joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140028250
Capabilities:
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x1400282bd
mov rax, qword [rbx + 0x38]
mov rdx, qword [rbx + 8]
shr rax, 3
cmp rax, rcx
jbe 0x140028286
mov r8, rdx
mov rcx, rbx
mov rdx, qword [rdx]
add rsp, 0x20
pop rbx
jmp 0x140028ab0
call fcn.140029540
mov rax, qword [rbx + 8]
lea r8, [rsp + 0x30]
mov qword [rax], rax
mov rax, qword [rbx + 8]
mov qword [rax + 8], rax
mov qword [rbx + 0x10], 0
mov rax, qword [rbx + 8]
mov rdx, qword [rbx + 0x20]
mov rcx, qword [rbx + 0x18]
mov qword [rsp + 0x30], rax
call fcn.1400295d0
add rsp, 0x20
pop rbx
ret
push rbp
push rsi
push rdi
sub rsp, 0x40
mov rbp, r8
mov rdi, rdx
mov rsi, rcx
cmp rdx, r8
je 0x140028b88
mov qword [rsp + 0x60], rbx
mov rbx, qword [rcx + 0x18]
mov qword [rsp + 0x38], r12
mov r12, qword [rcx + 8]
mov qword [rsp + 0x30], r13
mov r13, qword [rdx + 8]
add rdx, 0x10
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r15
mov qword [rsp + 0x78], rbx
call fcn.140028f40
add rax, rax
mov rdx, rdi
mov r14, qword [rbx + rax*8 + 8]
lea r15, [rbx + rax*8]
mov rax, qword [rbx + rax*8]
mov rbx, qword [rdi]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], r14
call fcn.140029990
dec qword [rsi + 0x10]
cmp rdi, r14
je 0x140028b4e
nop dword [rax + rax]
mov r14, rbx
cmp rbx, rbp
je 0x140028b5d
mov rdx, rbx
mov rbx, qword [rbx]
call fcn.140029990
dec qword [rsi + 0x10]
cmp r14, qword [rsp + 0x70]
jne 0x140028b30
cmp qword [rsp + 0x68], rdi
jne 0x140028b93
mov qword [r15], r12
mov rax, r12
jmp 0x140028b96
cmp qword [rsp + 0x68], rdi
jne 0x140028b67
mov qword [r15], rbx
mov r14, qword [rsp + 0x28]
mov r12, qword [rsp + 0x38]
mov r15, qword [rsp + 0x20]
mov qword [r13], rbx
mov qword [rbx + 8], r13
mov r13, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x60]
mov rax, rbp
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
mov rax, r13
mov qword [r15 + 8], rax
cmp rbx, rbp
je 0x140028b67
mov rdx, qword [rbx + 0x10]
movabs r9, 0x100000001b3
mov r15, qword [rsi + 0x30]
mov rax, rdx
shr rax, 8
movabs rcx, 0xcbf29ce484222325
movzx r8d, al
mov rdi, rbx
movzx eax, dl
xor rax, rcx
imul rax, r9
xor r8, rax
mov rax, rdx
imul r8, r9
shr rax, 0x10
movzx ecx, al
mov rax, rdx
xor r8, rcx
shr rax, 0x18
imul r8, r9
movzx ecx, al
mov rax, rdx
xor r8, rcx
shr rax, 0x20
imul r8, r9
movzx ecx, al
mov rax, rdx
xor r8, rcx
shr rax, 0x28
imul r8, r9
movzx ecx, al
mov rax, rdx
xor r8, rcx
shr rdx, 0x38
imul r8, r9
shr rax, 0x30
movzx ecx, al
xor r8, rcx
imul r8, r9
xor r8, rdx
mov rdx, rbx
mov rbx, qword [rbx]
imul r8, r9
and r15, r8
shl r15, 4
add r15, qword [rsp + 0x78]
mov r14, qword [r15 + 8]
call fcn.140029990
dec qword [rsi + 0x10]
cmp rdi, r14
je 0x140028c80
nop
mov rdi, rbx
cmp rbx, rbp
je 0x140028b64
mov rdx, rbx
mov rbx, qword [rbx]
call fcn.140029990
dec qword [rsi + 0x10]
cmp rdi, r14
jne 0x140028c60
mov qword [r15], r12
mov qword [r15 + 8], r12
jmp 0x140028b9a
Function at 0x140028ab0
Capabilities:
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x1400282bd
mov rax, qword [rbx + 0x38]
mov rdx, qword [rbx + 8]
shr rax, 3
cmp rax, rcx
jbe 0x140028286
mov r8, rdx
mov rcx, rbx
mov rdx, qword [rdx]
add rsp, 0x20
pop rbx
jmp 0x140028ab0
call fcn.140029540
mov rax, qword [rbx + 8]
lea r8, [rsp + 0x30]
mov qword [rax], rax
mov rax, qword [rbx + 8]
mov qword [rax + 8], rax
mov qword [rbx + 0x10], 0
mov rax, qword [rbx + 8]
mov rdx, qword [rbx + 0x20]
mov rcx, qword [rbx + 0x18]
mov qword [rsp + 0x30], rax
call fcn.1400295d0
add rsp, 0x20
pop rbx
ret
push rbp
push rsi
push rdi
sub rsp, 0x40
mov rbp, r8
mov rdi, rdx
mov rsi, rcx
cmp rdx, r8
je 0x140028b88
mov qword [rsp + 0x60], rbx
mov rbx, qword [rcx + 0x18]
mov qword [rsp + 0x38], r12
mov r12, qword [rcx + 8]
mov qword [rsp + 0x30], r13
mov r13, qword [rdx + 8]
add rdx, 0x10
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r15
mov qword [rsp + 0x78], rbx
call fcn.140028f40
add rax, rax
mov rdx, rdi
mov r14, qword [rbx + rax*8 + 8]
lea r15, [rbx + rax*8]
mov rax, qword [rbx + rax*8]
mov rbx, qword [rdi]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], r14
call fcn.140029990
dec qword [rsi + 0x10]
cmp rdi, r14
je 0x140028b4e
nop dword [rax + rax]
mov r14, rbx
cmp rbx, rbp
je 0x140028b5d
mov rdx, rbx
mov rbx, qword [rbx]
call fcn.140029990
dec qword [rsi + 0x10]
cmp r14, qword [rsp + 0x70]
jne 0x140028b30
cmp qword [rsp + 0x68], rdi
jne 0x140028b93
mov qword [r15], r12
mov rax, r12
jmp 0x140028b96
cmp qword [rsp + 0x68], rdi
jne 0x140028b67
mov qword [r15], rbx
mov r14, qword [rsp + 0x28]
mov r12, qword [rsp + 0x38]
mov r15, qword [rsp + 0x20]
mov qword [r13], rbx
mov qword [rbx + 8], r13
mov r13, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x60]
mov rax, rbp
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
mov rax, r13
mov qword [r15 + 8], rax
cmp rbx, rbp
je 0x140028b67
mov rdx, qword [rbx + 0x10]
movabs r9, 0x100000001b3
mov r15, qword [rsi + 0x30]
mov rax, rdx
shr rax, 8
movabs rcx, 0xcbf29ce484222325
movzx r8d, al
mov rdi, rbx
movzx eax, dl
xor rax, rcx
imul rax, r9
xor r8, rax
mov rax, rdx
imul r8, r9
shr rax, 0x10
movzx ecx, al
mov rax, rdx
xor r8, rcx
shr rax, 0x18
imul r8, r9
movzx ecx, al
mov rax, rdx
xor r8, rcx
shr rax, 0x20
imul r8, r9
movzx ecx, al
mov rax, rdx
xor r8, rcx
shr rax, 0x28
imul r8, r9
movzx ecx, al
mov rax, rdx
xor r8, rcx
shr rdx, 0x38
imul r8, r9
shr rax, 0x30
movzx ecx, al
xor r8, rcx
imul r8, r9
xor r8, rdx
mov rdx, rbx
mov rbx, qword [rbx]
imul r8, r9
and r15, r8
shl r15, 4
add r15, qword [rsp + 0x78]
mov r14, qword [r15 + 8]
call fcn.140029990
dec qword [rsi + 0x10]
cmp rdi, r14
je 0x140028c80
nop
mov rdi, rbx
cmp rbx, rbp
je 0x140028b64
mov rdx, rbx
mov rbx, qword [rbx]
call fcn.140029990
dec qword [rsi + 0x10]
cmp rdi, r14
jne 0x140028c60
mov qword [r15], r12
mov qword [r15 + 8], r12
jmp 0x140028b9a
Function at 0x140028f40
Capabilities:
Hash data using fnv

Disassembly:
mov r8, qword [rdx]
movabs r11, 0x100000001b3
