joyce8/EMBER2024-capa huggingface dataset:
Function at 0x486960
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x486a2a
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call sym.internal_bytealg.IndexByteString.abi0
xorps xmm15, xmm15
mov r14, qword [0x0061c970]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x486a0f
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x004bb7a0]
xor ebx, ebx
mov rcx, rdx
call sym.runtime.makeslice
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call sym.syscall.encodeWTF16
inc rbx
cmp rcx, rbx
jae 0x4869fe
mov edi, 1
lea rsi, [0x004bb7a0]
call sym.runtime.growslice
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x004fef08]
lea rsi, [0x004fe780]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.syscall.UTF16FromString

Function at 0x4a6660
Capabilities:
Hash data using fnv

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a6d9f
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
movabs rcx, 0xcbf29ce484222325
jmp 0x4a668d
lea rax, [rdx + 0x10]
dec rbx
mov rcx, rsi
test rbx, rbx
jle 0x4a6911
mov rdx, rax
mov rsi, qword [rax]
nop dword [rax]
test rsi, rsi
je 0x4a693d
mov edi, dword [rsi + 0x10]
shr edi, 1
mov r8, qword [rax + 8]
and edi, 0x3f
lea rax, [0x005006e0]
jmp qword [rax + rdi*8]
mov rax, rcx
add rsp, 0x10
pop rbp
ret
lea rax, [0x004bb6a0]
lea rbx, [0x004fee18]
call sym.runtime.gopanic
inc rax
cmp rax, r8
jge 0x4a6962
mov r9, qword [rsi + rax*8]
xor r10d, r10d
nop
jmp 0x4a6997
lea rdi, [0x004bb720]
mov rsi, rcx
movabs rcx, 0x100000001b3
jmp 0x4a6683
movzx r11d, r9b
xor rcx, r11
inc r10
shr r9, 8
movabs r11, 0x100000001b3
imul rcx, r11
cmp r10, 8
jl 0x4a697b
jmp 0x4a6950
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp sym.internal_bisect.Hash

Function at 0x4a6f40
Capabilities:
Hash data using fnv

Disassembly:
test byte [rax], al
mov rcx, rbx
and ebx, 0x7f
shl rbx, 5
lea rdx, [rax + rbx]
xor eax, eax
jmp 0x4a6f57
inc rax
cmp rax, 4
jge 0x4a6f6f
lea rbx, [rdx + rax*8]
mov rbx, qword [rbx]
cmp rbx, rcx
jne 0x4a6f54
mov eax, 1
ret
xor eax, eax
movabs rbx, 0xcbf29ce484222325
jmp 0x4a6f80
inc rax
cmp rax, 4
jge 0x4a6f8e
mov rsi, qword [rdx + rax*8]
xor edi, edi
jmp 0x4a6fb7
and ebx, 3
lea rdx, [rdx + rbx*8]
xchg qword [rdx], rcx
xor eax, eax
ret
movzx r8d, sil
xor rbx, r8
inc rdi
shr rsi, 8
movabs r8, 0x100000001b3
imul rbx, r8
cmp rdi, 8
jl 0x4a6f9b
jmp 0x4a6f7d
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x0048e4e0]
xor edx, edx
mov dword [rax], 1
mov rax, qword [0x0048e4f0]
mov dword [rax], 1
mov rax, qword [0x0048e500]
mov dword [rax], 1
mov rax, qword [0x0048e4d0]
mov dword [rax], 1
mov rax, qword [0x0048e260]
cmp word [rax], 0x5a4d
je 0x4010d0
mov rax, qword [0x0048e4c0]
mov dword [0x0049f008], edx
mov eax, dword [rax]
test eax, eax
je 0x4010c2
mov ecx, 2
call sym.__set_app_type
mov rcx, 0xffffffffffffffff
call sym._encode_pointer
mov rdx, qword [0x0048e310]
mov qword [rdx], rax
mov rdx, qword [0x0048e300]
mov qword [rdx], rax
mov rax, qword [0x0048e3b0]
mov edx, dword [rax]
mov rax, qword [sym.imp.msvcrt.dll__fmode]
mov rax, qword [rax]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x0048e1f0]
cmp dword [rax], 1
je 0x401120
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x401075
movsxd rcx, dword [rax + 0x3c]
add rax, rcx
cmp dword [rax], 0x4550
jne 0x401058
movzx ecx, word [rax + 0x18]
cmp cx, 0x10b
je 0x401133
cmp cx, 0x20b
jne 0x401058
cmp dword [rax + 0x84], 0xe
jbe 0x401058
mov ecx, dword [rax + 0xf8]
xor edx, edx
test ecx, ecx
setne dl
jmp 0x401058
lea rcx, [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x401058
mov r8d, dword [rax + 0xe8]
xor edx, edx
test r8d, r8d
setne dl
jmp 0x401058

