joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400d76d0
Capabilities:
Write file on windows

Disassembly:
jmp 0x1400d76d0
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x98
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov rax, qword [0x14028c8d0]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0xa0]
mov qword [rax + 0x60], 0
xor edx, edx
mov rcx, qword [rsp + 0xc0]
call fcn.140003d2d
mov rcx, qword [rsp + 0xa0]
add rcx, 0x60
lea r8, [0x1402314e4]
mov rdx, rax
call qword [sym.imp.MSVCR120D.dll__wfopen_s]
mov rax, qword [rsp + 0xa0]
cmp qword [rax + 0x60], 0
jne 0x1400d776d
mov dword [rsp + 0x38], 0
mov rcx, qword [rsp + 0xc0]
call fcn.1400053e9
mov eax, dword [rsp + 0x38]
jmp 0x1400d7932
mov r8d, recv
xor edx, edx
lea rcx, [rsp + 0x48]
call sub.MSVCR120D.dll_memset
mov r8d, 0x28
xor edx, edx
lea rcx, [rsp + 0x58]
call sub.MSVCR120D.dll_memset
mov eax, 0x4d42
mov word [rsp + 0x48], ax
xor eax, eax
mov word [rsp + 0x4e], ax
xor eax, eax
mov word [rsp + 0x50], ax
cmp dword [rsp + 0xb8], 0
je 0x1400d77bd
mov dword [rsp + 0x24], 1
jmp 0x1400d77c5
mov dword [rsp + 0x24], 3
mov eax, dword [rsp + 0xa8]
imul eax, dword [rsp + 0x24]
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
cdq
and edx, 3
add eax, edx
and eax, 3
sub eax, edx
mov ecx, dword [rsp + 0x20]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
imul eax, dword [rsp + 0xb0]
mov dword [rsp + 0x20], eax
movsxd rax, dword [rsp + 0x20]
add rax, 0x36
mov dword [rsp + 0x4a], eax
mov dword [rsp + 0x52], getservbyport
mov dword [rsp + 0x58], 0x28
mov eax, dword [rsp + 0xa8]
mov dword [rsp + 0x5c], eax
mov eax, dword [rsp + 0xb0]
mov dword [rsp + 0x60], eax
mov eax, 1
mov word [rsp + 0x64], ax
cmp dword [rsp + 0xb8], 0
je 0x1400d7851
mov dword [rsp + 0x28], 8
jmp 0x1400d7859
mov dword [rsp + 0x28], 0x18
movzx eax, word [rsp + 0x28]
mov word [rsp + 0x66], ax
mov dword [rsp + 0x68], 0
mov dword [rsp + 0x6c], 0
mov dword [rsp + 0x70], 0xec4
mov dword [rsp + 0x74], 0xec4
mov dword [rsp + 0x78], 0
mov dword [rsp + 0x7c], 0
mov rax, qword [rsp + 0xa0]
mov r9, qword [rax + 0x60]
mov r8d, 1
mov edx, recv
lea rcx, [rsp + 0x48]
call qword [sym.imp.MSVCR120D.dll_fwrite]
cmp rax, 1
je 0x1400d78d6
mov dword [rsp + 0x2c], 0
mov rcx, qword [rsp + 0xc0]
call fcn.1400053e9
mov eax, dword [rsp + 0x2c]
jmp 0x1400d7932
mov rax, qword [rsp + 0xa0]
mov r9, qword [rax + 0x60]
mov r8d, 1
mov edx, 0x28
lea rcx, [rsp + 0x58]
call qword [sym.imp.MSVCR120D.dll_fwrite]
cmp rax, 1
je 0x1400d7919
mov dword [rsp + 0x34], 0
mov rcx, qword [rsp + 0xc0]
call fcn.1400053e9
mov eax, dword [rsp + 0x34]
jmp 0x1400d7932
mov dword [rsp + 0x30], 1
mov rcx, qword [rsp + 0xc0]
call fcn.1400053e9
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1401b0dd0
add rsp, 0x98
ret
Function at 0x1400d7950
Capabilities:
Write file on windows

Disassembly:
jmp 0x1400d7950
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov qword [rsp + 0x28], 0
cmp dword [rsp + 0x68], 0
je 0x1400d7a5a
mov eax, dword [rsp + 0x60]
cdq
mov ecx, 3
idiv ecx
cdqe
mov rcx, rax
call fcn.1401b0bb0
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
jmp 0x1400d79b5
