joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004b8b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x10]
mov rbx, rcx
mov r11d, edx
and r11d, 7
je 0x14004b93f
cmp edx, r11d
jge 0x14004b92e
mov r8d, dword [rcx + 0x14]
mov eax, 1
mov ecx, edx
mov r9d, edx
shl eax, cl
cmp r8d, eax
jae 0x14004b924
mov r10, qword [rbx + 8]
mov rax, qword [rbx]
cmp rax, r10
jb 0x14004b8ef
xor cl, cl
jmp 0x14004b8f8
movzx ecx, byte [rax]
inc rax
mov qword [rbx], rax
movzx eax, cl
lea edx, [r9 + 8]
mov ecx, r9d
mov dword [rbx + 0x10], edx
shl eax, cl
or r8d, eax
mov dword [rbx + 0x14], r8d
cmp edx, 0x18
jg 0x14004b92e
mov ecx, edx
mov eax, 1
shl eax, cl
mov r9d, edx
cmp r8d, eax
jb 0x14004b8e3
mov rax, qword [rbx + 8]
mov edx, r9d
mov qword [rbx], rax
mov eax, dword [rbx + 0x14]
mov ecx, r11d
shr eax, cl
sub edx, r11d
mov dword [rbx + 0x14], eax
mov dword [rbx + 0x10], edx
xor r8d, r8d
mov r9d, edx
test edx, edx
jle 0x14004b982
mov eax, dword [rbx + 0x14]
lea rcx, [rsp + 0x30]
movzx r10d, al
nop word [rax + rax]
shr eax, 8
lea edx, [r9 - 8]
mov byte [rcx], r10b
lea rcx, [rcx + 1]
inc r8d
mov dword [rbx + 0x14], eax
mov r9d, edx
movzx r10d, al
test edx, edx
jg 0x14004b960
mov dword [rbx + 0x10], edx
jns 0x14004b9a8
mov rax, qword gs:[0x58]
mov edx, 0x28
mov rcx, qword [rax]
lea rax, [0x140d48548]
mov qword [rdx + rcx], rax
xor eax, eax
add rsp, 0x20
pop rbx
ret
movsxd rcx, r8d
cmp rcx, 4
jge 0x14004b9d7
mov r8, qword [rbx + 8]
mov rax, qword [rbx]
cmp rax, r8
jb 0x14004b9c1
xor dl, dl
jmp 0x14004b9ca
movzx edx, byte [rax]
inc rax
mov qword [rbx], rax
mov byte [rsp + rcx + 0x30], dl
inc rcx
cmp rcx, 4
jl 0x14004b9b8
movzx eax, byte [rsp + 0x30]
movzx r8d, byte [rsp + 0x31]
movzx ecx, byte [rsp + 0x33]
shl r8d, 8
add r8d, eax
shl ecx, 8
movzx eax, byte [rsp + 0x32]
add ecx, eax
mov eax, r8d
xor eax, 0xffff
cmp ecx, eax
jne 0x14004b984
mov rcx, qword [rbx]
mov qword [rsp + 0x38], rdi
mov edi, r8d
add rcx, rdi
cmp rcx, qword [rbx + 8]
jbe 0x14004ba41
mov rax, qword gs:[0x58]
mov edx, 0x28
mov rcx, qword [rax]
lea rax, [0x140d48558]
mov qword [rdx + rcx], rax
mov rdi, qword [rsp + 0x38]
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov rdx, qword [rbx + 0x18]
lea rax, [r8 + rdx]
cmp rax, qword [rbx + 0x28]
jbe 0x14004ba5b
mov rcx, rbx
call fcn.14004ad60
test eax, eax
je 0x14004ba34
mov rdx, qword [rbx]
mov r8, rdi
mov rcx, qword [rbx + 0x18]
call sub.VCRUNTIME140.dll_memcpy
add qword [rbx], rdi
mov eax, 1
add qword [rbx + 0x18], rdi
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
Function at 0x140056000
Capabilities:
Connect socket
Initialize winsock library

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x1e0
mov edi, edx
mov rsi, rcx
mov ecx, 0x202
lea rdx, [rsp + 0x40]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x14005605f
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, [0x140d48a18]
call fcn.140004950
lea rdx, [0x140004d20]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov eax, 0xffffffff
mov rsi, qword [rsp + 0x208]
add rsp, 0x1e0
pop rdi
ret
mov qword [rsp + 0x1f0], rbx
xor r8d, r8d
mov qword [rsp + 0x1f8], rbp
mov edx, 1
mov ebp, 2
mov ecx, ebp
call qword [sym.imp.WS2_32.dll_socket]
mov rbx, rax
test eax, eax
jns 0x1400560be
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, [0x140d48a30]
call fcn.140004950
lea rdx, [0x140004d20]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 0xffffffff
jmp 0x14005617b
xorps xmm0, xmm0
movzx ecx, di
movups xmmword [rsp + 0x30], xmm0
mov word [rsp + 0x30], bp
call qword [sym.imp.WS2_32.dll_htons]
mov word [rsp + 0x32], ax
lea r9, [rsp + 0x201]
lea rax, [rsp + 0x203]
mov rcx, rsi
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x200]
lea rax, [rsp + 0x202]
lea rdx, [0x140d48a00]
mov qword [rsp + 0x20], rax
call fcn.140005f40
mov ecx, dword [rsp + 0x34]
lea rdx, [rsp + 0x30]
cmp eax, 4
movsxd rdi, ebx
mov r8d, reloc.WS2_32.dll_recv
cmove ecx, dword [rsp + 0x200]
mov dword [rsp + 0x34], ecx
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_connect]
test eax, eax
jns 0x140056179
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, [0x140d48a40]
call fcn.140004950
lea rdx, [0x140004d20]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 0xffffffff
jmp 0x14005617b
mov eax, ebx
mov rbx, qword [rsp + 0x1f0]
mov rbp, qword [rsp + 0x1f8]
mov rsi, qword [rsp + 0x208]
add rsp, 0x1e0
pop rdi
ret
Function at 0x1400593a0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x150
mov rdi, rcx
xor edx, edx
lea rcx, [rsp + 0x24]
mov r8d, 0x12c
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x1400593eb
xor eax, eax
mov rbx, qword [rsp + 0x160]
add rsp, 0x150
pop rdi
ret
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x14005945a
nop word [rax + rax]
mov rdx, rdi
lea rcx, [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x140059445
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140059410
mov rbx, qword [rsp + 0x160]
add rsp, 0x150
pop rdi
ret
mov eax, dword [rsp + 0x28]
mov rbx, qword [rsp + 0x160]
add rsp, 0x150
pop rdi
ret
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x160]
add rsp, 0x150
pop rdi
ret
Function at 0x140068b50
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x70
xor ebx, ebx
lea rdx, [rsp + 0x30]
mov rcx, qword [0x145d1e390]
call qword [sym.imp.USER32.dll_GetWindowRect]
mov r10d, dword [rsp + 0x3c]
mov r9d, dword [rsp + 0x38]
cmp r9d, dword [0x1410d2e50]
jne 0x140068b86
cmp r10d, dword [0x1410d2e54]
je 0x140068be7
mov ecx, dword [rsp + 0x30]
sub r9d, ecx
mov dword [0x145d1e518], r9d
mov r8d, dword [rsp + 0x34]
sub r10d, r8d
mov dword [0x145d1e51c], r10d
mov eax, r9d
cdq
sub eax, edx
sar eax, 1
mov dword [0x145d1e524], eax
mov eax, r10d
cdq
sub eax, edx
sar eax, 1
mov dword [0x145d1e520], eax
inc r8d
lea edx, [rcx + 1]
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], r10d
mov rcx, qword [0x1410d2f18]
call qword [sym.imp.USER32.dll_MoveWindow]
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [0x1410d2e48], xmm0
call fcn.14007abf0
mov rax, qword [0x1410d2c60]
test rax, rax
je 0x140068c01
mov rcx, qword [rax + 0x98]
jmp 0x140068c04
mov rcx, rbx
cmp dword [rcx + 0x30], ebx
jne 0x140068c0e
call fcn.140030150
call fcn.14002f190
call fcn.14000b0e0
mov ecx, 0x2e
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140068d0b
cmp byte [0x1410d2f24], bl
sete al
mov byte [0x1410d2f24], al
mov edx, 0x2000d
mov rcx, qword [0x1410d2e68]
test al, al
je 0x140068c58
xor r8d, r8d
call fcn.14007ac10
jmp 0x140068d00
mov r8d, 1
call fcn.14007ac10
lea rcx, [rsp + 0x50]
call fcn.140058360
nop
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [0x140d48d20]
mov rcx, rax
call fcn.140004790
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbx
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], send
mov byte [rax], 0
lea rcx, [rsp + 0x30]
call fcn.1400586d0
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x140068d00
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140068cfb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140068cfb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140093434
