joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14007fc80
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
pxor xmm7, xmm15
pxor xmm7, xmm9
pxor xmm8, xmm2
pxor xmm2, xmm7
movups xmm0, xmmword [r11 + 0x20]
aesenc xmm2, xmm1
movups xmm1, xmmword [r11 + 0x30]
pxor xmm7, xmm9
aesenc xmm2, xmm0
movups xmm0, xmmword [r11 + 0x40]
jmp 0x14007fcc0
aesenc xmm2, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x14007fcc0
aesenc xmm2, xmm1
movups xmm1, xmmword [r11 + 0x10]
mov rax, r10
aesenclast xmm2, xmm7
repz ret

Function at 0x1400800e0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
pxor xmm15, xmm9
movdqu xmm11, xmmword [rbx + r12]
movdqa xmm12, xmm10
movdqu xmm13, xmmword [rbx + r13]
movdqa xmm14, xmm10
pxor xmm10, xmm15
movdqu xmm15, xmmword [rbx + r14]
pxor xmm11, xmm10
pxor xmm2, xmm10
pxor xmm12, xmm11
pxor xmm3, xmm11
pxor xmm13, xmm12
pxor xmm4, xmm12
pxor xmm14, xmm13
pxor xmm5, xmm13
pxor xmm15, xmm14
pxor xmm6, xmm14
pxor xmm7, xmm15
movups xmm0, xmmword [r11 + 0x20]
lea r12, [r8 + 1]
lea r13, [r8 + 3]
lea r14, [r8 + 5]
add r8, 6
pxor xmm10, xmm9
bsf r12, r12
bsf r13, r13
bsf r14, r14
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
pxor xmm11, xmm9
pxor xmm12, xmm9
aesdec xmm6, xmm1
pxor xmm13, xmm9
pxor xmm14, xmm9
aesdec xmm7, xmm1
movups xmm1, xmmword [r11 + 0x30]
pxor xmm15, xmm9
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
aesdec xmm6, xmm0
aesdec xmm7, xmm0
movups xmm0, xmmword [r11 + 0x40]
shl r12, 4
shl r13, 4
jmp 0x1400801e0
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
aesdec xmm6, xmm0
aesdec xmm7, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x1400801e0
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
movups xmm1, xmmword [r11 + 0x10]
shl r14, 4
aesdeclast xmm2, xmm10
movdqu xmm10, xmmword [rbx]
mov rax, r10
aesdeclast xmm3, xmm11
aesdeclast xmm4, xmm12
aesdeclast xmm5, xmm13
aesdeclast xmm6, xmm14
aesdeclast xmm7, xmm15
repz ret
Function at 0x1400802a0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
pxor xmm15, xmm9
movdqu xmm11, xmmword [rbx + r12]
movdqa xmm12, xmm10
movdqu xmm13, xmmword [rbx + r13]
pxor xmm10, xmm15
pxor xmm11, xmm10
pxor xmm2, xmm10
pxor xmm12, xmm11
pxor xmm3, xmm11
pxor xmm13, xmm12
pxor xmm4, xmm12
pxor xmm5, xmm13
movups xmm0, xmmword [r11 + 0x20]
pxor xmm10, xmm9
pxor xmm11, xmm9
pxor xmm12, xmm9
pxor xmm13, xmm9
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
movups xmm1, xmmword [r11 + 0x30]
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
movups xmm0, xmmword [r11 + 0x40]
jmp 0x140080340
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x140080340
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
movups xmm1, xmmword [r11 + 0x10]
mov rax, r10
aesdeclast xmm2, xmm10
aesdeclast xmm3, xmm11
aesdeclast xmm4, xmm12
aesdeclast xmm5, xmm13
repz ret

