, [r9 - 1]
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r8b, cl
add r8b, 0x30
mov byte [r9], r8b
mov r8d, edx
test edx, edx
jg 0x14015f260
lea rcx, [r9 - 1]
mov edx, 3
mov byte [rcx], 0x20
lea rbx, [0x140000000]
nop word [rax + rax]
movzx eax, byte [rdx + rbx + 0x2cd774]
lea rcx, [rcx - 1]
sub rdx, 1
mov byte [rcx], al
jns 0x14015f2b0
lea rdi, [rcx - 1]
mov byte [rdi], 0x5b
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
test eax, eax
mov byte [rdi - 1], 0x20
mov r8d, eax
mov byte [rdi - 2], 0x5d
cmovs r8d, r14d
mov r14, qword [rsp + 0xf0]
sub rdi, 2
nop
dec rdi
mov eax, 0x66666667
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r8b, cl
add r8b, 0x30
mov byte [rdi], r8b
mov r8d, edx
test edx, edx
jg 0x14015f2f0
dec rdi
mov ecx, 2
mov byte [rdi], 0x20
nop dword [rax]
movzx eax, byte [rcx + rbx + 0x2ceb10]
dec rdi
sub rcx, 1
mov byte [rdi], al
jns 0x14015f330
dec rdi
lea rbx, [rsp + 0xa4]
mov ecx, 0xfffffff4
sub rbx, rdi
mov byte [rdi], 0x5b
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], r15
mov rcx, rax
mov r8d, ebx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rdi, qword [rsp + 0xe8]
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov r8d, dword [rsi + 8]
lea r9, [rsp + 0x30]
mov rdx, qword [rsi]
mov rcx, rax
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], ebp
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1402c5880
mov rbx, qword [rsp + 0xf8]
add rsp, 0xc0
pop r15
pop rsi
pop rbp
ret
Function at 0x140160cd0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x140160e5f
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x40], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.1401609e0
lea rax, [rdi - 1]
mov qword [rsi + 0x38], rdi
mov qword [rsi + 0x30], rax
mov rax, qword [rsi + 8]
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x140160e24
mov qword [rsp + 0x38], rbp
movabs rdi, 0xcbf29ce484222325
movabs rbp, 0x100000001b3
nop dword [rax]
nop dword [rax + rax]
movzx r9d, byte [rax + 0x10]
mov r11, qword [rsi + 0x30]
mov edx, r9d
mov rcx, qword [rcx]
xor rdx, rdi
imul rdx, rbp
and r11, rdx
shl r11, 4
add r11, qword [rsi + 0x18]
mov r8, qword [r11]
cmp r8, rbx
jne 0x140160da2
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x140160e13
mov rdx, qword [r11 + 8]
cmp r9b, byte [rdx + 0x10]
jne 0x140160ddb
mov r10, qword [rdx]
cmp r10, rax
je 0x140160dd5
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x140160e13
cmp r8, rdx
je 0x140160def
mov rdx, qword [rdx + 8]
cmp r9b, byte [rdx + 0x10]
je 0x140160e39
cmp r8, rdx
jne 0x140160de0
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
jne 0x140160d70
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov r14, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x140160e13
lea rcx, str.invalid_hash_bucket_count
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_
int3
Function at 0x140165110
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
mov rdi, rcx
mov rcx, rbx
lea rdx, [rsp + 0x68]
xor r8d, r8d
call fcn.14015bfe0
mov rax, qword [rsp + 0x68]
test rax, rax
jne 0x1401651b0
mov rcx, rbx
call fcn.14015c080
lea r9, [rsp + 0x60]
mov dword [rsp + 0x60], 1
mov edx, 0xffff
mov dword [rsp + 0x20], 4
mov r8d, 4
mov rcx, rax
mov rbx, rax
call qword [sym.imp.WS2_32.dll_setsockopt]
lea r9, [rsp + 0x60]
mov dword [rsp + 0x20], 4
mov edx, 0xffff
mov r8d, 8
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_setsockopt]
mov edx, 6
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x60]
mov rcx, rbx
lea r8d, [rdx - 5]
call qword [sym.imp.WS2_32.dll_setsockopt]
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov qword [rdi], rax
mov rax, rdi
add rsp, 0x40
pop rdi
ret

Function at 0x1401651d0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rdi
sub rsp, 0x80
cmp byte [rcx + 0x49], 0
mov rdi, rcx
je 0x14016535e
cmp byte [rcx + 0x4a], 0
jne 0x140165344
cmp byte [rcx + 0x48], 0
jne 0x14016533b
xorps xmm0, xmm0
mov qword [rsp + 0xa0], rbx
lea rbx, [rcx + 0xd0]
movaps xmmword [rsp + 0x70], xmm6
movups xmmword [rbx], xmm0
add rcx, 0x50
lea rdx, [rsp + 0x50]
xor r8d, r8d
movups xmmword [rbx + 0x10], xmm0
call fcn.14013f6f0
lea rax, str.D:_a_ton_ton_tdutils_tdutilsportSocketFd.cpp
mov dword [rsp + 0x48], 0xcc
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x98]
mov rax, qword [rsp + 0x58]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x98], rax
call fcn.140163580
mov dword [rsp + 0x60], eax
lea rcx, [rdi + 0x18]
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x90], 0
call fcn.14015c080
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov rcx, rax
mov qword [rsp + 0x28], rbx
lea rax, [rsp + 0x90]
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r8d, [r9 + 1]
call qword [sym.imp.WS2_32.dll_WSARecv]
mov rbx, qword [rsp + 0xa0]
test eax, eax
je 0x14016532a
lea rax, str.Failed_to_read_from_connection
mov qword [rsp + 0x58], 0x1e
mov qword [rsp + 0x50], rax
movaps xmm6, xmmword [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
je 0x14016532a
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rcx, [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm6
mov qword [rsp + 0x20], rcx
mov r9d, eax
lea rcx, [rsp + 0x98]
mov r8b, 1
xor edx, edx
call fcn.14012b920
lea rdx, [rsp + 0x98]
mov rcx, rdi
call fcn.140165990
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x80
pop rdi
ret
mov rcx, rdi
call fcn.140164fc0
movaps xmm6, xmmword [rsp + 0x70]
mov byte [rdi + 0x4a], 1
add rsp, 0x80
pop rdi
ret
mov r8d, 0xc5
lea rdx, str.D:_a_ton_ton_tdutils_tdutilsportSocketFd.cpp
lea rcx, str._is_read_active_
call fcn.140153ae0
int3
mov r8d, 0xc4
lea rdx, str.D:_a_ton_ton_tdutils_tdutilsportSocketFd.cpp
lea rcx, str.is_connected_
call fcn.140153ae0
int3