mov ecx, 0x96
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x47
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140068d3a
cmp byte [0x1410d2f25], 0
sete byte [0x1410d2f25]
mov ecx, 0x96
add rsp, 0x70
pop rbx
jmp qword [sym.imp.KERNEL32.dll_Sleep]
add rsp, 0x70
pop rbx
ret
Function at 0x14006bc20
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je case.default.0x14006bc41
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x14006bc6e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x14006bc70
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x14006bcc9
test ecx, ecx
jle 0x14006bca9
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x14006bcc9
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x14006bcc9
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret
invalid
Function at 0x14006bcf0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x14006bd21
xor eax, eax
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rcx + 0x68], 0
je case.default.0x14006bd38
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x30], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x14006bd5b
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14006bd5d
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14006bd99
mov qword [rsp + 0x38], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x38]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x14006be2e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x14006bdd4
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x14006be0e
nop dword [rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x14006be2e
cmp rbx, rax
ja 0x14006bde0
test rbx, rbx
je 0x14006be2e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
mov rsi, qword [rsp + 0x48]
sub rbp, rbx
mov rbx, qword [rsp + 0x30]
mov rax, rbp
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
sub cl, byte es:[rsi]
add edx, esi
fidivr dword [rcx + 0x6a]
int 0xee
invalid
Function at 0x14006c270
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x70
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14006c294
xor eax, eax
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
mov rax, qword [rcx + 0x40]
mov rcx, qword [rax]
test rcx, rcx
je 0x14006c2d7
mov rdx, qword [rbx + 0x58]
movsxd r8, dword [rdx]
lea rax, [rcx + r8]
cmp rcx, rax
jae 0x14006c2d7
lea eax, [r8 - 1]
mov dword [rdx], eax
mov rcx, qword [rbx + 0x40]
mov rdx, qword [rcx]
lea rax, [rdx + 1]
mov qword [rcx], rax
mov eax, edi
mov byte [rdx], dil
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0x80], rsi
je 0x14006c408
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14006c31a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x14006c345
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmove edi, ecx
mov eax, edi
jmp 0x14006c40d
lea rax, [rsp + 0x90]
mov byte [rsp + 0x40], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x41]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x40]
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14006c3ba
sub eax, 1
je 0x14006c3ba
cmp eax, 2
jne 0x14006c408
movsx ecx, byte [rsp + 0x40]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmove edi, ecx
mov eax, edi
jmp 0x14006c40d
mov rsi, qword [rsp + 0x90]
lea rax, [rsp + 0x48]
sub rsi, rax
je 0x14006c3eb
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x48]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x14006c408
lea rax, [rsp + 0x40]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x98], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x14006c40d