Function at 0x401ba8
Capabilities:
Send data
Send data on socket

Disassembly:
sub rsp, 0x28
mov ecx, 0x3000001
call sym.ev_default_loop
lea rdx, [0x0049f040]
mov rcx, rax
add rsp, 0x28
jmp sym.ev_async_send

Function at 0x408ceb
Capabilities:
Resolve dns

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x60
mov rbx, qword [rcx + 0x60]
mov rbp, rcx
cmp qword [rbx + 0x60], 0
jne 0x408dfa
mov rcx, rbx
lea rdi, [rsp + 0x30]
call sym.get_curr_server
mov ecx, 0xc
mov rsi, rax
xor eax, eax
rep stosd dword [rdi], eax
mov dword [rsp + 0x30], 2
lea rdi, [rsp + 0x30]
cmp dword [rsi + 8], 0
jne 0x408d45
mov dword [rsp + 0x38], 2
mov dword [rsp + 0x3c], 0x11
jmp 0x408d55
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x3c], 6
mov rax, qword [0x0048e400]
cmp dword [rax], 1
jle 0x408d7c
mov r9, qword [rsi]
lea r8, str.resolving__s_n
lea rcx, str._mettle_mettle_src_network_client.c
mov edx, 0x1d3
call sym.zlog_time
mov dword [rbx + 0x7c], 1
lea r9, [rbx + 0x58]
mov rcx, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x18]
mov r8, rdi
mov rsi, qword [sym.imp.WS2_32.dll_getaddrinfo]
call rsi
cdqe
mov qword [rbp + 0x10], rax
mov rcx, qword [rbx + 0x70]
test rcx, rcx
jne 0x408db1
cmp word [rbx + 0x78], 0
je 0x408dfa
cmp qword [rbx + 0x68], 0
jne 0x408dfa
movzx r9d, word [rbx + 0x78]
lea rbp, [rbx + 0x68]
test r9w, r9w
je 0x408def
lea r12, [rsp + 0x2a]
lea r8, [0x0047bcba]
mov edx, 6
mov rcx, r12
call sym.snprintf_1
mov rcx, qword [rbx + 0x70]
mov r9, rbp
mov r8, rdi
mov rdx, r12
jmp 0x408df7
mov r9, rbp
mov r8, rdi
xor edx, edx
call rsi
nop
add rsp, 0x60
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x408e82
Capabilities:
Send data
Send data on socket