mov r10, rcx
movzx r9d, r8b
movabs rax, 0xcbf29ce484222325
xor r9, rax
mov rax, r8
imul r9, r11
shr rax, 8
movzx edx, al
mov rax, r8
xor r9, rdx
shr rax, 0x10
imul r9, r11
movzx ecx, al
mov rax, r8
xor r9, rcx
shr rax, 0x18
imul r9, r11
movzx ecx, al
mov rax, r8
xor r9, rcx
shr rax, 0x20
imul r9, r11
movzx ecx, al
mov rax, r8
xor r9, rcx
shr rax, 0x28
imul r9, r11
movzx ecx, al
mov rax, r8
xor r9, rcx
shr rax, 0x30
imul r9, r11
movzx ecx, al
mov rax, qword [r10 + 0x30]
xor r9, rcx
imul r9, r11
shr r8, 0x38
xor r9, r8
imul r9, r11
and rax, r9
ret

Function at 0x1400291c0
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x28
mov r8, qword [rdx]
mov r10, rcx
movabs r9, 0x100000001b3
movabs rcx, 0xcbf29ce484222325
mov rax, r8
shr rax, 8
movzx edx, al
movzx eax, r8b
xor rax, rcx
imul rax, r9
xor rdx, rax
mov rax, r8
imul rdx, r9
shr rax, 0x10
movzx ecx, al
mov rax, r8
xor rdx, rcx
shr rax, 0x18
imul rdx, r9
movzx ecx, al
mov rax, r8
xor rdx, rcx
shr rax, 0x20
imul rdx, r9
movzx ecx, al
mov rax, r8
xor rdx, rcx
shr rax, 0x28
imul rdx, r9
movzx ecx, al
mov rax, r8
xor rdx, rcx
shr rax, 0x30
imul rdx, r9
movzx ecx, al
mov rax, r8
xor rdx, rcx
shr rax, 0x38
mov rcx, qword [r10 + 8]
imul rdx, r9
xor rdx, rax
imul rdx, r9
mov r9, qword [r10 + 0x30]
and r9, rdx
shl r9, 4
add r9, qword [r10 + 0x18]
mov r11, qword [r9 + 8]
mov rdx, r11
cmp r11, rcx
je 0x140029296
mov rax, qword [r9]
cmp r8, qword [r11 + 0x10]
je 0x140029298
cmp rdx, rax
je 0x140029296
mov rdx, qword [rdx + 8]
cmp r8, qword [rdx + 0x10]
jne 0x140029285
jmp 0x140029298
xor edx, edx
test rdx, rdx
je 0x1400292ed
mov rax, qword [r9]
cmp r11, rdx
jne 0x1400292bd
cmp rax, rdx
jne 0x1400292b3
mov qword [r9], rcx
mov qword [r9 + 8], rcx
jmp 0x1400292c8
mov rcx, qword [rdx + 8]
mov qword [r9 + 8], rcx
jmp 0x1400292c8
cmp rax, rdx
jne 0x1400292c8
mov rax, qword [rdx]
mov qword [r9], rax
mov rcx, qword [rdx]
dec qword [r10 + 0x10]
mov rax, qword [rdx + 8]
mov qword [rax], rcx
mov rax, qword [rdx + 8]
mov qword [rcx + 8], rax
call fcn.140029990
mov eax, 1
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret
Function at 0x140029c30
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov ebx, 1
mov eax, ebx
shl rax, cl
cmp rdx, rax
jbe 0x140029c68
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x38], rdi
mov rdi, qword [rsi + 8]
or rax, rbx
bsr rcx, rax
mov r8, rdi
mov qword [rsp + 0x40], r14
inc ecx
shl rbx, cl
lea rcx, [rsi + 0x18]
lea rdx, [rbx + rbx]
call fcn.140028e00
mov qword [rsi + 0x38], rbx
lea rax, [rbx - 1]
mov qword [rsi + 0x30], rax
mov rcx, qword [rsi + 8]
mov rcx, qword [rcx]
cmp rcx, rdi
je 0x140029e04
mov qword [rsp + 0x30], rbp
mov rax, rcx
movabs rbp, 0xcbf29ce484222325
movabs rbx, 0x100000001b3
nop
mov r10, qword [rax + 0x10]
mov r11, qword [rsi + 0x30]
mov rdx, r10
mov rcx, qword [rcx]
shr rdx, 8
movzx r9d, dl
movzx edx, r10b
xor rdx, rbp
imul rdx, rbx
xor r9, rdx
mov rdx, r10
imul r9, rbx
shr rdx, 0x10
movzx r8d, dl
mov rdx, r10
xor r9, r8
shr rdx, 0x18
imul r9, rbx
movzx r8d, dl
mov rdx, r10
xor r9, r8
shr rdx, 0x20
imul r9, rbx
movzx r8d, dl
mov rdx, r10
xor r9, r8
shr rdx, 0x28
imul r9, rbx
movzx r8d, dl
mov rdx, r10
xor r9, r8
shr rdx, 0x30
imul r9, rbx
movzx r8d, dl
mov rdx, r10
xor r9, r8
shr rdx, 0x38
imul r9, rbx
xor r9, rdx
imul r9, rbx
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r8, qword [r11]
cmp r8, rdi
jne 0x140029d7c
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x140029df3
mov rdx, qword [r11 + 8]
cmp r10, qword [rdx + 0x10]
jne 0x140029db5
mov r10, qword [rdx]
cmp r10, rax
je 0x140029daf
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x140029df3
cmp r8, rdx
je 0x140029dcf
nop word [rax + rax]
mov rdx, qword [rdx + 8]
cmp r10, qword [rdx + 0x10]
je 0x140029e19
cmp r8, rdx
jne 0x140029dc0
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rdi
jne 0x140029cd0
mov rbp, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov r14, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x140029df3
Function at 0x14002b2a0
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x80
mov rbx, rcx
cmp qword [rcx + 0x20], 0
je 0x14002b444
mov rcx, qword [rcx + 0x28]
mov rax, qword [rcx + 0x18]
test rax, rax
je 0x14002b309
lea rcx, [0x14002bf40]
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rdx
vmovups xmm0, xmmword [rsp + 0x20]
vmovdqa xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
mov rcx, rbx
call rax
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
mov rdi, qword [rcx + 0x10]
mov rax, qword [rdx]
mov qword [rsp + 0x40], rax
movzx eax, byte [rdx + 8]
mov byte [rsp + 0x48], al
vmovdqu xmm0, xmmword [rdx + 0x10]
vmovdqu xmmword [rsp + 0x50], xmm0
xor esi, esi
mov qword [rdx + 0x10], rsi
mov qword [rdx + 0x18], rsi
vmovups xmm0, xmmword [rdx + 0x20]
vmovups xmmword [rsp + 0x60], xmm0
vmovsd xmm1, qword [rdx + 0x30]
vmovsd qword [rsp + 0x70], xmm1
lea rax, [rsp + 0x40]
mov qword [rsp + 0xa0], rax
mov rax, qword gs:[0x58]
mov ecx, listen
mov rax, qword [rax]
cmp byte [rcx + rax], sil
jne 0x14002b371
call fcn.1401d1c70
mov rax, qword gs:[0x58]
mov ecx, 0x10
mov rax, qword [rax]
mov rcx, qword [rcx + rax]
test rcx, rcx
je 0x14002b391
mov rdx, qword [rcx + 8]
jmp 0x14002b394
mov rdx, rsi
mov r8d, 0x48
call fcn.14002bf80
mov rcx, qword [rsp + 0x40]
mov qword [rax + 8], rcx
movzx ecx, byte [rsp + 0x48]
mov byte [rax + 0x10], cl
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rsi
mov rcx, qword [rsp + 0x50]
mov qword [rax + 0x18], rcx
mov rcx, qword [rsp + 0x58]
mov qword [rax + 0x20], rcx
vpxor xmm0, xmm0, xmm0
vmovdqu xmmword [rsp + 0x50], xmm0
vmovups xmm1, xmmword [rsp + 0x60]
vmovups xmmword [rax + 0x28], xmm1
vmovsd xmm0, qword [rsp + 0x70]
vmovsd qword [rax + 0x38], xmm0
lea rcx, [0x14002c730]
mov qword [rax], rcx
mov qword [rsp + 0x90], rax
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14002b41c
mov eax, 0xffffffff
lock xadd dword [rcx + 0xc], eax
cmp eax, 1
jne 0x14002b41c
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
lea rdx, [rsp + 0x90]
mov rcx, rbx
call rdi
nop
mov rcx, qword [rsp + 0x90]
test rcx, rcx
je 0x14002b43f
mov rax, qword [rcx]
xor edx, edx
call rax
nop
jmp 0x14002b2f4
lea rcx, [rsp + 0x20]
call fcn.14002dff0
nop
lea rcx, [rsp + 0x20]
call fcn.14002e320
int3
Function at 0x14002b8b0
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x80
mov r12d, r9d
mov r15, r8
mov r14, rdx
mov rbp, rcx
mov ecx, 0xe0
call fcn.14002e7c0
mov rdi, rax
mov rax, qword [r14 + 0x18]
xor r13d, r13d
mov esi, r13d
mov ecx, r13d
test rax, rax
je 0x14002b905
mov rcx, qword [r14 + 0x10]
mov rsi, rax
lock inc dword [rax + 0xc]
mov qword [rdi + 0x20], r13
lea rax, [0x14002c440]
mov qword [rdi + 0x28], rax
mov qword [rdi], r13
mov qword [rdi + 8], r13
mov qword [rdi + 0x10], r13
mov qword [rdi + 0x18], r13
mov dword [rdi + 0x30], r13d
mov qword [rdi + 0x38], r13
mov qword [rdi + 0x40], r13
test rsi, rsi
je 0x14002b940
mov qword [rdi + 0x38], rcx
mov qword [rdi + 0x40], rsi
lock inc dword [rsi + 0xc]
vmovups xmm0, xmmword [r15]
vmovups xmmword [rdi + 0x48], xmm0
mov rcx, qword [rsp + 0xd0]
mov rax, qword [rcx + 8]
mov qword [rdi + 0x60], rax
vmovups xmm0, xmmword [rcx + 0x10]
vmovups xmmword [rdi + 0x68], xmm0
vmovsd xmm1, qword [rcx + 0x20]
vmovsd qword [rdi + 0x78], xmm1
mov eax, dword [rcx + 0x28]
mov dword [rdi + 0x80], eax
mov rax, qword [rcx + 0x30]
mov qword [rdi + 0x88], rax
movzx eax, byte [rcx + 0x38]
mov byte [rdi + 0x90], al
mov qword [rdi + 0x98], r13
mov qword [rdi + 0xa0], r13
mov rax, qword [rcx + 0x40]
mov qword [rdi + 0x98], rax
mov rax, qword [rcx + 0x48]
mov qword [rdi + 0xa0], rax
mov qword [rcx + 0x40], r13
mov qword [rcx + 0x48], r13
lea rcx, [rdi + 0xa8]
mov r9, qword [rsp + 0xd8]
call fcn.14002a910
test rsi, rsi
je 0x14002b9e9
mov eax, 0xffffffff
lock xadd dword [rsi + 0xc], eax
cmp eax, 1
jne 0x14002b9e9
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + reloc.WS2_32.dll_htonl]
vmovups xmm0, xmmword [r15]
vmovups xmmword [rsp + 0x40], xmm0
vmovq qword [rsp + 0x58], xmm0
vpextrd dword [rsp + 0x50], xmm0, 2
mov rax, qword [r15 + 8]
mov qword [rsp + 0x60], rax
test byte [r14 + 8], 0x10
je 0x14002ba36
test rax, rax
jne 0x14002ba36
mov rax, qword [rbp + 8]
lock inc dword [rax + 0x30]
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [rbp + 8]
call fcn.14002d860
jmp 0x14002bad4
mov rax, qword [rbp + 8]
lock inc dword [rax + 0x30]
mov rcx, qword [r14]
cmp rcx, 0xffffffffffffffff
jne 0x14002ba5e
xor r9d, r9d
mov r8d, 0x2719
mov rdx, rdi
mov rcx, qword [rbp + 8]
call fcn.14002d860
jmp 0x14002bad4
mov dword [rsp + 0xd0], r13d
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], r12d
lea r9, [rsp + 0xd0]
mov r8d, 1
lea rdx, [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_WSASend]
mov ebx, eax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, 0x274d
cmp eax, 0x4d2
cmove eax, ecx
test ebx, ebx
je 0x14002bac7
cmp eax, 0x3e5
je 0x14002bac7
mov r9d, dword [rsp + 0xd0]
mov r8d, eax
mov rdx, rdi
mov rcx, qword [rbp + 8]
call fcn.14002d860
jmp 0x14002bad4
mov rdx, rdi
mov rcx, qword [rbp + 8]
call fcn.14002d910
nop
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14002e9a0
Capabilities:
Terminate thread

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [rcx + 0x10]
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
mov rbx, rcx
mov rax, qword [rcx + 8]
mov r9d, 0xffffffff
mov ecx, 2
mov qword [rsp + 0x28], rax
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
lock xadd dword [0x14026cfc8], eax
test eax, eax
mov rax, qword [rbx + 8]
je 0x14002ea01
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateThread]
add rsp, 0x30
pop rbx
ret
xor r8d, r8d
lea rcx, [fcn.140011f50]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_QueueUserAPC]
mov rcx, qword [rbx + 8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
add rsp, 0x30
pop rbx
ret
Function at 0x14002f9a0
Capabilities:
Send data
Send data on socket

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov dword [rax + 0x20], r9d
push rdi
push r14
push r15
sub rsp, 0x60
mov rbx, qword [rsp + 0xa0]
lea r9, [rax + 0x20]
xor r14d, r14d
mov r8d, 1
mov qword [rax - 0x48], r14
mov qword [rax - 0x50], r14
mov dword [rax - 0x58], r14d
mov dword [rax + 0x20], r14d
call qword [sym.imp.WS2_32.dll_WSASend]
mov esi, eax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov rdx, qword [0x14025e378]
lea rbp, [0x14025e370]
movabs r15, 0x4d54ee85da812030
mov dword [rsp + 0x44], r14d
add rdx, r15
mov edi, eax
cmp rdx, 1
jbe 0x14002fa2c
mov rcx, qword [0x14025e370]
mov edx, eax
mov r8, qword [rcx + 0x30]
mov rcx, rbp
call r8
jmp 0x14002fa31
test edi, edi
setne al
movzx eax, al
movabs r10, 0x4800144005b3
add rax, 2
mov dword [rsp + 0x40], edi
mov qword [rsp + 0x48], rbp
vmovups xmm0, xmmword [rsp + 0x40]
vmovups xmmword [rbx], xmm0
mov qword [rsp + 0x50], rax
vmovsd xmm1, qword [rsp + 0x50]
vmovsd qword [rbx + 0x10], xmm1
mov r9, qword [rbx + 0x10]
cmp r9, 1
je 0x14002fa76
mov eax, dword [rbx]
mov r8d, eax
jmp 0x14002faa6
mov rcx, qword [rbx + 8]
mov rax, r10
mov r8d, dword [rbx]
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 0x14
imul rax, rax, 0x1ffff7
sub rcx, rax
imul eax, ecx, 0x3e8
add eax, r8d
cmp eax, 0x40
jne 0x14002fae8
mov rcx, qword [0x14025e378]
add rcx, r15
mov dword [rsp + 0x44], r14d
cmp rcx, 1
jbe 0x14002fadc
mov rax, qword [0x14025e370]
mov edx, 0x2746
mov rcx, rbp
call qword [rax + 0x30]
mov dword [rsp + 0x40], 0x2746
jmp 0x14002fb57
mov al, 1
mov dword [rsp + 0x40], 0x2746
jmp 0x14002fb57
cmp r9, 1
jne 0x14002fb1b
mov rcx, qword [rbx + 8]
mov rax, r10
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 0x14
imul rax, rax, 0x1ffff7
sub rcx, rax
imul eax, ecx, 0x3e8
add r8d, eax
cmp r8d, 0x4d2
jne 0x14002fb7d
mov rcx, qword [0x14025e378]
add rcx, r15
mov dword [rsp + 0x44], r14d
cmp rcx, 1
jbe 0x14002fb4d
mov rax, qword [0x14025e370]
mov edx, 0x274d
mov rcx, rbp
call qword [rax + 0x30]
jmp 0x14002fb4f
mov al, 1
mov dword [rsp + 0x40], 0x274d
movzx eax, al
add rax, 2
mov qword [rsp + 0x48], rbp
vmovups xmm0, xmmword [rsp + 0x40]
mov qword [rsp + 0x50], rax
vmovsd xmm1, qword [rsp + 0x50]
vmovups xmmword [rbx], xmm0
vmovsd qword [rbx + 0x10], xmm1
test esi, esi
je 0x14002fb88
mov eax, 0xffffffff
jmp 0x14002fba7
mov eax, dword [rsp + 0x98]
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbx], xmm0
mov qword [rsp + 0x50], r14
vmovsd xmm0, qword [rsp + 0x50]
vmovsd qword [rbx + 0x10], xmm0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x1400301b0
Capabilities:
Set socket configuration

Disassembly:
push rbp
push rsi
push rdi
push r12
push r15
mov rbp, rsp
sub rsp, 0x60
xor r12d, r12d
mov r15, r9
mov rsi, rdx
mov rdi, rcx
cmp rcx, 0xffffffffffffffff
je 0x14003038a
mov qword [rsp + 0x98], rbx
test r8b, r8b
je 0x14003021c
movzx eax, byte [rdx]
test al, 8
je 0x14003021c
or al, 8
mov dword [rbp + 0x30], r12d
mov byte [rdx], al
lea r9, [rbp + 0x30]
mov edx, 0xffff
mov dword [rsp + 0x20], 4
mov r8d, 0x80
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
lea rcx, [rbp - 0x18]
setne dl
call fcn.1400300f0
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
test eax, eax
mov rcx, r15
mov ebx, eax
setne dl
call fcn.1400300f0
test ebx, ebx
je 0x140030386
mov qword [rsp + 0xa0], r13
movabs rcx, 0x4d54ee85da812030
mov qword [rsp + 0xa8], r14
lea r13, [0x14025e370]
mov r14, qword [0x14025e378]
add rcx, r14
mov dword [rbp - 0x2c], r12d
cmp rcx, 1
jbe 0x14003028c
mov rax, qword [0x14025e370]
mov edx, 0x2733
mov rcx, r13
call qword [rax + 0x30]
mov r14, qword [0x14025e378]
jmp 0x14003028e
mov al, 1
movzx eax, al
lea rdx, [rbp - 0x18]
add rax, 2
mov dword [rbp - 0x30], 0x2733
mov qword [rbp - 0x20], rax
mov rcx, r15
vmovsd xmm1, qword [rbp - 0x20]
mov qword [rbp - 0x28], r13
vmovups xmm0, xmmword [rbp - 0x30]
vmovsd qword [rbp - 8], xmm1
vmovups xmmword [rbp - 0x18], xmm0
call fcn.140030520
test al, al
jne 0x14003032f
movabs rax, 0x4d54ee85da812030
mov dword [rbp - 0x2c], r12d
add rax, r14
cmp rax, 1
jbe 0x1400302f3
mov rax, qword [0x14025e370]
mov edx, 0x4d5
mov rcx, r13
call qword [rax + 0x30]
jmp 0x1400302f5
mov al, 1
movzx eax, al
lea rdx, [rbp - 0x18]
add rax, 2
mov dword [rbp - 0x30], 0x4d5
mov qword [rbp - 0x20], rax
mov rcx, r15
vmovsd xmm1, qword [rbp - 0x20]
mov qword [rbp - 0x28], r13
vmovups xmm0, xmmword [rbp - 0x30]
vmovsd qword [rbp - 8], xmm1
vmovups xmmword [rbp - 0x18], xmm0
call fcn.140030520
test al, al
je 0x140030360
lea r8, [rbp + 0x30]
mov dword [rbp + 0x30], r12d
mov edx, 0x8004667e
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_ioctlsocket]
and byte [rsi], 0xfc
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
test eax, eax
mov rcx, r15
mov ebx, eax
setne dl
call fcn.1400300f0
mov r13, qword [rsp + 0xa0]
mov eax, ebx
mov r14, qword [rsp + 0xa8]
mov rbx, qword [rsp + 0x98]
add rsp, 0x60
pop r15
pop r12
pop rdi
pop rsi
pop rbp
ret
mov eax, ebx
jmp 0x140030372
mov eax, r12d
add rsp, 0x60
pop r15
pop r12
pop rdi
pop rsi
pop rbp
ret