joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400a6fc0
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x260
mov rax, qword [0x14011c028]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rbp, rdx
mov rsi, rcx
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x1400a7015
imul rbx, rax, 0x64
jmp 0x1400a7036
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
mov rbx, rax
imul rax, rcx, 0x3b9aca00
add rbx, rax
xor r15d, r15d
movabs r13, 0x431bde82d7b634db
movabs r12, 0x7ffffffffff0bdbf
movabs r14, 0x7fffffffffffffff
nop word [rax + rax]
mov qword [rsp + 0x48], rsi
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x38], r15d
mov dword [rsp + 0x3c], 0x2710
nop word [rax + rax]
lea rax, [rsp + 0x38]
xor r9d, r9d
lea ecx, [rsi + 1]
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rsp + 0x40]
call qword [sym.imp.WS2_32.dll_select]
movsxd rdi, eax
test eax, eax
jns 0x1400a70b0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 4
je 0x1400a7080
test rdi, rdi
js 0x1400a7194
jne 0x1400a7190
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rdi, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rdi, 0x989680
jne 0x1400a70dd
imul rcx, rax, 0x64
jmp 0x1400a70fe
cqo
idiv rdi
mov r8, rax
imul rax, rdx, 0x3b9aca00
cqo
idiv rdi
mov rcx, rax
imul rax, r8, 0x3b9aca00
add rcx, rax
sub rcx, rbx
mov rax, r13
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rbp, 0x3e8
cmp rdx, rax
jg 0x1400a7194
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rdi, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rdi, 0x989680
jne 0x1400a713f
imul rax, rax, 0x64
jmp 0x1400a715d
cqo
idiv rdi
mov rcx, rax
imul rax, rdx, 0x3b9aca00
imul rcx, rcx, 0x3b9aca00
cqo
idiv rdi
add rax, rcx
cmp rax, r12
jge 0x1400a717c
add rax, 0xf4240
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], rax
call fcn.14002a4c0
jmp 0x1400a7060
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], r14
call fcn.14002a4c0
jmp 0x1400a7060
mov al, 1
jmp 0x1400a7196
xor al, al
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1400d1560
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400af760
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x14011c028]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rax, qword [rcx]
lea rbx, [rsp + 0x58]
mov qword [rsp + 0x68], rax
lea rdi, [rsp + 0x60]
mov r9d, edx
mov dword [rsp + 0x60], 1
mov ecx, r8d
lea rsi, [rsp + 0x60]
movabs rax, 0x20c49ba5e353f7cf
imul r8
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul eax, edx, 0x3e8
mov dword [rsp + 0x58], edx
sub ecx, eax
imul eax, ecx, 0x3e8
mov dword [rsp + 0x5c], eax
xor eax, eax
test r8, r8
cmovs rbx, rax
cmp r9d, 1
mov qword [rsp + 0x20], rbx
cmovne rdi, rax
test r9d, r9d
mov r8, rdi
cmovne rsi, rax
xor r9d, r9d
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
jne 0x1400af838
nop dword [rax]
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2714
jne 0x1400af884
xor r9d, r9d
mov qword [rsp + 0x20], rbx
mov r8, rdi
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
je 0x1400af810
test eax, eax
je 0x1400af861
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1400d1560
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
lea rdx, str.Request_timed_out
lea rcx, [rsp + 0x30]
call fcn.1400af600
lea rdx, [0x140117db0]
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
call fcn.1400a66f0
mov rbx, rax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea r9, str.Failed_to_select_socket
mov r8, rbx
mov edx, eax
lea rcx, [rsp + 0x30]
call fcn.1400a64c0
lea rdx, [0x140117cc8]
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x1400b5ba0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x68
mov rax, qword [0x14011c028]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov ecx, 1
call fcn.1400d1580
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x1400cac70]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1400b5c3a
cmp dword [rsp + 0x38], 0
jne 0x1400b5c05
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
je 0x1400b5c28
mov ecx, eax
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_]
nop
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400d1560
add rsp, 0x68
ret
mov dword [rsp + 0x38], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x1400b7c50
Capabilities:
Create thread

Disassembly:
sub rsp, 0x68
mov rax, qword [0x14011c028]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov byte [0x140125b44], 1
mov ecx, 1
call fcn.1400d1580
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x1400caea0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1400b7cf1
cmp dword [rsp + 0x38], 0
jne 0x1400b7cbc
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
je 0x1400b7cdf
mov ecx, eax
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_]
nop
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400d1560
add rsp, 0x68
ret
mov dword [rsp + 0x38], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3

Function at 0x1400b7d10
Capabilities:
Create thread

Disassembly:
sub rsp, 0x68
mov rax, qword [0x14011c028]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov byte [0x140125b47], 1
mov ecx, 1
call fcn.1400d1580
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x1400caf50]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1400b7db1
cmp dword [rsp + 0x38], 0
jne 0x1400b7d7c
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
je 0x1400b7d9f
mov ecx, eax
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_]
nop
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400d1560
add rsp, 0x68
ret
mov dword [rsp + 0x38], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x1400b7dd0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x68
mov rax, qword [0x14011c028]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov byte [0x140125b43], 1
mov ecx, 1
call fcn.1400d1580
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x1400cb020]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1400b7e71
cmp dword [rsp + 0x38], 0
jne 0x1400b7e3c
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
je 0x1400b7e5f
mov ecx, eax
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_]
nop
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400d1560
add rsp, 0x68
ret
mov dword [rsp + 0x38], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3

Function at 0x1400b9250
Capabilities:
Create thread

Disassembly:
sub rsp, 0x78
mov rax, qword [0x14011c028]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov eax, dword [0x14011c06c]
mov ecx, 0xc8
cmp eax, ecx
cmovle eax, ecx
mov dword [0x14011c06c], eax
mov byte [0x140125b41], 1
cmp byte [0x1401259ff], 0
je 0x1400b9373
mov rax, qword [0x140126af0]
cmp byte [rax + 0x1d0], 0
je 0x1400b936c
lea rcx, [rax + 0x140]
cmp qword [rax + 0x158], 0x10
jb 0x1400b92b9
mov rcx, qword [rax + 0x140]
mov r8, qword [rax + 0x150]
cmp r8, 4
jne 0x1400b92da
lea rdx, str.EXIT
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400b9373
mov ecx, 1
call fcn.1400d1580
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x1400cb050]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1400b9358
cmp dword [rsp + 0x38], 0
jne 0x1400b932b
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x50], xmm0
lea rcx, [rsp + 0x50]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
je 0x1400b934d
mov ecx, eax
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_]
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x30], xmm0
jmp 0x1400b9373
mov dword [rsp + 0x38], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov byte [0x140125b41], 0
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400d1560
add rsp, 0x78
ret
Function at 0x1400b95e0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x68
mov rax, qword [0x14011c028]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov ecx, 1
call fcn.1400d1580
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x1400cb080]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1400b967a
cmp dword [rsp + 0x38], 0
jne 0x1400b9645
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
je 0x1400b9668
mov ecx, eax
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_]
nop
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400d1560
add rsp, 0x68
ret
mov dword [rsp + 0x38], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x1400bff60
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x56], 0
je 0x1400bff83
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x22]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x55
jb 0x1400bff70
mov byte [rcx + 0x56], 0
mov rax, rcx
ret

Function at 0x1400bff90
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x36], 0
je 0x1400bffb3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x22]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x35
jb 0x1400bffa0
mov byte [rcx + 0x36], 0
mov rax, rcx
ret

Function at 0x1400bffc0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x2f], 0
je 0x1400bffe3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x22]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x2e
jb 0x1400bffd0
mov byte [rcx + 0x2f], 0
mov rax, rcx
ret
Function at 0x1400c14d0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x68
mov rax, qword [0x14011c028]
xor rax, rsp
mov qword [rsp + 0x50], rax
cmp byte [reloc.WS2_32.dll_accept], 0
je 0x1400c1567
mov byte [reloc.WS2_32.dll_accept], 0
mov ecx, 1
call fcn.1400d1580
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x1400cb390]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1400c1579
cmp dword [rsp + 0x38], 0
jne 0x1400c1544
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
je 0x1400c1567
mov ecx, eax
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_]
nop
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400d1560
add rsp, 0x68
ret
mov dword [rsp + 0x38], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x1400c3e90
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x39], 0
je 0x1400c3eb3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x22]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x38
jb 0x1400c3ea0
mov byte [rcx + 0x39], 0
ret

Function at 0x1400c3ec0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x45], 0
je 0x1400c3ee3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x22]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x44
jb 0x1400c3ed0
mov byte [rcx + 0x45], 0
ret

Function at 0x1400c3ef0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xa1], 0
je 0x1400c3f18
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x22]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xa0
jb 0x1400c3f00
mov byte [rcx + 0xa1], 0
ret

Function at 0x1400c3f20
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x81], 0
je 0x1400c3f48
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x22]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x80
jb 0x1400c3f30
mov byte [rcx + 0x81], 0
ret

Function at 0x1400c4020
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov rax, qword [0x14011c028]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rdi, rdx
mov r14, rcx
mov qword [rsp + 0x20], rdx
mov rcx, rdx
call fcn.1400b15a0
mov rcx, qword [rdi + 0x10]
cmp qword [rdi + 0x18], 0x10
jb 0x1400c406b
mov rsi, qword [rdi]
lea rbp, [rcx + rsi]
mov rbx, rsi
jmp 0x1400c4075
mov rsi, rdi
lea rbp, [rcx + rdi]
mov rbx, rdi
cmp rbx, rbp
je 0x1400c4098
sub rsi, rbx
nop dword [rax]
movsx ecx, byte [rbx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
mov byte [rsi + rbx], al
inc rbx
cmp rbx, rbp
jne 0x1400c4080
mov rcx, qword [rdi + 0x10]
mov r8, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x1400c40a5
mov r8, qword [rdi]
xor edx, edx
movabs r9, 0xcbf29ce484222325
test rcx, rcx
je 0x1400c40d4
movabs r10, 0x100000001b3
movzx eax, byte [rdx + r8]
xor r9, rax
imul r9, r10
inc rdx
cmp rdx, rcx
jb 0x1400c40c0
mov r8, rdi
lea rdx, [rsp + 0x20]
mov rcx, r14
call fcn.1400c8b90
cmp qword [rax + 8], 0
setne bl
mov rcx, rdi
call fcn.140027180
movzx eax, bl
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400d1560
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x1400c4120
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x70
movaps xmmword [rsp + 0x60], xmm6
mov rax, qword [0x14011c028]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rdi, rdx
mov r14, rcx
mov qword [rsp + 0x50], rdx
mov rcx, rdx
call fcn.1400b15a0
mov rdx, qword [rdi + 0x10]
cmp qword [rdi + 0x18], 0x10
jb 0x1400c4170
mov rsi, qword [rdi]
lea rbp, [rdx + rsi]
mov rbx, rsi
jmp 0x1400c417a
mov rsi, rdi
lea rbp, [rdx + rdi]
mov rbx, rdi
cmp rbx, rbp
je 0x1400c419a
sub rsi, rbx
movsx ecx, byte [rbx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
mov byte [rbx + rsi], al
inc rbx
cmp rbx, rbp
jne 0x1400c4182
mov rdx, qword [rdi + 0x10]
mov r8, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x1400c41a7
mov r8, qword [rdi]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test rdx, rdx
je 0x1400c41e4
movabs r10, 0x100000001b3
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rcx + r8]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, rdx
jb 0x1400c41d0
mov r8, rdi
lea rdx, [rsp + 0x40]
mov rcx, r14
call fcn.1400c8b90
mov rbx, qword [rax + 8]
test rbx, rbx
je 0x1400c4210
cmp rbx, qword [r14 + 8]
je 0x1400c4210
mov rbx, qword [rbx + 0x30]
lea rsi, [r14 + 0x40]
jmp 0x1400c42b7
lea rsi, [r14 + 0x40]
mov rbx, qword [rsi + 8]
sub rbx, qword [rsi]
sar rbx, 6
mov r8, rdi
lea rdx, [rsp + 0x40]
mov rcx, r14
call fcn.1400c6ab0
mov rcx, qword [rax]
mov qword [rcx + 0x30], rbx
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
movdqa xmm6, xmmword [0x1400f8cb0]
movdqu xmmword [rsp + 0x30], xmm6
mov byte [rsp + 0x20], 0
mov rbp, qword [rsi + 8]
cmp rbp, qword [rsi + 0x10]
je 0x1400c4299
mov rdx, rdi
mov rcx, rbp
call fcn.1400265a0
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x38], 0
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rbp + 0x20], xmm0
movups xmmword [rbp + 0x30], xmm6
movdqa xmm0, xmm6
movdqu xmmword [rsp + 0x30], xmm6
mov byte [rsp + 0x20], 0
add qword [rsi + 8], 0x40
jmp 0x1400c42ad
lea r9, [rsp + 0x20]
mov r8, rdi
mov rdx, rbp
mov rcx, rsi
call fcn.1400c9870
nop
lea rcx, [rsp + 0x20]
call fcn.140027180
shl rbx, 6
add rbx, qword [rsi]
mov rcx, rdi
call fcn.140027180
lea rax, [rbx + 0x20]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400d1560
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
movaps xmm6, xmmword [rsp + 0x60]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x1400c4300
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0xb0
mov rax, qword [0x14011c028]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov rdi, rdx
mov r14, rcx
mov qword [rsp + 0x98], rdx
mov rcx, rdx
call fcn.1400b15a0
mov rdx, qword [rdi + 0x10]
cmp qword [rdi + 0x18], 0x10
jb 0x1400c4354
mov rsi, qword [rdi]
lea rbp, [rdx + rsi]
mov rbx, rsi
jmp 0x1400c435e
mov rsi, rdi
lea rbp, [rdx + rdi]
mov rbx, rdi
cmp rbx, rbp
je 0x1400c437e
sub rsi, rbx
movsx ecx, byte [rbx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
mov byte [rsi + rbx], al
inc rbx
cmp rbx, rbp
jne 0x1400c4366
mov rdx, qword [rdi + 0x10]
mov r8, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x1400c438b
mov r8, qword [rdi]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test rdx, rdx
je 0x1400c43c4
movabs r10, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [rcx + r8]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, rdx
jb 0x1400c43b0
mov r8, rdi
lea rdx, [rsp + 0x20]
mov rcx, r14
call fcn.1400c8b90
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x1400c43f0
cmp rcx, qword [r14 + 8]
je 0x1400c43f0
mov rbp, qword [rcx + 0x30]
lea rbx, [r14 + 0x40]
jmp 0x1400c44ac
lea rbx, [r14 + 0x40]
mov r8, qword [rbx + 8]
sub r8, qword [rbx]
movabs rax, 0x8888888888888889
imul r8
lea rbp, [r8 + rdx]
sar rbp, 6
mov rax, rbp
shr rax, 0x3f
add rbp, rax
mov r8, rdi
lea rdx, [rsp + 0x88]
mov rcx, r14
call fcn.1400c6ab0
mov rcx, qword [rax]
mov qword [rcx + 0x30], rbp
lea rcx, [rsp + 0x30]
call fcn.1400c4df0
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0x80], 0
mov rsi, qword [rbx + 8]
cmp rsi, qword [rbx + 0x10]
je 0x1400c4484
mov qword [rsp + 0x20], rsi
mov rdx, rdi
mov rcx, rsi
call fcn.1400265a0
nop
lea rcx, [rsi + 0x20]
lea rdx, [rsp + 0x30]
call fcn.1400cbd50
nop
add qword [rbx + 8], 0x78
jmp 0x1400c4498
lea r9, [rsp + 0x30]
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
call fcn.1400c99b0
nop
lea rcx, [rsp + 0x70]
call fcn.1400c50f0
lea rcx, [rsp + 0x30]
call fcn.1400b3a50
imul rax, rbp, 0x78
add rax, qword [rbx]
lea rbx, [rax + 0x20]
mov rcx, rdi
call fcn.140027180
mov rax, rbx
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1400d1560
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x1400c5ff0
Capabilities:
Resolve dns
Set socket configuration

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xa0
mov rax, qword [0x14011c028]
xor rax, rsp
mov qword [rbp + 0x1f], rax
mov rsi, qword [rbp + 0x77]
mov qword [rbp - 0x49], rsi
xorps xmm0, xmm0
movdqu xmmword [rbp - 1], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xf], xmm1
mov qword [rbp - 9], 1
xor r15d, r15d
mov dword [rbp - 0xd], r9d
mov dword [rbp - 0x11], r15d
mov edx, 0x1bb
lea rcx, [rbp - 0x31]
call fcn.1400031b0
nop
lea rdx, [rbp - 0x31]
cmp qword [rbp - 0x19], 0x10
cmovae rdx, qword [rbp - 0x31]
lea r9, [rbp - 0x41]
lea r8, [rbp - 0x11]
lea rcx, str.127.0.0.1
call qword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
jne 0x1400c6198
mov rbx, qword [rbp - 0x41]
test rbx, rbx
je 0x1400c618e
movzx r14d, byte [rbp + 0x6f]
nop word [rax + rax]
mov dword [rsp + 0x28], 0x81
mov dword [rsp + 0x20], r15d
xor r9d, r9d
mov r8d, dword [rbx + 0xc]
mov edx, dword [rbx + 8]
mov ecx, dword [rbx + 4]
call qword [sym.imp.WS2_32.dll_WSASocketW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x1400c60e6
mov r8d, dword [rbx + 0xc]
mov edx, dword [rbx + 8]
mov ecx, dword [rbx + 4]
call qword [sym.imp.WS2_32.dll_socket]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1400c617d
test r14b, r14b
je 0x1400c6110
mov dword [rbp - 0x39], 1
mov dword [rsp + 0x20], 4
lea r9, [rbp - 0x39]
mov edx, 6
lea r8d, [rdx - 5]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rcx, qword [rsi + 0x38]
test rcx, rcx
je 0x1400c6127
mov qword [rbp - 0x39], rdi
mov rax, qword [rcx]
lea rdx, [rbp - 0x39]
call qword [rax + reloc.WS2_32.dll_recv]
cmp dword [rbx + 4], 0x17
jne 0x1400c614f
mov dword [rbp - 0x39], r15d
mov dword [rsp + 0x20], 4
lea r9, [rbp - 0x39]
mov edx, 0x29
lea r8d, [rdx - 0xe]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_setsockopt]
mov r8d, dword [rbx + 0x10]
mov rdx, qword [rbx + 0x20]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_bind]
test eax, eax
jne 0x1400c6174
lea edx, [rax + 5]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_listen]
test eax, eax
je 0x1400c61eb
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
mov rbx, qword [rbx + 0x28]
test rbx, rbx
jne 0x1400c60a0
mov rbx, qword [rbp - 0x41]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
nop
lea rcx, [rbp - 0x31]
call fcn.140027180
nop
mov rcx, qword [rsi + 0x38]
test rcx, rcx
je 0x1400c61bb
cmp rcx, rsi
mov rax, qword [rcx]
setne dl
call qword [rax + 0x20]
mov qword [rsi + 0x38], r15
mov rax, 0xffffffffffffffff
mov rcx, qword [rbp + 0x1f]
xor rcx, rsp
call fcn.1400d1560
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
mov rcx, qword [rbp - 0x41]
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
nop
lea rcx, [rbp - 0x31]
call fcn.140027180
nop
mov rcx, qword [rsi + 0x38]
test rcx, rcx
je 0x1400c6219
mov rax, qword [rcx]
cmp rcx, rsi
setne dl
call qword [rax + 0x20]
mov qword [rsi + 0x38], r15
mov rax, rdi
jmp 0x1400c61c2