joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004fef0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test r9d, 0xff000000
je 0x140050081
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
movss xmm3, dword [rsp + 0x70]
xorps xmm0, xmm0
comiss xmm3, xmm0
mov edi, r9d
mov rsi, r8
mov rbp, rdx
mov rbx, rcx
jbe 0x14004ff60
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x20], eax
call fcn.14004f8b0
mov r8d, dword [rbx + 0x80]
mov r9d, edi
mov rdx, qword [rbx + 0x88]
mov rcx, rbx
call fcn.14004ef10
mov dword [rbx + 0x80], 0
jmp 0x14005006d
mov edx, 6
movaps xmmword [rsp + 0x30], xmm6
lea r8d, [rdx - 2]
call fcn.14004dbe0
movzx edx, word [rbx + 0x48]
mov rax, qword [rbx + 0x38]
movss xmm1, dword [rsi]
movss xmm2, dword [rbp + 4]
movss xmm3, dword [rbp]
lea ecx, [rdx + 1]
movss xmm6, dword [rax + 4]
movss xmm5, dword [rax]
movss xmm4, dword [rsi + 4]
mov rax, qword [rbx + 0x58]
mov word [rax], dx
mov rax, qword [rbx + 0x58]
mov word [rax + 2], cx
lea ecx, [rdx + 2]
mov rax, qword [rbx + 0x58]
mov word [rax + 4], cx
mov rax, qword [rbx + 0x58]
mov word [rax + 6], dx
add dx, 3
mov rax, qword [rbx + 0x58]
mov word [rax + 8], cx
mov rax, qword [rbx + 0x58]
mov word [rax + 0xa], dx
movsd xmm0, qword [rbp]
mov rax, qword [rbx + 0x50]
movsd qword [rax], xmm0
mov rax, qword [rbx + 0x50]
movss dword [rax + 8], xmm5
movss dword [rax + 0xc], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x10], edi
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x14], xmm1
movss dword [rax + 0x18], xmm2
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x1c], xmm5
movss dword [rax + 0x20], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x24], edi
movsd xmm0, qword [rsi]
mov rax, qword [rbx + 0x50]
movsd qword [rax + 0x28], xmm0
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x30], xmm5
movss dword [rax + 0x34], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x38], edi
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x3c], xmm3
movss dword [rax + 0x40], xmm4
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x44], xmm5
movss dword [rax + 0x48], xmm6
mov rax, qword [rbx + 0x50]
movaps xmm6, xmmword [rsp + 0x30]
mov dword [rax + 0x4c], edi
add qword [rbx + 0x50], 0x50
add dword [rbx + 0x48], 4
add qword [rbx + 0x58], 0xc
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x1400608e0
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xe0
mov rax, qword [0x1401310c0]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov r13, rcx
call fcn.140060ad0
mov rax, qword gs:[0x60]
test rax, rax
je 0x140060a95
mov r12, qword [rax + 0x18]
add r12, 0x20
mov r14, qword [r12]
test r14, r14
je 0x140060a95
cmp r14, r12
je 0x140060a8b
xor ebx, ebx
nop dword [rax]
lea r15, [r14 - 0x10]
test r15, r15
je 0x140060a7f
mov rdx, qword [r15 + 0x60]
lea rcx, [rsp + 0x20]
call fcn.140009730
nop
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0xf]
call fcn.1400648a0
nop