Disassembly:
mov rcx, qword [rcx + 0x50]
test rcx, rcx
je 0x408e90
jmp sym.bufferev_write
xor eax, eax
ret
Function at 0x40ac44
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push r12
push rbp
mov eax, 0x1020
push rdi
push rsi
push rbx
call fcn.0046ba70
sub rsp, rax
mov rbx, qword [rcx + 0x60]
mov edx, 0x104b1
mov rcx, qword [rbx + 0x10]
call sym.tlv_packet_get_str
mov rcx, qword [rbx + 0x10]
mov rsi, rax
mov edx, 0x104b2
call sym.tlv_packet_get_str
test rsi, rsi
mov rdi, rax
je 0x40ad07
test rax, rax
je 0x40ad07
lea rdx, [0x0047bdd3]
mov rcx, rsi
call sym.posix_fopen
test rax, rax
mov rsi, rax
je 0x40ad07
lea rdx, [0x0047bdd6]
mov rcx, rdi
lea r12, [rsp + 0x20]
call sym.posix_fopen
test rax, rax
mov rdi, rax
mov rcx, rsi
je 0x40ad02
mov r9, rsi
mov r8d, 0x1000
mov edx, 1
mov rcx, r12
call sym.fread
test rax, rax
mov rbp, rax
je 0x40ad0e
mov r9, rdi
mov r8, rbp
mov edx, 1
mov rcx, r12
call sym.fwrite
cmp rbp, rax
je 0x40acc1
mov rcx, rsi
call sym.fclose
mov rcx, rdi
call sym.fclose
mov edx, 0x16
jmp 0x40ad20
mov rcx, rsi
call sym.fclose
mov rcx, rdi
call sym.fclose
xor edx, edx
mov rcx, rbx
call sym.tlv_packet_response_result
mov rcx, qword [rbx + 0x18]
mov rdx, rax
call sym.tlv_dispatcher_enqueue_response
mov rcx, rbx
call sym.tlv_handler_ctx_free
nop
add rsp, 0x1020
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x40ad4b
Capabilities:
Read file on windows

Disassembly:
push rbp
push rdi
mov eax, 0x2038
push rsi
push rbx
call fcn.0046ba70
sub rsp, rax
mov rbx, qword [rcx + 0x60]
mov edx, 0x104b2
mov esi, 0x16
mov rcx, qword [rbx + 0x10]
call sym.tlv_packet_get_str
test rax, rax
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
je 0x40ae02
lea rdx, [0x0047bdd3]
mov rcx, rax
call sym.posix_fopen
test rax, rax
mov rsi, rax
jne 0x40adab
call qword [sym.imp.msvcrt.dll__errno]
mov esi, dword [rax]
jmp 0x40ae02
lea rdi, [rsp + 0x30]
lea rbp, [rsp + 0x90]
mov rcx, rdi
call sym.MD5Init
mov r8d, 0x1fa0
mov r9, rsi
mov edx, 1
mov rcx, rbp
call sym.fread
test rax, rax
mov r8, rax
je 0x40adeb
mov rdx, rbp
mov rcx, rdi
call sym.MD5Update
jmp 0x40adc0
lea rcx, [rsp + 0x20]
mov rdx, rdi
call sym.MD5Final
mov rcx, rsi
xor esi, esi
call sym.fclose
mov edx, esi
mov rcx, rbx
call sym.tlv_packet_response_result
test esi, esi
jne 0x40ae28
lea r8, [rsp + 0x20]
mov r9d, 0x10
mov edx, 0x404b6
mov rcx, rax
call sym.tlv_packet_add_raw
mov rcx, qword [rbx + 0x18]
mov rdx, rax
call sym.tlv_dispatcher_enqueue_response
mov rcx, rbx
call sym.tlv_handler_ctx_free
nop
add rsp, 0x2038
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x40ae49
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
mov eax, 0x2040
push rdi
push rsi
push rbx
call fcn.0046ba70
sub rsp, rax
mov rbx, qword [rcx + 0x60]
mov edx, 0x104b2
mov esi, 0x16
lea rdi, [rsp + 0x2c]
lea rbp, [rsp + 0x2c]
mov rcx, qword [rbx + 0x10]
call sym.tlv_packet_get_str
mov r8, rax
mov ecx, 5
xor eax, eax
test r8, r8
rep stosd dword [rdi], eax
je 0x40af04
lea rdx, [0x0047bdd3]
mov rcx, r8
call sym.posix_fopen
test rax, rax
mov rsi, rax
jne 0x40aeaf
call qword [sym.imp.msvcrt.dll__errno]
mov esi, dword [rax]
jmp 0x40af04
lea rdi, [rsp + 0x40]
lea r12, [rsp + 0xa0]
mov rcx, rdi
call sym.SHA1Init
mov r8d, 0x1fa0
mov r9, rsi
mov edx, 1
mov rcx, r12
call sym.fread
test rax, rax
mov r8, rax
je 0x40aeef
mov rdx, r12
mov rcx, rdi
call sym.SHA1Update
jmp 0x40aec4
mov rdx, rdi
mov rcx, rbp
call sym.SHA1Final
mov rcx, rsi
xor esi, esi
call sym.fclose
mov edx, esi
mov rcx, rbx
call sym.tlv_packet_response_result
test esi, esi
jne 0x40af28
mov r9d, 0x14
mov r8, rbp
mov edx, 0x404b6
mov rcx, rax
call sym.tlv_packet_add_raw
mov rcx, qword [rbx + 0x18]
mov rdx, rax
call sym.tlv_dispatcher_enqueue_response
mov rcx, rbx
call sym.tlv_handler_ctx_free
nop
add rsp, 0x2040
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x40afad
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
mov qword [rsp + 0x28], r8
call sym.channel_get_ctx
mov r8, qword [rsp + 0x28]
mov r9, rax
mov edx, 1
mov rcx, rbx
add rsp, 0x30
pop rbx
jmp sym.fread

Function at 0x40afd9
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
mov qword [rsp + 0x28], r8
call sym.channel_get_ctx
mov r8, qword [rsp + 0x28]
mov r9, rax
mov edx, 1
mov rcx, rbx
add rsp, 0x30
pop rbx
jmp sym.fwrite

Function at 0x40b3ee
Capabilities:
Resolve dns

Disassembly:
push rdi
sub rsp, 0x60
xor eax, eax
xor edx, edx
lea rdi, [rsp + 0x30]
mov r10, rcx
mov ecx, 0xc
mov qword [rsp + 0x28], 0
lea r9, [rsp + 0x28]
lea r8, [rsp + 0x30]
rep stosd dword [rdi], eax
mov dword [rsp + 0x30], 4
mov rcx, r10
xor edi, edi
call qword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
jne 0x40b443
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + 4], 0x17
sete dil
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
mov al, dil
add rsp, 0x60
pop rdi
ret

Function at 0x40bd75
Capabilities:
Query environment variable

Disassembly:
push rbx
sub rsp, 0x20
xor edx, edx
call sym.tlv_packet_response_result
lea rcx, str.http_proxy
mov rbx, rax
call sym.getenv
test rax, rax
mov r8, rax
je 0x40bda8
mov rcx, rbx
mov edx, 0x105a7
call sym.tlv_packet_add_str
mov rbx, rax
lea rcx, str.no_proxy
call sym.getenv
test rax, rax
mov r8, rax
je 0x40bdce
mov edx, 0x105a8
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp sym.tlv_packet_add_str
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x40c475
Capabilities:
Resolve dns