mov eax, 0xffffffff
mov rsi, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret

Function at 0x14006c820
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x14006c854
movabs r10, 0x100000001b3
nop
movzx ecx, byte [rdx + r9]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x14006c840
ret
Function at 0x14006ccc0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x50
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x14006cd89
cmp byte [rcx + 0x71], 0
je 0x14006cd89
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x68], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14006cd7c
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x60]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14006cd38
sub eax, 1
je 0x14006cd3c
cmp eax, 2
jne 0x14006cd7c
mov rdi, qword [rsp + 0x68]
mov al, 1
mov byte [rbx + 0x71], 0
add rsp, 0x50
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x60]
lea rax, [rsp + 0x30]
sub rdi, rax
je 0x14006cd6a
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x30]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14006cd7c
cmp byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x68]
sete al
add rsp, 0x50
pop rbx
ret
mov rdi, qword [rsp + 0x68]
xor al, al
add rsp, 0x50
pop rbx
ret
mov al, 1
add rsp, 0x50
pop rbx
ret

Function at 0x14006d160
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push rdi
sub rsp, 0x40
xor eax, eax
mov rdi, rcx
mov qword [rcx], rax
mov dword [rcx + 8], eax
mov eax, dword [0x145d1e384]
test eax, eax
jne 0x14006d1a3
movabs rax, 0xffff800fffffffff
movabs rcx, 0xffffffffd
add rax, rdx
cmp rax, rcx
ja 0x14006d1be
test dl, 3
jne 0x14006d1be
mov eax, 1
jmp 0x14006d1c0
cmp eax, 2
jne 0x14006d1be
movabs rax, 0xffff9fffffffffff
movabs rcx, 0x1ffffffffffd
jmp 0x14006d18f
xor eax, eax
test eax, eax
je 0x14006d23e
mov eax, dword [0x1410d2ef0]
xor r9d, r9d
mov qword [rsp + 0x25], rdx
mov r8d, send
mov qword [rsp + 0x58], rbx
lea rdx, [rsp + 0x20]
movsxd rbx, dword [0x1410d2ee0]
mov rcx, rbx
mov byte [rsp + 0x20], 0x2b
mov dword [rsp + 0x21], eax
mov dword [rsp + 0x2d], reloc.WS2_32.dll_inet_ntoa
mov byte [rsp + 0x31], 0
call qword [sym.imp.WS2_32.dll_send]
mov r9d, 8
lea rdx, [rsp + 0x50]
mov r8d, 4
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_recv]
mov r8d, dword [rsp + 0x50]
mov r9d, 8
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_recv]
mov rbx, qword [rsp + 0x58]
mov rax, rdi
add rsp, 0x40
pop rdi
ret
Function at 0x14006d250
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
sub rsp, 0x48
mov eax, dword [0x145d1e384]
mov dword [rsp + 0x58], 0
test eax, eax
jne 0x14006d28e
movabs rax, 0xffff800fffffffff
movabs rdx, 0xffffffffd
add rax, rcx
cmp rax, rdx
ja 0x14006d2a9
test cl, 3
jne 0x14006d2a9
mov eax, 1
jmp 0x14006d2ab
cmp eax, 2
jne 0x14006d2a9
movabs rax, 0xffff9fffffffffff
movabs rdx, 0x1ffffffffffd
jmp 0x14006d27a
xor eax, eax
test eax, eax
je 0x14006d338
mov eax, dword [0x1410d2ef0]
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x25], rcx
xor r9d, r9d
mov qword [rsp + 0x40], rbx
mov r8d, send
movsxd rbx, dword [0x1410d2edc]
mov rcx, rbx
mov byte [rsp + 0x20], 0x2b
mov dword [rsp + 0x21], eax
mov dword [rsp + 0x2d], 4
mov byte [rsp + 0x31], 0
call qword [sym.imp.WS2_32.dll_send]
mov r9d, 8
lea rdx, [rsp + 0x60]
mov r8d, 4
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_recv]
mov r8d, dword [rsp + 0x60]
lea rdx, [rsp + 0x58]
mov r9d, 8