mov rdx, qword [rbp - 0x71]
cmp rdx, 7
jbe 0x1400609bc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400609b7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140060ac4
call fcn.1400ab330
mov qword [rbp - 0x79], rbx
mov qword [rbp - 0x71], 7
mov word [rsp + 0x20], bx
lea rdi, [rbp + 0xf]
cmp qword [rbp + 0x27], 0xf
seta cl
mov rbx, qword [rbp + 0xf]
cmova rdi, rbx
lea rdx, [rbp + 0xf]
mov rsi, qword [rbp + 0x1f]
test cl, cl
je 0x1400609f2
add rsi, rbx
jmp 0x1400609f9
add rsi, rdx
lea rbx, [rbp + 0xf]
cmp rbx, rsi
je 0x140060a14
sub rdi, rbx
movsx ecx, byte [rbx]
call fcn.1400b2bb4
mov byte [rbx + rdi], al
inc rbx
cmp rbx, rsi
jne 0x140060a01
mov rbx, qword [r15 + 0x30]
lea rcx, [rbp - 0x69]
call fcn.140020cc0
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x29], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x19], xmm1
mov qword [rbp - 9], rbx
movsxd rax, dword [rbx + 0x3c]
add rax, rbx
mov qword [rbp - 0x11], rax
lea r8, [rbp + 0xf]
lea rdx, [rbp - 1]
mov rcx, r13
call fcn.140060e70
mov rcx, qword [rax]
add rcx, 0x30
lea rdx, [rbp - 0x69]
call fcn.140060820
nop
lea rcx, [rbp - 0x29]
call fcn.14000a5c0
lea rcx, [rbp - 0x69]
call fcn.14001eeb0
nop
lea rcx, [rbp + 0xf]
call fcn.14000a890
xor ebx, ebx
mov r14, qword [r14]
cmp r14, r12
jne 0x140060950
cmp qword [r13 + 0x10], 0
setne al
jmp 0x140060a97
xor al, al
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.1400ab310
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400b42c8
nop
int3

Function at 0x140060ad0
Capabilities:
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x140060b3d
mov rax, qword [rbx + 0x38]
mov rdx, qword [rbx + 8]
shr rax, 3
cmp rax, rcx
jbe 0x140060b06
mov r8, rdx
mov rcx, rbx
mov rdx, qword [rdx]
add rsp, 0x20
pop rbx
jmp fcn.140060c20
call fcn.1400611e0
mov rax, qword [rbx + 8]
lea r8, [rsp + 0x30]
mov qword [rax], rax
mov rax, qword [rbx + 8]
mov qword [rax + 8], rax
mov qword [rbx + 0x10], 0
mov rax, qword [rbx + 8]
mov rdx, qword [rbx + 0x20]
mov rcx, qword [rbx + 0x18]
mov qword [rsp + 0x30], rax
call fcn.14000d340
add rsp, 0x20
pop rbx
ret
Function at 0x140060c20
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
push r12
push r13
push r15
sub rsp, 0x70
mov qword [rsp + 0x48], r8
mov r15, r8
mov r12, rdx
mov r13, rcx
cmp rdx, r8
je 0x140060e46
cmp qword [rdx + 0x28], 0xf
lea r8, [rdx + 0x10]
mov r10, qword [rcx + 0x18]
mov r9, qword [r8 + 0x10]
mov qword [rax + 0x10], rbx
mov rbx, rdx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov qword [rax - 0x20], rdi
mov qword [rax - 0x28], r14
mov rax, qword [rcx + 8]
mov qword [rsp + 0x40], rax
mov rax, qword [rdx + 8]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x50], r10
jbe 0x140060c88
mov r8, qword [r8]
xor ecx, ecx
movabs rdx, 0xcbf29ce484222325
movabs r11, 0x100000001b3
test r9, r9
je 0x140060cc4
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r8 + rcx]
inc rcx
xor rdx, rax
imul rdx, r11
cmp rcx, r9
jb 0x140060cb0
mov rax, qword [r13 + 0x30]
and rax, rdx
shl rax, 4
add rax, r10
mov qword [rsp + 0x28], rax
mov rcx, qword [rax]
mov rax, qword [rax + 8]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rcx
nop dword [rax + rax]
mov rbp, rbx
mov r14, rbx
mov rbx, qword [rbx]
lea rcx, [rbp + 0x70]
call fcn.14000a5c0
lea rcx, [rbp + 0x30]
call fcn.14001eeb0
lea rcx, [rbp + 0x10]
call fcn.14000a890
mov edx, 0x98
mov rcx, rbp
call fcn.1400ab330
dec qword [r13 + 0x10]
cmp rbp, qword [rsp + 0x30]
je 0x140060d49
cmp rbx, r15
jne 0x140060cf0
cmp qword [rsp + 0x38], r12
jne 0x140060e18
mov rcx, qword [rsp + 0x28]
mov qword [rcx], rbx
jmp 0x140060e18
mov rcx, qword [rsp + 0x28]
cmp qword [rsp + 0x38], r12
jne 0x140060d5f
mov rax, qword [rsp + 0x40]
mov qword [rcx], rax
jmp 0x140060d64
mov rax, qword [rsp + 0x20]
mov qword [rcx + 8], rax
cmp rbx, r15
je 0x140060e18
cmp qword [rbx + 0x28], 0xf
lea r8, [rbx + 0x10]
mov r9, qword [r8 + 0x10]
jbe 0x140060d83
mov r8, qword [r8]
xor edx, edx
movabs rcx, 0xcbf29ce484222325
test r9, r9
je 0x140060db9
movabs r15, 0x100000001b3
nop
movzx eax, byte [r8 + rdx]
inc rdx
xor rcx, rax
imul rcx, r15
cmp rdx, r9
jb 0x140060da0
mov r15, qword [rsp + 0x48]
mov r12, qword [r13 + 0x30]
and r12, rcx
shl r12, 4
add r12, qword [rsp + 0x50]
mov rax, qword [r12 + 8]
mov qword [rsp + 0x30], rax
mov rbp, rbx
mov r14, rbx
mov rbx, qword [rbx]
lea rcx, [rbp + 0x70]
call fcn.14000a5c0
lea rcx, [rbp + 0x30]
call fcn.14001eeb0
lea rcx, [rbp + 0x10]
call fcn.14000a890
mov edx, 0x98
mov rcx, rbp
call fcn.1400ab330
dec qword [r13 + 0x10]
cmp rbp, qword [rsp + 0x30]
je 0x140060e54
cmp rbx, r15
jne 0x140060dd3
mov qword [r12], rbx
mov rax, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0xa8]
mov rbp, qword [rsp + 0xa0]
mov r14, qword [rsp + 0x60]
mov qword [rax], rbx
mov qword [rbx + 8], rax
mov rbx, qword [rsp + 0x98]
mov rax, r15
add rsp, 0x70
pop r15
pop r13
pop r12
ret
mov rdx, qword [rsp + 0x40]
mov qword [r12], rdx
mov qword [r12 + 8], rdx
cmp rbx, r15
jne 0x140060d71
jmp 0x140060e18
Function at 0x140063110
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xa0
mov rax, qword [0x1401310c0]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov r15, rcx
mov rcx, qword [rcx + 0x70]
movzx eax, word [rcx + 0x14]
lea rbx, [rcx + 0x18]
add rbx, rax
movzx edi, word [rcx + 6]
xor r12d, r12d
test rdi, rdi
je 0x140063238
nop
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 7], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x17], xmm1
movsd xmm0, qword [rbx + 0x20]
movsd qword [rbp + 0x27], xmm0
xorps xmm1, xmm1
movups xmmword [rbp - 0x39], xmm1
mov qword [rbp - 0x29], r12
mov qword [rbp - 0x21], r12
lea rax, [rbp + 7]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x140063193
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x39]
call fcn.14000d600
mov eax, dword [rbp + 0x17]
mov qword [rbp - 0x19], rax
mov ecx, dword [rbp + 0xf]
mov qword [rbp - 0x11], rcx
mov r8d, dword [rbp + 0x1b]
mov dword [rbp - 9], r8d
mov r9d, dword [rbp + 0x13]
mov dword [rbp - 5], r9d
xor r10d, r10d
mov qword [rbp - 1], r10
mov rdx, qword [r15 + 0x60]
cmp rdx, qword [r15 + 0x68]
je 0x140063213
movaps xmm0, xmmword [rbp - 0x39]
movups xmmword [rdx], xmm0
movaps xmm1, xmmword [rbp - 0x29]
movups xmmword [rdx + 0x10], xmm1
mov qword [rbp - 0x29], r12
mov qword [rbp - 0x21], recv
mov byte [rbp - 0x39], r10b
mov qword [rdx + 0x20], rax
mov qword [rdx + 0x28], rcx
mov dword [rdx + 0x30], r8d
mov dword [rdx + 0x34], r9d
mov dword [rdx + 0x38], r10d
add qword [r15 + 0x60], 0x40
jmp 0x140063221
lea r8, [rbp - 0x39]
lea rcx, [r15 + 0x58]
call fcn.14000f4e0
nop
lea rcx, [rbp - 0x39]
call fcn.14000a890
add rbx, 0x28
sub rdi, 1
jne 0x140063160
mov rax, qword [r15 + 0x70]
mov rax, qword [rax + 0xb0]
mov rcx, rax
shr rcx, 0x20
test ecx, ecx
je 0x14006331f
mov r11d, eax
mov ebx, eax
add rbx, qword [r15 + 0x78]
mov r8, qword [r15 + 0x58]
mov r10, qword [r15 + 0x60]
cmp r8, r10
je 0x140063291
mov ecx, dword [r8 + 0x34]
cmp ecx, eax
ja 0x14006327c
mov rdx, qword [r8 + 0x28]
add rdx, rcx
cmp r11, rdx
jb 0x140063287
add r8, 0x40
cmp r8, r10
jne 0x140063268
jmp 0x140063291
mov eax, dword [r8 + 0x30]
sub rax, rcx
add rbx, rax
cmp dword [rbx], 0
je 0x14006331f
nop word [rax + rax]
mov r14, r12
mov edx, dword [rbx + 4]
lea rax, [rdx - 8]
sar rax, 1
test eax, eax
je 0x140063315
lea rsi, [rbx + 8]
nop word [rax + rax]
mov eax, dword [rbx]
mov dword [rbp - 0x49], eax
movzx eax, word [rsi]
mov word [rbp - 0x45], ax
mov rdx, qword [r15 + 0x88]
cmp rdx, qword [r15 + 0x90]
je 0x1400632ed
mov rax, qword [rbp - 0x49]
mov qword [rdx], rax
add qword [r15 + 0x88], 8
jmp 0x1400632fd
lea r8, [rbp - 0x49]
lea rcx, [r15 + 0x80]
call fcn.14000fed0
inc r14
add rsi, 2
mov edx, dword [rbx + 4]
lea rax, [rdx - 8]
sar rax, 1
mov eax, eax
cmp r14, rax
jb 0x1400632c0
mov eax, edx
add rbx, rax
cmp dword [rbx], 0
jne 0x1400632a0
mov rcx, r15
call fcn.140063580
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.1400ab310
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x140067c20
Capabilities:
Hash data using sha1
Hash data using sha256
Hash data using sha384
Hash data using sha512

Disassembly:
push rdi
sub rsp, 0x20
mov rdi, rcx
test rcx, rcx
je 0x140067ec4
mov eax, 0xffe9
mov dword [rcx + 0x41d], 0
and word [rcx + 0x416], ax
mov eax, 0xfffc
and word [rcx + 0x414], ax
xor eax, eax
mov word [rcx + 0x422], 0
mov byte [rcx + 0x40c], 0
mov dword [rcx + 0x2dc], eax
mov rcx, qword [rcx + 0x18]
test rcx, rcx
je 0x140067e93
add rcx, 0x1d0
je 0x140067ec4
mov rax, qword [rdi + 0x48]
xor edx, edx
mov qword [rcx + 0x60], rax
mov qword [rcx], rdx
mov dword [rcx + 8], edx
mov dword [rcx + 0x4c], 0x67452301
mov dword [rcx + 0x50], 0xefcdab89
mov dword [rcx + 0x54], 0x98badcfe
mov dword [rcx + 0x58], 0x10325476
mov rcx, qword [rdi + 0x18]
add rcx, 0x168
je 0x140067ec4
mov rax, qword [rdi + 0x48]
mov qword [rcx + 0x60], rax
mov dword [rcx + 0x4c], 0x67452301
mov dword [rcx + 0x50], 0xefcdab89
mov dword [rcx + 0x54], 0x98badcfe
mov dword [rcx + 0x58], 0x10325476
mov dword [rcx + 0x5c], 0xc3d2e1f0
mov qword [rcx], rdx
mov dword [rcx + 8], edx
mov rcx, qword [rdi + 0x18]
add rcx, 0x238
je 0x140067ec4
mov rax, qword [rdi + 0x48]
xorps xmm0, xmm0
mov qword [rcx + 0x70], rax
movups xmmword [rcx], xmm0
movups xmmword [rcx + 0x10], xmm0
mov dword [rcx], 0x6a09e667
mov dword [rcx + 4], 0xbb67ae85
mov dword [rcx + 8], 0x3c6ef372
mov dword [rcx + 0xc], 0xa54ff53a
mov dword [rcx + 0x10], 0x510e527f
mov dword [rcx + 0x14], 0x9b05688c
mov dword [rcx + 0x18], 0x1f83d9ab
mov dword [rcx + 0x1c], 0x5be0cd19
mov qword [rcx + 0x60], rdx
mov dword [rcx + 0x68], edx
mov rcx, qword [rdi + 0x18]
add rcx, 0x2b0
je 0x140067ec4
mov rax, qword [rdi + 0x48]
mov qword [rcx + 0xd8], rax
movabs rax, 0xcbbb9d5dc1059ed8
mov qword [rcx], rax
movabs rax, 0x629a292a367cd507
mov qword [rcx + 8], rax
movabs rax, 0x9159015a3070dd17
mov qword [rcx + 0x10], rax
movabs rax, 0x152fecd8f70e5939
mov qword [rcx + 0x18], rax
movabs rax, 0x67332667ffc00b31
mov qword [rcx + 0x20], rax
movabs rax, 0x8eb44a8768581511
mov qword [rcx + 0x28], rax
movabs rax, 0xdb0c2e0d64f98fa7
mov qword [rcx + 0x30], rax
movabs rax, 0x47b5481dbefa4fa4
mov qword [rcx + 0x38], rax
mov dword [rcx + 0xc0], edx
mov qword [rcx + 0xc8], rdx
mov qword [rcx + 0xd0], rdx
mov rcx, qword [rdi + 0x18]
add rcx, 0x390
je 0x140067ec4
mov rax, qword [rdi + 0x48]
mov qword [rcx + 0xd8], rax
movabs rax, 0x6a09e667f3bcc908
mov qword [rcx], rax
movabs rax, 0xbb67ae8584caa73b
mov qword [rcx + 8], rax
movabs rax, 0x3c6ef372fe94f82b
mov qword [rcx + 0x10], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rcx + 0x18], rax
movabs rax, 0x510e527fade682d1
mov qword [rcx + 0x20], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rcx + 0x28], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rcx + 0x30], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rcx + 0x38], rax
mov dword [rcx + 0xc0], edx
mov qword [rcx + 0xc8], rdx
mov qword [rcx + 0xd0], rdx
lea rcx, [rdi + 0x4e0]
mov qword [rsp + 0x30], rbx
call fcn.14006bcf0
mov r8, qword [rdi + 0x48]
lea rcx, [rdi + 0x4e0]
call fcn.14006bba0
mov rbx, qword [rsp + 0x30]
mov eax, 1
add rsp, 0x20
pop rdi
ret
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x14006a240
Capabilities:
Check for software breakpoints

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x40
mov rax, qword [0x1401310c0]
xor rax, rsp
mov qword [rsp + 0x30], rax
xor r9d, r9d
mov rsi, r8
mov word [rsp + 0x20], r9w
mov rbx, rcx
mov qword [rsp + 0x28], r9
movzx r10d, r9w
test rcx, rcx
je 0x14006a28a
movzx eax, byte [rcx + 0x2e0]
cmp al, 3
jne 0x14006a2a4
cmp byte [rcx + 0x2e1], 1
jae 0x14006a2a8
xor eax, eax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400ab310
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rsi
ret
cmp al, 0xfe
jne 0x14006a28a
mov qword [rsp + 0x58], rdi
movzx ecx, r9w
mov rdi, qword [rbx + 8]
movzx r8d, word [rdi]
cmp r9w, r8w
jae 0x14006a2ed
nop
movzx eax, cx
movzx edx, byte [rax + rdi + 4]
cmp dl, 0x13
je 0x14006a419
cmp dl, 0xc0
je 0x14006a40a
cmp dl, 0xcc
je 0x14006a40a
add cx, 2
cmp cx, r8w
jb 0x14006a2c0
movzx r11d, byte [rsp + 0x29]
movzx ecx, r9w
bts r11d, 2
mov byte [rsp + 0x29], r11b
cmp r9w, r8w
jae 0x14006a331
nop word [rax + rax]
movzx eax, cx
movzx edx, byte [rax + rdi + 4]
cmp dl, 0x13
je 0x14006a341
cmp dl, 0xc0
je 0x14006a341
cmp dl, 0xcc
je 0x14006a341
add cx, 2
cmp cx, r8w
jb 0x14006a310
movzx eax, r11b
bts eax, 3
movzx r11d, al
mov byte [rsp + 0x29], al
cmp word [rdi + 2], r9w
mov rdi, qword [rsp + 0x58]
jne 0x14006a359
movzx eax, r11b
bts eax, 5
mov byte [rsp + 0x29], al
mov rcx, qword [rbx + 0x1aa0]
test rcx, rcx
je 0x14006a388
lea r9, [rsp + 0x20]
mov r8b, 1
lea rdx, [rsp + 0x28]
call fcn.140069b50
mov r9d, eax
test eax, eax
jne 0x14006a28c
movzx r10d, word [rsp + 0x20]
mov rax, qword [rbx]
test rax, rax
je 0x14006a3bf
mov rcx, qword [rax + 0x180]
test rcx, rcx
je 0x14006a3bf
lea r9, [rsp + 0x20]
mov r8b, 1
lea rdx, [rsp + 0x28]
call fcn.140069b50
mov r9d, eax
test eax, eax
jne 0x14006a28c
movzx r10d, word [rsp + 0x20]
mov eax, 0x200
test word [rbx + 0x418], ax
je 0x14006a3f3
movzx eax, word [rbx + 0x2e0]
cmp al, 3
jne 0x14006a3ee
shr ax, 8
cmp al, 4
jb 0x14006a3ee
mov eax, 0x400
test word [rbx + 0x414], ax
je 0x14006a3f3
add r10w, 4
test r10w, r10w
je 0x14006a3fe
add r10w, 2
add word [rsi], r10w
mov eax, r9d
jmp 0x14006a28c
movzx r11d, byte [rsp + 0x29]
movzx ecx, r9w
jmp 0x14006a310
movzx r11d, byte [rsp + 0x29]
mov ecx, r9d
jmp 0x14006a310
Function at 0x14006a430
Capabilities:
Check for software breakpoints

Disassembly:
push rbx
push rbp
push rsi
sub rsp, 0x50
mov rax, qword [0x1401310c0]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor r10d, r10d
mov rbp, r9
mov qword [rsp + 0x38], r10
mov rsi, rdx
mov rbx, rcx
test rcx, rcx
je 0x14006a471
movzx eax, byte [rcx + 0x2e0]
cmp al, 3
jne 0x14006a488
cmp byte [rcx + 0x2e1], 1
jae 0x14006a48c
xor eax, eax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400ab310
add rsp, 0x50
pop rsi
pop rbp
pop rbx
ret
cmp al, 0xfe
jne 0x14006a471
test rsi, rsi
je 0x14006a471
mov qword [rsp + 0x80], rdi
mov r9d, 2
mov rdi, qword [rbx + 8]
movzx ecx, r10w
mov word [rsp + 0x30], r9w
movzx r8d, word [rdi]
cmp r10w, r8w
jae 0x14006a4ed
nop word [rax + rax]
movzx eax, cx
movzx edx, byte [rax + rdi + 4]
cmp dl, 0x13
je 0x14006a656
cmp dl, 0xc0
je 0x14006a647
cmp dl, 0xcc
je 0x14006a647
add cx, r9w
cmp cx, r8w
jb 0x14006a4c0
movzx r11d, byte [rsp + 0x39]
movzx ecx, r10w
bts r11d, 2
mov byte [rsp + 0x39], r11b
cmp r10w, r8w
jae 0x14006a531
nop word [rax + rax]
movzx eax, cx
movzx edx, byte [rax + rdi + 4]
cmp dl, 0x13
je 0x14006a541
cmp dl, 0xc0
je 0x14006a541
cmp dl, 0xcc
je 0x14006a541
add cx, r9w
cmp cx, r8w
jb 0x14006a510
movzx eax, r11b
bts eax, 3
movzx r11d, al
mov byte [rsp + 0x39], al
cmp word [rdi + 2], r10w
mov rdi, qword [rsp + 0x80]
jne 0x14006a55c
movzx eax, r11b
bts eax, 5
mov byte [rsp + 0x39], al
mov rcx, qword [rbx + 0x1aa0]
test rcx, rcx
je 0x14006a594
lea rax, [rsp + 0x30]
mov r9b, 1
lea rdx, [rsi + 2]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x38]
call fcn.140069d50
mov r10d, eax
test eax, eax
jne 0x14006a473
movzx r9d, word [rsp + 0x30]
mov rax, qword [rbx]
test rax, rax
je 0x14006a5d7
mov rcx, qword [rax + 0x180]
test rcx, rcx
je 0x14006a5d7
movzx edx, r9w
lea rax, [rsp + 0x30]
add rdx, rsi
mov qword [rsp + 0x20], rax
mov r9b, 1
lea r8, [rsp + 0x38]
call fcn.140069d50
mov r10d, eax
test eax, eax
jne 0x14006a473
movzx r9d, word [rsp + 0x30]
mov eax, 0x200
test word [rbx + 0x418], ax
je 0x14006a623
movzx eax, word [rbx + 0x2e0]
cmp al, 3
jne 0x14006a606
shr ax, 8
cmp al, 4
jb 0x14006a606
mov eax, 0x400
test word [rbx + 0x414], ax
je 0x14006a623
movzx eax, r9w
add r9w, 2
movzx ecx, r9w
mov word [rax + rsi], 0x1700
mov word [rcx + rsi], 0
lea r9d, [rcx + 2]
cmp r9w, 2
jbe 0x14006a63a
lea ecx, [r9 - 2]
movzx eax, cx
mov byte [rsi + 1], cl
shr ax, 8
mov byte [rsi], al
add word [rbp], r9w
mov eax, r10d
jmp 0x14006a473
movzx r11d, byte [rsp + 0x39]
movzx ecx, r10w
jmp 0x14006a510
movzx r11d, byte [rsp + 0x39]
mov ecx, r10d
jmp 0x14006a510
Function at 0x14006ab90
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
xor eax, eax
mov r10, rcx
mov ecx, eax
test r8d, r8d
jle 0x14006ac5f
cmp r8d, 8
jb 0x14006ac5f
mov qword [rsp + 0x10], rbx
mov r11, r10
movsxd r9, r8d
sub r11, rdx
and r9, 0xfffffffffffffff8
mov qword [rsp], rdi
mov rbx, 0xfffffffffffffffc
lea rdi, [rdx + 4]
sub rbx, rdx
xorps xmm4, xmm4
xorps xmm3, xmm3
nop dword [rax + rax]
movd xmm2, dword [r11 + rdi - 4]
xorps xmm0, xmm0
movd xmm1, dword [rdi - 4]
lea rdi, [rdi + 8]
punpcklbw xmm2, xmm0
lea rax, [rbx + rdi]
punpcklwd xmm2, xmm0
add ecx, 8
punpcklbw xmm1, xmm0
punpcklwd xmm1, xmm0
xorps xmm2, xmm1
movd xmm1, dword [rdi - 8]
punpcklbw xmm1, xmm0
orps xmm4, xmm2
movd xmm2, dword [r11 + rdi - 8]
punpcklbw xmm2, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
xorps xmm2, xmm1
orps xmm3, xmm2
cmp rax, r9
jl 0x14006abe0
mov rdi, qword [rsp]
orps xmm3, xmm4
mov rbx, qword [rsp + 0x10]
movdqa xmm0, xmm3
psrldq xmm0, 8
orps xmm3, xmm0
movdqa xmm0, xmm3
psrldq xmm0, 4
orps xmm3, xmm0
movd eax, xmm3
movsxd r11, ecx
movsxd r9, r8d
cmp r11, r9
jge 0x14006ac98
sub r10, rdx
lea rcx, [r11 + rdx]
sub r9, r11
nop dword [rax]
nop dword [rax + rax]
movzx r8d, byte [rcx + r10]
movzx edx, byte [rcx]
lea rcx, [rcx + 1]
xor r8d, edx
or eax, r8d
sub r9, 1
jne 0x14006ac80
add rsp, 8
ret
Function at 0x14006e260
Capabilities:
Hash data using sha1

Disassembly:
push rbp
push rbx
push rsi
push rdi
lea rbp, [rsp - 0x38]
sub rsp, 0x138
mov rax, qword [0x1401310c0]
xor rax, rsp
mov qword [rbp + 0x28], rax
xor eax, eax
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
je 0x14006e4ce
mov qword [rsp + 0x130], r15
mov r15d, 0x2000
test word [rcx + 0x414], r15w
je 0x14006e360
lea r8, [rsp + 0x60]
mov dword [rsp + 0x60], 0x30
lea rdx, [rsp + 0x68]
call fcn.140068210
test eax, eax
jne 0x14006e360
lea r8d, [rax + 4]
mov rcx, rsi
lea rdx, str.CLNT
call fcn.1400be360
test eax, eax
lea rcx, str.server_finished
lea r9, str.client_finished
cmovne r9, rcx
cmp byte [rbx + 0x2e0], 3
jne 0x14006e30e
cmp byte [rbx + 0x2e1], 3
jb 0x14006e30e
mov edx, 1
jmp 0x14006e310
xor edx, edx
mov rax, qword [rbx + 0x48]
movzx ecx, byte [rbx + 0x2ee]
mov r8, qword [rbx + 0x10]
mov qword [rsp + 0x50], rax
add r8, 0x7d
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x48], ecx
mov rcx, rdi
mov dword [rsp + 0x40], edx
mov edx, recv
mov dword [rsp + 0x38], eax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], recv
mov qword [rsp + 0x20], r9
lea r9d, [rdx + 0x24]
call fcn.14008d0b0
test word [rbx + 0x414], r15w
mov r15, qword [rsp + 0x130]
jne 0x14006e4d3
mov r8, rsi
mov rdx, rdi
mov rcx, rbx
call fcn.14006dd10
test eax, eax
jne 0x14006e4d3
mov rax, qword [rbx + 0x18]
add rax, 0x168
je 0x14006e4ce
movups xmm0, xmmword [rax]
mov r8d, 4
lea rcx, [rbp - 0x60]
mov rdx, rsi
movaps xmmword [rbp - 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movaps xmmword [rbp - 0x50], xmm1
movups xmm0, xmmword [rax + 0x20]
movaps xmmword [rbp - 0x40], xmm0
movups xmm1, xmmword [rax + 0x30]
movaps xmmword [rbp - 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movaps xmmword [rbp - 0x20], xmm0
movups xmm1, xmmword [rax + 0x50]
movaps xmmword [rbp - 0x10], xmm1
movsd xmm0, qword [rax + 0x60]
movsd qword [rbp], xmm0
call fcn.140098290
test eax, eax
jne 0x14006e4d3
mov rdx, qword [rbx + 0x10]
lea r8d, [rax + 0x30]
add rdx, 0x7d
lea rcx, [rbp - 0x60]
call fcn.140098290
test eax, eax
jne 0x14006e4d3
lea r8d, [rax + 0x28]
lea rdx, str.666666666666666666666666666666666666666666666666U
lea rcx, [rbp - 0x60]
call fcn.140098290
test eax, eax
jne 0x14006e4d3
lea rdx, [rbp + 0x10]
lea rcx, [rbp - 0x60]
call fcn.140098730
test eax, eax
jne 0x14006e4d3
mov rdx, qword [rbx + 0x10]
lea rcx, [rbp - 0x60]
mov rax, qword [rbx + 0x48]
add rdx, 0x7d
mov r8d, 0x30
mov qword [rbp], rax
mov dword [rbp - 0x14], 0x67452301
mov dword [rbp - 0x10], 0xefcdab89
mov dword [rbp - 0xc], 0x98badcfe
mov dword [rbp - 8], 0x10325476
mov dword [rbp - 4], 0xc3d2e1f0
mov qword [rbp - 0x60], 0
mov dword [rbp - 0x58], 0
call fcn.140098290
test eax, eax
jne 0x14006e4d3
lea r8d, [rax + 0x28]
lea rdx, str.CLNTDOGNGRD
lea rcx, [rbp - 0x60]
call fcn.140098290
test eax, eax
jne 0x14006e4d3
lea r8d, [rax + 0x14]
lea rdx, [rbp + 0x10]
lea rcx, [rbp - 0x60]
call fcn.140098290
test eax, eax
jne 0x14006e4d3
lea rdx, [rdi + 0x10]
lea rcx, [rbp - 0x60]
call fcn.140098730
jmp 0x14006e4d3
mov eax, 0xffffff53
mov rcx, qword [rbp + 0x28]
xor rcx, rsp
call fcn.1400ab310
add rsp, 0x138
pop rdi
pop rsi
pop rbx
pop rbp
ret