Function at 0x1400803c0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
pxor xmm7, xmm15
pxor xmm7, xmm9
pxor xmm2, xmm7
movups xmm0, xmmword [r11 + 0x20]
aesdec xmm2, xmm1
movups xmm1, xmmword [r11 + 0x30]
pxor xmm7, xmm9
aesdec xmm2, xmm0
movups xmm0, xmmword [r11 + 0x40]
jmp 0x140080400
aesdec xmm2, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x140080400
aesdec xmm2, xmm1
movups xmm1, xmmword [r11 + 0x10]
mov rax, r10
aesdeclast xmm2, xmm7
repz ret
Function at 0x140081d80
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov ecx, dword [0x14012c434]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rdi
add rsp, 0x28
pop rdi
pop rsi
ret

Function at 0x140081db0
Capabilities:
Set thread local storage value

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rdi, r8
mov rsi, rdx
mov ebp, ecx
lea rcx, [0x14012c428]
lea rdx, [0x140081d50]
call fcn.140081ba0
cmp dword [0x14012c430], 0
je 0x140081de7
mov rcx, rsi
call rdi
xor eax, eax
jmp 0x140081e24
call fcn.140081d80
mov rbx, rax
test rax, rax
je 0x140081e2f
lea r14, [0x14012c438]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
movsxd rbp, ebp
lea rax, [0x14012c440]
mov qword [rax + rbp*8], rdi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov qword [rbx + rbp*8], rsi
mov eax, 1
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
mov ecx, 0x18
call fcn.140060000
test rax, rax
je 0x140081dde
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], 0
mov ecx, dword [0x14012c434]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x140081df4
mov rcx, rbx
call fcn.140060030
jmp 0x140081dde

Function at 0x1400889d0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test rdx, rdx
je 0x140088a0c
mov rsi, rdx
mov rdi, rcx
mov r14d, 0xffffffff
cmp rsi, r14
mov ebx, 0xffffffff
cmovb rbx, rsi
mov rcx, rdi
mov edx, ebx
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x140088a16
add rdi, rbx
sub rsi, rbx
jne 0x1400889ea
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.1400dad20
ud2
Function at 0x140089bd0
Capabilities:
Encode data using xor

