joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14013c7b0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x14013c7e1
xor eax, eax
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rcx + 0x68], 0
je 0x14013c7ff
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x30], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x14013c81b
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14013c81d
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14013c859
mov qword [rsp + 0x38], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x38]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x14013c8ee
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x14013c894
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x14013c8ce
nop dword [rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x14013c8ee
cmp rbx, rax
ja 0x14013c8a0
test rbx, rbx
je 0x14013c8ee
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
mov rsi, qword [rsp + 0x48]
sub rbp, rbx
mov rbx, qword [rsp + 0x30]
mov rax, rbp
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x14013cd50
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x14025e2c0]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14013cd7d
xor eax, eax
jmp 0x14013cee9
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x14013cdb7
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x14013cdb7
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x14013cee9
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x14013cedc
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14013cdfa
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x14013ce25
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14013cee1
lea rax, [rsp + 0x48]
mov byte [rsp + 0x40], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x41]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x40]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14013ce94
sub eax, 1
je 0x14013ce94
cmp eax, 2
jne 0x14013cedc
movsx ecx, byte [rsp + 0x40]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14013cee1
mov rsi, qword [rsp + 0x48]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x14013cec2
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x14013cedc
lea rax, [rsp + 0x40]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x50], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x14013cee1
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1401d1730
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x14013d520
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x14025e2c0]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x14013d5f3
cmp byte [rcx + 0x71], 0
je 0x14013d5f3
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14013d5ef
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14013d5b4
sub eax, 1
je 0x14013d5b8
cmp eax, 2
jne 0x14013d5ef
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1401d1730
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x14013d5e6
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14013d5ef
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14013d59c
xor al, al
jmp 0x14013d59c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1401d1730
add rsp, 0x60
pop rbx
ret
Function at 0x140140f50
Capabilities:
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x140140fbd
mov rax, qword [rbx + 0x38]
mov rdx, qword [rbx + 8]
shr rax, 3
cmp rax, rcx
jbe 0x140140f86
mov r8, rdx
mov rcx, rbx
mov rdx, qword [rdx]
add rsp, 0x20
pop rbx
jmp 0x140140fd0
call fcn.1401090a0
mov rax, qword [rbx + 8]
lea r8, [rsp + 0x30]
mov qword [rax], rax
mov rax, qword [rbx + 8]
mov qword [rax + 8], rax
mov qword [rbx + 0x10], 0
mov rax, qword [rbx + 8]
mov rdx, qword [rbx + 0x20]
mov rcx, qword [rbx + 0x18]
mov qword [rsp + 0x30], rax
call fcn.1400295d0
add rsp, 0x20
pop rbx
ret
push rbp
push rsi
push r14
sub rsp, 0x40
mov rbp, r8
mov r14, rdx
mov rsi, rcx
cmp rdx, r8
je 0x140141171
mov rdx, qword [rcx + 0x18]
movabs r8, 0x100000001b3
mov qword [rsp + 0x60], rbx
movabs rax, 0xcbf29ce484222325
mov rbx, qword [r14]
mov qword [rsp + 0x38], rdi
mov rdi, qword [rsi + 0x30]
mov qword [rsp + 0x30], r12
mov r12, qword [rcx + 8]
movzx ecx, byte [r14 + 0x10]
xor rcx, rax
mov qword [rsp + 0x28], r13
movzx eax, byte [r14 + 0x11]
mov r13, qword [r14 + 8]
imul rcx, r8
mov qword [rsp + 0x78], rdx
xor rcx, rax
mov qword [rsp + 0x20], r15
imul rcx, r8
and rdi, rcx
shl rdi, 4
add rdi, rdx
mov rdx, r14
mov qword [rsp + 0x68], rdi
mov rax, qword [rdi]
mov r15, qword [rdi + 8]
mov qword [rsp + 0x70], rax
call fcn.14010a370
dec qword [rsi + 0x10]
cmp r14, r15
je 0x140141095
mov rdi, rbx
cmp rbx, rbp
je 0x1401410a4
mov rdx, rbx
mov rbx, qword [rbx]
call fcn.14010a370
dec qword [rsi + 0x10]
cmp rdi, r15
jne 0x140141074
mov rdi, qword [rsp + 0x68]
cmp qword [rsp + 0x70], r14
jne 0x1401410bc
mov qword [rdi], r12
mov rax, r12
jmp 0x1401410bf
cmp qword [rsp + 0x70], r14
jne 0x140141150
mov rax, qword [rsp + 0x68]
mov qword [rax], rbx
jmp 0x140141150
mov rax, r13
mov qword [rdi + 8], rax
cmp rbx, rbp
je 0x140141150
nop dword [rax]
movzx r15d, byte [rbx + 0x10]
movabs rdx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
mov rdi, rbx
xor r15, rax
movzx eax, byte [rbx + 0x11]
imul r15, rdx
xor r15, rax
imul r15, rdx
mov rdx, rbx
mov rbx, qword [rbx]
and r15, qword [rsi + 0x30]
shl r15, 4
add r15, qword [rsp + 0x78]
mov r14, qword [r15 + 8]
call fcn.14010a370
dec qword [rsi + 0x10]
cmp rdi, r14
je 0x14014113f
mov rdi, rbx
cmp rbx, rbp
je 0x14014114d
mov rdx, rbx
mov rbx, qword [rbx]
call fcn.14010a370
dec qword [rsi + 0x10]
cmp rdi, r14
jne 0x140141123
mov qword [r15], r12
mov qword [r15 + 8], r12
cmp rbx, rbp
jne 0x1401410d0
jmp 0x140141150
mov qword [r15], rbx
mov r12, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov r15, qword [rsp + 0x20]
mov qword [r13], rbx
mov qword [rbx + 8], r13
mov r13, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x60]
mov rax, rbp
add rsp, 0x40
pop r14
pop rsi
pop rbp
ret
Function at 0x140140fd0
Capabilities:
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x140140fbd
mov rax, qword [rbx + 0x38]
mov rdx, qword [rbx + 8]
shr rax, 3
cmp rax, rcx
jbe 0x140140f86
mov r8, rdx
mov rcx, rbx
mov rdx, qword [rdx]
add rsp, 0x20
pop rbx
jmp 0x140140fd0
call fcn.1401090a0
mov rax, qword [rbx + 8]
lea r8, [rsp + 0x30]
mov qword [rax], rax
mov rax, qword [rbx + 8]
mov qword [rax + 8], rax
mov qword [rbx + 0x10], 0
mov rax, qword [rbx + 8]
mov rdx, qword [rbx + 0x20]
mov rcx, qword [rbx + 0x18]
mov qword [rsp + 0x30], rax
call fcn.1400295d0
add rsp, 0x20
pop rbx
ret
push rbp
push rsi
push r14
sub rsp, 0x40
mov rbp, r8
mov r14, rdx
mov rsi, rcx
cmp rdx, r8
je 0x140141171
mov rdx, qword [rcx + 0x18]
movabs r8, 0x100000001b3
mov qword [rsp + 0x60], rbx
movabs rax, 0xcbf29ce484222325
mov rbx, qword [r14]
mov qword [rsp + 0x38], rdi
mov rdi, qword [rsi + 0x30]
mov qword [rsp + 0x30], r12
mov r12, qword [rcx + 8]
movzx ecx, byte [r14 + 0x10]
xor rcx, rax
mov qword [rsp + 0x28], r13
movzx eax, byte [r14 + 0x11]
mov r13, qword [r14 + 8]
imul rcx, r8
mov qword [rsp + 0x78], rdx
xor rcx, rax
mov qword [rsp + 0x20], r15
imul rcx, r8
and rdi, rcx
shl rdi, 4
add rdi, rdx
mov rdx, r14
mov qword [rsp + 0x68], rdi
mov rax, qword [rdi]
mov r15, qword [rdi + 8]
mov qword [rsp + 0x70], rax
call fcn.14010a370
dec qword [rsi + 0x10]
cmp r14, r15
je 0x140141095
mov rdi, rbx
cmp rbx, rbp
je 0x1401410a4
mov rdx, rbx
mov rbx, qword [rbx]
call fcn.14010a370
dec qword [rsi + 0x10]
cmp rdi, r15
jne 0x140141074
mov rdi, qword [rsp + 0x68]
cmp qword [rsp + 0x70], r14
jne 0x1401410bc
mov qword [rdi], r12
mov rax, r12
jmp 0x1401410bf
cmp qword [rsp + 0x70], r14
jne 0x140141150
mov rax, qword [rsp + 0x68]
mov qword [rax], rbx
jmp 0x140141150
mov rax, r13
mov qword [rdi + 8], rax
cmp rbx, rbp
je 0x140141150
nop dword [rax]
movzx r15d, byte [rbx + 0x10]
movabs rdx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
mov rdi, rbx
xor r15, rax
movzx eax, byte [rbx + 0x11]
imul r15, rdx
xor r15, rax
imul r15, rdx
mov rdx, rbx
mov rbx, qword [rbx]
and r15, qword [rsi + 0x30]
shl r15, 4
add r15, qword [rsp + 0x78]
mov r14, qword [r15 + 8]
call fcn.14010a370
dec qword [rsi + 0x10]
cmp rdi, r14
je 0x14014113f
mov rdi, rbx
cmp rbx, rbp
je 0x14014114d
mov rdx, rbx
mov rbx, qword [rbx]
call fcn.14010a370
dec qword [rsi + 0x10]
cmp rdi, r14
jne 0x140141123
mov qword [r15], r12
mov qword [r15 + 8], r12
cmp rbx, rbp
jne 0x1401410d0
jmp 0x140141150
mov qword [r15], rbx
mov r12, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov r15, qword [rsp + 0x20]
mov qword [r13], rbx
mov qword [rbx + 8], r13
mov r13, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x60]
mov rax, rbp
add rsp, 0x40
pop r14
pop rsi
pop rbp
ret
Function at 0x140152860
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
movzx r9d, byte [r8 + 0x10]
mov r10, rcx
movabs rcx, 0x100000001b3
mov rdi, rdx
movabs rax, 0xcbf29ce484222325
xor r9, rax
movzx eax, byte [r8 + 0x11]
mov rdx, qword [r10 + 0x30]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 0x12]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 0x13]
imul r9, rcx
xor r9, rax
imul r9, rcx
and rdx, r9
shl rdx, 4
add rdx, qword [r10 + 0x18]
mov rax, qword [rdx]
cmp qword [rdx + 8], r8
jne 0x1401528e8
cmp rax, r8
jne 0x1401528de
mov rax, qword [r10 + 8]
mov qword [rdx], rax
mov qword [rdx + 8], rax
jmp 0x1401528f3
mov rax, qword [r8 + 8]
mov qword [rdx + 8], rax
jmp 0x1401528f3
cmp rax, r8
jne 0x1401528f3
mov rax, qword [r8]
mov qword [rdx], rax
mov rbx, qword [r8]
mov edx, 0x18
dec qword [r10 + 0x10]
mov rcx, r8
mov rax, qword [r8 + 8]
mov qword [rax], rbx
mov rax, qword [r8 + 8]
mov qword [rbx + 8], rax
call fcn.1401d177c
mov qword [rdi], rbx
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1401539b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbp
push r14
sub rsp, 0x20
cmp byte [rcx + 0x13a], 0
mov r14, rdx
mov rbp, rcx
jne 0x140153b39
mov r9, qword [rdx]
mov eax, 0xfffe
add word [r9 + 0x3c092], ax
movzx eax, word [r9]
movzx r8d, word [r9 + 0x3c092]
mov word [r8 + r9 + 6], ax
add word [r9], 2
cmp byte [rcx + 0x138], 0
je 0x140153b39
mov qword [rsp + 0x30], rbx
lea rbx, [rcx + 0x38]
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], rdi
mov rdi, qword [rdx]
movzx ecx, word [rdi]
mov eax, ecx
and eax, 7
je 0x140153a54
movzx edx, word [rdi + 2]
mov esi, 8
sub rsi, rax
lea rax, [rdx + rsi]
cmp rax, 0x3c07e
jae 0x140153a54
lea rcx, [rdi + 6]
mov r8, rsi
add rcx, rdx
mov edx, 0x33
call sub.VCRUNTIME140.dll_memset
add word [rdi], si
movzx ecx, word [rdi]
movzx eax, word [rdi + 0x3c092]
xor r10d, r10d
add rdi, 6
movzx r11d, cx
add rdi, rax
add r11, rdi
nop dword [rax]
mov rax, rdi
cmp rdi, r11
jae 0x140153ac3
nop dword [rax + rax]
mov r9d, dword [rax + 4]
mov r8d, r9d
shr r8d, 5
mov ecx, r9d
shl ecx, 4
xor r8d, ecx
add r8d, r9d
xor r8d, dword [rbx]
add r8d, dword [rax]
mov edx, r8d
mov ecx, r8d
shl ecx, 4
shr edx, 5
xor ecx, edx
add ecx, r8d
xor ecx, dword [rbx + 4]
add ecx, r9d
mov dword [rax], r8d
mov dword [rax + 4], ecx
add rax, 8
cmp rax, r11
jb 0x140153a80
add r10d, 2
add rbx, 8
cmp r10d, 0x40
jb 0x140153a70
cmp byte [rbp + 0x139], 0
mov rdi, qword [r14]
je 0x140153b09
movzx ebx, word [rdi + 0x3c092]
lea rcx, [rdi + 6]
movzx edx, word [rdi]
add rcx, rbx
call fcn.140195240
sub bx, 4
movzx ecx, bx
mov word [rdi + 0x3c092], cx
mov dword [rcx + rdi + 6], eax
add word [rdi], 4
movzx eax, word [rdi + 0x3c092]
mov rsi, qword [rsp + 0x38]
sub ax, 2
mov rbx, qword [rsp + 0x30]
movzx ecx, ax
movzx eax, word [rdi]
mov word [rdi + 0x3c092], cx
mov word [rcx + rdi + 6], ax
add word [rdi], 2
mov rdi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140175110
Capabilities:
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x40
mov r9, rdx
mov r10, rcx
movzx r8d, byte [rdx]
movabs rax, 0xcbf29ce484222325
xor r8, rax
movabs rcx, 0x100000001b3
imul r8, rcx
movzx eax, byte [rdx + 1]
xor r8, rax
imul r8, rcx
movzx eax, byte [rdx + 2]
xor r8, rax
imul r8, rcx
movzx eax, byte [rdx + 3]
xor r8, rax
imul r8, rcx
mov rdx, qword [r10 + 0x30]
and rdx, r8
shl rdx, 4
add rdx, qword [r10 + 0x18]
mov rbx, qword [rdx + 8]
mov r8, qword [r10 + 8]
cmp rbx, r8
je 0x140175193
mov rcx, qword [rdx]
mov eax, dword [r9]
cmp eax, dword [rbx + 0x10]
je 0x140175195
cmp rbx, rcx
je 0x140175193
mov rbx, qword [rbx + 8]
cmp eax, dword [rbx + 0x10]
jne 0x140175183
jmp 0x140175195
xor ebx, ebx
test rbx, rbx
je 0x140175228
mov rax, qword [rdx]
cmp qword [rdx + 8], rbx
jne 0x1401751bf
cmp rax, rbx
jne 0x1401751b5
mov qword [rdx], r8
mov qword [rdx + 8], r8
jmp 0x1401751ca
mov r8, qword [rbx + 8]
mov qword [rdx + 8], r8
jmp 0x1401751ca
cmp rax, rbx
jne 0x1401751ca
mov rax, qword [rbx]
mov qword [rdx], rax
mov rcx, qword [rbx]
dec qword [r10 + 0x10]
mov rax, qword [rbx + 8]
mov qword [rax], rcx
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
lea rdx, [rbx + 0x20]
lea r8, [rsp + 0x20]
mov rcx, qword [rbx + 0x18]
call fcn.1400288f0
lea rcx, [rbx + 0x58]
cmp qword [rcx + 0x20], 0
je 0x140175207
mov rax, qword [rcx + 0x18]
mov rdx, qword [rax]
call rdx
nop
lea rcx, [rbx + 0x30]
call fcn.14002f5f0
mov edx, 0x90
mov rcx, rbx
call fcn.1401d177c
mov eax, 1
add rsp, 0x40
pop rbx
ret
xor eax, eax
add rsp, 0x40
pop rbx
ret
Function at 0x140175a70
Capabilities:
Hash data using fnv

Disassembly:
mov r8, qword [rcx]
mov r10, rcx
movzx edx, byte [rcx + 8]
movabs rax, 0xcbf29ce484222325
xor rdx, rax
movabs rcx, 0x100000001b3
imul rdx, rcx
movzx eax, byte [r10 + 9]
mov r9, qword [r8 + 0x28]
xor rdx, rax
movzx eax, byte [r10 + 0xa]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [r10 + 0xb]
imul rdx, rcx
xor rdx, rax
imul rdx, rcx
mov rcx, qword [r8 + 0x50]
and rcx, rdx
mov rdx, qword [r8 + 0x38]
shl rcx, 4
add rdx, rcx
mov rcx, qword [rdx + 8]
cmp rcx, r9
je 0x140175af4
mov eax, dword [r10 + 8]
mov rdx, qword [rdx]
cmp eax, dword [rcx + 0x10]
je 0x140175af6
cmp rcx, rdx
je 0x140175af4
mov rcx, qword [rcx + 8]
cmp eax, dword [rcx + 0x10]
jne 0x140175ae4
jmp 0x140175af6
xor ecx, ecx
test rcx, rcx
cmove rcx, r9
cmp rcx, r9
je 0x140175b0b
add rcx, 0x18
jmp fcn.140028180
ret
Function at 0x14017da50
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rbx, qword [rbp + 0x60]
mov r14, r9
mov esi, r8d
mov r12, rdx
mov r15, rcx
cmp qword [rbx + 0x10], 1
je 0x14017da8d
mov eax, dword [rbx]
jmp 0x14017dac0
mov rcx, qword [rbx + 8]
movabs rax, 0x4800144005b3
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 0x14
imul rax, rax, 0x1ffff7
sub rcx, rax
imul eax, ecx, 0x3e8
add eax, dword [rbx]
xor r13d, r13d
lea rdi, [0x14025e370]
movabs rcx, 0x4d54ee85da812030
cmp eax, 0x40
jne 0x14017db29
add rcx, qword [0x14025e378]
mov dword [rbp - 0x1c], r13d
cmp rcx, 1
jbe 0x14017dafe
mov rax, qword [0x14025e370]
mov edx, 0x2745
mov rcx, rdi
call qword [rax + 0x30]
jmp 0x14017db00
mov al, 1
movzx eax, al
add rax, 2
mov dword [rbp - 0x20], 0x2745
mov qword [rbp - 0x18], rdi
vmovups xmm0, xmmword [rbp - 0x20]
mov qword [rbp - 0x10], rax
vmovsd xmm1, qword [rbp - 0x10]
vmovups xmmword [rbx], xmm0
vmovsd qword [rbx + 0x10], xmm1
mov rax, qword [rbx + 0x10]
test al, 1
je 0x14017db44
cmp rax, 1
jne 0x14017dc5c
cmp dword [rbx], r13d
jne 0x14017dc5c
test r14, r14
je 0x14017dbc8
mov rdi, qword [rbp + 0x50]
test rdi, rdi
je 0x14017dbc1
lea rax, [rbp + 0x60]
mov qword [rbp - 0x30], r13
mov qword [rsp + 0x38], rax
mov r9d, esi
lea rax, [rbp - 0x38]
mov dword [rbp - 0x40], r13d
mov qword [rsp + 0x30], rax
mov r8d, esi
lea rax, [rbp - 0x40]
mov qword [rbp - 0x38], r13
mov qword [rsp + 0x28], rax
xor edx, edx
lea rax, [rbp - 0x30]
mov dword [rbp + 0x60], r13d
mov rcx, r12
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSWSOCK.dll_GetAcceptExSockaddrs]
movsxd rsi, dword [rbp + 0x60]
cmp rsi, qword [rdi]
jbe 0x14017dbaf
mov edx, 0x2726
mov rcx, rbx
call fcn.140030060
jmp 0x14017dbc1
mov rdx, qword [rbp - 0x38]
mov r8, rsi
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
mov qword [rdi], rsi
lea rdi, [0x14025e370]
mov rcx, qword [rbp + 0x58]
mov qword [rbp - 0x28], r15
cmp rcx, 0xffffffffffffffff
jne 0x14017dc32
movabs rcx, 0x4d54ee85da812030
mov dword [rbp - 0x1c], r13d
add rcx, qword [0x14025e378]
cmp rcx, 1
jbe 0x14017dc05
mov rax, qword [0x14025e370]
mov edx, 0x2719
mov rcx, rdi
call qword [rax + 0x30]
jmp 0x14017dc07
mov al, 1
movzx eax, al
add rax, 2
mov dword [rbp - 0x20], 0x2719
mov qword [rbp - 0x18], rdi
vmovups xmm0, xmmword [rbp - 0x20]
mov qword [rbp - 0x10], rax
vmovsd xmm1, qword [rbp - 0x10]
vmovups xmmword [rbx], xmm0
vmovsd qword [rbx + 0x10], xmm1
jmp 0x14017dc5c
lea r9, [rbp - 0x28]
mov dword [rsp + 0x20], 8
mov edx, 0xffff
mov r8d, 0x700b
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
mov rcx, rbx
setne dl
call fcn.1400300f0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x14017dde0
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rbx, r9
mov dword [rsp + 0x28], 1
xor r9d, r9d
mov dword [rsp + 0x20], 0
mov esi, ecx
call qword [sym.imp.WS2_32.dll_WSASocketW]
cmp rax, 0xffffffffffffffff
mov rcx, rbx
mov rdi, rax
sete dl
call fcn.1400300f0
cmp rdi, 0xffffffffffffffff
jne 0x14017de38
mov rax, rdi
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
cmp esi, 0x17
jne 0x14017de66
lea r9, [rsp + 0x30]
mov dword [rsp + 0x30], 0
mov edx, 0x29
mov dword [rsp + 0x20], 4
mov r8d, 0x1b
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rbx, qword [rsp + 0x50]
mov rax, rdi
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret

Function at 0x14017efa0
Capabilities:
Check mutex on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x150
mov rax, qword [0x14025e2c0]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r9d, eax
mov qword [rsp + 0x20], rbx
lea r8, str.asio_58CCDC44_6264_4842_90C2_F3C545CB8AA7__u__p
mov edx, 0x80
lea rcx, [rsp + 0x40]
call fcn.14017ef40
lea r8, [rsp + 0x40]
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov rdi, rax
mov qword [rsp + 0x30], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test rdi, rdi
jne 0x14017f013
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x14017f092
cmp eax, 0xb7
jne 0x14017f028
mov edx, 0xffffffff
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp byte [rbx], 0
jne 0x14017f061
lea rcx, [rbx + 8]
mov edx, 0x80000000
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
test eax, eax
jne 0x14017f05e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
jmp 0x14017f092
mov byte [rbx], 1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x14017f092
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1401d1730
mov rbx, qword [rsp + 0x168]
add rsp, 0x150
pop rdi
ret