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x60]
cdq
mov ecx, 3
idiv ecx
cmp dword [rsp + 0x20], eax
jge 0x1400d7a19
imul eax, dword [rsp + 0x20], 3
cdqe
mov rcx, qword [rsp + 0x58]
movzx eax, byte [rcx + rax]
imul ecx, dword [rsp + 0x20], 3
inc ecx
movsxd rcx, ecx
mov rdx, qword [rsp + 0x58]
movzx ecx, byte [rdx + rcx]
add eax, ecx
imul ecx, dword [rsp + 0x20], 3
add ecx, 2
movsxd rcx, ecx
mov rdx, qword [rsp + 0x58]
movzx ecx, byte [rdx + rcx]
add eax, ecx
cdq
mov ecx, 3
idiv ecx
movsxd rcx, dword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
mov byte [rdx + rcx], al
jmp 0x1400d79ab
mov eax, dword [rsp + 0x60]
cdq
mov ecx, 3
idiv ecx
cdqe
mov rcx, qword [rsp + 0x50]
mov r9, qword [rcx + 0x60]
mov r8d, 1
mov rdx, rax
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.MSVCR120D.dll_fwrite]
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x38]
call sub.MSVCR120D.dll_void___cdecl_operator_delete___void____ptr64_
jmp 0x1400d7a7c
movsxd rax, dword [rsp + 0x60]
mov rcx, qword [rsp + 0x50]
mov r9, qword [rcx + 0x60]
mov r8d, 1
mov rdx, rax
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.MSVCR120D.dll_fwrite]
mov eax, 1
add rsp, 0x48
ret

Function at 0x1400dc720
Capabilities:
Initialize winsock library

Disassembly:
jmp 0x1400dc720
mov qword [rsp + 8], rcx
sub rsp, 0x1f8
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rax, qword [0x14028c8d0]
xor rax, rsp
mov qword [rsp + 0x1e0], rax
mov rax, qword [rsp + 0x200]
mov rcx, rax
call fcn.140002d51
nop
mov rax, qword [rsp + 0x200]
add rax, 0x10
mov rcx, rax
call fcn.140002d51
nop
mov rax, qword [rsp + 0x200]
add rax, 0x18
mov rcx, rax
call fcn.140002d51
lea rdx, [rsp + 0x40]
mov cx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x1400dc7d6
lea rax, [0x1402327d0]
mov qword [rsp + 0x28], rax
lea rax, [0x1402327e8]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 0x7d
lea rdx, [0x1402327f0]
mov ecx, 2
call qword [sym.imp.MSVCR120D.dll__CrtDbgReportW]
cmp eax, 1
jne 0x1400dc7d6
int3
mov rax, qword [rsp + 0x200]
mov dword [rax + 8], 0x19
mov rax, qword [rsp + 0x200]
mov qword [rax + 0x28], 0
mov rax, qword [rsp + 0x200]
mov qword [rax + 0x20], 0
mov rax, qword [rsp + 0x200]
mov rcx, qword [rsp + 0x1e0]
xor rcx, rsp
call fcn.1401b0dd0
add rsp, 0x1f8
ret
Function at 0x1400dcdf0
Capabilities:
Create thread

Disassembly:
jmp 0x1400dcdf0
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x60]
mov qword [rax + 0x28], rcx
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
mov qword [rax + 0x20], rcx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9, qword [rsp + 0x50]
lea r8, [0x140003832]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x1400dce5a
mov eax, 1
jmp 0x1400dce5c
xor eax, eax
add rsp, 0x48
ret
Function at 0x1400dce70
Capabilities:
Resolve dns

Disassembly:
jmp 0x1400dce70
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xc8
mov qword [rsp + 0xa8], 0xfffffffffffffffe
mov qword [rsp + 0x30], 0
mov rdx, qword [rsp + 0xd8]
lea rcx, [rsp + 0x50]
call fcn.140002b67
nop
lea rcx, [rsp + 0x48]
call fcn.140002d51
nop
mov dx, reloc.OLEAUT32.dll_VarI4FromDisp
lea rcx, [rsp + 0x50]
call fcn.140004309
inc eax
mov r8d, eax
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x50]
call fcn.140001488
mov qword [rsp + 0xa0], rax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x68], rax
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x48]
call fcn.140001451
nop
lea rcx, [rsp + 0x80]
call fcn.1400053e9
lea rcx, [rsp + 0x38]
call fcn.140002d51
nop
mov r8, qword [rsp + 0x48]
lea rdx, str.Quering_MX_record_of_domain__s
lea rcx, [rsp + 0x38]
call fcn.140001d8e
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x98], rax
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x98]
call fcn.140001a7d
mov qword [rsp + 0x90], rax
mov r9b, 1
mov r8d, 2
mov rdx, qword [rsp + 0x90]
mov rax, qword [rsp + 0xd0]
mov rcx, qword [rax + 0x28]
call fcn.140002a31
lea rcx, [rsp + 0x48]
call fcn.140002b08
mov qword [rsp + 0x28], 0
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
xor r8d, r8d
mov dx, reloc.WS2_32.dll_ntohs
mov rcx, rax
call sub.DNSAPI.dll_DnsQuery_W
mov dword [rsp + 0x40], eax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x70], rax
cmp dword [rsp + 0x40], 0
jne 0x1400dd06f
cmp qword [rsp + 0x30], 0
je 0x1400dd02f
mov rax, qword [rsp + 0x30]
movzx eax, word [rax + 0x10]
cmp eax, 0xf
jne 0x1400dd020
mov rax, qword [rsp + 0x30]
mov rdx, qword [rax + 0x20]
lea rcx, [rsp + 0x60]
call fcn.140002b67
nop
mov rax, qword [rsp + 0x30]
add rax, 0x28
mov rdx, rax
mov rcx, qword [rsp + 0xe0]
call fcn.140001ca3
lea rdx, [rsp + 0x60]
mov rcx, rax
call fcn.140001451
nop
lea rcx, [rsp + 0x60]
call fcn.1400053e9
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x30], rax
jmp 0x1400dcfc5
mov edx, 1
mov rcx, qword [rsp + 0x70]
call sub.DNSAPI.dll_DnsFree
mov dword [rsp + 0x58], 0
lea rcx, [rsp + 0x38]
call fcn.1400053e9
nop
lea rcx, [rsp + 0x48]
call fcn.1400053e9
nop
lea rcx, [rsp + 0x50]
call fcn.1400053e9
mov eax, dword [rsp + 0x58]
jmp 0x1400dd0f7
mov r8d, dword [rsp + 0x40]
lea rdx, str.DNS_query_failed_with_code__d
lea rcx, [rsp + 0x38]
call fcn.140001d8e
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x78], rax
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x78]
call fcn.140001a7d
mov qword [rsp + 0x88], rax
mov r9b, 1
mov r8d, 2
mov rdx, qword [rsp + 0x88]
mov rax, qword [rsp + 0xd0]
mov rcx, qword [rax + 0x28]
call fcn.140002a31
mov dword [rsp + 0x5c], 1
lea rcx, [rsp + 0x38]
call fcn.1400053e9
nop
lea rcx, [rsp + 0x48]
call fcn.1400053e9
nop
lea rcx, [rsp + 0x50]
call fcn.1400053e9
mov eax, dword [rsp + 0x5c]
add rsp, 0xc8
ret
Function at 0x1400df740
Capabilities:
Read file on windows

Disassembly:
jmp 0x1400df740
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xe8
mov qword [rsp + 0x80], 0xfffffffffffffffe
mov rax, qword [0x14028c8d0]
xor rax, rsp
mov qword [rsp + 0xd0], rax
lea rcx, [rsp + 0x88]
call fcn.1400037e7
nop
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov rcx, qword [rsp + 0xf8]
call fcn.140002b08
mov rcx, rax
call fcn.1400060c3
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jge 0x1400df7df
mov dword [rsp + 0x50], 1
lea rcx, [rsp + 0x88]
call fcn.140004179
nop
mov rcx, qword [rsp + 0xf8]
call fcn.1400053e9
mov eax, dword [rsp + 0x50]
