joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140015830
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.14000f514
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x1400158ba
cmp byte [rbp - 0x21], r15b
je 0x1400158b5
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x1400158f0
call fcn.14000b450
test eax, eax
jne 0x1400158dc
cmp byte [rbp - 0x21], r15b
je 0x1400158d4
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x1400158f0
cmp byte [rbp - 0x21], r15b
je 0x1400158ed
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.14000eaf4
test eax, eax
jne 0x140015990
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.14000f514
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x14001592f
cmp byte [rbp - 0x21], r15b
je 0x140015964
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x140015964
call fcn.14000b450
test eax, eax
jne 0x140015950
cmp byte [rbp - 0x21], r15b
je 0x140015949
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x140015964
cmp byte [rbp - 0x21], r15b
je 0x140015961
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.14000eaf4
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x140015990
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x140015993
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x1400159a1
mov rcx, rdi
call fcn.14000b200
cmp byte [rbp + 0x3f], r15b
je 0x1400159b0
mov rcx, qword [rbp + 0x27]
call fcn.14000b200
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x1400168e0
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.140009da0
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.140009da0
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x140016a30
cmp rax, 0xffffffffffffffff
je 0x140016a30
xor edi, edi
test rbp, rbp
jle 0x1400169db
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14000b188
mov rbx, rax
test rax, rax
jne 0x140016968
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x1400169d1
mov edx, 0x8000
mov ecx, r14d
call fcn.140008e14
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14000e0d0
cmp eax, 0xffffffff
je 0x1400169b1
cdqe
sub rbp, rax
test rbp, rbp
jg 0x140016978
mov edx, r15d
mov ecx, r14d
call fcn.140008e14
jmp 0x1400169d1
cmp byte [rsi + 0x38], dil
je 0x1400169c8
cmp dword [rsi + 0x34], 5
jne 0x1400169c8
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x1400169d1
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14000b200
jmp 0x140016a44
jns 0x140016a44
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.140009da0
cmp rax, 0xffffffffffffffff
jne 0x1400169fc
cmp byte [rsi + 0x30], dil
je 0x140016a44
mov edi, dword [rsi + 0x2c]
jmp 0x140016a44
mov ecx, r14d
call fcn.140010f28
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x140016a44
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x140016a44
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x140016a3d
mov eax, dword [rsi + 0x2c]
jmp 0x140016a42
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.140009da0
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x140017a80
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140017aa8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140017aa8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x1400155d4
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x24], eax
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x40]
mov ecx, dword [rsp + 0x24]
mov dword [rax + 0xe8], ecx
mov rax, qword [rsp + 0x40]
mov rdx, qword [rax + 0x40]
lea rcx, [0x140023bd8]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x40]
add rax, 0x50
mov rcx, rax
call fcn.140025138
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x40]
add rax, 0x28
mov r8, rax
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x28]
call fcn.140015ed4
mov eax, dword [rsp + 0x20]
or eax, 1
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x48]
add rsp, 0x38
ret
Function at 0x14001e384
Capabilities:
Parse credit card information

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x80]
and eax, 0x400000
test eax, eax
je 0x14001e3ee
mov rax, qword [rsp + 0x20]
mov al, byte [rax + 0x78]
mov byte [rsp + 4], al
cmp byte [rsp + 4], 0x44
je 0x14001e3e0
cmp byte [rsp + 4], 0x53
je 0x14001e3e0
cmp byte [rsp + 4], 0x57
je 0x14001e3e0
cmp byte [rsp + 4], 0x63
je 0x14001e3e0
cmp byte [rsp + 4], 0x64
je 0x14001e3e0
cmp byte [rsp + 4], 0x73
je 0x14001e3e0
cmp byte [rsp + 4], 0x77
je 0x14001e3e0
jmp 0x14001e3e7
xor al, al
jmp 0x14001e4c7
mov al, 1
jmp 0x14001e4c7
mov rax, qword [rsp + 0x20]
movsx eax, byte [rax + 0x78]
mov dword [rsp], eax
cmp dword [rsp], 0x2f
jg 0x14001e43d
cmp dword [rsp], 0x2f
je 0x14001e499
cmp dword [rsp], 0x22
je 0x14001e499
cmp dword [rsp], 0x24
je 0x14001e469
cmp dword [rsp], 0x28
je 0x14001e46d
cmp dword [rsp], 0x29
je 0x14001e46d
cmp dword [rsp], 0x2a
je 0x14001e469
cmp dword [rsp], 0x2b
je 0x14001e46d
cmp dword [rsp], 0x2e
je 0x14001e469
jmp 0x14001e4c5
cmp dword [rsp], 0x3f
je 0x14001e46d
cmp dword [rsp], 0x5b
je 0x14001e469
cmp dword [rsp], 0x5c
je 0x14001e469
cmp dword [rsp], 0x5e
je 0x14001e469
cmp dword [rsp], 0x7b
je 0x14001e46d
cmp dword [rsp], 0x7c
je 0x14001e469
cmp dword [rsp], 0x7d
je 0x14001e46d
jmp 0x14001e4c5
mov al, 1
jmp 0x14001e4c7
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x80]
and eax, 0x800000
test eax, eax
je 0x14001e48b
mov dword [rsp + 8], 1
jmp 0x14001e493
mov dword [rsp + 8], 0
mov al, byte [rsp + 8]
jmp 0x14001e4c7
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x80]
and eax, 0x1000000
test eax, eax
je 0x14001e4b7
mov dword [rsp + 0xc], 1
jmp 0x14001e4bf
mov dword [rsp + 0xc], 0
mov al, byte [rsp + 0xc]
jmp 0x14001e4c7
xor al, al
add rsp, 0x18
ret
Function at 0x1400232fc
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xc0
mov rax, qword [0x140223748]
xor rax, rsp
mov qword [rsp + 0xb0], rax
lea rdx, str.comdlg32.dll
lea rcx, [rsp + 0x90]
call fcn.14001067c
nop
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x28]
call fcn.140012588
nop
lea rcx, [rsp + 0x90]
call fcn.140013cb0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
xor r8d, r8d
mov edx, eax
lea rcx, [rsp + 0x70]
call fcn.140010d30
xor edx, edx
lea rcx, [rsp + 0x70]
call fcn.1400150f4
mov edx, dword [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov dword [rsp + 0x38], 0x38
mov dword [rsp + 0x3c], reloc.SHLWAPI.dll_SHCreateMemStream
lea rax, str.shell32.dll
mov qword [rsp + 0x40], rax
xor eax, eax
mov word [rsp + 0x48], ax
xor eax, eax
mov word [rsp + 0x4a], ax
lea rcx, [rsp + 0x70]
call fcn.14002301c
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0x7c
lea rax, [rsp + 0x60]
mov rdi, rax
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_CreateActCtxA]
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x70]
call fcn.140013cb0
nop
lea rcx, [rsp + 0x28]
call fcn.14001454c
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.14017c920
add rsp, 0xc0
pop rdi
ret

Function at 0x140035a50
Capabilities:
Initialize winsock library

Disassembly:
mov byte [rsp + 0x18], r8b
mov byte [rsp + 0x10], dl
mov qword [rsp + 8], rcx
sub rsp, 0x1e8
mov rax, qword [0x140223748]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
mov rax, qword [rsp + 0x1f0]
mov ecx, 1
lock xadd dword [rax], ecx
inc ecx
mov eax, ecx
cmp eax, 1
jne 0x140035add
movzx eax, byte [rsp + 0x1f8]
and rax, 0xff
movzx eax, al
movzx ecx, byte [rsp + 0x200]
and rcx, 0xff
movzx ecx, cl
shl ecx, 8
or eax, ecx
lea rdx, [rsp + 0x30]
movzx ecx, ax
call qword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x1f0]
add rax, 4
mov ecx, dword [rsp + 0x20]
xchg dword [rax], ecx
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.14017c920
add rsp, 0x1e8
ret

Function at 0x140035e0c
Capabilities:
Allocate thread local storage

Disassembly:
sub rsp, 0x48
mov dword [rsp + 0x28], 0xffffffff
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0xffffffff
jne 0x140035e5a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x24], eax
call fcn.1400352ac
mov r8, rax
mov edx, dword [rsp + 0x24]
lea rcx, [rsp + 0x30]
call fcn.1400125bc
lea rdx, [0x1401cfc88]
lea rcx, [rsp + 0x30]
call fcn.140035b78
mov eax, dword [rsp + 0x20]
add rsp, 0x48
ret
Function at 0x140080464
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x38
mov rax, qword [rsp + 0x58]
mov eax, dword [rax]
mov dword [rsp + 0x20], eax
lea r8, [rsp + 0x20]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.WS2_32.dll_getsockname]
mov dword [rsp + 0x24], eax
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x58]
mov qword [rcx], rax
mov eax, dword [rsp + 0x24]
add rsp, 0x38
ret

Function at 0x140080518
Capabilities:
Set socket configuration

Disassembly:
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x38
mov eax, dword [rsp + 0x68]
mov dword [rsp + 0x20], eax
mov r9, qword [rsp + 0x60]
mov r8d, dword [rsp + 0x58]
mov edx, dword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.WS2_32.dll_setsockopt]
add rsp, 0x38
ret
Function at 0x140097b54
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov byte [rsp + 0x20], r9b
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov rdx, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x90]
call fcn.1400926f8
nop
mov rax, qword [rsp + 0x90]
lea rcx, vtable.asio::detail::win_iocp_io_context.0
mov qword [rax], rcx
mov rax, qword [rsp + 0x90]
add rax, 0x28
mov rcx, rax
call fcn.1400124b4
nop
mov rax, qword [rsp + 0x90]
mov dword [rax + 0x30], 0
mov rax, qword [rsp + 0x90]
mov dword [rax + 0x34], 0
mov rax, qword [rsp + 0x90]
mov dword [rax + 0x38], 0
mov rax, qword [rsp + 0x90]
mov dword [rax + 0x3c], 0
call fcn.1400b7e4c
mov rcx, qword [rsp + 0x90]
mov dword [rcx + 0x40], eax
mov rax, qword [rsp + 0x90]
add rax, 0x48
mov qword [rsp + 0x38], rax
xor edx, edx
mov rcx, qword [rsp + 0x38]
call fcn.140009f20
nop
mov rax, qword [rsp + 0x90]
add rax, 0x50
mov rcx, rax
call fcn.1400124b4
nop
mov rax, qword [rsp + 0x90]
mov dword [rax + 0x58], 0
mov rax, qword [rsp + 0x90]
add rax, 0x60
mov rcx, rax
call fcn.140097ec4
nop
mov rax, qword [rsp + 0x90]
add rax, 0x88
mov rcx, rax
call fcn.1400124b4
mov rax, qword [rsp + 0x90]
add rax, 0x90
mov rcx, rax
call fcn.1400341b4
nop
mov rax, qword [rsp + 0x90]
mov ecx, dword [rsp + 0xa0]
mov dword [rax + 0xa0], ecx
mov rax, qword [rsp + 0x90]
add rax, 0xa8
mov qword [rsp + 0x40], rax
xor edx, edx
mov rcx, qword [rsp + 0x40]
call fcn.140009f20
nop
cmp dword [rsp + 0xa0], 0
jl 0x140097cc8
mov eax, dword [rsp + 0xa0]
mov dword [rsp + 0x20], eax
jmp 0x140097cd0
mov dword [rsp + 0x20], 0xffffffff
mov r9d, dword [rsp + 0x20]
xor r8d, r8d
xor edx, edx
mov rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov rcx, qword [rsp + 0x90]
mov qword [rcx + 0x28], rax
mov rax, qword [rsp + 0x90]
cmp qword [rax + 0x28], 0
jne 0x140097d33
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x24], eax
call fcn.1400352ac
mov r8, rax
mov edx, dword [rsp + 0x24]
lea rcx, [rsp + 0x68]
call fcn.1400125bc
lea rdx, str.iocp
lea rcx, [rsp + 0x68]
call fcn.140035b78
movzx eax, byte [rsp + 0xa8]
test eax, eax
je 0x140097dd2
mov rax, qword [rsp + 0x90]
add rax, 0x30
lock inc dword [rax]
mov rax, qword [rsp + 0x90]
add rax, 0xa8
mov qword [rsp + 0x58], rax
mov ecx, 0x18
call fcn.14017c2e0
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x140097daf
mov rdx, qword [rsp + 0x90]
lea rcx, [rsp + 0x60]
call fcn.140009f20
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
xor r8d, r8d
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x28]
call fcn.14006c508
mov qword [rsp + 0x30], rax
jmp 0x140097db8
mov qword [rsp + 0x30], 0
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
call fcn.1400cdaa4
nop
mov rax, qword [rsp + 0x90]
add rsp, 0x88
ret

Function at 0x14009b4a4
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rdx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x30]
mov ecx, dword [rax]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
add rsp, 0x28
ret
Function at 0x1400acc60
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x20], r9
mov byte [rsp + 0x18], r8b
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov dword [rsp + 0x44], 0
cmp qword [rsp + 0x90], 0xffffffffffffffff
je 0x1400ace05
movzx eax, byte [rsp + 0xa0]
test eax, eax
je 0x1400acd06
mov rax, qword [rsp + 0x98]
movzx eax, byte [rax]
and eax, 8
test eax, eax
je 0x1400acd06
xor eax, eax
mov word [rsp + 0x48], ax
xor eax, eax
mov word [rsp + 0x4a], ax
lea rcx, [rsp + 0x50]
call fcn.14003442c
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], 4
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 0x80
mov r8d, 0xffff
mov rdx, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x90]
call fcn.1400d26cc
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.WS2_32.dll_closesocket]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
je 0x1400acd26
mov byte [rsp + 0x40], 1
jmp 0x1400acd2b
mov byte [rsp + 0x40], 0
mov dl, byte [rsp + 0x40]
mov rcx, qword [rsp + 0xa8]
call fcn.1400b81c4
cmp dword [rsp + 0x44], 0
je 0x1400ace05
mov edx, 0x2733
lea rcx, [rsp + 0x60]
call fcn.14006eec4
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0xa8]
call fcn.140014fb4
movzx eax, al
test eax, eax
jne 0x1400acd97
mov edx, 0x4d5
lea rcx, [rsp + 0x70]
call fcn.14006eec4
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0xa8]
call fcn.140014fb4
movzx eax, al
test eax, eax
je 0x1400ace05
mov dword [rsp + 0x4c], 0
lea r8, [rsp + 0x4c]
mov edx, 0x8004667e
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov rax, qword [rsp + 0x98]
movzx eax, byte [rax]
and eax, 0xfffffffc
mov rcx, qword [rsp + 0x98]
mov byte [rcx], al
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.WS2_32.dll_closesocket]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
je 0x1400acdef
mov byte [rsp + 0x41], 1
jmp 0x1400acdf4
mov byte [rsp + 0x41], 0
mov dl, byte [rsp + 0x41]
mov rcx, qword [rsp + 0xa8]
call fcn.1400b81c4
mov eax, dword [rsp + 0x44]
add rsp, 0x88
ret

Function at 0x1400c110c
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 8]
mov qword [rsp + 0x28], rax
mov r9d, 0xffffffff
xor r8d, r8d
lea rdx, [rsp + 0x20]
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.1400d4b74
movzx eax, al
test eax, eax
je 0x1400c1178
xor edx, edx
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
jmp 0x1400c11a5
xor r8d, r8d
mov rax, qword [rsp + 0x40]
mov rdx, qword [rax + 8]
lea rcx, [fcn.140007b10]
call qword [sym.imp.KERNEL32.dll_QueueUserAPC]
mov edx, 0xffffffff
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
add rsp, 0x38
ret
Function at 0x1400c3928
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 8], rcx
mov eax, 4
imul rax, rax, 1
mov rcx, qword [rsp + 8]
mov dword [rcx + rax], 0
mov eax, 4
imul rax, rax, 0
mov rcx, qword [rsp + 8]
mov dword [rcx + rax], 0
mov eax, 4
imul rax, rax, 0
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 8], 0x67452301
mov eax, 4
imul rax, rax, 1
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 8], 0xefcdab89
mov eax, 4
imul rax, rax, 2
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 8], 0x98badcfe
mov eax, 4
imul rax, rax, 3
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 8], 0x10325476
ret

Function at 0x1400d032c
Capabilities:
Send data
Send data on socket

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x40], 0
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x44], eax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov eax, dword [rsp + 0x44]
mov dword [rsp + 0x20], eax
lea r9, [rsp + 0x40]
mov r8d, dword [rsp + 0x48]
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.WS2_32.dll_WSASend]
mov dword [rsp + 0x4c], eax
mov dl, 1
mov rcx, qword [rsp + 0x80]
call fcn.1400b81c4
mov rcx, qword [rsp + 0x80]
call fcn.140006414
cmp eax, 0x40
jne 0x1400d03c9
mov edx, 0x2746
mov rcx, qword [rsp + 0x80]
call fcn.14006f5b8
jmp 0x1400d03ef
mov rcx, qword [rsp + 0x80]
call fcn.140006414
cmp eax, 0x4d2
jne 0x1400d03ef
mov edx, 0x274d
mov rcx, qword [rsp + 0x80]
call fcn.14006f5b8
cmp dword [rsp + 0x4c], 0
je 0x1400d03fd
mov eax, 0xffffffff
jmp 0x1400d0420
mov rcx, qword [rsp + 0x80]
call fcn.14001d748
mov r8, rax
xor edx, edx
mov rcx, qword [rsp + 0x80]
call fcn.1400a93cc
mov eax, dword [rsp + 0x40]
add rsp, 0x58
ret

Function at 0x1400d2e80
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
sub rsp, 0x48
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, dword [rsp + 0x60]
mov edx, dword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_WSASocketW]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0xffffffffffffffff
jne 0x1400d2ed0
mov byte [rsp + 0x30], 1
jmp 0x1400d2ed5
mov byte [rsp + 0x30], 0
mov dl, byte [rsp + 0x30]
mov rcx, qword [rsp + 0x68]
call fcn.1400b81c4
cmp qword [rsp + 0x38], 0xffffffffffffffff
jne 0x1400d2ef2
mov rax, qword [rsp + 0x38]
jmp 0x1400d2f29
cmp dword [rsp + 0x50], 0x17
jne 0x1400d2f24
mov dword [rsp + 0x34], 0
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x34]
mov r8d, 0x1b
mov edx, 0x29
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rax, qword [rsp + 0x38]
add rsp, 0x48
ret
Function at 0x1400d367c
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rdx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x80]
call fcn.140005b20
mov rax, qword [rsp + 0x80]
mov rcx, qword [rax + 8]
call fcn.1400d6704
movzx eax, byte [rsp + 0xa8]
test eax, eax
je 0x1400d36f4
mov rax, qword [rsp + 0x80]
mov rax, qword [rax + 8]
mov qword [rsp + 0x50], rax
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x50]
call fcn.1400c4f64
jmp 0x1400d382e
mov rdx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x80]
call fcn.1400c105c
movzx eax, al
test eax, eax
jne 0x1400d3741
mov rax, qword [rsp + 0x80]
mov rax, qword [rax + 8]
mov qword [rsp + 0x58], rax
xor r9d, r9d
mov r8d, 0x2719
mov rdx, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x58]
call fcn.1400c4f64
jmp 0x1400d382e
mov dword [rsp + 0x44], 0
mov eax, dword [rsp + 0xa0]
mov dword [rsp + 0x48], eax
mov qword [rsp + 0x30], 0
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x44]
mov r8d, dword [rsp + 0x98]
mov rdx, qword [rsp + 0x90]
mov rax, qword [rsp + 0x88]
mov rcx, qword [rax]
call qword [sym.imp.WS2_32.dll_WSARecv]
mov dword [rsp + 0x4c], eax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0x40
jne 0x1400d37b9
mov dword [rsp + 0x40], 0x2746
jmp 0x1400d37cb
cmp dword [rsp + 0x40], 0x4d2
jne 0x1400d37cb
mov dword [rsp + 0x40], 0x274d
cmp dword [rsp + 0x4c], 0
je 0x1400d380b
cmp dword [rsp + 0x40], 0x3e5
je 0x1400d380b
mov rax, qword [rsp + 0x80]
mov rax, qword [rax + 8]
mov qword [rsp + 0x60], rax
mov r9d, dword [rsp + 0x44]
mov r8d, dword [rsp + 0x40]
mov rdx, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x60]
call fcn.1400c4f64
jmp 0x1400d382e
mov rax, qword [rsp + 0x80]
mov rax, qword [rax + 8]
mov qword [rsp + 0x68], rax
mov rdx, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x68]
call fcn.1400c5024
add rsp, 0x78
ret