joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002760
Capabilities:
Encode data using xor
Encrypt data using des

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov r11, qword [rcx + 0x30]
mov rdi, qword [rcx + 0x40]
mov esi, dword [rcx + 0x20]
mov r9, qword [rcx + 0x18]
mov r8, r11
mov rax, rdx
and r8, rdx
mov rdx, qword [rcx + 0x28]
mov r12, rcx
mov qword [rsp + 8], rdi
mov ecx, edx
mov dword [rsp + 0x10], esi
mov dword [rsp + 0x14], edx
shr rax, cl
test esi, esi
je 0x1400028a3
mov qword [rsp + 0x70], r12
mov r10d, 1
lea rbp, [0x140051760]
lea rdi, [0x140051960]
mov qword [rsp + 0x18], rdx
lea rsi, [0x140051560]
lea r13, [0x140051b60]
lea r14, [0x140051860]
lea r15, [0x140051c60]
nop dword [rax + rax]
mov ecx, r10d
mov rdx, r9
lea rbx, [0x140051a60]
ror rdx, cl
xor rdx, rax
mov rcx, rdx
mov r12, rdx
shr rcx, 8
shr r12, 0x10
and r12d, 0x3f
and ecx, 0x3f
mov ecx, dword [rbp + rcx*4]
xor ecx, dword [rdi + r12*4]
mov r12, rdx
shr rdx, 0x18
and r12d, 0x3f
and edx, 0x3f
xor ecx, dword [rsi + r12*4]
xor ecx, dword [r13 + rdx*4]
mov rdx, r9
add rcx, r8
and rcx, r11
mov r8, rcx
lea ecx, [r10 + 1]
add r10d, 2
ror rdx, cl
xor rdx, r8
mov rcx, rdx
mov r12, rdx
shr rcx, 8
shr r12, 0x10
and r12d, 0x3f
and ecx, 0x3f
mov ecx, dword [r14 + rcx*4]
xor ecx, dword [rbx + r12*4]
mov r12, rdx
shr rdx, 0x18
and r12d, 0x3f
lea rbx, [0x140051660]
and edx, 0x3f
xor ecx, dword [rbx + r12*4]
xor ecx, dword [r15 + rdx*4]
add rcx, rax
mov rax, qword [rsp + 8]
and rax, rcx
cmp dword [rsp + 0x10], r10d
jae 0x1400027e8
mov r12, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x18]
mov ecx, edx
mov r14, qword [r12]
shl rax, cl
add rax, r8
cmp rax, r14
jb 0x1400029e3
mov qword [rsp + 0x18], r14
lea r13, [0x140051760]
lea r12, [0x140051960]
lea rbp, [0x140051560]
lea rdi, [0x140051b60]
lea rsi, [0x140051860]
lea rbx, [0x140051a60]
nop word [rax + rax]
movzx ecx, byte [rsp + 0x14]
mov rdx, r11
and rdx, rax
shr rax, cl
mov ecx, dword [rsp + 0x10]
test ecx, ecx
je 0x1400029ca
mov r8d, 1
mov ecx, r8d
mov r15, r9
lea r10, [0x140051660]
ror r15, cl
mov rcx, r15
xor rcx, rax
mov r14, rcx
mov r15, rcx
shr r14, 8
shr r15, 0x10
and r15d, 0x3f
and r14d, 0x3f
mov r14d, dword [r13 + r14*4]
xor r14d, dword [r12 + r15*4]
mov r15, rcx
shr rcx, 0x18
and r15d, 0x3f
and ecx, 0x3f
xor r14d, dword [rbp + r15*4]
xor r14d, dword [rdi + rcx*4]
lea ecx, [r8 + 1]
mov r15, r9
add r14, rdx
ror r15, cl
add r8d, 2
mov rdx, r14
mov rcx, r15
and rdx, r11
xor rcx, rdx
mov r14, rcx
mov r15, rcx
shr r14, 8
shr r15, 0x10
and r15d, 0x3f
and r14d, 0x3f
mov r14d, dword [rsi + r14*4]
xor r14d, dword [rbx + r15*4]
mov r15, rcx
shr rcx, 0x18
and r15d, 0x3f
and ecx, 0x3f
xor r14d, dword [r10 + r15*4]
lea r10, [0x140051c60]
xor r14d, dword [r10 + rcx*4]
add r14, rax
mov rax, qword [rsp + 8]
and rax, r14
cmp dword [rsp + 0x10], r8d
jae 0x140002910
movzx ecx, byte [rsp + 0x14]
shl rax, cl
add rax, rdx
mov rdx, qword [rsp + 0x18]
cmp rax, rdx
jae 0x1400028f0
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140003670
Capabilities:
Encode data using xor

Disassembly:
push rdi
push rsi
push rbx
lea eax, [rdx + rdx + 0xf]
mov rdx, r9
lea r10d, [r8 + 0xf]
mov r11, rcx
add rdx, 0x3b9aca00
jns 0x1400036a6
movsxd rcx, eax
nop dword [rax]
add rdx, rcx
add eax, 0x1e
add rcx, 0x1e
test rdx, rdx
js 0x140003690
lea r9, [rdx - 0x3b9aca00]
mov ecx, r9d
cmp r9d, 0x1f47f
jg 0x140003733
nop word cs:[rax + rax]
add ecx, eax
mov edi, eax
add eax, 0x1e
cmp ecx, 0x1f47f
jle 0x1400036c0
lea rsi, [0x140052840]
cmp edi, 0xf
jle 0x14000372f
nop dword [rax + rax]
sub ecx, edi
jns 0x1400036f3
nop dword [rax]
add ecx, r10d
add r10d, 0x1e
test ecx, ecx
js 0x1400036e8
mov edx, ecx
mov r9d, r10d
cmp ecx, 0x1f47f
jg 0x140003727
mov eax, edx
mov r8d, edx
add edx, r9d
add r9d, 0x1e
shr eax, 5
and r8d, 0x1f
lea rbx, [r11 + rax*4]
mov eax, dword [rbx]
xor eax, dword [rsi + r8*4]
mov dword [rbx], eax
cmp edx, 0x1f47f
jle 0x140003700
sub edi, 0x1e
cmp edi, 0xf
jg 0x1400036e0
pop rbx
pop rsi
pop rdi
ret
lea edi, [rax - 0x1e]
jmp 0x1400036cf

Function at 0x140003740
Capabilities:
Encode data using xor

Disassembly:
push rdi
push rsi
push rbx
lea eax, [rdx + 5]
mov rdx, r9
lea r10d, [r8 + 0xf]
mov r11, rcx
add rdx, 0x3b9aca00
jns 0x140003776
movsxd rcx, eax
nop dword [rax]
add rdx, rcx
add eax, 0xa
add rcx, 0xa
test rdx, rdx
js 0x140003760
lea r9, [rdx - 0x3b9aca00]
mov ecx, r9d
cmp r9d, 0x1f47f
jg 0x140003803
nop word cs:[rax + rax]
add ecx, eax
mov edi, eax
add eax, 0xa
cmp ecx, 0x1f47f
jle 0x140003790
lea rsi, [0x140052840]
cmp edi, 5
jle 0x1400037ff
nop dword [rax + rax]
sub ecx, edi
jns 0x1400037c3
nop dword [rax]
add ecx, r10d
add r10d, 0x1e
test ecx, ecx
js 0x1400037b8
mov edx, ecx
mov r9d, r10d
cmp ecx, 0x1f47f
jg 0x1400037f7
mov eax, edx
mov r8d, edx
add edx, r9d
add r9d, 0x1e
shr eax, 5
and r8d, 0x1f
lea rbx, [r11 + rax*4]
mov eax, dword [rbx]
xor eax, dword [rsi + r8*4]
mov dword [rbx], eax
cmp edx, 0x1f47f
jle 0x1400037d0
sub edi, 0xa
cmp edi, 5
jg 0x1400037b0
pop rbx
pop rsi
pop rdi
ret
lea edi, [rax - 0xa]
jmp 0x14000379f
Function at 0x140004c00
Capabilities:
Encode data using xor

Disassembly:
push rdi
push rsi
push rbx
movabs rax, 0x6c7967656e657261
mov rsi, qword [r9 + 8]
mov rdi, qword [r9]
movabs r9, 0x646f72616e646f6d
xor rax, rdi
mov r11, r8
mov r10, rcx
mov rcx, rdx
mov ebx, r8d
and r11, 0xfffffffffffffff8
and ebx, 7
shl r8, 0x38
add r11, rdx
movabs rdx, 0x7465646279746573
xor rdx, rsi
xor rsi, r9
movabs r9, 0x736f6d6570736575
xor rdi, r9
cmp rcx, r11
je 0x140004cd2
nop dword [rax]
mov r9, qword [rcx]
add rdi, rsi
rol rsi, 0xd
add rcx, 8
xor rsi, rdi
rol rdi, 0x20
xor rdx, r9
add rax, rdx
rol rdx, 0x10
xor rdx, rax
add rax, rsi
rol rsi, 0x11
add rdi, rdx
rol rdx, 0x15
xor rsi, rax
xor rdx, rdi
rol rax, 0x20
add rdi, rsi
add rax, rdx
rol rsi, 0xd
rol rdx, 0x10
xor rsi, rdi
rol rdi, 0x20
xor rdx, rax
add rax, rsi
rol rsi, 0x11
add rdi, rdx
rol rdx, 0x15
xor rsi, rax
xor rdx, rdi
rol rax, 0x20
xor rdi, r9
cmp r11, rcx
jne 0x140004c60
lea r9, [0x1400529a4]
movsxd rcx, dword [r9 + rbx*4]
add rcx, r9
jmp rcx
movzx ecx, byte [r11 + 6]
shl rcx, 0x30
or r8, rcx
movzx ecx, byte [r11 + 5]
shl rcx, 0x28
or r8, rcx
movzx ecx, byte [r11 + 4]
shl rcx, 0x20
or r8, rcx
movzx ecx, byte [r11 + 3]
shl rcx, 0x18
or r8, rcx
movzx ecx, byte [r11 + 2]
shl rcx, 0x10
or r8, rcx
movzx ecx, byte [r11 + 1]
shl rcx, 8
or r8, rcx
movzx ecx, byte [r11]
or r8, rcx
xor rdx, r8
lea r9, [rsi + rdi]
rol rsi, 0xd
add rax, rdx
rol rdx, 0x10
xor rsi, r9
mov rdi, r9
mov rcx, rdx
rol rdi, 0x20
lea rdx, [rsi + rax]
xor rcx, rax
mov rax, rsi
lea r9, [rdi + rcx]
rol rax, 0x11
rol rcx, 0x15
xor rcx, r9
xor rax, rdx
rol rdx, 0x20
add r9, rax
add rdx, rcx
rol rax, 0xd
rol rcx, 0x10
xor rax, r9
rol r9, 0x20
xor rcx, rdx
add rdx, rax
rol rax, 0x11
add r9, rcx
xor rax, rdx
rol rcx, 0x15
xor r8, r9
rol rdx, 0x20
xor rcx, r9
add r8, rax
xor dl, 0xff
rol rax, 0xd
xor rax, r8
rol r8, 0x20
add rdx, rcx
rol rcx, 0x10
xor rcx, rdx
add rdx, rax
rol rax, 0x11
add r8, rcx
rol rcx, 0x15
xor rax, rdx
xor rcx, r8
rol rdx, 0x20
add r8, rax
add rdx, rcx
rol rax, 0xd
rol rcx, 0x10
xor rax, r8
rol r8, 0x20
xor rcx, rdx
add rdx, rax
rol rax, 0x11
add r8, rcx
rol rcx, 0x15
xor rax, rdx
xor rcx, r8
rol rdx, 0x20
add r8, rax
add rdx, rcx
rol rax, 0xd
rol rcx, 0x10
xor rax, r8
rol r8, 0x20
xor rcx, rdx
add r8, rcx
rol rcx, 0x15
add rdx, rax
rol rax, 0x11
xor rcx, r8
xor rax, rdx
rol rdx, 0x20
add r8, rax
rol rax, 0xd
xor r8, rax
lea rax, [rcx + rdx]
rol rcx, 0x10
mov rdx, rcx
xor rdx, rax
add rax, r8
rol r8, 0x11
rol rdx, 0x15
xor rdx, rax
rol rax, 0x20
xor rdx, r8
xor rax, rdx
mov qword [r10], rax
pop rbx
pop rsi
pop rdi
ret
Function at 0x14000cf40
Capabilities:
Read file on windows

Disassembly:
push r13
mov eax, 0x8078
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.140044900
sub rsp, rax
cmp qword [rcx + 0x10], 0
mov rsi, rcx
mov rdi, rdx
mov rbx, r8
je 0x14000cf80
xor eax, eax
add rsp, 0x8078
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov edx, 0x5b
mov rcx, rdi
call sym.strchr
test rax, rax
je 0x14000cfa0
lea r9, [rax + 1]
movzx eax, byte [rax + 1]
xor ecx, ecx
test al, al
jne 0x14000cfc2
xor r12d, r12d
jmp 0x14000cfdf
sub edx, 0x30
lea rax, [rcx + rcx*4]
add r9, 1
movsxd rdx, edx
lea rcx, [rdx + rax*2]
movzx eax, byte [r9]