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xa8
mov rbx, qword [rcx + 0x60]
mov rcx, rbx
call sym.tlv_packet_response
mov rcx, qword [rbx + 0x10]
lea r8, [rsp + 0x34]
mov edx, 0x205a4
mov rsi, rax
call sym.tlv_packet_get_u32
test eax, eax
jne 0x40c4b8
mov edx, dword [rsp + 0x34]
cmp edx, 2
je 0x40c4ef
cmp edx, 0x17
je 0x40c4ef
mov rax, qword [0x0048e400]
mov edi, 0x16
cmp dword [rax], 1
jle 0x40c638
mov r9d, dword [rsp + 0x34]
lea r8, str.Unsupported_address_family__u_for_hostname_resolution_n
lea rcx, str._mettle_mettle_src_stdapi_net_resolve.c
mov edx, 0x1a
call sym.zlog_time
jmp 0x40c638
lea rdi, [rsp + 0x70]
xor eax, eax
mov ecx, 0xc
lea r12, [rsp + 0x70]
lea rbp, [rsp + 0x58]
rep stosd dword [rdi], eax
lea rdi, [rsp + 0x58]
mov ecx, 6
mov dword [rsp + 0x74], edx
rep stosd dword [rdi], eax
mov rax, qword [rbx + 0x10]
mov dword [rsp + 0x68], 0x10578
mov qword [rsp + 0x58], rax
mov rcx, rbp
call sym.tlv_packet_iterate_str
test rax, rax
mov rdi, rax
je 0x40c638
xor edx, edx
mov qword [rsp + 0x38], 0
lea r9, [rsp + 0x38]
mov r8, r12
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
mov r13d, eax
jne 0x40c5e7
cmp dword [rsp + 0x34], 2
mov rax, qword [rsp + 0x38]
jne 0x40c58a
mov rax, qword [rax + 0x20]
mov word [rsp + 0x44], 2
mov word [rsp + 0x46], 0x20
mov eax, dword [rax + 4]
mov dword [rsp + 0x48], eax
jmp 0x40c5a5
mov rax, qword [rax + 0x20]
mov word [rsp + 0x44], 3
mov word [rsp + 0x46], pe_nt_image_headers64
movups xmm0, xmmword [rax + 8]
movups xmmword [rsp + 0x48], xmm0
lea rax, [rsp + 0x44]
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
mov edx, 0x40596
mov qword [rsp + 0x20], rax
call sym.tlv_packet_add_addr
mov r8d, dword [rsp + 0x34]
mov edx, 0x205a4
mov rcx, rax
call sym.tlv_packet_add_u32
mov rcx, qword [rsp + 0x38]
mov rsi, rax
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
jmp 0x40c528
mov rax, qword [0x0048e400]
cmp dword [rax], 1
jle 0x40c620
mov ecx, r13d
call dbg.gai_strerrorA
lea r8, str.Unable_to_resolve_host__s:__d___s__n
lea rcx, str._mettle_mettle_src_stdapi_net_resolve.c
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r13d
mov r9, rdi
mov edx, 0x3f
call sym.zlog_time
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40596
mov rcx, rsi
call sym.tlv_packet_add_raw
jmp 0x40c528
mov edx, edi
mov rcx, rsi
call sym.tlv_packet_add_result
mov rcx, qword [rbx + 0x18]
mov rdx, rsi
call sym.tlv_dispatcher_enqueue_response
mov rcx, rbx
call sym.tlv_handler_ctx_free
nop
add rsp, 0xa8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
Function at 0x40c667
Capabilities:
Query environment variable

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
xor edx, edx
or r12, 0xffffffffffffffff
xor r13d, r13d
lea rdi, [rsp + 0x28]
mov rsi, rcx
lea rbp, [rsp + 0x28]
call sym.tlv_packet_response_result
mov ecx, 6
mov rbx, rax
xor eax, eax
rep stosd dword [rdi], eax
mov rax, qword [rsi + 0x10]
mov dword [rsp + 0x38], 0x1044c
mov qword [rsp + 0x28], rax
mov rcx, rbp
call sym.tlv_packet_iterate_str
test rax, rax
mov rsi, rax
je 0x40c745
mov rdx, rax
mov al, byte [rdx]
sub eax, 0x24
cmp al, 1
ja 0x40c6d0
inc rdx
jmp 0x40c6c2
mov al, r13b
mov rcx, r12
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
lea rax, [rdx + rcx - 2]
cmp rdx, rax
jb 0x40c73b
mov byte [rax + 1], 0
mov rcx, rdx
call sym.getenv
test rax, rax
mov rdi, rax
je 0x40c6ab
xor edx, edx
mov ecx, 0x4000044e
call sym.tlv_packet_new
mov r8, rsi
mov edx, 0x1044c
mov rcx, rax
call sym.tlv_packet_add_str
mov r8, rdi
mov edx, 0x1044d
mov rcx, rax
call sym.tlv_packet_add_str
mov rcx, rbx
mov rdx, rax
call sym.tlv_packet_add_child
mov rbx, rax
jmp 0x40c6ab
cmp byte [rax], 0x25
jne 0x40c6e8
dec rax
jmp 0x40c6e3
mov rax, rbx
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret

Function at 0x40d208
Capabilities:
Send data
Send data on socket

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], r8
call sym.channel_get_ctx
test rax, rax
mov r8, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
je 0x40d247
mov rcx, qword [rax + 8]
cmp r8, 0xffe3
mov eax, 0xffe3
cmova r8, rax
add rsp, 0x38
jmp sym.network_client_write
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], 5
or rax, 0xffffffffffffffff
add rsp, 0x38
ret

Function at 0x40d753
Capabilities:
Send data
Send data on socket

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], r8
call sym.channel_get_ctx
test rax, rax
mov r8, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
je 0x40d782
mov rcx, qword [rax + 8]
add rsp, 0x38
jmp sym.bufferev_write
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], 5
or rax, 0xffffffffffffffff
add rsp, 0x38
ret

Function at 0x40d81f
Capabilities:
Send data
Send data on socket

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], r8
call sym.channel_get_ctx
test rax, rax
mov r8, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
je 0x40d84e
mov rcx, qword [rax + 8]
add rsp, 0x38
jmp sym.network_client_write
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], 5
or rax, 0xffffffffffffffff
add rsp, 0x38
ret

Function at 0x40e64f
Capabilities:
Move file

Disassembly:
sub rsp, 0x28
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
sete al
movzx eax, al
neg eax
add rsp, 0x28
ret

Function at 0x40e66e
Capabilities:
Connect socket

Disassembly:
sub rsp, 0x28
movsxd rcx, ecx
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x40e691
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
add rsp, 0x28
jmp sym.wsa_errno
add rsp, 0x28
ret
Function at 0x40e6df
Capabilities:
Read file on windows
Receive data
Receive data on socket

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
xor r9d, r9d
movsxd rcx, ecx
mov rsi, rdx
mov rdi, r8
mov rbx, rcx
call qword [sym.imp.WS2_32.dll_recv]
cdqe
cmp rax, 0xffffffffffffffff
jne 0x40e72f
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2736
je 0x40e717
cmp eax, 0x2719
jne 0x40e726
mov r8d, edi
mov rdx, rsi
mov ecx, ebx
call sym.read
jmp 0x40e72d
mov ecx, eax
call sym.wsa_errno
cdqe
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret

Function at 0x40e737
Capabilities:
Send data
Send data on socket

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
xor r9d, r9d
movsxd rcx, ecx
mov rsi, rdx
mov rdi, r8
mov rbx, rcx
call qword [sym.imp.WS2_32.dll_send]
cdqe
cmp rax, 0xffffffffffffffff
jne 0x40e787
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2736
je 0x40e76f
cmp eax, 0x2719
jne 0x40e77e
mov r8d, edi
mov rdx, rsi
mov ecx, ebx
call sym.write
jmp 0x40e785
mov ecx, eax
call sym.wsa_errno
cdqe
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret

Function at 0x40e7c2
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x38
mov eax, dword [rsp + 0x60]
movsxd rcx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x40e7ec
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
add rsp, 0x38
jmp sym.wsa_errno
xor eax, eax
add rsp, 0x38
ret

Function at 0x40f7d1
Capabilities:
Receive data
Receive data on socket

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rbx, qword [rdx + 0x10]
mov eax, dword [rbx + 0x40]
test eax, eax
je 0x40f804
dec eax
jne 0x40f8a2
mov rcx, rbx
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sym.on_read_tcp
mov edx, 0x1008f
mov ecx, 1
xor edi, edi
call sym.calloc
mov r13, qword [sym.imp.WS2_32.dll_recvfrom]
lea rbp, [rax + 0x90]
lea r12, [rax + 0x10]
mov rsi, rax
mov dword [rsi], pe_nt_image_headers64
movsxd rcx, dword [rbx + 0x44]
xor r9d, r9d
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], r12
mov r8d, 0xffff
mov rdx, rbp
call r13
cdqe
test rax, rax
mov qword [rsi + 8], rax
jle 0x40f871
mov rcx, qword [rbx + 0x88]
lea r8, [rax + 0x90]
mov rdx, rsi
add rdi, rax
call sym.buffer_queue_add
cmp qword [rsi + 8], 0
jg 0x40f82a
test rdi, rdi
je 0x40f8a2
mov rax, qword [rbx + 0x90]
test rax, rax
je 0x40f8a2
mov rdx, qword [rbx + 0xa8]
mov rcx, rbx
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp rax
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
Function at 0x40f97d
Capabilities:
Send data
Send data on socket