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_recv]
mov eax, dword [rsp + 0x58]
mov rbx, qword [rsp + 0x40]
add rsp, 0x48
ret
xor eax, eax
add rsp, 0x48
ret

Function at 0x14006d340
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
sub rsp, 0x48
mov eax, dword [0x145d1e384]
mov qword [rsp + 0x60], 0
test eax, eax
jne 0x14006d37f
movabs rax, 0xffff800fffffffff
movabs rdx, 0xffffffffd
add rax, rcx
cmp rax, rdx
ja 0x14006d39a
test cl, 3
jne 0x14006d39a
mov eax, 1
jmp 0x14006d39c
cmp eax, 2
jne 0x14006d39a
movabs rax, 0xffff9fffffffffff
movabs rdx, 0x1ffffffffffd
jmp 0x14006d36b
xor eax, eax
test eax, eax
je 0x14006d42a
mov eax, dword [0x1410d2ef0]
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x25], rcx
xor r9d, r9d
mov qword [rsp + 0x40], rbx
mov r8d, send
movsxd rbx, dword [0x1410d2edc]
mov rcx, rbx
mov byte [rsp + 0x20], 0x2b
mov dword [rsp + 0x21], eax
mov dword [rsp + 0x2d], 8
mov byte [rsp + 0x31], 0
call qword [sym.imp.WS2_32.dll_send]
mov r9d, 8
lea rdx, [rsp + 0x58]
mov r8d, 4
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_recv]
mov r8d, dword [rsp + 0x58]
lea rdx, [rsp + 0x60]
mov r9d, 8
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_recv]
mov rax, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x40]
add rsp, 0x48
ret
xor eax, eax
add rsp, 0x48
ret
Function at 0x14006d440
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
movss dword [rsp + 0x10], xmm1
sub rsp, 0x48
mov eax, dword [0x145d1e384]
test eax, eax
jne 0x14006d47c
movabs rax, 0xffff800fffffffff
movabs rdx, 0xffffffffd
add rax, rcx
cmp rax, rdx
ja 0x14006d497
test cl, 3
jne 0x14006d497
mov eax, 1
jmp 0x14006d499
cmp eax, 2
jne 0x14006d497
movabs rax, 0xffff9fffffffffff
movabs rdx, 0x1ffffffffffd
jmp 0x14006d468
xor eax, eax
test eax, eax
je 0x14006d51a
mov eax, dword [0x1410d2ef0]
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x25], rcx
xor r9d, r9d
mov qword [rsp + 0x40], rbx
mov r8d, send
movsxd rbx, dword [0x1410d2ee8]
mov rcx, rbx
mov dword [rsp + 0x60], 0
mov byte [rsp + 0x20], 0xa
mov dword [rsp + 0x21], eax
mov dword [rsp + 0x2d], 4
call qword [sym.imp.WS2_32.dll_send]
xor r9d, r9d
lea rdx, [rsp + 0x58]
mov r8d, 4
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_send]
mov r9d, 8
lea rdx, [rsp + 0x60]
mov r8d, 4
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_recv]
mov rbx, qword [rsp + 0x40]
add rsp, 0x48
ret

Function at 0x14006d520
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push rdi
sub rsp, 0x40
xor eax, eax
mov rdi, rcx
mov qword [rcx], rax
mov dword [rcx + 8], eax
mov eax, dword [0x145d1e384]
test eax, eax
jne 0x14006d563
movabs rax, 0xffff800fffffffff
movabs rcx, 0xffffffffd
add rax, rdx
cmp rax, rcx
ja 0x14006d57e
test dl, 3
jne 0x14006d57e
mov eax, 1
jmp 0x14006d580
cmp eax, 2
jne 0x14006d57e
movabs rax, 0xffff9fffffffffff
movabs rcx, 0x1ffffffffffd
jmp 0x14006d54f
xor eax, eax
test eax, eax
je 0x14006d5fe
mov eax, dword [0x1410d2ef0]
xor r9d, r9d
mov qword [rsp + 0x25], rdx
mov r8d, send
mov qword [rsp + 0x58], rbx
lea rdx, [rsp + 0x20]
movsxd rbx, dword [0x1410d2edc]
mov rcx, rbx
mov byte [rsp + 0x20], 0x2b
mov dword [rsp + 0x21], eax
mov dword [rsp + 0x2d], reloc.WS2_32.dll_inet_ntoa
mov byte [rsp + 0x31], 0
call qword [sym.imp.WS2_32.dll_send]
mov r9d, 8
lea rdx, [rsp + 0x50]
mov r8d, 4
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_recv]
mov r8d, dword [rsp + 0x50]
mov r9d, 8
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_recv]
mov rbx, qword [rsp + 0x58]
mov rax, rdi
add rsp, 0x40
pop rdi
ret