test al, al
je 0x14000cfd0
movsx edx, al
movzx eax, al
sub eax, 0x30
cmp eax, 9
jbe 0x14000cfa8
mov r12d, ecx
cmp ecx, 0xffff
ja 0x14000d088
lea rcx, [rsp + 0x28]
lea r8, [0x140055d74]
mov rdx, rbx
call qword [sym.imp.msvcrt.dll_fopen_s]
test eax, eax
jne 0x14000d0b0
mov r9, qword [rsp + 0x28]
lea rbp, [rsp + 0x70]
mov r8d, 0x4000
mov edx, 1
mov rcx, rbp
call sym.fread
mov rdi, rax
test rax, rax
je 0x14000d0d0
mov rcx, qword [rsp + 0x28]
lea r13, [rsp + 0x4070]
lea rbx, [rsp + 0x30]
call sym.fclose
mov r9, rdi
mov r8, rbp
mov rcx, r13
mov edx, 0x3fff
call dbg.base64_encode
mov rcx, rbx
mov r9d, r12d
mov edx, 0x40
lea r8, [0x140055d9c]
mov byte [rsp + rax + 0x4070], 0
call sym.snprintf
mov r8, r13
mov rdx, rbx
mov rcx, rsi
call dbg.masscan_set_parameter
jmp 0x14000cf65
mov ecx, 2
call qword [dbg.__acrt_iob_func]
mov r8, rdi
lea rdx, str._s:_bad_index_n
mov rcx, rax
call sym.fprintf_1
mov eax, 2
jmp 0x14000cf67
xor ecx, ecx
lea rdx, str._FAILED__could_not_read_hello_file_n
call dbg.LOG
mov rcx, rbx
call sym.perror
jmp 0x14000d0a5
lea rdx, str._FAILED__could_not_read_hello_file_n
xor ecx, ecx
call dbg.LOG
mov rcx, rbx
call sym.perror
mov rcx, qword [rsp + 0x28]
call sym.fclose
jmp 0x14000d0a5
Function at 0x14000e600
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rsi, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x98]
mov ebx, dword [rsp + 0xa0]
mov qword [rsp + 0x28], rdx
mov r12, rdx
lea rdx, [rsp + 0x28]
mov r10, rcx
mov r13d, r9d
mov rbp, r8
mov rax, rdx
mov ecx, 0x811c9dc5
lea r9, [rsp + 0x30]
nop dword [rax + rax]
movzx r8d, byte [rax]
add rax, 1
xor ecx, r8d
imul ecx, ecx, 0x1000193
cmp r9, rax
jne 0x14000e650
mov qword [rsp + 0x28], rbp
mov rax, rdx
lea r9, [rsp + 0x30]
nop dword [rax + rax]
movzx r8d, byte [rax]
add rax, 1
xor ecx, r8d
imul ecx, ecx, 0x1000193
cmp r9, rax
jne 0x14000e678
movzx eax, r13b
mov qword [rsp + 0x28], rsi
lea r9, [rsp + 0x30]
xor eax, ecx
mov ecx, r13d
imul eax, eax, 0x1000193
movzx ecx, ch
xor eax, ecx
mov rcx, rdx
imul eax, eax, 0x1000193
nop dword [rax]
movzx r8d, byte [rcx]
add rcx, 1
xor eax, r8d
imul eax, eax, 0x1000193
cmp r9, rcx
jne 0x14000e6b8
mov qword [rsp + 0x28], rdi
lea r8, [rsp + 0x30]
nop dword [rax + rax]
movzx ecx, byte [rdx]
add rdx, 1
xor eax, ecx
imul eax, eax, 0x1000193
cmp r8, rdx
jne 0x14000e6e0
movzx edx, bl
xor eax, edx
movzx edx, bh
imul eax, eax, 0x1000193
xor eax, edx
xor edx, edx
imul eax, eax, 0x1000193
movzx eax, ax
lea rax, [rax + rax*4]
shl rax, 5
lea r14, [r10 + rax + 0x400000]
mov rax, r14
mov rcx, qword [rax + 8]
mov r8, qword [rax]
cmp rcx, rbp
jne 0x14000e733
cmp r8, r12
je 0x14000e780
add edx, 1
add rax, 0x28
cmp edx, 4
jne 0x14000e722
lea rdx, [r14 + 0x4c]
lea rcx, [r14 + 0x24]
mov r8d, 0x54
call sym.memmove
mov qword [r14], r12
xor eax, eax
mov qword [r14 + 8], rbp
mov word [r14 + 0x20], r13w
mov qword [r14 + 0x10], rsi
mov qword [r14 + 0x18], rdi
mov word [r14 + 0x22], bx
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
movzx r9d, word [rax + 0x20]
cmp r13d, r9d
jne 0x14000e733
mov r9, qword [rax + 0x10]
mov r10, qword [rax + 0x18]
cmp r9, rsi
jne 0x14000e733
cmp r10, rdi
jne 0x14000e733
movzx r11d, word [rax + 0x22]
cmp ebx, r11d
jne 0x14000e733
test edx, edx
jne 0x14000e7b1
mov eax, 1
jmp 0x14000e76d
mov rdx, qword [r14 + 8]
shl ebx, 0x10
movd xmm2, dword [r14 + 0x20]
xor r8, qword [r14]
xor r9, qword [r14 + 0x10]
xor rdx, rcx
mov ecx, ebx
xor r10, qword [r14 + 0x18]
mov qword [r14], r8
or ecx, r13d
mov qword [r14 + 8], rdx
xor rdx, qword [rax + 8]
movd xmm0, ecx
mov qword [r14 + 0x10], r9
mov rcx, qword [rax]
pxor xmm0, xmm2
mov qword [r14 + 0x18], r10
xor r9, qword [rax + 0x10]
movd dword [r14 + 0x20], xmm0
movd xmm3, dword [rax + 0x20]
xor r10, qword [rax + 0x18]
xor rcx, r8
mov qword [rax], rcx
pxor xmm0, xmm3
mov qword [rax + 8], rdx
movd dword [rax + 0x20], xmm0
movd xmm1, dword [r14 + 0x20]
mov qword [rax + 0x10], r9
pxor xmm1, xmm0
mov qword [rax + 0x18], r10
xor qword [r14], rcx
xor qword [r14 + 8], rdx
xor qword [r14 + 0x10], r9
xor qword [r14 + 0x18], r10
movd dword [r14 + 0x20], xmm1
jmp 0x14000e7aa
Function at 0x140018d30
Capabilities:
Write file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x98
xor eax, eax
lea r8, str.masscan_1.1_ns:_u_n
lea rsi, [rsp + 0x20]
mov rbx, rcx
mov ecx, 0xc
mov rbp, rdx
mov rdi, rsi
mov r9d, dword [rbx + 0x228]
mov edx, 0x63
rep stosq qword [rdi], rax
xor eax, eax
mov rcx, rsi
mov word [rdi], ax
mov byte [rdi + 2], 0
call sym.snprintf.constprop.0_3
mov r9, rbp
mov edx, 1
mov rcx, rsi
mov r8d, 0x63
call sym.fwrite
cmp rax, 0x63
jne 0x140018da7
add qword [rbx + 0x258], 0x63
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea rcx, str.output
call sym.perror
mov ecx, 1
call sym.exit
nop
nop
Function at 0x140019440
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x238
mov r10, rdx
mov rdx, qword [rsp + 0x270]
mov rbx, rcx
mov eax, dword [rdx]
cmp byte [rdx + 0x10], 6
bswap eax
je 0x140019528
cmp r9d, 2
je 0x140019518
cmp r9d, 3
je 0x140019508
mov edx, 6
cmp r9d, 1
jne 0x1400194f8
mov dword [rsp + 0x36], eax
bswap r8d
lea rcx, [rsp + 0x30]
mov r9, r10
movzx eax, byte [rsp + 0x278]
mov byte [rsp + 0x30], dl
mov edx, 1
mov dword [rsp + 0x32], r8d
mov r8d, 0xf
mov byte [rsp + 0x3a], al
movzx eax, word [rsp + 0x280]
mov byte [rsp + 0x31], 0xd
rol ax, 8
mov word [rsp + 0x3b], ax
movzx eax, byte [rsp + 0x288]
mov byte [rsp + 0x3d], al
movzx eax, byte [rsp + 0x290]
mov byte [rsp + 0x3e], al
call sym.fwrite
cmp rax, 0xf
jne 0x140019622
add qword [rbx + 0x258], 0xf
add rsp, 0x238
pop rbx
pop rsi
ret
mov edx, 8
jmp 0x140019484
mov edx, 7
jmp 0x140019484
mov rsi, qword [rdx]
mov r11, qword [rdx + 8]
cmp r9d, 2
je 0x140019618
cmp r9d, 3
je 0x140019608
cmp r9d, 1
jne 0x1400194f8
mov eax, 0xa
mov byte [rsp + 0x130], al
movzx eax, byte [rsp + 0x278]
lea rdx, [rsp + 0x28]
bswap r8d
lea rcx, [rsp + 0x130]
mov dword [rsp + 0x132], r8d
mov r8, rsi
mov byte [rsp + 0x136], al
movzx eax, word [rsp + 0x280]
mov byte [rsp + 0x131], 0x1a
rol ax, 8
mov byte [rsp + 0x13b], 6
mov word [rsp + 0x137], ax
movzx eax, byte [rsp + 0x288]
mov qword [rsp + 0x28], 0xc
mov byte [rsp + 0x139], al
movzx eax, byte [rsp + 0x290]
mov byte [rsp + 0x13a], al
call sym._put_long.constprop.0
mov r8, r11
call sym._put_long.constprop.0
cmp qword [rsp + 0x28], 0x1c
jne 0x140019638
mov r9, r10
mov r8d, 0x1c
mov edx, 1
call sym.fwrite
cmp rax, 0x1c
jne 0x140019622
add qword [rbx + 0x258], 0x1c
jmp 0x1400194f8
mov eax, 0xc
jmp 0x14001954e
mov eax, 0xb
jmp 0x14001954e
lea rcx, str.output
call sym.perror
mov ecx, 1
call sym.exit
mov r8d, 0x8c
lea rdx, str.src_out_binary.c
lea rcx, str.offset__2__26
call qword [sym.imp.msvcrt.dll__assert]
nop
nop word cs:[rax + rax]
nop

Function at 0x140019660
Capabilities:
Write file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x98
xor eax, eax
lea r8, str.masscan_1.1
lea rbx, [rsp + 0x20]
mov rsi, rcx
mov ecx, 0xc
mov rbp, rdx
mov rdi, rbx
mov edx, 0x63
rep stosq qword [rdi], rax
xor eax, eax
mov rcx, rbx
mov word [rdi], ax
mov byte [rdi + 2], 0
call sym.snprintf.constprop.0_3
mov r9, rbp
mov edx, 1
mov rcx, rbx
mov r8d, 0x63
call sym.fwrite
cmp rax, 0x63
jne 0x1400196d0
add qword [rsi + 0x258], 0x63
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea rcx, str.output
call sym.perror
mov ecx, 1
call sym.exit
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x14001a7a0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbp, qword [sym.imp.WS2_32.dll_recv]
xor ebx, ebx
mov rdi, rcx
mov rsi, rdx
nop word [rax + rax]
xor r9d, r9d
lea rdx, [rsi + rbx]
mov r8d, 1
mov rcx, rdi
call rbp
test eax, eax
je 0x14001a7f6
add rbx, 1
cmp byte [rsi + rbx - 1], 0xa
je 0x14001a7ea
cmp rbx, 0x400
jne 0x14001a7c0
mov rax, rbx
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
xor ecx, ecx
lea rdx, str.redis:_recv_line___failed_n
call dbg.LOG
mov ecx, 1
call sym.exit
nop
nop

Function at 0x14001a810
Capabilities:
Send data
Send data on socket

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x438
mov rbp, qword [sym.imp.WS2_32.dll_send]
mov rdi, qword [rcx + 0x2f8]
mov rbx, rdx
test rdi, rdi
je 0x14001a8d0
mov rcx, rdi
lea rsi, [rsp + 0x30]
call sym.strlen
mov qword [rsp + 0x20], rdi
mov edx, 0x400
mov rcx, rsi
mov r9d, eax
lea r8, str.2_r_n_4_r_nAUTH_r_n__u_r_n_s_r_n
call sym.snprintf_2
mov rcx, rsi
call sym.strlen
xor r9d, r9d
mov rcx, rbx
mov rdx, rsi
mov rbp, qword [sym.imp.WS2_32.dll_send]
mov r8d, eax
call rbp
mov rcx, rsi
movsxd rdi, eax
call sym.strlen
cmp rax, rdi
jne 0x14001a938
mov rdx, rsi
mov rcx, rbx
call sym.recv_line.constprop.0
cmp rax, 5
je 0x14001a8d0
cmp dword [rsp + 0x30], 0xd4b4f2b
je 0x14001a8c8
xor ecx, ecx
mov r8, rsi
lea rdx, str.redis:_unexpected_response_from_redis_server:__s_n
call dbg.LOG
mov ecx, 1
call sym.exit
nop dword [rax]
cmp byte [rsp + 0x34], 0xa
jne 0x14001a8aa
nop
xor r9d, r9d
mov r8d, 6
lea rdx, str.PING_r_n
mov rcx, rbx
call rbp
cmp eax, 6
jne 0x14001a920
lea rsi, [rsp + 0x30]
mov rcx, rbx
mov rdx, rsi
call sym.recv_line.constprop.0
cmp rax, 7
je 0x14001a914
cmp dword [rsp + 0x30], 0x4e4f502b
jne 0x14001a8aa
cmp dword [rsp + 0x33], 0xa0d474e
jne 0x14001a8aa
add rsp, 0x438
pop rbx
pop rsi
pop rdi
pop rbp
ret
xor ecx, ecx
lea rdx, str.redis:_send_ping__failed_n
call dbg.LOG
mov ecx, 1
call sym.exit
xor ecx, ecx
lea rdx, str.redis:_error_auth_n
call dbg.LOG
mov ecx, 1
call sym.exit
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x14001a960
Capabilities:
Send data
Send data on socket

Disassembly:
push rsi
push rbx
sub rsp, 0x428
xor r9d, r9d
mov r8d, 6
mov rbx, rdx
lea rdx, str.QUIT_r_n
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 6
jne 0x14001a9f6
lea rsi, [rsp + 0x20]
mov rcx, rbx
mov rdx, rsi
call sym.recv_line.constprop.0
cmp rax, 5
je 0x14001a9c3
cmp dword [rsp + 0x20], 0xd4b4f2b
je 0x14001a9d0
mov edx, 1
cmp rax, 4
je 0x14001a9c3
test edx, edx
je 0x14001a9c3
cmp dword [rsp + 0x20], 0xa0d303a
jne 0x14001a9db
add rsp, 0x428
pop rbx
pop rsi
ret
xor edx, edx
cmp byte [rsp + 0x24], 0xa
jne 0x14001a9aa
jmp 0x14001a9af
xor ecx, ecx
mov r8, rsi
lea rdx, str.redis:_unexpected_response_from_redis_server:__s_n
call dbg.LOG
mov ecx, 1
call sym.exit
xor ecx, ecx
lea rdx, str.redis:_send_quit__failed_n
call dbg.LOG
mov ecx, 1
call sym.exit
nop
nop
Function at 0x14001b740
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
movzx esi, byte [rcx + 0x270]
shr sil, 6
and esi, 1
cmp dword [rcx + 0x220], 0x100
mov qword [rsp + 0x28], 0
mov rbx, rcx
mov rbp, rdx
je 0x14001b828
cmp byte [rdx], 0x2d
je 0x14001b7f0
movzx esi, sil
lea rcx, [rsp + 0x28]
mov rdx, rbp
mov r8d, esi
call dbg.pixie_fopen_shareable
test eax, eax
jne 0x14001b7a0
mov rdi, qword [rsp + 0x28]
test rdi, rdi
jne 0x14001b812
nop dword [rax]
test esi, esi
lea rax, str.appending
mov ecx, 2
lea rbx, str.writing
cmovne rbx, rax
xor edi, edi
call qword [dbg.__acrt_iob_func]
lea rdx, str.out:_could_not_open_file_for__s_n
mov rcx, rax
mov r8, rbx
call sym.fprintf_17
mov rcx, rbp
call sym.perror
mov rax, qword [0x14006cc90]
mov dword [rax], 1
jmp 0x14001b819
cmp byte [rdx + 1], 0
jne 0x14001b77a
mov ecx, 1
call qword [dbg.__acrt_iob_func]
mov qword [rsp + 0x28], rax
mov rdi, rax
test rax, rax
je 0x14001b77a
or byte [rbx + 0x230], 1
mov rax, rdi
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov rdi, qword [rcx + 0x300]
test rdi, rdi
jle 0x14001b850
mov rax, qword [rbx + 0x218]
mov rdx, rdi
mov rcx, rbx
call qword [rax + 0x10]
mov rax, rdi
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
xor r8d, r8d
mov edx, 1
mov ecx, 2
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
call qword [sym.imp.WS2_32.dll_socket]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14001b8ec
mov ecx, dword [rbx + 0x2d8]
call qword [sym.imp.WS2_32.dll_htonl]
movzx ecx, word [rbx + 0x2f0]
mov dword [rsp + 0x34], eax
call qword [sym.imp.WS2_32.dll_htons]
lea rdx, [rsp + 0x30]
mov r8d, 0x10
mov rcx, rdi
mov word [rsp + 0x32], ax
mov eax, 2
mov word [rsp + 0x30], ax
call qword [sym.imp.WS2_32.dll_connect]
test eax, eax
jne 0x14001b8d0
mov qword [rbx + 0x300], rdi
jmp 0x14001b834
xor ecx, ecx
lea rdx, str.redis:_connect___failed_n
call dbg.LOG
lea rcx, str.connect
call sym.perror
jmp 0x14001b8c2
xor ecx, ecx
lea rdx, str.redis:_socket___failed_to_create_socket_n
call dbg.LOG
mov ecx, 1
call sym.exit
nop
nop word cs:[rax + rax]
Function at 0x14001d440
Capabilities:
Create thread

Disassembly:
xor edx, edx
jmp qword [sym.imp.msvcrt.dll__beginthread]

Function at 0x14001d4d0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push rbx
sub rsp, 0x40
mov ecx, dword [0x140175b74]
mov rbx, rdx
test ecx, ecx
je 0x14001d568
mov eax, dword [0x140175b70]
test eax, eax
je 0x14001d550
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x28]
sub rax, qword [0x140175b68]
pxor xmm0, xmm0
cvtsi2sd xmm0, rax
divsd xmm0, qword [0x140175b60]
movabs rax, 0x431bde82d7b634db
cvttsd2si rcx, xmm0
imul rcx
mov rax, rcx
sar rax, 0x3f
sar rdx, 0x12
sub rdx, rax
xor eax, eax
mov dword [rbx], edx
imul rdx, rdx, 0xf4240
sub rcx, rdx
mov dword [rbx + 4], ecx
add rsp, 0x40
pop rbx
ret
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov rax, qword [rsp + 0x30]
jmp 0x14001d500
mov dword [0x140175b74], 1
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov dword [0x140175b70], eax
test eax, eax
jne 0x14001d5d0
xor edx, edx
mov dword [rsp + 0x30], 0x107b2
lea rcx, [rsp + 0x30]
mov word [rsp + 0x3e], dx
lea rdx, [rsp + 0x28]
mov qword [rsp + 0x36], 1
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov rax, qword [rsp + 0x28]
movsd xmm0, qword [0x14005b628]
mov qword [0x140175b68], rax
movsd qword [0x140175b60], xmm0
jmp 0x14001d4e6
lea rcx, [0x140175b68]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
pxor xmm0, xmm0
cvtsi2sd xmm0, qword [rsp + 0x20]
divsd xmm0, qword [0x14005b630]
jmp 0x14001d5c3