jmp 0x1400df936
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x30], eax
movsxd rax, dword [rsp + 0x30]
mov rcx, rax
call fcn.1401b0bb0
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], 0
mov rcx, qword [rsp + 0xf8]
call fcn.140002b08
lea r8, [0x1402329cc]
mov rdx, rax
lea rcx, [rsp + 0x48]
call qword [sym.imp.MSVCR120D.dll__wfopen_s]
cmp qword [rsp + 0x48], 0
je 0x1400df85a
movsxd rax, dword [rsp + 0x30]
mov r9, qword [rsp + 0x48]
mov r8d, 1
mov rdx, rax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.MSVCR120D.dll_fread]
cmp rax, 1
je 0x1400df8a3
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call sub.MSVCR120D.dll_void___cdecl_operator_delete___void____ptr64_
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x58], 2
lea rcx, [rsp + 0x88]
call fcn.140004179
nop
mov rcx, qword [rsp + 0xf8]
call fcn.1400053e9
mov eax, dword [rsp + 0x58]
jmp 0x1400df936
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.MSVCR120D.dll_fclose]
lea rax, [0x140232354]
mov qword [rsp + 0x20], rax
mov r9d, 0x4c
mov r8d, dword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0xa8]
call fcn.140005687
mov qword [rsp + 0x70], rax
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x100]
call fcn.140002022
lea rcx, [rsp + 0xa8]
call fcn.1400028ec
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x68], rax
mov rcx, qword [rsp + 0x68]
call sub.MSVCR120D.dll_void___cdecl_operator_delete___void____ptr64_
mov dword [rsp + 0x54], 0
lea rcx, [rsp + 0x88]
call fcn.140004179
nop
mov rcx, qword [rsp + 0xf8]
call fcn.1400053e9
mov eax, dword [rsp + 0x54]
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.1401b0dd0
add rsp, 0xe8
ret
Function at 0x1400e9530
Capabilities:
Resolve dns

Disassembly:
jmp 0x1400e9530
mov word [rsp + 0x20], r9w
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], 0
mov rax, qword [rsp + 0x30]
mov qword [rax], 0
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 0x70]
mov byte [rcx + rax], 0
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_gethostbyname]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1400e9650
mov rax, qword [rsp + 0x28]
movsx eax, word [rax + 0x10]
cmp eax, 2
jne 0x1400e962e
mov rax, qword [rsp + 0x28]
movsx rax, word [rax + 0x12]
cmp rax, 4
jne 0x1400e962e
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x38], rax
jmp 0x1400e95d5
mov rax, qword [rsp + 0x38]
add rax, 8
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x1400e962e
mov rax, qword [rsp + 0x38]
mov rax, qword [rax]
mov r9d, dword [rax]
movzx r8d, word [rsp + 0x68]
mov edx, dword [rsp + 0x60]
mov ecx, dword [rsp + 0x58]
call fcn.140001131
mov rcx, qword [rsp + 0x30]
mov qword [rcx], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
jne 0x1400e961b
mov eax, 8
jmp 0x1400e96a5
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
add rax, 0x28
mov qword [rsp + 0x30], rax
jmp 0x1400e95c7
mov r9d, 0x400
mov rax, qword [rsp + 0x28]
mov r8, qword [rax]
mov edx, 0x401
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.MSVCR120D.dll_strncpy_s]
xor eax, eax
jmp 0x1400e96a5
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0x2af9
je 0x1400e9684