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov eax, dword [rcx + 0x40]
mov rbp, rcx
mov r12, rdx
mov r13, r8
cmp eax, 1
je 0x40f9b3
jb 0x40f9c7
cmp eax, 2
jne 0x40fa09
mov rcx, qword [rcx + 0x80]
call sym.buffer_queue_add
jmp 0x40fa05
xor ebx, ebx
xor edi, edi
mov r15, qword [sym.imp.WS2_32.dll_send]
mov r14, qword [sym.imp.msvcrt.dll__errno]
jmp 0x40f9e0
movsxd rcx, dword [rcx + 0x44]
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_send]
jmp 0x40fa05
je 0x40fa17
call r14
cmp dword [rax], 0xb
jne 0x40fa0f
movsxd rcx, dword [rbp + 0x44]
mov r8d, r13d
xor r9d, r9d
sub r8d, edi
lea rdx, [r12 + rdi]
call r15
movsxd rsi, eax
cmp rsi, 0
jle 0x40f9d6
add rdi, rsi
add rbx, rsi
jmp 0x40f9e0
cdqe
jmp 0x40fa21
or rax, 0xffffffffffffffff
jmp 0x40fa21
call r14
cmp dword [rax], 4
je 0x40f9e0
test rbx, rbx
mov rax, rsi
cmovne rax, rbx
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x40fcc7
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rsi
push rbx
sub rsp, 0xb8
movsxd rcx, dword [rcx + 0x44]
lea rbx, [rsp + 0x30]
mov rsi, rdx
mov dword [rsp + 0x2c], pe_nt_image_headers64
lea r8, [rsp + 0x2c]
mov rdx, rbx
call qword [sym.imp.WS2_32.dll_getsockname]
mov edx, eax
xor eax, eax
inc edx
je 0x40fd05
mov rdx, rsi
mov rcx, rbx
call sym.parse_sockaddr
add rsp, 0xb8
pop rbx
pop rsi
ret

Function at 0x410725
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
mov eax, 0x1020
push rdi
push rsi
push rbx
call fcn.0046ba70
sub rsp, rax
lea rdx, [0x0047c4c0]
xor edi, edi
call sym.posix_fopen
mov rsi, rax
call sym.json_tokener_new
test rsi, rsi
mov rbx, rax
je 0x4107de
test rax, rax
je 0x4107de
lea r12, [rsp + 0x20]
mov r9, rsi
mov r8d, 0x1000
mov edx, 1
mov rcx, r12
call sym.fread
mov rbp, rax
mov eax, 1
test rbp, rbp
jle 0x4107a0
mov rcx, rbx
mov r8d, ebp
mov rdx, r12
call sym.json_tokener_parse_ex
mov rcx, rbx
mov rdi, rax
call sym.json_tokener_get_error
test rbp, rbp
jle 0x4107aa
cmp eax, 1
je 0x410764
test eax, eax
je 0x4107e3
mov rdx, qword [0x0048e400]
cmp dword [rdx], 0
js 0x4107e3
mov ecx, eax
call sym.json_tokener_error_desc
lea r8, str.JSON_parse_error:__s_n
lea rcx, str._mettle_mettle_src_json.c
mov r9, rax
mov edx, 0x1f
call sym.zlog_time
jmp 0x4107e3
test rbx, rbx
je 0x4107eb
mov rcx, rbx
call sym.json_tokener_free
test rsi, rsi
je 0x4107f8
mov rcx, rsi
call sym.fclose
mov rax, rdi
add rsp, 0x1020
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret