joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001e9c0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [rcx]
mov ebx, r9d
mov edi, r8d
mov rbp, rcx
call qword [rax + reloc.WS2_32.dll_htonl]
mov edx, dword [rsp + 0x90]
mov word [rsp + 0x32], bx
mov eax, reloc.WS2_32.dll_recv
mov dword [rsp + 0x34], edx
mov word [rsp + 0x3e], ax
shl ebx, 4
xor esi, esi
shr ebx, 3
lea r8, [rsp + 0x30]
mov r13d, 1
movzx ecx, bx
xor r9d, r9d
mov dword [rsp + 0x28], esi
mov eax, ecx
mov dword [rbp + 8], edi
mov word [rsp + 0x30], r13w
mov word [rsp + 0x3c], bx
mov word [rsp + 0x40], si
mov qword [rsp + 0x20], rbp
imul eax, edx
mov dword [rsp + 0x38], eax
mov eax, 0x51eb851f
mul edx
mov r12d, edx
mov edx, edi
shr r12d, 5
imul r12d, ecx
lea rcx, [rbp + 0xb8]
call qword [sym.imp.WINMM.dll_waveOutOpen]
mov ebx, eax
test eax, eax
je 0x14001ea9c
cmp dword [reloc.WS2_32.dll_accept], r13d
jg 0x14001ea95
lea r9, str.Failed_to_open_playback_channel._err_d
lea rdx, str.....media_tavAudioChannel.cpp
mov r8d, 0x1dc
mov ecx, r13d
mov dword [rsp + 0x20], eax
call fcn.1400045a0
mov eax, ebx
jmp 0x14001eb85
mov edi, esi
lea rbx, [rbp + 0x10]
lea rcx, [r12 + 0x30]
call fcn.1401e3610
xor ecx, ecx
mov r8d, gethostbyaddr
mov qword [rbx], rax
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], rcx
mov qword [rax + 0x20], rcx
mov qword [rax + 0x28], rcx
mov rax, qword [rbx]
mov dword [rax + 8], r12d
mov rcx, qword [rbx]
lea rax, [rcx + 0x30]
mov qword [rcx], rax
mov rax, qword [rbx]
movsxd rcx, edi
mov dword [rax + 0x18], esi
mov rax, qword [rbx]
mov dword [rax + 0x1c], esi
mov rax, qword [rbx]
mov qword [rax + 0x10], rcx
mov rdx, qword [rbx]
mov rcx, qword [rbp + 0xb8]
call qword [sym.imp.WINMM.dll_waveOutPrepareHeader]
test eax, eax
jne 0x14001eb80
inc edi
add rbx, 8
cmp edi, 0x10
jb 0x14001eaa2
mov dword [rbp + 0xc], esi
cmp qword [rbp + 0xa0], rsi
jne 0x14001eb79
mov r9, qword [rbp + 0xb0]
lea rax, [rbp + 0xa8]
lea r8, section..text
mov qword [rsp + 0x28], rax
mov edx, 0x8000
xor ecx, ecx
mov dword [rsp + 0x20], 0x10000
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0xa0], rax
test rax, rax
je 0x14001eb66
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
cmp qword [rbp + 0xa0], rsi
setne sil
test esi, esi
je 0x14001eb79
xor eax, eax
jmp 0x14001eb85
mov eax, 0xfffffffb
jmp 0x14001eb85
mov eax, 2
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop r12
ret
Function at 0x14001f9a0
Capabilities:
Encode data using xor

Disassembly:
mov dword [rsp + 0x10], edx
push rbx
push rbp
push rsi
push rdi
push r12
push r15
sub rsp, 0x18
movsxd rbx, edx
xor edx, edx
mov r11d, r8d
mov r10, rcx
mov edi, 2
movzx r12d, r9b
test r9d, 0xff0000
je 0x14001f9d4
mov edi, edx
mov edx, 2
mov r8, qword [rsp + 0x70]
mov ecx, ebx
imul ecx, r11d
mov eax, ecx
movsxd r15, ecx
sar eax, 2
add r15, r8
add eax, ecx
movsxd rcx, eax
add rcx, r8
mov qword [rsp + 0x70], rcx
mov ecx, r12d
imul ecx, ebx
test r9d, 0xff00
je 0x14001fa19
lea eax, [r11 - 2]
imul eax, ecx
cdqe
add r10, rax
mov eax, ecx
imul eax, eax, 0xfffffffd
jmp 0x14001fa1b
mov eax, ecx
sar r11d, 1
movsxd rbp, edi
movsxd rsi, edx
sub r11d, 1
movsxd rdi, ecx
mov qword [rsp], r12
mov dword [rsp + 0x60], r11d
js 0x14001fbc6
cdqe
mov qword [rsp + 0x50], r13
mov r9, rbx
mov qword [rsp + 0x10], r14
lea rdx, [0x140000000]
mov qword [rsp + 8], rax
test ebx, ebx
jle 0x14001fba7
mov r11, qword [rsp]
lea r14d, [rbx - 1]
mov rbx, qword [rsp + 0x70]
shr r14d, 1
lea r12, [rdi + rsi]
lea r13, [rdi + rbp]
inc r14d
nop dword [rax + rax]
movzx ecx, byte [r10 + rbp]
movzx eax, byte [rsi + r10]
add r8, 2
mov edx, dword [rdx + rcx*4 + 0x2e46e0]
lea rcx, [0x140000000]
inc r15
add edx, dword [rcx + rax*4 + 0x2e3ee0]
movzx eax, byte [r10 + 1]
inc rbx
add edx, dword [rcx + rax*4 + 0x2e42e0]
mov byte [r8 - 2], dl
shr edx, 0x14
xor dl, 0x80
mov byte [r15 - 1], dl
movzx ecx, byte [rdi + r10 + 1]
movzx eax, byte [r13 + r10]
lea rdx, [0x140000000]
mov edx, dword [rdx + rcx*4 + 0x2e42e0]
lea rcx, [0x140000000]
add edx, dword [rcx + rax*4 + 0x2e46e0]
movzx eax, byte [r12 + r10]
add r10, r11
add edx, dword [rcx + rax*4 + 0x2e3ee0]
mov byte [r9 + r8 - 2], dl
shr edx, 0xa
xor dl, 0x80
mov byte [rbx - 1], dl
movzx ecx, byte [r10 + rbp]
movzx eax, byte [rsi + r10]
lea rdx, [0x140000000]
movzx edx, byte [rdx + rcx*4 + 0x2e46e0]
lea rcx, [0x140000000]
add dl, byte [rcx + rax*4 + 0x2e3ee0]
movzx eax, byte [r10 + 1]
add dl, byte [rcx + rax*4 + 0x2e42e0]
mov byte [r8 - 1], dl
movzx ecx, byte [rdi + r10 + 1]
movzx eax, byte [r13 + r10]
lea rdx, [0x140000000]
movzx edx, byte [rdx + rcx*4 + 0x2e42e0]
lea rcx, [0x140000000]
add dl, byte [rcx + rax*4 + 0x2e46e0]
movzx eax, byte [r12 + r10]
add r10, r11
add dl, byte [rcx + rax*4 + 0x2e3ee0]
sub r14, 1
mov byte [r9 + r8 - 1], dl
lea rdx, [0x140000000]
jne 0x14001fa80
mov r11d, dword [rsp + 0x60]
mov rax, qword [rsp + 8]
mov qword [rsp + 0x70], rbx
mov ebx, dword [rsp + 0x58]
lea rdx, [0x140000000]
add r8, r9
add r10, rax
sub r11d, 1
mov dword [rsp + 0x60], r11d
jns 0x14001fa55
mov r14, qword [rsp + 0x10]
mov r13, qword [rsp + 0x50]
add rsp, 0x18
pop r15
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14002a640
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x50
mov rsi, rcx
lea rcx, [rsp + 0x78]
xor r12d, r12d
mov rbx, r9
mov rbp, r8
mov rdi, rdx
mov dword [rsp + 0x78], r12d
call fcn.140035600
mov r10, qword [rsp + 0x90]
bt eax, 0x1f
mov dword [r10], eax
jae 0x14002a689
mov dword [rbx], 0x80
jmp 0x14002a6b1
bt eax, 0x1e
jae 0x14002a697
mov dword [rbx], 0x40
jmp 0x14002a6b1
bt eax, 0x1d
jae 0x14002a6a5
mov dword [rbx], 0x20
jmp 0x14002a6b1
bt eax, 0x1c
jae 0x14002a6b1
mov dword [rbx], reloc.WS2_32.dll_recv
mov r9d, dword [rbx]
mov ebx, dword [rsp + 0x78]
mov edx, eax
mov r8d, ebx
mov rcx, rsi
call fcn.14002a440
cmp r12w, word [rdi + 0x37c]
jne 0x14002a6fe
test ebx, ebx
jne 0x14002a6e2
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ebx, dword [rsp + 0x40]
cmp r12w, word [rdi + 0x37c]
jne 0x14002a6fe
mov eax, 1
test ebx, ebx
cmovg ax, bx
mov word [rdi + 0x37c], ax
movzx eax, word [rdi + 0x37c]
cmp ax, 1
jae 0x14002a712
mov eax, 1
jmp 0x14002a722
cmp ax, 4
jbe 0x14002a71f
mov eax, 4
jmp 0x14002a722
movzx eax, ax
movzx r8d, ax
mov r9, rbp
mov rdx, rdi
mov rcx, rsi
mov word [rdi + 0x37c], ax
call fcn.14002a350
test eax, eax
je 0x14002a75a
lea r8, str.GetMultipleThreadIdc____InitSliceSettings_failed.
mov edx, 1
mov rcx, rsi
call fcn.1400254a0
mov eax, 1
jmp 0x14002a75c
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x80]
add rsp, 0x50
pop r12
pop rdi
pop rsi
ret
Function at 0x14004fdc0
Capabilities:
Encode data using base64
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
xor edx, edx
test r8b, r8b
jne 0x14004fe07
movzx eax, byte [rcx - 0x54]
movzx r8d, byte [rcx + 0x44]
sub r8d, eax
mov dword [rcx + 0x4c], r8d
mov eax, dword [rcx - 0x98]
bt eax, 8
jb 0x14004fe07
cmp eax, 2
je 0x14004fdfd
cmp byte [rcx - 0x87], dl
je 0x14004fe07
cmp dword [rcx - 0x4c], edx
je 0x14004fe07
mov edx, 1
mov ebx, dword [rcx + 0x4c]
test ebx, ebx
je 0x14004fecd
test ebx, ebx
jns 0x14004fe1c
neg ebx
add ebx, ebx
jmp 0x14004fe20
lea ebx, [rbx + rbx - 1]
add edx, 0x3c
mov r8d, 1
mov rcx, rdi
call fcn.14004f4d0
cmp ebx, 1
jne 0x14004fe3e
lea edx, [rbx + 0x3d]
jmp 0x14004fed0
mov edx, 0x3e
mov rcx, rdi
lea r8d, [rdx - 0x3d]
call fcn.14004f4d0
sub ebx, 2
test ebx, ebx
jle 0x14004fec6
mov qword [rsp + 0x30], rsi
lea rsi, [0x140000000]
movzx eax, byte [rdi + 0x53]
test al, 1
je 0x14004feae
mov edx, dword [rdi + 0x10]
movzx r8d, al
mov eax, edx
shr r8d, 1
shr rax, 6
and eax, 3
lea rax, [rax + r8*4]
movzx eax, byte [rax + rsi + 0x293a70]
sub edx, eax
mov ecx, edx
btc ecx, 8
shr ecx, 8
add dword [rdi + 0xc], ecx
shl edx, cl
mov dword [rdi + 0x10], edx
movzx eax, byte [rsi + r8*2 + 0x293b71]
add al, al
inc al
mov byte [rdi + 0x53], al
jmp 0x14004febb
mov edx, 0x3f
mov rcx, rdi
call fcn.14004c5c0
dec ebx
test ebx, ebx
jg 0x14004fe62
mov rsi, qword [rsp + 0x30]
mov edx, 0x3f
jmp 0x14004fed0
add edx, 0x3c
xor r8d, r8d
mov rcx, rdi
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.14004f4d0

Function at 0x14004fef0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
movsx rax, r9w
xor ebx, ebx
mov rsi, rcx
cmp byte [rax + r8 + 0x7a], bl
movsx ecx, byte [rax + r8 + 0x75]
movsx edi, byte [rax + r8 + 0x7b]
jle 0x14004ff29
cmp byte [r8 + 0x1bb], bl
jne 0x14004ff29
mov ebx, 1
test cx, cx
jle 0x14004ff3c
cmp byte [r8 + 0x1b9], 0
jne 0x14004ff3c
add bx, 2
test di, di
jle 0x14004ffc7
mov qword [rsp + 0x30], rbp
lea rbp, [0x140000000]
movsx edx, bx
add edx, 0x36
movsxd r9, edx
movzx eax, byte [r9 + rsi + 0x14]
test al, 1
je 0x14004ffaa
mov edx, dword [rsi + 0x10]
movzx r8d, al
mov eax, edx
shr r8d, 1
shr rax, 6
and eax, 3
lea rax, [rax + r8*4]
movzx eax, byte [rax + rbp + 0x293a70]
sub edx, eax
mov ecx, edx
btc ecx, 8
shr ecx, 8
add dword [rsi + 0xc], ecx
shl edx, cl
mov dword [rsi + 0x10], edx
movzx eax, byte [rbp + r8*2 + 0x293b71]
add al, al
inc al
mov byte [r9 + rsi + 0x14], al
jmp 0x14004ffb2
mov rcx, rsi
call fcn.14004c5c0
sar bx, 2
dec di
add bx, 4
test di, di
jg 0x14004ff51
mov rbp, qword [rsp + 0x30]
movsx edx, bx
xor r8d, r8d
mov rcx, rsi
add edx, 0x36
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp fcn.14004f4d0
Function at 0x14004fff0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov ebp, r8d
mov r14d, edx
mov rbx, rcx
test edx, edx
jle 0x140050014
mov r12d, edx
jmp 0x14005001a
mov r12d, edx
neg r12d
mov r13d, 9
mov r15d, 1
cmp r12d, r13d
cmovl r13d, r12d
cmp r9d, 0x20
jle 0x140050039
lea eax, [r15 + 1]
jmp 0x140050043
xor eax, eax
cmp r9d, 2
cmovg eax, r15d
test r13d, r13d
je 0x140050168
cmp r13d, 9
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rdi
jge 0x1400500ce
lea edx, [rax + r8]
mov r8d, r15d
call fcn.14004f4d0
xor edi, edi
dec r13d
mov esi, 3
test r13d, r13d
jle 0x14005009c
nop word [rax + rax]
lea edx, [rsi + rbp]
mov r8d, r15d
mov rcx, rbx
call fcn.14004f4d0
cmp edi, 3
jge 0x140050095
inc esi
inc edi
cmp edi, r13d
jl 0x140050080
lea edx, [rsi + rbp]
xor r8d, r8d
mov rcx, rbx
call fcn.14004f4d0
mov eax, dword [rbx + 8]
xor edi, edi
test r14d, r14d
sets dil
inc dword [rbx + 0xc]
mov ecx, dword [rbx + 0xc]
lea edx, [rcx + rax]
neg edi
cmp edx, 0x40
jge 0x140050131
shl qword [rbx], cl
mov dword [rbx + 8], edx
jmp 0x140050139
lea edx, [rax + r8]
mov r8d, r15d
call fcn.14004f4d0
xor edi, edi
lea esi, [rbp + 3]
nop
mov r8d, r15d
mov edx, esi
mov rcx, rbx
call fcn.14004f4d0
cmp edi, 3
jge 0x1400500f4
inc esi
inc edi
cmp edi, 8
jl 0x1400500e0
lea r8d, [r12 - 9]
mov edx, 3
mov rcx, rbx
call fcn.14004c680
mov eax, dword [rbx + 8]
xor edi, edi
test r14d, r14d
sets dil
inc dword [rbx + 0xc]
mov ecx, dword [rbx + 0xc]
lea edx, [rcx + rax]
neg edi
cmp edx, 0x40
jge 0x140050131
shl qword [rbx], cl
mov dword [rbx + 8], edx
jmp 0x140050139
mov rcx, rbx
call fcn.14004c4d0
mov ecx, dword [rbx + 0x10]
mov rsi, qword [rsp + 0x50]
mov eax, edi
mov rdi, qword [rsp + 0x58]
and rcx, rax
mov dword [rbx + 0xc], 0
add qword [rbx], rcx
mov rbx, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
lea edx, [rax + r8]
xor r8d, r8d
mov rbx, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rbp
jmp fcn.14004f4d0

Function at 0x140064710
Capabilities:
Create thread

Disassembly:
push rdi
sub rsp, 0x30
cmp qword [rcx + 0x38], 0
mov rdi, rcx
je 0x140064799
cmp byte [rcx + 0x70], 0
jne 0x140064791
add rcx, 0x48
mov qword [rsp + 0x40], rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [rdi + 0x48]
mov byte [rdi + 0x71], 0
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor r11d, r11d
lea r8, [0x140064820]
mov qword [rsp + 0x28], r11
mov r9, rdi
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], r11d
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, qword [rsp + 0x40]
test rax, rax
je 0x140064799
cmp byte [rdi + 0x70], 0
mov qword [rdi + 0x30], rax
jne 0x140064791
nop dword [rax + rax]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [rdi + 0x70], 0
je 0x140064780
xor eax, eax
add rsp, 0x30
pop rdi
ret
or eax, 0xffffffff
add rsp, 0x30
pop rdi
ret
Function at 0x140069f40
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rsi, rcx
mov rcx, qword [rcx + 0x58]
mov rbp, rdx
lea rdx, [rsp + 0x40]
call fcn.140068a90
xor edi, edi
mov rcx, qword [rax]
test rcx, rcx
je 0x140069f7a
mov rcx, qword [rcx]
test rcx, rcx
jne 0x140069f7d
mov rcx, rdi
cmp qword [rbp + 0x10], rdi
jne 0x140069f91
test rcx, rcx
je 0x140069f91
call fcn.1401ebca8
mov qword [rbp + 0x10], rax
mov rbx, qword [rsp + 0x40]
test rbx, rbx
je 0x140069fb8
dec dword [rbx + 0x10]
cmp dword [rbx + 0x10], edi
jg 0x140069fb8
mov rcx, qword [rbx]
test rcx, rcx
je 0x140069fb0
call fcn.1401e36c8
mov rcx, rbx
call fcn.1401e32b0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbp
call fcn.14006f350
cmp dword [rbp + 0x18], edi
jne 0x14006a066
mov ecx, reloc.WS2_32.dll_getservbyport
call fcn.1401e37b4
mov rbx, rax
test rax, rax
je 0x140069ffa
mov qword [rax + 8], rdi
mov dword [rax + 0x10], edi
mov qword [rax + 0x18], rax
lea rax, vtable.._AVResolveThread__4__ResolveAddRemoteCandidate_PeerConnection_webrtc__AEAAXPEAVCandidate_3__Z_.0
mov qword [rbx], rax
jmp 0x140069ffd
mov rbx, rdi
mov qword [rbx + 0x20], rbp
mov rax, qword [rsi + 0xa0]
mov qword [rbx + 0x30], rsi
mov qword [rbx + 0x28], rax
cmp qword [rbx + 8], rdi
jne 0x14006a07a
mov r9, qword [rbx + 0x18]
lea rax, [rbx + 0x10]
lea r8, section..text
mov qword [rsp + 0x28], rax
mov edx, 0x50000
xor ecx, ecx
mov dword [rsp + 0x20], 0x10000
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 8], rax
test rax, rax
je 0x14006a053
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
cmp qword [rbx + 8], rdi
setne dil
test edi, edi
je 0x14006a07a
lock add dword [rsi + 0x48], 1
jmp 0x14006a07a
mov rcx, qword [rsi + 0xa0]
mov rdx, qword [rbp + 0x20]
mov rcx, qword [rcx + 0x60]
call fcn.1400766d0
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x14006e1b0
Capabilities:
Resolve dns

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x20
mov rdi, qword [rsp + 0x68]
mov r14, qword [rsp + 0x60]
movzx ebp, r9w
mov qword [rdi], 0
mov r12d, r8d
mov r13d, edx
mov byte [r14], 0
call sub.WS2_32.dll_gethostbyname
mov rsi, rax
test rax, rax
je 0x14006e288
cmp word [rax + 0x10], 2
mov qword [rsp + 0x40], rbx
jne 0x14006e24b
cmp word [rax + 0x12], 4
jne 0x14006e24b
mov rbx, qword [rax + 0x18]
mov rcx, qword [rbx]
test rcx, rcx
je 0x14006e24b
nop dword [rax + rax]
mov r9d, dword [rcx]
movzx r8d, bp
mov edx, r12d
mov ecx, r13d
call fcn.14006e110
mov qword [rdi], rax
test rax, rax
je 0x14006e281
mov rcx, qword [rbx + 8]
add rbx, 8
lea rdi, [rax + 0x28]
test rcx, rcx
jne 0x14006e220
mov r8, qword [rsi]
mov r9d, 0x400
mov rcx, r14
lea edx, [r9 + 1]
call fcn.1401eba00
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r13
pop r12
ret
mov eax, 8
jmp 0x14006e262
call sub.WS2_32.dll_WSAGetLastError
sub eax, 0x2af9
je 0x14006e29e
sub eax, 1
je 0x14006e2ac
sub eax, 1
je 0x14006e2a5
mov eax, 0x2af9
jmp 0x14006e267
mov eax, 0x2afb
jmp 0x14006e267
mov eax, 0x2afa
jmp 0x14006e267
Function at 0x14006eb40
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
sub rsp, 0x280
mov rax, qword [0x1402de400]
xor rax, rsp
mov qword [rsp + 0x270], rax
cmp dword [0x1402e50a8], 0
lea rax, [0x14006e590]
lea rbx, str.getaddrinfo
mov qword [rsp + 0x28], rax
lea rax, str.getnameinfo
movzx ebp, cx
mov qword [rsp + 0x30], rax
lea rax, [0x14006e8a0]
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x38], rax
lea rax, str.freeaddrinfo
mov qword [rsp + 0x40], rax
lea rax, [fcn.14006e530]
mov qword [rsp + 0x48], rax
jne 0x14006ed0e
lea rcx, [rsp + 0x160]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x14006ed04
lea r8, [rsp + 0x160]
lea rcx, [rsp + 0x50]
mov edx, 0x10c
mov qword [rsp + 0x290], rsi
call fcn.1401ebba8
lea r8, str.ws2_32
lea rcx, [rsp + 0x50]
mov edx, 0x10c
call fcn.1401ebc1c
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x14006ec34
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x14006ec94
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea r8, [rsp + 0x160]
lea rcx, [rsp + 0x50]
mov edx, 0x10c
call fcn.1401ebba8
lea r8, str.wship6
lea rcx, [rsp + 0x50]
mov edx, 0x10c
call fcn.1401ebc1c
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x14006ecfc
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x14006ec94
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x14006ecfc
mov qword [rsp + 0x298], rdi
lea rbx, [rsp + 0x28]
xor edi, edi
mov rdx, qword [rbx - 8]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx], rax
test rax, rax
je 0x14006eceb
inc rdi
add rbx, 0x10
cmp rdi, 3
jl 0x14006eca3
mov rax, qword [rsp + 0x28]
mov qword [0x1402e2410], rax
mov rax, qword [rsp + 0x38]
mov qword [0x1402e2420], rax
mov rax, qword [rsp + 0x48]
mov qword [fcn.14006e530], rax
jmp 0x14006ecf4
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rdi, qword [rsp + 0x298]
mov rsi, qword [rsp + 0x290]
mov dword [0x1402e50a8], 1
movzx eax, bp
lea rcx, str.0l_
add rax, rax
mov rax, qword [rcx + rax*8 + 8]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1401e42a0
mov rbx, qword [rsp + 0x2a0]
add rsp, 0x280
pop rbp
ret
Function at 0x140070930
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
cmp edx, 0xc
jne 0x1400709c8
mov rcx, qword [rcx + 0x60]
mov qword [rsp + 0x30], rsi
call fcn.140073b10
mov esi, eax
test eax, eax
je 0x1400709b8
mov rdx, qword [rdi + 0x68]
test rdx, rdx
je 0x1400709b8
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [rdi + 0x58]
lea ebx, [rsi + rax]
test ecx, ecx
je 0x140070996
cmp ecx, ebx
jb 0x14007097b
sub ecx, ebx
jmp 0x14007097f
sub ecx, ebx
dec ecx
cmp ecx, 0x8ca0
ja 0x1400709b8
mov rcx, qword [rdi + 0x68]
mov edx, reloc.WS2_32.dll_inet_addr
mov rax, qword [rcx]
call qword [rax + 0x30]
mov rcx, qword [rdi + 0x68]
xor r9d, r9d
mov r8d, esi
mov rax, qword [rcx]
lea edx, [r9 + 0xb]
call qword [rax + 0x28]
mov dword [rdi + 0x58], ebx
test ebx, ebx
jne 0x1400709b8
mov dword [rdi + 0x58], 0xffffffff
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
cmp edx, 0xb
jne 0x140070a19
mov rcx, qword [rcx + 0x60]
call fcn.140073b10
mov rcx, qword [rdi + 0x68]
mov r10, qword [rcx]
mov ebx, eax
mov eax, 0x1388
test ebx, ebx
cmove ebx, eax
xor r9d, r9d
lea edx, [r9 + 0xb]
mov r8d, ebx
call qword [r10 + 0x28]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea ecx, [rax + rbx]
mov dword [rdi + 0x58], ecx
test ecx, ecx
jne 0x1400709bd
mov dword [rdi + 0x58], 0xffffffff
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x1400709bd
mov rax, qword [rcx]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp qword [rax + 0x20]
Function at 0x1400727f0
Capabilities:
Enumerate pe sections

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x108
mov rax, qword [0x1402de400]
xor rax, rsp
mov qword [rsp + 0xf0], rax
mov rbx, r9
mov rdi, r8
mov rsi, rdx
mov rbp, rcx
test rdx, rdx
jne 0x140072833
call fcn.1401ebb20
mov dword [rax], reloc.WS2_32.dll_ntohl
or rax, 0xffffffffffffffff
jmp 0x1400728d5
lea rcx, [rsp + 0x70]
xor edx, edx
mov r8d, 0x80
call fcn.1401e42d0
test rbx, rbx
je 0x14007296f
mov edx, dword [rbx]
mov qword [rsp + 0x100], r12
xor r12d, r12d
test dl, 1
je 0x14007288c
movzx eax, word [rbx + 4]
mov cx, word [rbx + 6]
mov word [rsp + 0x70], ax
mov eax, dword [rbx + 8]
mov word [rsp + 0x74], cx
mov dword [rsp + 0x78], eax
mov eax, dword [rbx + 0xc]
mov dword [rsp + 0x7c], eax
mov eax, dword [rbx + 0x10]
mov dword [rsp + 0x8c], eax
jmp 0x14007289a
mov ecx, r12d
mov word [rsp + 0x70], r12w
mov word [rsp + 0x74], cx
test dl, 2
je 0x1400728b9
movzx eax, word [rbx + 0x14]
and ax, 0xf
or cx, ax
mov eax, dword [rbx + 0x18]
mov dword [rsp + 0x80], eax
mov word [rsp + 0x74], cx
test dl, 4
je 0x1400728f1
call fcn.1401ebb20
mov dword [rax], socket
or rax, 0xffffffffffffffff
mov r12, qword [rsp + 0x100]
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.1401e42a0
add rsp, 0x108
pop rdi
pop rsi
pop rbp
pop rbx
ret
lea rax, [rsp + 0x60]
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x60], rdi
mov dword [rsp + 0x48], 1
mov dword [rsp + 0x58], r12d
mov dword [rsp + 0x5c], 1
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x4c], r12d
mov qword [rsp + 0x50], rdi
call fcn.1401ebb20
lea r8, [rsp + 0x40]
xor r9d, r9d
mov rbx, rax
lea rax, [rsp + 0x70]
xor edx, edx
mov qword [rsp + 0x30], rax
mov rcx, rbp
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
call fcn.1400b7230
mov dword [rbx], eax
call fcn.1401ebb20
cmp dword [rax], r12d
jne 0x1400728c9
sub rdi, qword [rsp + 0x50]
mov rax, rdi
jmp 0x1400728cd
call fcn.1401ebb20
mov dword [rax], socket
or rax, 0xffffffffffffffff
jmp 0x1400728d5
Function at 0x140075af0
Capabilities:
Send data
Send data on socket

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0xe0
mov rax, qword [0x1402de400]
xor rax, rsp
mov qword [rsp + 0xd0], rax
cmp dword [rsp + 0x120], 0x17
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
jne 0x140075bdf
cmp word [r9], 2
jne 0x140075bdf
lea rcx, [rsp + 0x40]
mov rdx, r9
mov r8d, 0x88
call fcn.1401e3ed0
cmp word [rsp + 0x40], 2
lea rcx, [rsp + 0x40]
mov rax, qword [rcx]
lea r11, [rsp + 0x30]
mov qword [r11], rax
mov rax, qword [rcx + 8]
mov qword [r11 + 8], rax
jne 0x140075bbf
xor eax, eax
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x4c], eax
mov dword [rsp + 0x54], eax
mov dword [rsp + 0x44], eax
mov dword [rsp + 0x58], eax
mov eax, reloc.WS2_32.dll_socket
mov word [rsp + 0x40], ax
movzx eax, word [rsp + 0x32]
mov word [rsp + 0x42], ax
xor eax, eax
mov qword [rsp + 0x48], rax
mov word [rsp + 0x50], ax
or rax, 0xffffffffffffffff
mov word [rsp + 0x52], ax
mov eax, dword [rsp + 0x34]
mov dword [rsp + 0x54], eax
mov eax, 0x1c
mov dword [rsp + 0xc0], eax
jmp 0x140075bc6
mov eax, dword [rsp + 0xc0]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x40]
mov r8d, esi
mov rdx, rdi
mov rcx, rbx
mov qword [rsp + 0x20], rax
jmp 0x140075bef
mov eax, dword [r9 + 0x80]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r9
xor r9d, r9d
call sub.WS2_32.dll_sendto
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.1401e42a0
add rsp, 0xe0
pop rdi
pop rsi
pop rbx
ret