cmp dword [rsp + 0x20], 0x2afa
je 0x1400e968b
cmp dword [rsp + 0x20], 0x2afb
je 0x1400e9692
cmp dword [rsp + 0x20], 0x2afc
je 0x1400e9699
jmp 0x1400e96a0
mov eax, 0x2af9
jmp 0x1400e96a5
mov eax, 0x2afa
jmp 0x1400e96a5
mov eax, 0x2afb
jmp 0x1400e96a5
mov eax, 0x2af9
jmp 0x1400e96a5
mov eax, 0x2af9
add rsp, 0x48
ret
Function at 0x140127e10
Capabilities:
Check for software breakpoints

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov rdi, rsp
mov ecx, reloc.WS2_32.dll_inet_ntoa
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x40]
cmp dword [rax + 0x24], 0xca
jne 0x140127e72
mov rcx, qword [rsp + 0x40]
call fcn.140134060
mov rax, qword [rsp + 0x40]
movzx eax, byte [rax + 0x58]
test eax, eax
je 0x140127e66
mov rax, qword [rsp + 0x40]
mov dword [rax + 0x24], 0xcf
mov al, 1
jmp 0x140127fc7
mov rax, qword [rsp + 0x40]
mov dword [rax + 0x24], VarI2FromI1
mov rax, qword [rsp + 0x40]
cmp dword [rax + 0x24], 0xcb
jne 0x140127f74
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x238]
movzx eax, byte [rax + 0x20]
test eax, eax
je 0x140127f5c
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x10], 0
je 0x140127eb8
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x10]
mov rcx, qword [rsp + 0x40]
call qword [rax]
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x238]
mov rcx, qword [rsp + 0x40]
call qword [rax]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jne 0x140127edd
xor al, al
jmp 0x140127fc7
cmp dword [rsp + 0x20], 2
jne 0x140127ee6
jmp 0x140127f5c
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x10], 0
je 0x140127f57
cmp dword [rsp + 0x20], 3
je 0x140127f00
cmp dword [rsp + 0x20], 1
jne 0x140127f57
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x10]
mov eax, dword [rax + 8]
inc eax
mov dword [rsp + 0x24], eax
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x10]
mov ecx, dword [rsp + 0x24]
mov dword [rax + 8], ecx
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x10]
mov eax, dword [rax + 0xc]
cmp dword [rsp + 0x24], eax
jl 0x140127f57
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x10]
mov eax, dword [rax + 0xc]
mov rcx, qword [rsp + 0x40]
add eax, dword [rcx + 0x188]
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx + 0x10]
mov dword [rcx + 0xc], eax
jmp 0x140127e9c
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x40]
mov ecx, dword [rcx + 0x9c]
mov dword [rax + 0xa4], ecx
jmp 0x140127fbd
mov rax, qword [rsp + 0x40]
cmp dword [rax + 0x24], 0xcc
je 0x140127fbd
mov rax, qword [rsp + 0x40]
mov rax, qword [rax]
mov dword [rax + 0x28], socket
mov rax, qword [rsp + 0x40]
mov rax, qword [rax]
mov ecx, 4
imul rcx, rcx, 0
mov rdx, qword [rsp + 0x40]
mov edx, dword [rdx + 0x24]
mov dword [rax + rcx + 0x2c], edx
mov rax, qword [rsp + 0x40]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x40]
call qword [rax]
mov rcx, qword [rsp + 0x40]
call fcn.1401284f0
add rsp, 0x30
pop rdi
ret
Function at 0x1401284f0
Capabilities:
Check for software breakpoints

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov rdi, rsp
mov ecx, reloc.WS2_32.dll_recv
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x50]
cmp dword [rax + 0x24], 0xcc
je 0x14012854a
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 0x218]
mov rcx, qword [rsp + 0x50]
call qword [rax]
mov rax, qword [rsp + 0x50]
mov dword [rax + 0x98], 0
mov rax, qword [rsp + 0x50]
mov dword [rax + 0x24], reloc.OLEAUT32.dll_VarI2FromI1
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 0x218]
movzx eax, byte [rax + 0x10]
test eax, eax
je 0x140128657
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x50]
mov ecx, dword [rcx + 0x78]
cmp dword [rax + 0x98], ecx
jae 0x14012861c
mov rax, qword [rsp + 0x50]
cmp qword [rax + 0x10], 0
je 0x1401285c2
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 0x10]
mov rcx, qword [rsp + 0x50]
mov ecx, dword [rcx + 0x98]
mov dword [rax + 8], ecx
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 0x10]
mov rcx, qword [rsp + 0x50]
mov ecx, dword [rcx + 0x78]
mov dword [rax + 0xc], ecx
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 0x10]
mov rcx, qword [rsp + 0x50]
call qword [rax]
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 0x98]
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x50]
add rax, 0x98
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx + 0x220]
mov qword [rsp + 0x28], rcx
xor r9d, r9d
mov r8, rax
xor edx, edx
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x28]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rax, qword [rsp + 0x50]
mov ecx, dword [rsp + 0x20]
cmp dword [rax + 0x98], ecx
jne 0x140128617
xor al, al
jmp 0x140128684
jmp 0x140128562
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 0x218]
mov rcx, qword [rsp + 0x50]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 0x218]
mov rcx, qword [rsp + 0x50]
call qword [rax]
mov rax, qword [rsp + 0x50]
mov dword [rax + 0x98], 0
jmp 0x14012854a
mov rax, qword [rsp + 0x50]
movzx eax, byte [rax + 0x59]
test eax, eax
je 0x14012866e
mov dword [rsp + 0x30], 0xce
jmp 0x140128676
mov dword [rsp + 0x30], 0xcd
mov rax, qword [rsp + 0x50]
mov ecx, dword [rsp + 0x30]
mov dword [rax + 0x24], ecx
mov al, 1
add rsp, 0x40
pop rdi
ret
Function at 0x140137610
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov byte [rsp + 0x10], dl
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x60
mov rdi, rsp
mov ecx, 0x18
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x70]
mov rax, qword [rsp + 0x70]
mov rax, qword [rax + 8]
mov r8d, 0xe0
mov edx, 1
mov rcx, qword [rsp + 0x70]
call qword [rax]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x30]
mov qword [rax + 0x228], rcx
mov rax, qword [rsp + 0x30]
lea rcx, [0x140139310]
mov qword [rax], rcx
mov rax, qword [rsp + 0x30]
lea rcx, [0x140139360]
mov qword [rax + 0x10], rcx
mov rax, qword [rsp + 0x30]
mov qword [rax + 0xd8], 0
movzx eax, byte [rsp + 0x78]
test eax, eax
je 0x1401377bd
mov dword [rsp + 0x38], 0
mov rax, qword [rsp + 0x70]
mov rax, qword [rax + 0x120]
mov qword [rsp + 0x40], rax
jmp 0x1401376d2
mov eax, dword [rsp + 0x38]
inc eax
mov dword [rsp + 0x38], eax
mov rax, qword [rsp + 0x40]
add rax, 0x60
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x70]
mov eax, dword [rax + 0x38]
cmp dword [rsp + 0x38], eax
jge 0x140137784
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 0xc]
mov dword [rsp + 0x3c], eax
mov rax, qword [rsp + 0x70]
movzx eax, byte [rax + 0x129]
test eax, eax
je 0x140137709
imul eax, dword [rsp + 0x3c], 3
mov dword [rsp + 0x3c], eax
mov rax, qword [rsp + 0x40]
mov edx, dword [rax + 0xc]
mov rax, qword [rsp + 0x40]
mov ecx, dword [rax + 0x20]
call fcn.140136050
mov dword [rsp + 0x54], eax
mov rcx, qword [rsp + 0x40]
mov edx, dword [rcx + 8]
mov rcx, qword [rsp + 0x40]
mov ecx, dword [rcx + 0x1c]
call fcn.140136050
mov rcx, qword [rsp + 0x70]
mov rcx, qword [rcx + 8]
mov qword [rsp + 0x58], rcx
mov edx, dword [rsp + 0x3c]
mov dword [rsp + 0x28], edx
mov edx, dword [rsp + 0x54]
mov dword [rsp + 0x20], edx
mov r9d, eax
mov r8b, 1
mov edx, 1
mov rcx, qword [rsp + 0x70]
mov rax, qword [rsp + 0x58]
call qword [rax + 0x28]
movsxd rcx, dword [rsp + 0x38]
mov rdx, qword [rsp + 0x30]
mov qword [rdx + rcx*8 + 0x88], rax
jmp 0x1401376ba
mov rax, qword [rsp + 0x30]
lea rcx, [0x140139410]
mov qword [rax + 8], rcx
mov rax, qword [rsp + 0x30]
lea rcx, [0x140137c60]
mov qword [rax + 0x18], rcx
mov rax, qword [rsp + 0x30]
add rax, 0x88
mov rcx, qword [rsp + 0x30]
mov qword [rcx + 0x20], rax
jmp 0x14013784e
mov rax, qword [rsp + 0x70]
mov rax, qword [rax + 8]
mov r8d, 0x500
mov edx, 1
mov rcx, qword [rsp + 0x70]
call qword [rax + reloc.WS2_32.dll_htonl]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x50], 0
jmp 0x1401377f2
mov eax, dword [rsp + 0x50]
inc eax
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0xa
jge 0x140137821
movsxd rax, dword [rsp + 0x50]
imul rax, rax, 0x80
mov rcx, qword [rsp + 0x48]
add rcx, rax
mov rax, rcx
movsxd rcx, dword [rsp + 0x50]
mov rdx, qword [rsp + 0x30]
mov qword [rdx + rcx*8 + 0x38], rax
jmp 0x1401377e8
mov rax, qword [rsp + 0x30]
lea rcx, [0x140139400]
mov qword [rax + 8], rcx
mov rax, qword [rsp + 0x30]
lea rcx, [0x140137860]
mov qword [rax + 0x18], rcx
mov rax, qword [rsp + 0x30]
mov qword [rax + 0x20], 0
add rsp, 0x60
pop rdi
ret
Function at 0x140182be0
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x10
mov rdi, rsp
mov ecx, 4
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x20]
mov rax, qword [rsp + 0x20]
mov ecx, dword [rsp + 0x30]
mov eax, dword [rax]
xor eax, ecx
and eax, 0xff
cdqe
mov rcx, qword [rsp + 0x20]
mov ecx, dword [rcx]
shr ecx, 8
mov rdx, qword [rsp + 0x28]
mov eax, dword [rdx + rax*4]
xor eax, ecx
mov rcx, qword [rsp + 0x20]
mov dword [rcx], eax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax]
and eax, 0xff
mov rcx, qword [rsp + 0x20]
add eax, dword [rcx + 4]
mov rcx, qword [rsp + 0x20]
mov dword [rcx + 4], eax
mov rax, qword [rsp + 0x20]
imul eax, dword [rax + 4], 0x8088405
inc eax
mov rcx, qword [rsp + 0x20]
mov dword [rcx + 4], eax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 4]
shr eax, 0x18
mov dword [rsp], eax
mov rax, qword [rsp + 0x20]
mov ecx, dword [rsp]
mov eax, dword [rax + 8]
xor eax, ecx
and eax, 0xff
cdqe
mov rcx, qword [rsp + 0x20]
mov ecx, dword [rcx + 8]
shr ecx, 8
mov rdx, qword [rsp + 0x28]
mov eax, dword [rdx + rax*4]
xor eax, ecx
mov rcx, qword [rsp + 0x20]
mov dword [rcx + 8], eax
mov eax, dword [rsp + 0x30]
add rsp, 0x10
pop rdi
ret