Disassembly:
lea r11, [0x14008a800]
movdqu xmm7, xmmword [rcx]
lea rcx, [rcx + 0x10]
movdqa xmm0, xmmword [r11]
movdqa xmm1, xmmword [r11 + 0x10]
movdqa xmm2, xmmword [r11 + 0x20]
movdqa xmm3, xmmword [r11 + 0x30]
movdqa xmm4, xmmword [r11 + 0x40]
pcmpeqd xmm5, xmm5
movdqu xmm6, xmmword [rcx]
movdqa xmmword [rax], xmm7
lea rax, [rax + 0x10]
dec r10d
jmp 0x140089c20
pshufb xmm6, xmm4
movdqa xmm8, xmm0
movdqa xmm9, xmm1
pand xmm8, xmm6
pand xmm9, xmm6
movdqa xmm10, xmm2
pcmpeqb xmm8, xmm0
psllq xmm0, 4
movdqa xmm11, xmm3
pcmpeqb xmm9, xmm1
psllq xmm1, 4
pand xmm10, xmm6
pand xmm11, xmm6
movdqa xmm12, xmm0
pcmpeqb xmm10, xmm2
psllq xmm2, 4
movdqa xmm13, xmm1
pcmpeqb xmm11, xmm3
psllq xmm3, 4
movdqa xmm14, xmm2
movdqa xmm15, xmm3
pxor xmm8, xmm5
pxor xmm9, xmm5
pand xmm12, xmm6
pand xmm13, xmm6
movdqa xmmword [rax], xmm8
pcmpeqb xmm12, xmm0
psrlq xmm0, 4
movdqa xmmword [rax + 0x10], xmm9
pcmpeqb xmm13, xmm1
psrlq xmm1, 4
lea rcx, [rcx + 0x10]
pand xmm14, xmm6
pand xmm15, xmm6
movdqa xmmword [rax + 0x20], xmm10
pcmpeqb xmm14, xmm2
psrlq xmm2, 4
movdqa xmmword [rax + 0x30], xmm11
pcmpeqb xmm15, xmm3
psrlq xmm3, 4
movdqu xmm6, xmmword [rcx]
pxor xmm13, xmm5
pxor xmm14, xmm5
movdqa xmmword [rax + 0x40], xmm12
movdqa xmmword [rax + 0x50], xmm13
movdqa xmmword [rax + 0x60], xmm14
movdqa xmmword [rax + 0x70], xmm15
lea rax, [rax + 0x80]
dec r10d
jne 0x140089c20
movdqa xmm7, xmmword [r11 + 0x50]
repz ret
Function at 0x14008dec0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
vmovdqu xmm4, xmmword [rcx - 0x80]
vmovdqu xmm2, xmmword [r11 + 0x20]
lea r13, [rbp - 1]
vmovups xmm15, xmmword [rcx - 0x70]
lea r12, [rcx - 0x60]
vpxor xmm9, xmm1, xmm4
add ebx, 0x6000000
jb 0x14008dfe0
vpaddb xmm10, xmm1, xmm2
vpaddb xmm11, xmm10, xmm2
vpxor xmm10, xmm10, xmm4
vpaddb xmm12, xmm11, xmm2
vpxor xmm11, xmm11, xmm4
vpaddb xmm13, xmm12, xmm2
vpxor xmm12, xmm12, xmm4
vpaddb xmm14, xmm13, xmm2
vpxor xmm13, xmm13, xmm4
vpaddb xmm1, xmm14, xmm2
vpxor xmm14, xmm14, xmm4
jmp 0x14008df20
vaesenc xmm9, xmm9, xmm15
vaesenc xmm10, xmm10, xmm15
vaesenc xmm11, xmm11, xmm15
vaesenc xmm12, xmm12, xmm15
vaesenc xmm13, xmm13, xmm15
vaesenc xmm14, xmm14, xmm15
vmovups xmm15, xmmword [r12]
lea r12, [r12 + 0x10]
dec r13d
jne 0x14008df20
vmovdqu xmm3, xmmword [r12]
vaesenc xmm9, xmm9, xmm15
vpxor xmm4, xmm3, xmmword [rdi]
vaesenc xmm10, xmm10, xmm15
vpxor xmm5, xmm3, xmmword [rdi + 0x10]
vaesenc xmm11, xmm11, xmm15
vpxor xmm6, xmm3, xmmword [rdi + 0x20]
vaesenc xmm12, xmm12, xmm15
vpxor xmm8, xmm3, xmmword [rdi + 0x30]
vaesenc xmm13, xmm13, xmm15
vpxor xmm2, xmm3, xmmword [rdi + 0x40]
vaesenc xmm14, xmm14, xmm15
vpxor xmm3, xmm3, xmmword [rdi + 0x50]
lea rdi, [rdi + 0x60]
vaesenclast xmm9, xmm9, xmm4
vaesenclast xmm10, xmm10, xmm5
vaesenclast xmm11, xmm11, xmm6
vaesenclast xmm12, xmm12, xmm8
vaesenclast xmm13, xmm13, xmm2
vaesenclast xmm14, xmm14, xmm3
vmovups xmmword [rsi], xmm9
vmovups xmmword [rsi + 0x10], xmm10
vmovups xmmword [rsi + 0x20], xmm11
vmovups xmmword [rsi + 0x30], xmm12
vmovups xmmword [rsi + 0x40], xmm13
vmovups xmmword [rsi + 0x50], xmm14
lea rsi, [rsi + 0x60]
repz ret
vpshufb xmm6, xmm1, xmm0
vmovdqu xmm5, xmmword [r11 + 0x30]
vpaddd xmm10, xmm6, xmmword [r11 + 0x40]
vpaddd xmm11, xmm6, xmm5
vpaddd xmm12, xmm10, xmm5
vpshufb xmm10, xmm10, xmm0
vpaddd xmm13, xmm11, xmm5
vpshufb xmm11, xmm11, xmm0
vpxor xmm10, xmm10, xmm4
vpaddd xmm14, xmm12, xmm5
vpshufb xmm12, xmm12, xmm0
vpxor xmm11, xmm11, xmm4
vpaddd xmm1, xmm13, xmm5
vpshufb xmm13, xmm13, xmm0
vpxor xmm12, xmm12, xmm4
vpshufb xmm14, xmm14, xmm0
vpxor xmm13, xmm13, xmm4
vpshufb xmm1, xmm1, xmm0
vpxor xmm14, xmm14, xmm4
jmp 0x14008df20
Function at 0x1400a48d0
Capabilities:
Encrypt data using curve25519

