joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140009490
Capabilities:
Delete file

Disassembly:
sub rsp, 0x248
mov rax, qword [0x1400d1608]
xor rax, rsp
mov qword [rsp + 0x230], rax
lea r8, [rsp + 0x20]
mov r9d, 0x104
call fcn.1400090c0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
neg eax
dec eax
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.14006f1f0
add rsp, 0x248
ret

Function at 0x1400094f0
Capabilities:
Create directory

Disassembly:
sub rsp, 0x248
mov rax, qword [0x1400d1608]
xor rax, rsp
mov qword [rsp + 0x230], rax
lea r8, [rsp + 0x20]
mov r9d, 0x104
call fcn.1400090c0
lea rcx, [rsp + 0x20]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
neg eax
sbb eax, eax
neg eax
dec eax
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.14006f1f0
add rsp, 0x248
ret

Function at 0x140009550
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x240
mov rax, qword [0x1400d1608]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rdi, rdx
mov rsi, rcx
test rdx, rdx
jne 0x14000958c
mov ecx, 0xa0
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x140009654
mov ecx, 0x568
mov qword [rsp + 0x258], rbx
call fcn.140073404
mov rbx, rax
test rax, rax
jne 0x1400095b7
lea ecx, [rax + 8]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rbx
jmp 0x14000964c
lea r8, [rsp + 0x20]
mov r9d, 0x104
mov rdx, rdi
mov rcx, rsi
call fcn.1400090c0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x20]
mov r11d, eax
xor eax, eax
repne scasw ax, word [rdi]
not rcx
inc rcx
cmp rcx, 0x104
jae 0x140009642
cmp r11d, 0xffffffff
je 0x140009642
test r11b, 0x10
je 0x140009642
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x20]
lea rdx, [rbx + 8]
repne scasw ax, word [rdi]
mov eax, dword [0x1400a23f4]
lea rcx, [rsp + 0x20]
mov dword [rdi - 2], eax
movzx eax, word [0x1400a23f8]
mov word [rdi + 2], ax
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov byte [rbx + 0x258], 0
mov qword [rbx], rax
mov rax, rbx
jmp 0x14000964c
mov rcx, rbx
call fcn.1400733f0
xor eax, eax
mov rbx, qword [rsp + 0x258]
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.14006f1f0
mov rsi, qword [rsp + 0x260]
add rsp, 0x240
pop rdi
ret
Function at 0x140009730
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x470
mov rax, qword [0x1400d1608]
xor rax, rsp
mov qword [rsp + 0x460], rax
xor eax, eax
mov edi, edx
xor esi, esi
mov qword [rsp + 0x30], rax
mov eax, 0x10624dd3
mov rbp, rcx
mov r11d, esi
mov dword [rsp + 0x250], esi
imul r8d
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
mov dword [rsp + 0x30], edx
imul edx, edx, 0x3e8
sub r8d, edx
mov edx, esi
mov dword [rsp + 0x40], edx
imul r8d, r8d, 0x3e8
mov dword [rsp + 0x34], r8d
mov r8d, esi
test edi, edi
je 0x14000985c
mov r9, rcx
mov ebx, edi
nop word [rax + rax]
movzx eax, word [r9 + 8]
test al, 1
je 0x1400097f2
mov eax, esi
mov rcx, rsi
test edx, edx
je 0x1400097d5
mov r10, qword [r9]
cmp qword [rsp + rcx*8 + 0x48], r10
je 0x1400097d5
inc eax
inc rcx
cmp eax, edx
jb 0x1400097c5
cmp eax, edx
jne 0x140009840
cmp edx, 0x40
jae 0x140009840
mov rax, qword [r9]
mov qword [rsp + rcx*8 + 0x48], rax
mov edx, dword [rsp + 0x40]
inc edx
mov dword [rsp + 0x40], edx
jmp 0x140009840
test al, 4
je 0x140009840
mov eax, esi
mov rcx, rsi
test r8d, r8d
je 0x140009817
mov r10, qword [r9]
cmp qword [rsp + rcx*8 + 0x258], r10
je 0x140009817
inc eax
inc rcx
cmp eax, r8d
jb 0x140009803
cmp eax, r8d
jne 0x140009840
cmp r8d, 0x40
jae 0x140009840
mov rax, qword [r9]
mov qword [rsp + rcx*8 + 0x258], rax
mov r8d, dword [rsp + 0x250]
inc r8d
mov dword [rsp + 0x250], r8d
mov rax, qword [r9]
mov word [r9 + 0xa], si
cmp rax, r11
cmova r11, rax
add r9, 0x10
dec rbx
jne 0x1400097b0
lea rax, [rsp + 0x30]
lea ecx, [r11 + 1]
lea r8, [rsp + 0x250]
lea rdx, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_select]
mov esi, eax
test eax, eax
jle 0x1400098ca
test edi, edi
je 0x1400098ca
lea rbx, [rbp + 0xa]
nop
mov rcx, qword [rbx - 0xa]
lea rdx, [rsp + 0x40]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x1400098a6
or word [rbx], 1
mov rcx, qword [rbx - 0xa]
lea rdx, [rsp + 0x250]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x1400098bf
or word [rbx], 4
add rbx, 0x10
dec rdi
jne 0x140009890
mov eax, esi
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.14006f1f0
mov rbx, qword [rsp + 0x498]
add rsp, 0x470
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400099a0
Capabilities:
Get socket status

Disassembly:
push rbx
push rbp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x470
mov rax, qword [0x1400d1608]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov r15, r9
mov ebp, r8d
mov r13d, edx
xor r9d, r9d
mov r14, rcx
mov r12d, 0x7d0
mov qword [rsp + 0x4b8], rsi
mov eax, dword [r15]
test eax, eax
jne 0x140009b9b
test ebp, ebp
js 0x1400099f8
cmp ebp, r12d
cmovl r12d, ebp
xor eax, eax
mov r11, r9
mov r8d, r9d
mov qword [rsp + 0x30], rax
mov eax, 0x10624dd3
mov dword [rsp + 0x250], r9d
imul r12d
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, r12d
mov dword [rsp + 0x30], edx
imul edx, edx, 0x3e8
sub eax, edx
mov edx, r9d
mov dword [rsp + 0x40], edx
imul eax, eax, 0x3e8
mov dword [rsp + 0x34], eax
test r13d, r13d
je 0x140009b0c
mov r10, r14
mov rbx, r13
nop
movzx eax, word [r10 + 8]
test al, 1
je 0x140009a96
mov eax, r9d
mov rcx, r9
test edx, edx
je 0x140009a79
mov r9, qword [r10]
cmp qword [rsp + rcx*8 + 0x48], r9
je 0x140009a76
inc eax
inc rcx
cmp eax, edx
jb 0x140009a66
xor r9d, r9d
cmp eax, edx
jne 0x140009af0
cmp edx, 0x40
jae 0x140009af0
mov rax, qword [r10]
mov qword [rsp + rcx*8 + 0x48], rax
mov edx, dword [rsp + 0x40]
inc edx
mov dword [rsp + 0x40], edx
jmp 0x140009af0
test al, 4
je 0x140009af0
mov eax, r9d
mov rcx, r9
test r8d, r8d
je 0x140009ac7
mov r9, qword [r10]
nop dword [rax + rax]
cmp qword [rsp + rcx*8 + 0x258], r9
je 0x140009ac4
inc eax
inc rcx
cmp eax, r8d
jb 0x140009ab0
xor r9d, r9d
cmp eax, r8d
jne 0x140009af0
cmp r8d, 0x40
jae 0x140009af0
mov rax, qword [r10]
mov qword [rsp + rcx*8 + 0x258], rax
mov r8d, dword [rsp + 0x250]
inc r8d
mov dword [rsp + 0x250], r8d
mov rax, qword [r10]
mov word [r10 + 0xa], r9w
cmp rax, r11
cmova r11, rax
add r10, 0x10
dec rbx
jne 0x140009a50
lea rax, [rsp + 0x30]
lea ecx, [r11 + 1]
lea r8, [rsp + 0x250]
lea rdx, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_select]
mov esi, eax
test eax, eax
jle 0x140009b7a
test r13d, r13d
je 0x140009b7a
lea rbx, [r14 + 0xa]
mov rdi, r13
mov rcx, qword [rbx - 0xa]
lea rdx, [rsp + 0x40]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x140009b58
or word [rbx], 1
mov rcx, qword [rbx - 0xa]
lea rdx, [rsp + 0x250]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x140009b71
or word [rbx], 4
add rbx, 0x10
dec rdi
jne 0x140009b42
test esi, esi
jne 0x140009b97
test ebp, ebp
jle 0x140009b87
sub ebp, r12d
test ebp, ebp
mov r9d, 0
jne 0x1400099e2
xor eax, eax
jmp 0x140009ba0
mov eax, esi
jmp 0x140009ba0
mov eax, 0xfffffffe
mov rsi, qword [rsp + 0x4b8]
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.14006f1f0
add rsp, 0x470
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rbp
pop rbx
ret
Function at 0x140009ee0
Capabilities:
Read file on windows
Receive data
Receive data on socket

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x58
mov rax, qword [0x1400d1608]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor edi, edi
mov ebp, r9d
mov rbx, r8
mov rsi, rdx
test rcx, rcx
je 0x140009f42
call fcn.1400812ec
mov r8d, ebp
mov rdx, rbx
mov ecx, eax
call fcn.140080d78
mov ebx, eax
test eax, eax
jns 0x140009f28
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test ebx, ebx
jne 0x14000a0df
test ebp, ebp
jle 0x14000a0df
mov eax, 0xfffffffe
jmp 0x14000a101
mov rcx, qword [rdx + 0x8e0]
test rcx, rcx
je 0x140009fbc
call qword [0x1400d10e8]
test eax, eax
jle 0x140009fbc
mov rcx, qword [rsi + 0x8e0]
cmp eax, ebp
mov rdx, rbx
cmovg eax, ebp
mov r8d, eax
call qword [0x1400d0ff8]
mov ebx, eax
test eax, eax
jg 0x14000a0df
mov rcx, qword [rsi + 0x8e0]
mov edx, eax
call qword [0x1400d1018]
mov edi, eax
cmp eax, 5
jne 0x140009fa2
cmp ebx, 0xffffffff
jne 0x140009fb4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x14000a0df
cmp eax, 2
je 0x14000a0dd
cmp eax, 3
je 0x14000a0dd
or eax, 0xffffffff
jmp 0x14000a101
movsd xmm0, qword [rsp + 0xa0]
mov r9, qword [rsi + 0x8c8]
mov rax, qword [rsi + 0x8f0]
add r9, 0x28
mov edx, 1
mulsd xmm0, qword [0x140097a20]
cvttsd2si r8d, xmm0
cmp qword [rsi + 0x8e0], rdi
je 0x14000a07e
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
mov word [rsp + 0x28], dx
call fcn.1400099a0
mov rcx, qword [rsi + 0x8c8]
mov edx, dword [rcx + 0x28]
test edx, edx
jne 0x140009f38
test eax, eax
jle 0x14000a0d7
mov rcx, qword [rsi + 0x8e0]
mov r8d, ebp
mov rdx, rbx
call qword [0x1400d0ff8]
mov ebx, eax
test eax, eax
jg 0x14000a0df
mov rcx, qword [rsi + 0x8e0]
mov edx, eax
call qword [0x1400d1018]
mov edi, eax
cmp eax, 5
jne 0x14000a06a
cmp ebx, 0xffffffff
jne 0x140009f38
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x14000a0df
cmp eax, 2
je 0x14000a0dd
cmp eax, 3
je 0x14000a0dd
mov eax, 0xfffffffe
jmp 0x14000a101
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], rax
mov word [rsp + 0x38], dx
call fcn.1400099a0
mov rcx, qword [rsi + 0x8c8]
mov edx, dword [rcx + 0x28]
test edx, edx
jne 0x140009f38
test eax, eax
jle 0x14000a0d7
mov rcx, qword [rsi + 0x8f0]
xor r9d, r9d
mov r8d, ebp
mov rdx, rbx
call qword [sym.imp.WS2_32.dll_recv]
mov ebx, eax
test eax, eax
jns 0x14000a0cc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test ebx, ebx
jg 0x14000a0df
mov eax, 0xfffffffe
jmp 0x14000a101
js 0x140009f38
xor ebx, ebx
mov rax, qword [rsi + 0x8c8]
mov ecx, dword [rax + 0x28]
test ecx, ecx
jne 0x140009f38
test ebx, ebx
jg 0x14000a0ff
jne 0x14000a117
test ebp, ebp
jne 0x140009fb4
mov eax, ebx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14006f1f0
add rsp, 0x58
pop rdi
pop rsi
pop rbp
pop rbx
ret
jns 0x140009fb4
cmp edi, 0x2733
je 0x140009f38
cmp edi, 0x274c
jne 0x140009f38
xor eax, eax
jmp 0x14000a101
Function at 0x14000b260
Capabilities:
Hash data with md5

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rcx
mov qword [r11 + 0x10], rdx
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x20], r9
push rbx
push rdi
sub rsp, 0xa8
mov rax, qword [0x1400d1608]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rdx, qword [r11 + 0x10]
xor eax, eax
lea rbx, [r11 + 0x10]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 0x67452301
mov dword [rsp + 0x2c], 0xefcdab89
mov dword [rsp + 0x30], 0x98badcfe
mov dword [rsp + 0x34], 0x10325476
test rdx, rdx
je 0x14000b2eb
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rsp + 0x20]
call fcn.140008270
mov rdx, qword [rbx + 8]
add rbx, 8
test rdx, rdx
jne 0x14000b2c2
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x20]
call fcn.140008370
mov rdx, qword [rsp + 0xc0]
mov r9, qword [str.0123456789abcdef]
mov edi, reloc.WS2_32.dll_recv
lea r8, [rsp + 0x80]
nop dword [rax]
movzx ecx, byte [r8]
add rdx, 2
inc r8
mov eax, ecx
and ecx, 0xf
shr rax, 4
dec rdi
movzx eax, byte [rax + r9]
mov byte [rdx - 2], al
movzx eax, byte [rcx + r9]
mov byte [rdx - 1], al
jne 0x14000b320
mov byte [rdx], dil
mov rax, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.14006f1f0
add rsp, 0xa8
pop rdi
pop rbx
ret

Function at 0x14000b8d0
Capabilities:
Resolve dns

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x60
mov rax, rdx
xor edx, edx
mov rsi, r9
mov rbp, r8
mov qword [r11 - 0x40], rdx
mov qword [r11 - 0x38], rdx
mov qword [r11 - 0x30], rdx
mov qword [r11 - 0x28], rdx
mov qword [r11 - 0x20], rdx
mov qword [r11 - 0x18], rdx
mov dword [rsp + 0x2c], ecx
lea r9, [r11 - 0x48]
lea r8, [r11 - 0x40]
mov rcx, rax
xor edi, edi
call qword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
je 0x14000b932
xor eax, eax
lea r11, [rsp + 0x60]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
mov qword [rsp + 0x70], rbx
mov rbx, qword [rsp + 0x20]
mov qword [rsp + 0x78], r12
mov r12, rbx
test rbx, rbx
je 0x14000b978
nop dword [rax]
mov r8, qword [rbx + 0x10]
cmp rsi, r8
jb 0x14000b96a
mov rdx, qword [rbx + 0x20]
mov rcx, rbp
call fcn.14006ffd0
mov edi, 1
mov rbx, qword [rbx + 0x28]
mov qword [rsp + 0x20], rbx
test rbx, rbx
jne 0x14000b950
mov rcx, r12
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
mov r12, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
lea r11, [rsp + 0x60]
mov eax, edi
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14000bce0
Capabilities:
Create directory

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x580
mov rax, qword [0x1400d1608]
xor rax, rsp
mov qword [rsp + 0x570], rax
xor r13d, r13d
mov r12, rcx
mov rbp, rdx
lea rcx, [rdx + 2]
lea edi, [r13 + 1]
mov qword [rsp + 0x20], r13
lea edx, [rdi + 0x2e]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x40], r13
call fcn.14006fd18
mov rsi, rax
test rax, rax
je 0x14000be14
mov qword [rsp + 0x5c0], rbx
nop word [rax + rax]
mov rbx, rsi
sub rbx, rbp
cmp rbx, 0x30c
jae 0x14000be0f
lea rcx, [rsp + 0x50]
mov r8, rbx
mov rdx, rbp
call fcn.14006ffd0
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x50]
mov rcx, r12
mov byte [rsp + rbx + 0x50], r13b
call fcn.140009340
test eax, eax
jne 0x14000bdbd
lea r8, [rsp + 0x360]
lea rdx, [rsp + 0x50]
mov r9d, 0x104
mov rcx, r12
call fcn.1400090c0
lea rcx, [rsp + 0x360]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x14000be08
cmp byte [rsi + 1], r13b
lea rcx, [rsi + 1]
mov edx, 0x2f
cmove edi, r13d
call fcn.14006fd18
mov rsi, rax
test rax, rax
jne 0x14000bd50
mov eax, edi
mov rbx, qword [rsp + 0x5c0]
mov rcx, qword [rsp + 0x570]
xor rcx, rsp
call fcn.14006f1f0
add rsp, 0x580
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov eax, 0xfffffffe
jmp 0x14000bde1
or eax, 0xffffffff
jmp 0x14000bde1
mov eax, edi
jmp 0x14000bde9
Function at 0x14000c890
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rbx, qword [rcx]
mov rdi, rcx
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14000c8b8
cmp eax, 0x102
je 0x14000c8be
jmp 0x14000c901
cmp rbx, 0xffffffffffffffff
je 0x14000c901
mov rbx, qword [rdi]
mov edx, reloc.WS2_32.dll_shutdown
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
mov rbx, qword [rdi]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14000c8fb
cmp eax, 0x102
je 0x14000c8e0
jmp 0x14000c901
cmp rbx, 0xffffffffffffffff
jne 0x14000c8e0
or eax, 0xffffffff
lock xadd dword [rdi + 8], eax
dec eax
jne 0x14000c915
mov rcx, rdi
call fcn.1400733f0
xor eax, eax
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14000cce0
Capabilities:
Resolve dns

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x460
mov rax, qword [0x1400d1608]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov r13, rcx
lea r8, str.Host
add rcx, 0x90
mov edx, dword [r13 + 0x88]
call fcn.1400088c0
mov rdi, rax
test rax, rax
je 0x14000ce7b
cmp byte [rax], 0
mov ecx, 0x401
lea rdx, [rsp + 0x40]
je 0x14000cd69
lea rax, [rsp + 0x40]
sub rdi, rax
nop dword [rax]
cmp rcx, 1
jbe 0x14000cd69
movzx eax, byte [rdi + rdx]
inc rdx
dec rcx
mov byte [rdx - 1], al
cmp byte [rdi + rdx], 0
jne 0x14000cd50
mov byte [rdx], 0
movsx ecx, byte [rsp + 0x40]
lea rbx, [rsp + 0x40]
mov byte [rsp + 0x440], 0
call fcn.140074650
test eax, eax
je 0x14000cda0
nop word [rax + rax]
movsx ecx, byte [rbx + 1]
inc rbx
call fcn.140074650
test eax, eax
jne 0x14000cd90
cmp byte [rbx], 0x5b
mov rcx, rbx
jne 0x14000cdbd
mov edx, 0x5d
call fcn.14006fd18
test rax, rax
je 0x14000ce16
mov byte [rax + 1], 0
jmp 0x14000cdcf
mov edx, 0x3a
call fcn.14006fd18
test rax, rax
je 0x14000cdcf
mov byte [rax], 0
cmp qword [r13 + 0x8e0], 0
je 0x14000ce1d
mov rcx, qword [r13 + 0x8d0]
mov rdx, qword [rcx + 0xa8]
test rdx, rdx
je 0x14000cec1
mov rax, qword [r13 + 0x8c8]
add rax, 0xf0
cmp rcx, rax
je 0x14000cec1
mov rcx, rbx
call fcn.1400085f0
test eax, eax
je 0x14000cec1
xor eax, eax
jmp 0x14000cf0f
mov rbp, qword [r13 + 0x8c8]
add rbp, 0xf0
je 0x14000cec1
mov r12, qword [rbp + 0xa8]
mov rsi, rbx
nop dword [rax + rax]
movzx ecx, byte [r12]
call fcn.14007f264
movzx ecx, byte [rsi]
mov edi, eax
call fcn.14007f264
inc r12
inc rsi
cmp eax, edi
jne 0x14000ce6d
cmp byte [rsi - 1], 0
jne 0x14000ce40
mov qword [r13 + 0x8d0], rbp
jmp 0x14000cec1
mov rbp, qword [rbp + 0x1a0]
test rbp, rbp
jne 0x14000ce31
jmp 0x14000cec1
lea rax, [r13 + 0x8f8]
mov byte [rsp + 0x40], 0
test rax, rax
je 0x14000cebc
cmp word [rax], 2
jne 0x14000cebc
xor ecx, ecx
mov dword [rsp + 0x30], 2
lea r8, [rsp + 0x40]
mov dword [rsp + 0x28], ecx
lea edx, [rcx + 0x10]
mov qword [rsp + 0x20], rcx
mov r9d, 0x401
mov rcx, rax
call qword [sym.imp.WS2_32.dll_getnameinfo]
lea rbx, [rsp + 0x40]
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
mov rdi, rcx
call fcn.140073404
mov r11, rax
test rax, rax
je 0x14000cf0c
cmp byte [rbx], 0
mov rcx, rax
je 0x14000cf09
sub rbx, rax
nop word [rax + rax]
cmp rdi, 1
jbe 0x14000cf09
movzx eax, byte [rbx + rcx]
inc rcx
dec rdi
mov byte [rcx - 1], al
cmp byte [rbx + rcx], 0
jne 0x14000cef0
mov byte [rcx], 0
mov rax, r11
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.14006f1f0
lea r11, [rsp + 0x460]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x14000e1f0
Capabilities:
Resolve dns

Disassembly:
push rdi
mov eax, 0x22d0
call fcn.14006f190
sub rsp, rax
mov rax, qword [0x1400d1608]
xor rax, rsp
mov qword [rsp + 0x22b0], rax
mov rdi, rcx
mov r9, r8
mov r8, rdx
lea rcx, [rsp + 0x2b0]
mov edx, 0x2000
call fcn.140045350
mov byte [rsp + 0x22af], 0
test rdi, rdi
jne 0x14000e24b
lea rcx, [rsp + 0x2b0]
call fcn.140081754
jmp 0x14000e41a
mov rax, qword [rdi + 0x8c8]
mov r8, qword [rax + 0x90]
test r8, r8
je 0x14000e274
lea rdx, [rsp + 0x2b0]
mov rcx, rdi
call r8
test eax, eax
jne 0x14000e41a
mov rax, qword [rdi + 0x8d0]
cmp qword [rax + 0x50], 0
je 0x14000e41a
mov qword [rsp + 0x22f8], rbx
mov qword [rsp + 0x22c8], rbp
mov rbp, qword [rax + 0x50]
lea r8, [rsp + 0x40]
mov rcx, rdi
mov rdx, rbp
mov qword [rsp + 0x22c0], rsi
mov qword [rsp + 0x60], 0
call fcn.140009340
lea r8, [rsp + 0xa0]
mov r9d, 0x104
mov rdx, rbp
mov rcx, rdi
mov ebx, eax
call fcn.1400090c0
lea rdx, [0x1400a2774]
lea rcx, [rsp + 0xa0]
call fcn.14007e750
mov rsi, rax
mov qword [rsp + 0x60], rax
test ebx, ebx
jne 0x14000e30b
lea r8, [rsp + 0x40]
mov rdx, rbp
mov rcx, rdi
call fcn.140009340
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x22c8]
xor eax, eax
test rsi, rsi
setne al
test eax, eax
je 0x14000e40a
test rsi, rsi
je 0x14000e40a
lea rcx, [0x140234110]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor ecx, ecx
call fcn.1400754a0
lea rcx, [rdi + 0x908]
mov byte [rsp + 0x68], 0
mov rbx, rax
test rcx, rcx
je 0x14000e388
cmp word [rcx], 2
jne 0x14000e388
mov r9d, gethostbyname
mov dword [rsp + 0x30], 2
lea r8, [rsp + 0x68]
lea edx, [r9 - 0x22]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.WS2_32.dll_getnameinfo]
lea r9, [rsp + 0x68]
lea rdx, str.__010lu___error___client__s_
mov r8d, ebx
mov rcx, rsi
call fcn.14006abe0
mov r8, qword [rdi + 8]
test r8, r8
je 0x14000e3c9
mov rax, qword [rdi + 0x10]
lea r9, [0x1400a03bb]
lea rdx, str._s__s:
test rax, rax
mov rcx, rsi
cmovne r9, rax
call fcn.14006abe0
lea r8, [rsp + 0x2b0]
lea rdx, [0x1400a24e0]
mov rcx, rsi
call fcn.14006abe0
mov rdx, rsi
mov ecx, 0xa
call fcn.140081568
mov rcx, rsi
call fcn.14007eb30
lea rcx, [0x140234110]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, rsi
call fcn.14007e7e0
mov rbx, qword [rsp + 0x22f8]
mov rsi, qword [rsp + 0x22c0]
mov rcx, qword [rsp + 0x22b0]
xor rcx, rsp
call fcn.14006f1f0
add rsp, 0x22d0
pop rdi
ret
Function at 0x14000f690
Capabilities:
Read file on windows

Disassembly:
test rdx, rdx
je 0x14000f7d1
push rbx
push rbp
push rsi
push rdi
mov eax, 0x2038
call fcn.14006f190
sub rsp, rax
mov rax, qword [0x1400d1608]
xor rax, rsp
mov qword [rsp + 0x2020], rax
mov rbx, r9
mov rdi, r8
mov rbp, rdx
mov rsi, rcx
test rcx, rcx
je 0x14000f7b6
mov rax, qword [rdx]
movabs rcx, 0x7fffffffffffffff
cmp rax, rcx
cmova rax, rcx
test r8, r8
jns 0x14000f6ee
xor edi, edi
jmp 0x14000f6f5
cmp r8, rax
cmovg rdi, rax
test rbx, rbx
jle 0x14000f7b6
mov rcx, qword [rdx + 0x20]
test rcx, rcx
je 0x14000f7b6
test rdi, rdi
jle 0x14000f770
call fcn.1400812ec
xor r8d, r8d
mov rdx, rdi
mov ecx, eax
call fcn.140081d14
cmp rax, 0xffffffffffffffff
jne 0x14000f770
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140073314
lea r8, str.send_file_data
lea rdx, str._s:_fseeko___failed:__s
mov r9, rax
mov rcx, rsi
call fcn.14000e440
lea r9, str.Error:_Unable_to_access_file_at_requested_position.
lea r8, [0x1400a24e0]
mov edx, 0x1f4
mov rcx, rsi
call fcn.140016890
jmp 0x14000f7b6
mov r9, qword [rbp + 0x20]
mov eax, 0x2000
lea rcx, [rsp + 0x20]
cmp rbx, rax
mov edx, 1
cmovl eax, ebx
movsxd r8, eax
call fcn.140081ac0
mov rdi, rax
test eax, eax
jle 0x14000f7b6
lea rdx, [rsp + 0x20]
movsxd r8, eax
mov rcx, rsi
call fcn.14000a640
cmp eax, edi
jne 0x14000f7b6
cdqe
sub rbx, rax
test rbx, rbx
jg 0x14000f770
mov rcx, qword [rsp + 0x2020]
xor rcx, rsp
call fcn.14006f1f0
add rsp, 0x2038
pop rdi
pop rsi
pop rbp
pop rbx
repz ret
Function at 0x140010ef0
Capabilities:
Set socket configuration

Disassembly:
test rcx, rcx
je 0x1400110f1
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x2060
call fcn.14006f190
sub rsp, rax
mov rax, qword [0x1400d1608]
xor rax, rsp
mov qword [rsp + 0x2040], rax
xor esi, esi
mov rbx, rcx
mov rcx, qword [rcx + 0x8f0]
lea r8, [rsp + 0x38]
mov edx, 0x8004667e
mov qword [rsp + 0x2078], rbp
movaps xmmword [rsp + 0x2050], xmm6
mov dword [rsp + 0x34], esi
lea edi, [rsi - 2]
mov dword [rsp + 0x3c], 4
mov dword [rsp + 0x38], esi
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov rcx, qword [rbx + 0x8f0]
mov ebp, 1
mov edx, ebp
call qword [sym.imp.WS2_32.dll_shutdown]
movsd xmm6, qword [0x140097a00]
nop
lea r8, [rsp + 0x40]
mov r9d, 0x2000
mov rdx, rbx
xor ecx, ecx
movsd qword [rsp + 0x20], xmm6
call fcn.140009ee0
test eax, eax
jg 0x140010f80
mov rcx, qword [rbx + 0x8d0]
movaps xmm6, xmmword [rsp + 0x2050]
cmp qword [rcx + 0x30], rsi
je 0x140010fe6
mov rcx, qword [rcx + 0x30]
call fcn.140074200
mov edi, eax
test eax, eax
js 0x140010fe6
lea ecx, [rax + 0x3e7]
mov eax, 0x10624dd3
mov word [rsp + 0x30], bp
imul ecx
sar edx, 6
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
mov word [rsp + 0x32], dx
jmp 0x140010fea
mov dword [rsp + 0x30], esi
mov rbp, qword [rsp + 0x2078]
cmp edi, 0xffffffff
jl 0x1400110b5
mov rcx, qword [rbx + 0x8f0]
lea rax, [rsp + 0x3c]
lea r9, [rsp + 0x34]
mov edx, 0xffff
mov r8d, 0x1007
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
je 0x14001104e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140073314
lea r8, str.close_socket_gracefully
lea rdx, str._s:_getsockopt_SOL_SOCKET_SO_ERROR__failed:__s
mov r9, rax
mov rcx, rbx
call fcn.14000e440
jmp 0x1400110b5
cmp dword [rsp + 0x34], 0x6c
je 0x1400110b5
mov rcx, qword [rbx + 0x8f0]
lea r9, [rsp + 0x30]
mov edx, 0xffff
mov r8d, 0x80
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x1400110b5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140073314
movzx ecx, word [rsp + 0x32]
movzx r9d, word [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ecx
lea r8, str.close_socket_gracefully
lea rdx, str._s:_setsockopt_SOL_SOCKET_SO_LINGER__i__i___failed:__s
mov rcx, rbx
call fcn.14000e440
mov rcx, qword [rbx + 0x8f0]
call qword [sym.imp.WS2_32.dll_closesocket]
mov qword [rbx + 0x8f0], 0xffffffffffffffff
mov rcx, qword [rsp + 0x2040]
xor rcx, rsp
call fcn.14006f1f0
lea r11, [rsp + 0x2060]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
repz ret