joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14016ea40
Capabilities:
Hash data using fnv

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x40
mov rbp, r8
mov r14, rdx
mov rsi, rcx
cmp rdx, r8
je 0x14016e44e
mov rdx, qword [rcx + 0x18]
movabs r8, 0x100000001b3
mov qword [rsp + 0x60], rbx
movabs rax, 0xcbf29ce484222325
mov qword [rsp + 0x38], rdi
mov rbx, r14
mov qword [rsp + 0x30], r12
mov r12, qword [rcx + 8]
movzx ecx, byte [r14 + 0x10]
xor rcx, rax
mov qword [rsp + 0x28], r13
movzx eax, byte [r14 + 0x11]
mov r13, qword [r14 + 8]
imul rcx, r8
mov qword [rsp + 0x20], r15
mov r15, qword [rsi + 0x30]
xor rcx, rax
movzx eax, byte [r14 + 0x12]
imul rcx, r8
mov qword [rsp + 0x78], rdx
xor rcx, rax
movzx eax, byte [r14 + 0x13]
imul rcx, r8
xor rcx, rax
imul rcx, r8
and r15, rcx
shl r15, 4
add r15, rdx
mov rax, qword [r15]
mov qword [rsp + 0x68], rax
mov rax, qword [r15 + 8]
mov qword [rsp + 0x70], rax
nop dword [rax + rax]
mov rcx, rbx
mov rdi, rbx
mov rbx, qword [rbx]
mov edx, 0x20
call fcn.1401dcf3c
dec qword [rsi + 0x10]
cmp rdi, qword [rsp + 0x70]
je 0x14016e45a
cmp rbx, rbp
jne 0x14016e400
cmp qword [rsp + 0x68], r14
jne 0x14016e42d
mov qword [r15], rbx
mov r12, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov r15, qword [rsp + 0x20]
mov qword [r13], rbx
mov qword [rbx + 8], r13
mov r13, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x60]
mov rax, rbp
add rsp, 0x40
pop r14
pop rsi
pop rbp
ret
cmp qword [rsp + 0x68], r14
jne 0x14016e469
mov qword [r15], r12
mov rax, r12
jmp 0x14016e46c
mov rax, r13
mov qword [r15 + 8], rax
cmp rbx, rbp
je 0x14016e42d
nop word [rax + rax]
movzx ecx, byte [rbx + 0x10]
movabs rdx, 0x100000001b3
mov r15, qword [rsi + 0x30]
movabs rax, 0xcbf29ce484222325
xor rcx, rax
movzx eax, byte [rbx + 0x11]
imul rcx, rdx
xor rcx, rax
movzx eax, byte [rbx + 0x12]
imul rcx, rdx
xor rcx, rax
movzx eax, byte [rbx + 0x13]
imul rcx, rdx
xor rcx, rax
imul rcx, rdx
and r15, rcx
shl r15, 4
add r15, qword [rsp + 0x78]
mov r14, qword [r15 + 8]
nop dword [rax]
nop dword [rax + rax]
mov rcx, rbx
mov rdi, rbx
mov rbx, qword [rbx]
mov edx, 0x20
call fcn.1401dcf3c
dec qword [rsi + 0x10]
cmp rdi, r14
je 0x14016e506
cmp rbx, rbp
jne 0x14016e4e0
jmp 0x14016e42a
mov qword [r15], r12
mov qword [r15 + 8], r12
cmp rbx, rbp
jne 0x14016e480
jmp 0x14016e42d
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x14016eaec
mov rax, qword [rdi + 0x38]
shr rax, 3
cmp rax, rcx
jbe 0x14016ea7a
mov rdx, qword [rdi + 8]
mov rcx, rdi
mov r8, rdx
mov rdx, qword [rdx]
add rsp, 0x20
pop rdi
jmp 0x14016e350
mov rcx, qword [rdi + 8]
mov rax, qword [rcx + 8]
mov qword [rax], 0
mov rcx, qword [rcx]
test rcx, rcx
je 0x14016eaba
mov qword [rsp + 0x38], rbx
nop word [rax + rax]
mov rbx, qword [rcx]
mov edx, 0x20
call fcn.1401dcf3c
mov rcx, rbx
test rbx, rbx
jne 0x14016eaa0
mov rbx, qword [rsp + 0x38]
mov rax, qword [rdi + 8]
lea r8, [rsp + 0x30]
mov qword [rax], rax
mov rax, qword [rdi + 8]
mov qword [rax + 8], rax
mov qword [rdi + 0x10], 0
mov rax, qword [rdi + 8]
mov rdx, qword [rdi + 0x20]
mov rcx, qword [rdi + 0x18]
mov qword [rsp + 0x30], rax
call fcn.1400510f0
add rsp, 0x20
pop rdi
ret
Function at 0x14016ec50
Capabilities:
Hash data using fnv

Disassembly:
cmp byte [rcx + 0x48], 0
jne fcn.14016ea40
ret

Function at 0x14016eda0
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 8
cmp byte [rcx + 0x48], 0
mov r11, r8
mov r10, rcx
je 0x14016ee58
movabs rax, 0xcbf29ce484222325
mov qword [rsp], rbx
movabs rbx, 0x100000001b3
movzx r9d, dl
xor r9, rax
mov eax, edx
imul r9, rbx
shr eax, 8
movzx r8d, al
mov eax, edx
xor r9, r8
shr eax, 0x10
mov r8, qword [r10 + 8]
imul r9, rbx
movzx ecx, al
xor r9, rcx
mov eax, edx
mov rcx, qword [r10 + 0x30]
imul r9, rbx
shr rax, 0x18
xor r9, rax
imul r9, rbx
mov rbx, qword [rsp]
and rcx, r9
shl rcx, 4
add rcx, qword [r10 + 0x18]
mov rax, qword [rcx + 8]
cmp rax, r8
je 0x14016ee58
mov rcx, qword [rcx]
cmp edx, dword [rax + 0x10]
je 0x14016ee3e
nop dword [rax + rax]
cmp rax, rcx
je 0x14016ee58
mov rax, qword [rax + 8]
cmp edx, dword [rax + 0x10]
jne 0x14016ee30
test rax, rax
cmove rax, r8
cmp rax, r8
je 0x14016ee58
mov rcx, qword [rax + 0x18]
mov al, 1
mov qword [r11], rcx
add rsp, 8
ret
xor al, al
add rsp, 8
ret
Function at 0x14016f6d0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov rsi, rcx
cmp byte [rcx + 0x48], 0
je 0x14016f8c8
mov rcx, qword [rdx + 0x108]
test rcx, rcx
je 0x14016f8dd
lea rdx, [rsp + 0x60]
call fcn.140139180
test rax, rax
je 0x14016f8dd
mov edi, dword [rax]
mov rax, qword [rsi + 0x10]
dec rax
cmp rdi, rax
jne 0x14016f8c8
movzx edx, dil
movabs r14, 0xcbf29ce484222325
xor rdx, r14
movabs rbp, 0x100000001b3
imul rdx, rbp
mov eax, edi
shr eax, 8
movzx ecx, al
xor rdx, rcx
imul rdx, rbp
mov eax, edi
shr eax, 0x10
movzx ecx, al
xor rdx, rcx
imul rdx, rbp
mov eax, edi
shr rax, 0x18
xor rdx, rax
imul rdx, rbp
mov r9, qword [rsi + 0x30]
mov rax, r9
and rax, rdx
mov r10, qword [rsi + 0x18]
add rax, rax
mov rcx, qword [r10 + rax*8 + 8]
mov r8, qword [rsi + 8]
xor ebx, ebx
cmp rcx, r8
je 0x14016f7a8
mov rax, qword [r10 + rax*8]
cmp edi, dword [rcx + 0x10]
je 0x14016f7ab
cmp rcx, rax
je 0x14016f7a8
mov rcx, qword [rcx + 8]
cmp edi, dword [rcx + 0x10]
jne 0x14016f798
jmp 0x14016f7ab
mov rcx, rbx
test rcx, rcx
cmove rcx, r8
movzx edx, byte [rcx + 0x10]
xor rdx, r14
imul rdx, rbp
movzx eax, byte [rcx + 0x11]
xor rdx, rax
imul rdx, rbp
movzx eax, byte [rcx + 0x12]
xor rdx, rax
imul rdx, rbp
movzx eax, byte [rcx + 0x13]
xor rdx, rax
imul rdx, rbp
and rdx, r9
add rdx, rdx
mov rax, qword [r10 + rdx*8]
cmp qword [r10 + rdx*8 + 8], rcx
jne 0x14016f80a
cmp rax, rcx
jne 0x14016f7ff
mov qword [r10 + rdx*8], r8
mov qword [r10 + rdx*8 + 8], r8
jmp 0x14016f816
mov r8, qword [rcx + 8]
mov qword [r10 + rdx*8 + 8], r8
jmp 0x14016f816
cmp rax, rcx
jne 0x14016f816
mov rax, qword [rcx]
mov qword [r10 + rdx*8], rax
mov rdx, qword [rcx]
dec qword [rsi + 0x10]
mov rax, qword [rcx + 8]
mov qword [rax], rdx
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
mov edx, 0x20
call fcn.1401dcf3c
test edi, edi
je 0x14016f8c0
lea r8d, [rdi - 1]
mov r9d, r8d
movzx edx, r8b
xor rdx, r14
imul rdx, rbp
mov eax, r8d
shr eax, 8
movzx ecx, al
xor rdx, rcx
imul rdx, rbp
mov eax, r8d
shr eax, 0x10
movzx ecx, al
xor rdx, rcx
imul rdx, rbp
mov eax, r8d
shr rax, 0x18
xor rdx, rax
imul rdx, rbp
mov rcx, qword [rsi + 0x30]
and rcx, rdx
shl rcx, 4
add rcx, qword [rsi + 0x18]
mov rax, qword [rcx + 8]
mov rdx, qword [rsi + 8]
cmp rax, rdx
je 0x14016f8b5
mov rcx, qword [rcx]
cmp r9d, dword [rax + 0x10]
je 0x14016f8b2
cmp rax, rcx
je 0x14016f8b5
mov rax, qword [rax + 8]
cmp r8d, dword [rax + 0x10]
jne 0x14016f8a3
mov rbx, rax
test rbx, rbx
cmove rbx, rdx
mov rbx, qword [rbx + 0x18]
mov qword [rsi + 0x40], rbx
mov al, 1
jmp 0x14016f8ca
xor al, al
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x20]
call fcn.140010690
nop
mov rcx, rax
call fcn.14000fcc0
int3
Function at 0x14016f900
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0x60
mov rbx, rdx
mov rsi, rcx
cmp byte [rcx + 0x40], 0
je 0x14016fa30
lea rcx, [rsp + 0x40]
call fcn.14013c770
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x20], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x30], xmm1
mov rcx, qword [rbx + 0x108]
test rcx, rcx
je 0x14016fada
lea rdx, [rsp + 0x90]
call fcn.140139180
test rax, rax
je 0x14016fada
mov r8d, dword [rax]
movzx edx, r8b
movabs r13, 0xcbf29ce484222325
xor rdx, r13
movabs r12, 0x100000001b3
imul rdx, r12
mov eax, r8d
shr eax, 8
movzx ecx, al
xor rdx, rcx
imul rdx, r12
mov eax, r8d
shr eax, 0x10
movzx ecx, al
xor rdx, rcx
imul rdx, r12
mov eax, r8d
shr rax, 0x18
xor rdx, rax
imul rdx, r12
and rdx, qword [rsi + 0x30]
mov r15, qword [rsi + 0x18]
add rdx, rdx
mov rbx, qword [r15 + rdx*8]
mov rbp, qword [rsi + 8]
cmp rbx, rbp
je 0x14016fa30
mov rax, qword [r15 + rdx*8 + 8]
cmp dword [rbx + 0x10], r8d
je 0x14016f9ee
nop word [rax + rax]
cmp rbx, rax
je 0x14016fa30
mov rbx, qword [rbx]
cmp dword [rbx + 0x10], r8d
jne 0x14016f9e0
mov rdi, qword [rbx]
cmp rbx, rax
je 0x14016fa07
mov rcx, rdi
cmp r8d, dword [rdi + 0x10]
jne 0x14016fa07
mov rdi, qword [rdi]
cmp rcx, rax
jne 0x14016f9f6
cmp rbx, rdi
je 0x14016fa30
nop dword [rax]
lea rcx, [rbx + 0x14]
mov r8d, 0x20
lea rdx, [rsp + 0x20]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14016fa4b
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x14016fa10
xor al, al
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r13
pop r12
pop rdi
pop rsi
ret
movzx ecx, byte [rbx + 0x10]
xor rcx, r13
imul rcx, r12
movzx eax, byte [rbx + 0x11]
xor rcx, rax
imul rcx, r12
movzx eax, byte [rbx + 0x12]
xor rcx, rax
imul rcx, r12
movzx eax, byte [rbx + 0x13]
xor rcx, rax
imul rcx, r12
and rcx, qword [rsi + 0x30]
add rcx, rcx
mov rax, qword [r15 + rcx*8]
cmp qword [r15 + rcx*8 + 8], rbx
jne 0x14016faa4
cmp rax, rbx
jne 0x14016fa99
mov qword [r15 + rcx*8], rbp
mov qword [r15 + rcx*8 + 8], rbp
jmp 0x14016fab0
mov rbp, qword [rbx + 8]
mov qword [r15 + rcx*8 + 8], rbp
jmp 0x14016fab0
cmp rax, rbx
jne 0x14016fab0
mov rax, qword [rbx]
mov qword [r15 + rcx*8], rax
mov rcx, qword [rbx]
dec qword [rsi + 0x10]
mov rax, qword [rbx + 8]
mov qword [rax], rcx
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
mov edx, 0x38
mov rcx, rbx
call fcn.1401dcf3c
mov al, 1
jmp 0x14016fa32
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x20]
call fcn.140010690
nop
mov rcx, rax
call fcn.14000fcc0
int3
Function at 0x14017e6d0
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x18
jmp fcn.1401721c0

Function at 0x14017e6e0
Capabilities:
Encode data using xor

Disassembly:
mov rax, r8
mov r9, rdx
mov r8, rcx
mov edx, eax
mov rcx, r9
jmp fcn.1401721b0

Function at 0x14017e890
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movdqu xmm3, xmmword [rcx + 0x10]
movdqu xmm0, xmmword [rcx]
movdqu xmmword [rdx + 0x10], xmm3
movdqa xmm2, xmm0
movdqu xmmword [rdx], xmm0
pslldq xmm2, 4
movdqa xmm1, xmm2
pslldq xmm2, 4
pxor xmm1, xmm0
movdqa xmm4, xmm2
pxor xmm4, xmm1
pslldq xmm2, 4
pxor xmm4, xmm2
aeskeygenassist xmm0, xmm3, 1
pshufd xmm1, xmm0, 0xff
pxor xmm4, xmm1
movdqa xmm1, xmm3
pslldq xmm1, 4
movdqa xmm0, xmm1
movdqu xmmword [rdx + 0x20], xmm4
pslldq xmm1, 4
pxor xmm0, xmm3
movdqa xmm2, xmm1
pslldq xmm1, 4
pxor xmm2, xmm0
pxor xmm2, xmm1
aeskeygenassist xmm0, xmm4, 0
pshufd xmm1, xmm0, 0xaa
pxor xmm2, xmm1
movdqa xmm1, xmm4
pslldq xmm1, 4
movdqa xmm0, xmm1
movdqu xmmword [rdx + 0x30], xmm2
pslldq xmm1, 4
pxor xmm0, xmm4
movdqa xmm3, xmm1
pslldq xmm1, 4
pxor xmm3, xmm0
pxor xmm3, xmm1
aeskeygenassist xmm0, xmm2, 2
pshufd xmm1, xmm0, 0xff
pxor xmm3, xmm1
movdqa xmm1, xmm2
pslldq xmm1, 4
movdqa xmm0, xmm1
movdqu xmmword [rdx + 0x40], xmm3
pxor xmm0, xmm2
pslldq xmm1, 4
movdqa xmm2, xmm1
pslldq xmm1, 4
pxor xmm2, xmm0
pxor xmm2, xmm1
aeskeygenassist xmm0, xmm3, 0
pshufd xmm1, xmm0, 0xaa
pxor xmm2, xmm1
movdqa xmm1, xmm3
pslldq xmm1, 4
movdqa xmm0, xmm1
movdqu xmmword [rdx + 0x50], xmm2
pslldq xmm1, 4
pxor xmm0, xmm3
movdqa xmm3, xmm1
pslldq xmm1, 4
pxor xmm3, xmm0
pxor xmm3, xmm1
aeskeygenassist xmm0, xmm2, 4
pshufd xmm1, xmm0, 0xff
pxor xmm3, xmm1
movdqa xmm1, xmm2
pslldq xmm1, 4
movdqa xmm0, xmm1
movdqu xmmword [rdx + 0x60], xmm3
pxor xmm0, xmm2
pslldq xmm1, 4
movdqa xmm2, xmm1
pslldq xmm1, 4
pxor xmm2, xmm0
pxor xmm2, xmm1
aeskeygenassist xmm0, xmm3, 0
pshufd xmm1, xmm0, 0xaa
pxor xmm2, xmm1
movdqa xmm1, xmm3
movdqu xmmword [rdx + 0x70], xmm2
pslldq xmm1, 4
movdqa xmm0, xmm1
pslldq xmm1, 4
movdqa xmm4, xmm1
pxor xmm0, xmm3
pslldq xmm1, 4
pxor xmm4, xmm0
pxor xmm4, xmm1
aeskeygenassist xmm0, xmm2, 8
pshufd xmm1, xmm0, 0xff
pxor xmm4, xmm1
movdqa xmm1, xmm2
pslldq xmm1, 4
movdqa xmm0, xmm1
movdqu xmmword [rdx + 0x80], xmm4
pxor xmm0, xmm2
pslldq xmm1, 4
movdqa xmm3, xmm1
pslldq xmm1, 4
pxor xmm3, xmm0
pxor xmm3, xmm1
aeskeygenassist xmm0, xmm4, 0
pshufd xmm1, xmm0, 0xaa
pxor xmm3, xmm1
movdqa xmm1, xmm4
pslldq xmm1, 4
movdqa xmm0, xmm1
movdqu xmmword [rdx + 0x90], xmm3
pslldq xmm1, 4
pxor xmm0, xmm4
movdqa xmm2, xmm1
pslldq xmm1, 4
pxor xmm2, xmm0
pxor xmm2, xmm1
aeskeygenassist xmm0, xmm3, 0x10
pshufd xmm1, xmm0, 0xff
pxor xmm2, xmm1
movdqu xmmword [rdx + 0xa0], xmm2
ret
Function at 0x1401b00f0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0x100
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
mov rcx, qword [rcx]
call fcn.1401af1a0
test al, al
jne 0x1401b02a8
mov dword [rbp - 0x61], edi
mov qword [rbp - 0x59], rsi
xor esi, esi
mov dword [rbp + 0x67], esi
mov qword [rbp + 7], rsi
mov qword [rsp + 0x30], rsi
lea rax, [rbp - 0x11]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x67]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8d, [rsi + 1]
lea rdx, [rbp - 0x61]
mov rcx, qword [rbx + 8]
call qword [sym.imp.WS2_32.dll_WSARecv]
test eax, eax
je 0x1401b016e
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
jne 0x1401b02cf
mov rcx, qword [rbx]
call fcn.1401aef80
mov qword [rbp + 0xf], rax
mov byte [rbp + 0x17], sil
lea rax, [rbp - 0x11]
mov qword [rbx + 0x10], rax
mov rcx, qword [rbx]
call fcn.1401aef80
lea rdx, [rax + 0x70]
lea rcx, vtable.std::_Func_impl_no_alloc_class__lambda_ba592e99b77cc87b7eb140194ef6b88a___void___.0
mov qword [rbp - 0x51], rcx
mov qword [rbp - 0x49], rbx
lea rcx, [rbp - 0x51]
mov qword [rbp - 0x19], rcx
lea rcx, [rbp - 0x51]
call fcn.14019dcc0
mov rcx, qword [rbp - 0x19]
test rcx, rcx
je 0x1401b01cb
mov rax, qword [rcx]
lea rdx, [rbp - 0x51]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
mov rcx, qword [rbx]
call fcn.1401aec90
mov rcx, qword [rbx]
call fcn.1401aef80
lea rdi, [rax + 0x70]
mov rcx, qword [rdi + 0x38]
test rcx, rcx
je 0x1401b01f8
mov rax, qword [rcx]
cmp rcx, rdi
setne dl
call qword [rax + 0x20]
mov qword [rdi + 0x38], rsi
mov qword [rbx + 0x10], rsi
lea rax, [rbp + 0x67]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rbp + 0x7f]
lea rdx, [rbp - 0x11]
mov rcx, qword [rbx + 8]
call qword [sym.imp.WS2_32.dll_WSAGetOverlappedResult]
cmp eax, 1
je 0x1401b022e
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e3
jne 0x1401b026b
jmp 0x1401b0244
mov eax, dword [rbp + 0x7f]
mov rbx, qword [rsp + 0x128]
add rsp, 0x100
pop rdi
pop rsi
pop rbp
ret
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x79], xmm0
mov qword [rbp - 0x69], rax
lea rcx, [rbp - 0x79]
call fcn.140194c00
lea rdx, [0x1402cad98]
lea rcx, [rbp - 0x79]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
mov edx, eax
lea rcx, [rbp - 0x51]
call fcn.1401b2000
nop
mov r8, rax
lea rdx, str.TcpConnection::read__WSAGetOverlappedResult_failed_
lea rcx, [rbp + 0x1f]
call fcn.1400dbe30
nop
mov rdx, rax
lea rcx, [rbp - 0x79]
call fcn.1400106b0
lea rdx, [0x1402ca490]
lea rcx, [rbp - 0x79]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x79], xmm0
mov qword [rbp - 0x69], rax
lea rcx, [rbp - 0x79]
call fcn.140194c00
lea rdx, [0x1402cad98]
lea rcx, [rbp - 0x79]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
mov edx, eax
lea rcx, [rbp + 0x1f]
call fcn.1401b2000
nop
mov r8, rax
lea rdx, str.TcpConnection::read__WSARecv_failed_
lea rcx, [rbp - 0x51]
call fcn.1400dbe30
nop
mov rdx, rax
lea rcx, [rbp - 0x79]
call fcn.1400106b0
lea rdx, [0x1402ca490]
lea rcx, [rbp - 0x79]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x1401b1390
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister
Resolve dns

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x1340]
mov eax, 0x1440
call fcn.1401dd870
sub rsp, rax
mov rdi, r8
mov rsi, rdx
mov rcx, qword [rcx]
call fcn.1401af1a0
test al, al
jne 0x1401b1556
movdqa xmm0, xmmword [0x140282250]
movdqu xmmword [rsp + 0x38], xmm0
xor ebx, ebx
mov qword [rsp + 0x48], rbx
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rbx
cmp qword [rdi + 0x18], 0x10
jb 0x1401b13f8
mov rdi, qword [rdi]
lea r9, [rbp + 0x1350]
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
jne 0x1401b1516
mov rax, qword [rbp + 0x1350]
test rax, rax
je 0x1401b142f
inc rbx
mov rax, qword [rax + 0x28]
test rax, rax
jne 0x1401b1423
call sub.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_
mov r8d, 0xffffffff
mov dword [rbp + 0x1334], r8d
mov dword [rbp - 0x4c], eax
mov edx, 1
nop dword [rax]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [rbp + rdx*4 - 0x4c], eax
inc rdx
cmp rdx, 0x270
jb 0x1401b1450
mov dword [rbp - 0x50], 0x270
lea rax, [rbp - 0x50]
mov qword [rsp + 0x20], rax
mov ecx, 0x40
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
dec rcx
shr rax, 1
cmp rax, r8
ja 0x1401b1490
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x20]
test rbx, rbx
jne 0x1401b14b6
call fcn.1400657f0
jmp 0x1401b14be
mov rdx, rbx
call fcn.140064ea0
mov rbx, qword [rbp + 0x1350]
test rax, rax
je 0x1401b14da
nop word [rax + rax]
mov rbx, qword [rbx + 0x28]
sub rax, 1
jne 0x1401b14d0
mov rax, qword [rbx + 0x20]
mov ecx, dword [rax + 4]
call qword [sym.imp.WS2_32.dll_ntohl]
mov edx, eax
mov rcx, rsi
call fcn.1401b1180
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
mov rax, rsi
lea r11, [rsp + 0x1440]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
mov edx, eax
lea rcx, [rsp + 0x68]
call fcn.1401b2000
nop
mov r8, rax
lea rdx, str.Ipv4Resolver::resolve__getaddrinfo_failed_
lea rcx, [rbp - 0x78]
call fcn.1400dbe30
nop
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.1400106b0
lea rdx, [0x1402ca490]
lea rcx, [rsp + 0x20]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x20]
call fcn.140194c00
lea rdx, [0x1402cad98]
lea rcx, [rsp + 0x20]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x1401c48d0
Capabilities:
Initialize winsock library

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x1f0
movzx ebx, dl
mov rdi, rcx
mov eax, 1
lock xadd dword [0x1402f5478], eax
inc eax
cmp eax, 1
jne 0x1401c490b
lea ecx, [rax + 1]
lea rdx, [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_WSAStartup]
xchg dword [0x1402f547c], eax
test bl, bl
je 0x1401c49af
xor ebx, ebx
lock xadd dword [0x1402f547c], ebx
test ebx, ebx
je 0x1401c49af
movabs rcx, 0x4d54ee85da812030
mov qword [rsp + 0x200], rsi
add rcx, qword [0x1402e64e0]
lea rsi, [0x1402e64d8]
mov dword [rsp + 0x3c], 0
cmp rcx, 1
jbe 0x1401c4964
mov rax, qword [0x1402e64d8]
mov edx, ebx
mov rcx, rsi
call qword [rax + 0x30]
jmp 0x1401c4966
mov al, 1
lea rcx, str.C:local_vcpkginstalledx64_windowsinclude_boost_asio_detail_impl_winsock_init.ipp
movzx eax, al
add rax, 2
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x40], rsi
lea rcx, str.throw_on_error
mov rsi, qword [rsp + 0x200]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], 0x48
mov dword [rsp + 0x34], 0x1a
test al, 1
jne 0x1401c49c3
mov rbx, qword [rsp + 0x208]
mov rax, rdi
add rsp, 0x1f0
pop rdi
ret
lea r8, [rsp + 0x20]
lea rdx, str.winsock
lea rcx, [rsp + 0x38]
call fcn.1401cee00
int3
Function at 0x1401d1960
Capabilities:
Terminate thread

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [rcx + 0x10]
lea rdx, [rsp + 0x20]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rax, qword [rcx + 8]
mov rbx, rcx
mov r9d, 0xffffffff
mov qword [rsp + 0x28], rax
lea ecx, [r8 + 2]
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
lock xadd dword [0x1402f5470], eax
mov rcx, qword [rbx + 8]
test eax, eax
je 0x1401d19bd
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
add rsp, 0x30
pop rbx
ret
mov rdx, rcx
xor r8d, r8d
lea rcx, [fcn.1400066d0]
call qword [sym.imp.KERNEL32.dll_QueueUserAPC]
mov rcx, qword [rbx + 8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
add rsp, 0x30
pop rbx
ret
Function at 0x1401da860
Capabilities:
Get local ipv4 addresses
Get socket information
Resolve dns
Send data
Send data on socket
Send http request
Send http request with host header

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x8c0
movzx edi, dx
mov r14, r8
mov r8d, dword [rsp + 0x910]
movzx edx, di
mov r15, r9
mov dword [r9], 0
mov rbp, rcx
call fcn.1401db430
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x1401da8a9
xor eax, eax
jmp 0x1401da9f4
mov qword [rsp + 0x8e0], rbx
mov rbx, qword [rsp + 0x900]
test rbx, rbx
je 0x1401da94f
lea r8, [rsp + 0x8f8]
mov dword [rsp + 0x8f8], 0x80
lea rdx, [rsp + 0x40]
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jns 0x1401da8f6
lea rcx, str.getsockname
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_perror]
jmp 0x1401da94f
mov r9d, dword [rsp + 0x908]
lea rcx, [rsp + 0x40]
mov edx, dword [rsp + 0x8f8]
mov r8, rbx
mov dword [rsp + 0x30], 0xa
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.WS2_32.dll_getnameinfo]
mov ebx, eax
test eax, eax
je 0x1401da94f
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8d, ebx
lea rdx, str.getnameinfo___failed_:__d_n
mov rcx, rax
call fcn.14016b3f0
mov dword [rsp + 0x30], edi
lea rax, [0x140283f2c]
mov qword [rsp + 0x28], rbp
lea r8, str.GET__s_HTTP__s_r_nHost:__s:_d_r_nConnection:_Close_r_nUser_Agent:_Windows__UPnP_1.1__MiniUPnPc_2.2.2_r_n_r_n
mov r9, r14
mov qword [rsp + 0x20], rax
mov edx, 0x800
lea rcx, [rsp + 0xc0]
call fcn.1401c22a0
mov edi, eax
cmp eax, 0x800
jae 0x1401daa1a
xor ebx, ebx
test eax, eax
jle 0x1401da9ca
nop dword [rax]
nop word [rax + rax]
mov r8d, edi
movsxd rax, ebx
lea rdx, [rsp + 0xc0]
sub r8d, ebx
add rdx, rax
xor r9d, r9d
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
js 0x1401daa0d
add ebx, eax
cmp ebx, edi
jl 0x1401da9a0
mov r8, qword [rsp + 0x918]
mov rdx, r15
mov rcx, rsi
call fcn.1401da180
mov rcx, rsi
mov rbx, rax
call qword [sym.imp.WS2_32.dll_closesocket]
mov rax, rbx
mov rbx, qword [rsp + 0x8e0]
lea r11, [rsp + 0x8c0]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
lea rcx, str.send
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_perror]
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
jmp 0x1401da9ec