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x110
mov rbx, r8
mov rsi, rdx
mov r14, rcx
mov rax, qword [0x140125058]
xor rax, rsp
mov qword [rsp + 0x108], rax
lea rdi, [rsp + 0xc0]
mov edx, 0x20
mov rcx, r8
mov r8, rdi
call fcn.1400528a0
and byte [rdi], 0xf8
mov al, byte [rdi + 0x1f]
and al, 0x3f
or al, 0x40
mov byte [rdi + 0x1f], al
lea r8, [0x1401082a0]
lea r15, [rsp + 0x20]
mov rcx, r15
mov rdx, rdi
call fcn.1400a3230
mov rcx, r14
mov rdx, r15
call fcn.1400a2110
movups xmm0, xmmword [rbx]
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
movups xmm0, xmmword [r14]
movups xmm1, xmmword [r14 + 0x10]
movups xmmword [rsi + 0x20], xmm0
movups xmmword [rsi + 0x30], xmm1
mov rcx, qword [rsp + 0x108]
xor rcx, rsp
call fcn.1400a8dd0
nop
add rsp, 0x110
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x1400afc00
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x1400afc13
add rsp, 0x48
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, ax
lea rcx, [rsp + 0x20]
or edx, 0x80070000
test eax, eax
cmovle edx, eax
call fcn.1400b061c
lea rdx, [0x140124438]
lea rcx, [rsp + 0x20]
call fcn.1400cb2fc
int3

Function at 0x1400bafec
Capabilities:
Set thread local storage value

Disassembly:
mov rdx, rcx
mov ecx, dword [0x14012ca28]
jmp fcn.1400afc00

Function at 0x1400bb378
Capabilities:
Set thread local storage value

Disassembly:
mov ecx, dword [0x14012ca28]
xor edx, edx
jmp fcn.1400afc00

Function at 0x1400c7558
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rcx + 0x98], rdx
mov r8, rcx
mov r9, qword [rdx + 0x1a8]
add rcx, 0x40
lea rdx, [0x1400c79a0]
mov r9, qword [r9 + 8]
jmp fcn.1400b5528

Function at 0x1400c7580
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rcx + 0x98], rdx
mov r8, rcx
mov r9, qword [rdx + 0x1a8]
add rcx, 0x40
lea rdx, [0x1400c79b0]
mov r9, qword [r9 + 8]
jmp fcn.1400b5528

Function at 0x1400d5964
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400d5a94
Function at 0x140001da0
Capabilities:
Encrypt data using des

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x1401a003a]
call fcn.140068b20
mov rax, qword [rbp + 0x120]
movzx ecx, al
mov rax, qword [rbp + 0x130]
shr rax, cl
mov ecx, 0x40
sub rcx, qword [rbp + 0x120]
mov rdx, qword [rbp + 0x130]
shl rdx, cl
mov rcx, rdx
or rax, rcx
mov rcx, qword [rbp + 0x128]
xor rcx, rax
mov rax, rcx
mov qword [rbp + 8], rax
mov rax, qword [rbp + 0x120]
and rax, 1
test rax, rax
je 0x140001e79
mov rax, qword [rbp + 8]
and rax, 0x3f
lea rcx, [0x14006cf50]
mov rdx, qword [rbp + 8]
shr rdx, 8
and rdx, 0x3f
lea r8, [0x14006cd50]
mov edx, dword [r8 + rdx*4]
mov eax, dword [rcx + rax*4]
xor eax, edx
mov rcx, qword [rbp + 8]
shr rcx, 0x10
and rcx, 0x3f
lea rdx, [0x14006cb50]
xor eax, dword [rdx + rcx*4]
mov rcx, qword [rbp + 8]
shr rcx, 0x18
and rcx, 0x3f
lea rdx, [0x14006c950]
xor eax, dword [rdx + rcx*4]
mov eax, eax
mov qword [rbp + 0x28], rax
jmp 0x140001ed6
mov rax, qword [rbp + 8]
and rax, 0x3f
lea rcx, [0x14006ce50]
mov rdx, qword [rbp + 8]
shr rdx, 8
and rdx, 0x3f
lea r8, [0x14006cc50]
mov edx, dword [r8 + rdx*4]
mov eax, dword [rcx + rax*4]
xor eax, edx
mov rcx, qword [rbp + 8]
shr rcx, 0x10
and rcx, 0x3f
lea rdx, [0x14006ca50]
xor eax, dword [rdx + rcx*4]
mov rcx, qword [rbp + 8]
shr rcx, 0x18
and rcx, 0x3f
lea rdx, [0x14006c850]
xor eax, dword [rdx + rcx*4]
mov eax, eax
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x28]
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret
Function at 0x14000ec60
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0x1e0
lea rbp, [rsp + 0x20]
lea rcx, [0x1401a01d0]
call fcn.140068b20
mov rax, qword [rbp + 0x1e8]
mov rax, qword [rax + 8]
mov qword [rbp + 8], rax
mov qword [rbp + 0x28], 0
mov rax, qword [rbp + 0x1e8]
mov rax, qword [rax + 8]
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x1e8]
mov rax, qword [rax + 0x18]
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0
jne 0x14000ecf1
mov ecx, 2
call qword [sym.imp.ucrtbased.dll___acrt_iob_func]
lea rdx, str.____ipv6_picker_is_null_n
mov rcx, rax
call fcn.140001b10
mov ecx, 1
call qword [sym.imp.ucrtbased.dll_exit]
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x48]
sub rcx, rax
mov rax, rcx
xor edx, edx
mov ecx, 2
div rcx
mov rcx, qword [rbp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x68], rax
mov rax, qword [rbp + 0x88]
mov rcx, qword [rbp + 0x68]
mov rax, qword [rax + rcx*8]
cmp qword [rbp + 0x1f0], rax
jae 0x14000ed39
mov rax, qword [rbp + 0x68]
mov qword [rbp + 0x48], rax
jmp 0x14000ecf1
mov rax, qword [rbp + 0x88]
mov rcx, qword [rbp + 0x68]
mov rax, qword [rax + rcx*8]
cmp qword [rbp + 0x1f0], rax
jb 0x14000ed8a
mov rax, qword [rbp + 0x68]
inc rax
cmp rax, qword [rbp + 8]
jne 0x14000ed62
jmp 0x14000ed8f
mov rax, qword [rbp + 0x88]
mov rcx, qword [rbp + 0x68]
mov rax, qword [rax + rcx*8 + 8]
cmp qword [rbp + 0x1f0], rax
jae 0x14000ed7f
jmp 0x14000ed8f
mov rax, qword [rbp + 0x68]
inc rax
mov qword [rbp + 0x28], rax
jmp 0x14000ecf1
mov rax, qword [rbp + 0x88]
mov rcx, qword [rbp + 0x68]
mov rax, qword [rax + rcx*8]
mov rcx, qword [rbp + 0x1f0]
sub rcx, rax
mov rax, rcx
imul rcx, qword [rbp + 0x68], 0x20
mov rdx, qword [rbp + 0x1e8]
mov rdx, qword [rdx]
lea r8, [rbp + 0x1a0]
mov rdi, r8
lea rsi, [rdx + rcx]
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
mov r8, rax
lea rdx, [rbp + 0x1a0]
lea rcx, [rbp + 0x168]
call fcn.14000d530
mov rdi, qword [rbp + 0x1e0]
mov rsi, rax
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rbp + 0x1e0]
lea rsp, [rbp + 0x1c0]
pop rdi
pop rsi
pop rbp
ret
Function at 0x140014480
Capabilities:
Get socket status
Receive data
Receive data on socket
Terminate process

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xa28
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x1be
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0xa48]
mov rax, qword [0x14009ad80]
xor rax, rbp
mov qword [rbp + 0x9e8], rax
lea rcx, [0x1401a03eb]
call fcn.140068b20
mov dword [rbp + 0x238], 0
mov dword [rbp + 0x23c], 0
mov dword [rbp + 0x10], 0
mov dword [rbp + 0x6d4], 0
jmp 0x140014503
mov eax, dword [rbp + 0x6d4]
inc eax
mov dword [rbp + 0x6d4], eax
mov eax, dword [rbp + 0x10]
cmp dword [rbp + 0x6d4], eax
jae 0x140014526
mov eax, dword [rbp + 0x6d4]
mov rcx, qword [rbp + 0xa18]
cmp qword [rbp + rax*8 + 0x18], rcx
jne 0x140014524
jmp 0x140014526
jmp 0x1400144f5
mov eax, dword [rbp + 0x10]
cmp dword [rbp + 0x6d4], eax
jne 0x140014551
cmp dword [rbp + 0x10], 0x40
jae 0x140014551
mov eax, dword [rbp + 0x6d4]
mov rcx, qword [rbp + 0xa18]
mov qword [rbp + rax*8 + 0x18], rcx
mov eax, dword [rbp + 0x10]
inc eax
mov dword [rbp + 0x10], eax
xor eax, eax
test eax, eax
jne 0x1400144e9
mov eax, dword [rbp + 0xa18]
mov dword [rbp + 0x274], eax
lea rax, [rbp + 0x238]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x10]
mov ecx, dword [rbp + 0x274]
call qword [sym.imp.WS2_32.dll_select]
mov dword [rbp + 0x254], eax
cmp dword [rbp + 0x254], 0
jne 0x14001459e
mov eax, 1
jmp 0x140014645
cmp dword [rbp + 0x254], 0
jge 0x1400145c0
lea rdx, str.redis:select___failed_n
xor ecx, ecx
call fcn.14002ddd0
mov ecx, 1
call qword [sym.imp.ucrtbased.dll_exit]
cmp dword [rbp + 0x254], 1
je 0x1400145e2
lea rdx, str.redis:select___failed_n
xor ecx, ecx
call fcn.14002ddd0
mov ecx, 1
call qword [sym.imp.ucrtbased.dll_exit]
xor r9d, r9d
mov r8d, 0x400
lea rdx, [rbp + 0x2a0]
mov rcx, qword [rbp + 0xa18]
call qword [sym.imp.WS2_32.dll_recv]
cdqe
mov qword [rbp + 0x6b8], rax
cmp qword [rbp + 0x6b8], 0
jne 0x14001462b
lea rdx, str.redis:recv___failed_n
xor ecx, ecx
call fcn.14002ddd0
mov ecx, 1
call qword [sym.imp.ucrtbased.dll_exit]
mov r8, qword [rbp + 0x6b8]
lea rdx, [rbp + 0x2a0]
mov rcx, qword [rbp + 0xa10]
call fcn.140014680
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x140072df0]
call fcn.140068a90
mov rax, rdi
mov rcx, qword [rbp + 0x9e8]
xor rcx, rbp
call fcn.140068cb0
lea rsp, [rbp + 0x9f8]
pop rdi
pop rbp
ret
Function at 0x140014960
Capabilities:
Receive data
Receive data on socket
Terminate process

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x1401a03eb]
call fcn.140068b20
mov qword [rbp + 8], 0
mov rax, qword [rbp + 0x130]
cmp qword [rbp + 8], rax
jae 0x140014a1a
mov rax, qword [rbp + 8]
mov rcx, qword [rbp + 0x128]
add rcx, rax
mov rax, rcx
xor r9d, r9d
mov r8d, 1
mov rdx, rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.WS2_32.dll_recv]
cdqe
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
jne 0x1400149ee
lea rdx, str.redis:_recv_line___failed_n
xor ecx, ecx
call fcn.14002ddd0
mov ecx, 1
call qword [sym.imp.ucrtbased.dll_exit]
mov rax, qword [rbp + 8]
inc rax
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov rcx, qword [rbp + 0x128]
add rcx, rax
mov rax, rcx
movzx eax, byte [rax - 1]
cmp eax, 0xa
jne 0x140014a15
jmp 0x140014a1a
jmp 0x140014991
mov rax, qword [rbp + 8]
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret
Function at 0x140038010
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rcx, [0x1401a0a48]
call fcn.140068b20
mov qword [rbp + 8], 0
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x100]
movsx eax, byte [rcx + rax]
and eax, 0xff
mov ecx, eax
call qword [sym.imp.ucrtbased.dll_isdigit]
test eax, eax
je 0x140038095
imul rax, qword [rbp + 8], 0xa
mov ecx, 1
imul rcx, rcx, 0
mov rdx, qword [rbp + 0x100]
movsx ecx, byte [rdx + rcx]
sub ecx, 0x30
movsxd rcx, ecx
add rax, rcx
mov qword [rbp + 8], rax
mov rax, qword [rbp + 0x100]
inc rax
mov qword [rbp + 0x100], rax
jmp 0x140038037
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x100]
movsx eax, byte [rcx + rax]
mov ecx, eax
call qword [sym.imp.ucrtbased.dll_ispunct]
test eax, eax
jne 0x1400380d5
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x100]
movsx eax, byte [rcx + rax]
mov ecx, eax
call qword [sym.imp.ucrtbased.dll_isspace]
test eax, eax
je 0x1400380e8
mov rax, qword [rbp + 0x100]
inc rax
mov qword [rbp + 0x100], rax
jmp 0x140038095
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x100]
movsx eax, byte [rcx + rax]
mov ecx, eax
call qword [sym.imp.ucrtbased.dll_isalpha]
test eax, eax
je 0x140038117
cmp qword [rbp + 8], 0
jne 0x140038117
mov qword [rbp + 8], 1
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x100]
movsx eax, byte [rcx + rax]
test eax, eax
jne 0x140038138
mov rax, qword [rbp + 8]
jmp 0x14003823a
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x100]
movsx eax, byte [rcx + rax]
mov ecx, eax
call qword [sym.imp.ucrtbased.dll_tolower]
mov dword [rbp + 0xd4], eax
mov eax, dword [rbp + 0xd4]
sub eax, 0x65
mov dword [rbp + 0xd4], eax
cmp dword [rbp + 0xd4], 0xf
ja case.0x14003818e.1
movsxd rax, dword [rbp + 0xd4]
lea rcx, [0x140000000]
mov eax, dword [rcx + rax*4 + 0x38244]
add rax, rcx
jmp rax
imul rax, qword [rbp + 8], 0x400
mov qword [rbp + 8], rax
jmp 0x140038236
imul rax, qword [rbp + 8], 0x100000
mov qword [rbp + 8], rax
jmp 0x140038236
imul rax, qword [rbp + 8], 0x40000000
mov qword [rbp + 8], rax
jmp 0x140038236
movabs rax, 0x10000000000
mov rcx, qword [rbp + 8]
imul rcx, rax
mov rax, rcx
mov qword [rbp + 8], rax
jmp 0x140038236
movabs rax, 0x4000000000000
mov rcx, qword [rbp + 8]
imul rcx, rax
mov rax, rcx
mov qword [rbp + 8], rax
jmp 0x140038236
movabs rax, 0x1000000000000000
mov rcx, qword [rbp + 8]
imul rcx, rax
mov rax, rcx
mov qword [rbp + 8], rax
jmp 0x140038236
mov ecx, 2
call qword [sym.imp.ucrtbased.dll___acrt_iob_func]
lea rdx, str.__rotate_size:_unknown_character_n
mov rcx, rax
call fcn.140001b10
mov ecx, 1
call qword [sym.imp.ucrtbased.dll_exit]
mov rax, qword [rbp + 8]
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret