joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401cefd0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x1404af540]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rbx, rcx
xor ebp, ebp
mov qword [rcx + 0x10], rbp
mov rax, rcx
cmp qword [rcx + 0x18], 7
jbe 0x1401cf009
mov rax, qword [rcx]
mov word [rax], bp
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1401cf1d4
mov ecx, Ordinal_16
call qword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x1401cf109
mov ecx, Ordinal_16
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1401cf1ce
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rsi, rax
test rax, rax
je 0x1401cf1ce
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalSize]
shr rax, 1
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rbp
mov r8, rax
mov rdx, rsi
lea rcx, [rsp + 0x20]
call fcn.140006340
nop
lea rax, [rsp + 0x20]
cmp rbx, rax
je 0x1401cf0b3
lea rdx, [rsp + 0x20]
cmp qword [rsp + 0x38], 7
cmova rdx, qword [rsp + 0x20]
mov r8, qword [rsp + 0x30]
mov rcx, rbx
call fcn.1400050d0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 7
jbe 0x1401cf1ce
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401cf1c9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1401cf1c9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov ecx, 1
call qword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x1401cf1ce
mov ecx, 1
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1401cf1ce
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rsi, rax
test rax, rax
je 0x1401cf1ce
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalSize]
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
mov r8, rax
mov rdx, rsi
lea rcx, [rsp + 0x40]
call fcn.1400da7b0
nop
xor r8d, r8d
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.1401f6100
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x1401cf1ce
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401cf1c9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1401cf1c9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1403ca488
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1403ca460
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1401cf200
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1401cf2ad
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], r14
call qword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
je 0x1401cf298
mov rax, qword [rbx + 0x10]
mov ecx, 2
lea r14, [rax + rax]
lea rdx, [r14 + 2]
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rdi, rax
test rax, rax
je 0x1401cf298
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rsi, rax
test rax, rax
je 0x1401cf298
cmp qword [rbx + 0x18], 7
jbe 0x1401cf26c
mov rbx, qword [rbx]
mov r8, r14
mov rdx, rbx
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
xor eax, eax
mov rcx, rdi
mov word [r14 + rsi], ax
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rdx, rdi
mov ecx, Ordinal_16
call qword [sym.imp.USER32.dll_SetClipboardData]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x30]
mov r14, qword [rsp + 0x40]
add rsp, 0x20
pop rbx
ret
Function at 0x1401d5870
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
cmp qword [rcx + 0x18], 7
mov r8, rcx
mov ebx, 0xffffffff
mov rdx, rcx
jbe 0x1401d588b
mov rdx, qword [rcx]
movzx eax, word [rdx]
movabs rcx, 0xcbf29ce484222325
test ax, ax
je 0x1401d5aa9
movabs r9, 0x100000001b3
nop dword [rax + rax]
movzx eax, ax
lea rdx, [rdx + 2]
xor rcx, rax
movzx eax, word [rdx]
imul rcx, r9
test ax, ax
jne 0x1401d58b0
movabs rax, 0x8604b3772bcbd43a
cmp rcx, rax
ja 0x1401d59d7
je 0x1401d59c2
movabs rax, 0x1d93126de090b4ca
cmp rcx, rax
ja 0x1401d5976
je 0x1401d5964
movabs rax, 0x126f6a13f44d5fd8
cmp rcx, rax
je 0x1401d594f
movabs rax, 0x15c71055290b29ac
cmp rcx, rax
je 0x1401d593a
movabs rax, 0x1d930d6de090ac4b
cmp rcx, rax
jne 0x1401d5aa9
mov rcx, r8
mov ebx, 2
call fcn.140006060
mov eax, ebx
add rsp, 0x20
pop rbx
ret
mov rcx, r8
mov ebx, 3
call fcn.140006060
mov eax, ebx
add rsp, 0x20
pop rbx
ret
mov rcx, r8
mov ebx, 0xa
call fcn.140006060
mov eax, ebx
add rsp, 0x20
pop rbx
ret
xor ebx, ebx
mov rcx, r8
call fcn.140006060
mov eax, ebx
add rsp, 0x20
pop rbx
ret
movabs rax, 0x5af1f573bf3db5d8
cmp rcx, rax
je 0x1401d59ad
movabs rax, 0x6eac919e3891d1cf
cmp rcx, rax
jne 0x1401d5aa9
mov rcx, r8
mov ebx, 7
call fcn.140006060
mov eax, ebx
add rsp, 0x20
pop rbx
ret
mov rcx, r8
mov ebx, VariantTimeToDosDateTime
call fcn.140006060
mov eax, ebx
add rsp, 0x20
pop rbx
ret
mov rcx, r8
mov ebx, 4
call fcn.140006060
mov eax, ebx
add rsp, 0x20
pop rbx
ret
movabs rax, 0xaed3f9c0b1172fba
cmp rcx, rax
ja 0x1401d5a71
je 0x1401d5a5c
movabs rax, 0x99ff04d4dad97469
cmp rcx, rax
je 0x1401d5a47
movabs rax, 0x9a53ee6b67696c5e
cmp rcx, rax
je 0x1401d5a32
movabs rax, 0xa5b123b5431bf209
cmp rcx, rax
jne 0x1401d5aa9
mov rcx, r8
mov ebx, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
call fcn.140006060
mov eax, ebx
add rsp, 0x20
pop rbx
ret
mov rcx, r8
mov ebx, 8
call fcn.140006060
mov eax, ebx
add rsp, 0x20
pop rbx
ret
mov rcx, r8
mov ebx, 6
call fcn.140006060
mov eax, ebx
add rsp, 0x20
pop rbx
ret
mov rcx, r8
mov ebx, 5
call fcn.140006060
mov eax, ebx
add rsp, 0x20
pop rbx
ret
movabs rax, 0xcbae70bda0745d59
cmp rcx, rax
je 0x1401d5aa4
movabs rax, 0xda10dce74587f548
cmp rcx, rax
jne 0x1401d5aa9
mov rcx, r8
mov ebx, 9
call fcn.140006060
mov eax, ebx
add rsp, 0x20
pop rbx
ret
mov ebx, 1
mov rcx, r8
call fcn.140006060
mov eax, ebx
add rsp, 0x20
pop rbx
ret
Function at 0x1401d5ac0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
xor ebx, ebx
mov r8, rcx
cmp qword [rcx + 0x18], 7
mov rdx, rcx
jbe 0x1401d5ad8
mov rdx, qword [rcx]
movzx eax, word [rdx]
movabs rcx, 0xcbf29ce484222325
test ax, ax
je 0x1401d5d08
movabs r9, 0x100000001b3
nop dword [rax + rax]
movzx eax, ax
lea rdx, [rdx + 2]
xor rcx, rax
movzx eax, word [rdx]
imul rcx, r9
test ax, ax
jne 0x1401d5b00
movabs rax, 0x8604b3772bcbd43a
cmp rcx, rax
ja 0x1401d5c31
je 0x1401d5c1b
movabs rax, 0x1d93126de090b4ca
cmp rcx, rax
ja 0x1401d5bcd
je 0x1401d5bb7
movabs rax, 0x126f6a13f44d5fd8
cmp rcx, rax
je 0x1401d5ba1
movabs rax, 0x15c71055290b29ac
cmp rcx, rax
je 0x1401d5b8b
movabs rax, 0x1d930d6de090ac4b
cmp rcx, rax
jne 0x1401d5d08
mov rcx, r8
mov ebx, 0x404
call fcn.140006060
movzx eax, bx
add rsp, 0x20
pop rbx
ret
mov rcx, r8
mov ebx, 0x40c
call fcn.140006060
movzx eax, bx
add rsp, 0x20
pop rbx
ret
mov rcx, r8
mov ebx, 0x816
call fcn.140006060
movzx eax, bx
add rsp, 0x20
pop rbx
ret
mov rcx, r8
mov ebx, 0x804
call fcn.140006060
movzx eax, bx
add rsp, 0x20
pop rbx
ret
movabs rax, 0x5af1f573bf3db5d8
cmp rcx, rax
je 0x1401d5c05
movabs rax, 0x6eac919e3891d1cf
cmp rcx, rax
jne 0x1401d5d08
mov rcx, r8
mov ebx, 0x412
call fcn.140006060
movzx eax, bx
add rsp, 0x20
pop rbx
ret
mov rcx, r8
mov ebx, 0x41e
call fcn.140006060
movzx eax, bx
add rsp, 0x20
pop rbx
ret
mov rcx, r8
mov ebx, 0x407
call fcn.140006060
movzx eax, bx
add rsp, 0x20
pop rbx
ret
movabs rax, 0xaed3f9c0b1172fba
cmp rcx, rax
ja 0x1401d5ccf
je 0x1401d5cb9
movabs rax, 0x99ff04d4dad97469
cmp rcx, rax
je 0x1401d5ca3
movabs rax, 0x9a53ee6b67696c5e
cmp rcx, rax
je 0x1401d5c8d
movabs rax, 0xa5b123b5431bf209
cmp rcx, rax
jne 0x1401d5d08
mov rcx, r8
mov ebx, 0x401
call fcn.140006060
movzx eax, bx
add rsp, 0x20
pop rbx
ret
mov rcx, r8
mov ebx, 0x419
call fcn.140006060
movzx eax, bx
add rsp, 0x20
pop rbx
ret
mov rcx, r8
mov ebx, 0x411
call fcn.140006060
movzx eax, bx
add rsp, 0x20
pop rbx
ret
mov rcx, r8
mov ebx, 0x410
call fcn.140006060
movzx eax, bx
add rsp, 0x20
pop rbx
ret
movabs rax, 0xcbae70bda0745d59
cmp rcx, rax
je 0x1401d5d03
movabs rax, 0xda10dce74587f548
cmp rcx, rax
jne 0x1401d5d08
mov rcx, r8
mov ebx, 0xc0a
call fcn.140006060
movzx eax, bx
add rsp, 0x20
pop rbx
ret
mov ebx, 0x409
mov rcx, r8
call fcn.140006060
movzx eax, bx
add rsp, 0x20
pop rbx
ret
Function at 0x1401d7170
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov rsi, r8
mov rdi, rdx
mov r14, rcx
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x20], 1
xorps xmm0, xmm0
movups xmmword [rdx], xmm0
xor ebx, ebx
mov qword [rdx + 0x10], rbx
mov qword [rdx + 0x18], rbx
xor r8d, r8d
lea rdx, [0x140419d94]
mov rcx, rdi
call fcn.140006340
nop
mov dword [rsp + 0x20], 1
mov rdx, qword [rsi + 0x10]
test rdx, rdx
je 0x1401d724a
mov rcx, rsi
cmp qword [rsi + 0x18], 7
jbe 0x1401d71d6
mov rcx, qword [rsi]
movabs r9, 0xcbf29ce484222325
add rdx, rdx
je 0x1401d7203
movabs r8, 0x100000001b3
nop
movzx eax, byte [rcx + rbx]
xor r9, rax
imul r9, r8
inc rbx
cmp rbx, rdx
jb 0x1401d71f0
mov r8, rsi
lea rdx, [rsp + 0x30]
lea rcx, [r14 + 8]
call fcn.140125c20
mov r8, qword [rax + 8]
test r8, r8
jne 0x1401d7221
mov r8, qword [r14 + 0x10]
cmp r8, qword [r14 + 0x10]
je 0x1401d724a
add r8, 0x30
cmp rdi, r8
je 0x1401d724a
mov rdx, r8
cmp qword [r8 + 0x18], 7
jbe 0x1401d723d
mov rdx, qword [r8]
mov r8, qword [r8 + 0x10]
mov rcx, rdi
call fcn.1400050d0
nop
mov rax, rdi
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x1401d7260
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x30
mov r10, qword [rdx + 0x10]
mov rdi, rcx
test r10, r10
je 0x1401d72fe
cmp qword [rdx + 0x18], 7
mov r8, rdx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rsi
jbe 0x1401d728d
mov r8, qword [rdx]
xor esi, esi
movabs r9, 0xcbf29ce484222325
mov ecx, esi
add r10, r10
je 0x1401d72c4
movabs r11, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [r8 + rcx]
inc rcx
xor r9, rax
imul r9, r11
cmp rcx, r10
jb 0x1401d72b0
mov r8, rdx
lea rcx, [rdi + 8]
lea rdx, [rsp + 0x20]
call fcn.140125c20
mov rcx, qword [rax + 8]
test rcx, rcx
jne 0x1401d72e2
mov rcx, qword [rdi + 0x10]
cmp rcx, qword [rdi + 0x10]
lea rax, [rcx + 0x30]
mov rbx, qword [rsp + 0x50]
cmove rax, rsi
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
xor eax, eax
add rsp, 0x30
pop rdi
ret
Function at 0x1401d7540
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
cmp qword [rdx + 0x18], 7
mov r9, rdx
mov r8, rdx
jbe 0x1401d7550
mov r8, qword [rdx]
movzx eax, word [r8]
movabs rdx, 0xcbf29ce484222325
test ax, ax
je 0x1401d75e2
movabs r10, 0x100000001b3
nop dword [rax]
movzx eax, ax
lea r8, [r8 + 2]
xor rdx, rax
movzx eax, word [r8]
imul rdx, r10
test ax, ax
jne 0x1401d7570
movabs rax, 0x6eac919e3891d1cf
cmp rdx, rax
ja 0x1401d766a
je 0x1401d765d
movabs rax, 0x1d93126de090b4ca
cmp rdx, rax
ja 0x1401d7609
je 0x1401d7643
movabs rax, 0x126f6a13f44d5fd8
cmp rdx, rax
je 0x1401d75fc
movabs rax, 0x15c71055290b29ac
cmp rdx, rax
je 0x1401d75ef
movabs rax, 0x1d930d6de090ac4b
cmp rdx, rax
je 0x1401d7650
mov word [rcx], 0x409
mov rcx, r9
jmp fcn.140006060
mov word [rcx], 0x40c
mov rcx, r9
jmp fcn.140006060
mov word [rcx], 0x816
mov rcx, r9
jmp fcn.140006060
movabs rax, 0x3f9d9815a59ac143
cmp rdx, rax
je 0x1401d7650
movabs rax, 0x3fde9115a5d24c53
cmp rdx, rax
je 0x1401d7643
movabs rax, 0x5af1f573bf3db5d8
cmp rdx, rax
jne 0x1401d75e2
mov word [rcx], 0x41e
mov rcx, r9
jmp fcn.140006060
mov word [rcx], 0x804
mov rcx, r9
jmp fcn.140006060
mov word [rcx], 0x404
mov rcx, r9
jmp fcn.140006060
mov word [rcx], 0x412
mov rcx, r9
jmp fcn.140006060
movabs rax, 0xa5b123b5431bf209
cmp rdx, rax
ja 0x1401d76e0
je 0x1401d76d3
movabs rax, 0x8604b3772bcbd43a
cmp rdx, rax
je 0x1401d76c6
movabs rax, 0x99ff04d4dad97469
cmp rdx, rax
je 0x1401d76b9
movabs rax, 0x9a53ee6b67696c5e
cmp rdx, rax
jne 0x1401d75e2
mov word [rcx], 0x419
mov rcx, r9
jmp fcn.140006060
mov word [rcx], 0x411
mov rcx, r9
jmp fcn.140006060
mov word [rcx], 0x407
mov rcx, r9
jmp fcn.140006060
mov word [rcx], 0x401
mov rcx, r9
jmp fcn.140006060
movabs rax, 0xaed3f9c0b1172fba
cmp rdx, rax
je 0x1401d770f
movabs rax, 0xda10dce74587f548
cmp rdx, rax
jne 0x1401d75e2
mov word [rcx], 0x40a
mov rcx, r9
jmp fcn.140006060
mov word [rcx], 0x410
mov rcx, r9
jmp fcn.140006060
Function at 0x1401dbdf0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x430
mov rax, qword [0x1404af540]
xor rax, rsp
mov qword [rsp + 0x420], rax
mov ebx, edx
mov rsi, rcx
xor edx, edx
lea rcx, [rsp + 0x24]
mov r8d, 0x3fc
call sub.VCRUNTIME140.dll_memset
xor eax, eax
lea rdi, [rsp + 0x20]
mov ecx, 0x400
lea r8, [rsp + 0x20]
rep stosb byte [rdi], al
xor edi, edi
mov ecx, edi
lea r8, [r8 + 4]
shr ecx, 1
mov edx, ecx
xor edx, 0xedb88320
test dil, 1
cmove edx, ecx
mov eax, edx
shr eax, 1
mov ecx, eax
xor ecx, 0xedb88320
test dl, 1
cmove ecx, eax
mov eax, ecx
shr eax, 1
mov edx, eax
xor edx, 0xedb88320
test cl, 1
cmove edx, eax
mov eax, edx
shr eax, 1
mov ecx, eax
xor ecx, 0xedb88320
test dl, 1
cmove ecx, eax
mov eax, ecx
shr eax, 1
mov edx, eax
xor edx, 0xedb88320
test cl, 1
cmove edx, eax
mov eax, edx
shr eax, 1
mov ecx, eax
xor ecx, 0xedb88320
test dl, 1
cmove ecx, eax
mov eax, ecx
shr eax, 1
mov edx, eax
xor edx, 0xedb88320
test cl, 1
cmove edx, eax
mov ecx, edx
shr ecx, 1
mov eax, ecx
xor eax, 0xedb88320
test dl, 1
cmove eax, ecx
inc edi
mov dword [r8 - 4], eax
cmp edi, 0x100
jl 0x1401dbe40
mov eax, 0xffffffff
test ebx, ebx
je 0x1401dbf0b
nop
movzx ecx, byte [rsi]
lea rsi, [rsi + 1]
mov edx, eax
shr eax, 8
xor rdx, rcx
movzx ecx, dl
xor eax, dword [rsp + rcx*4 + 0x20]
add ebx, 0xffffffff
jne 0x1401dbef0
mov ecx, eax
shr eax, 8
xor rcx, 0x53
movzx edx, cl
xor eax, dword [rsp + rdx*4 + 0x20]
mov ecx, eax
shr eax, 8
xor rcx, 0x49
movzx edx, cl
xor eax, dword [rsp + rdx*4 + 0x20]
mov ecx, eax
shr eax, 8
xor rcx, 0x4e
movzx edx, cl
xor eax, dword [rsp + rdx*4 + 0x20]
mov ecx, eax
shr eax, 8
xor rcx, 0x4f
movzx edx, cl
xor eax, dword [rsp + rdx*4 + 0x20]
not eax
mov rcx, qword [rsp + 0x420]
xor rcx, rsp
call fcn.1403ca460
lea r11, [rsp + 0x430]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x1401dbf80
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Receive data
Receive data on socket
Resolve dns
Send data
Send data on socket

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x48
mov rax, qword [0x1404af540]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [rsp + 0xb8]
mov rsi, r8
movzx r12d, dx
mov r15, rcx
mov r13d, 2
mov edx, 1
mov ecx, r13d
mov r8d, 6
mov r14, r9
xor edi, edi
call qword [sym.imp.WS2_32.dll_socket]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x1401dc149
mov rcx, r15
call qword [sym.imp.WS2_32.dll_gethostbyname]
mov r15, rax
test rax, rax
je 0x1401dc129
xorps xmm0, xmm0
movzx ecx, r12w
movups xmmword [rsp + 0x20], xmm0
mov word [rsp + 0x20], r13w
call qword [sym.imp.WS2_32.dll_htons]
mov rdx, qword [r15 + 0x18]
lea rcx, [rsp + 0x24]
movsx r8, word [r15 + 0x12]
mov word [rsp + 0x22], ax
xor eax, eax
mov qword [rsp + 0x28], rax
mov rdx, qword [rdx]
call sub.VCRUNTIME140.dll_memcpy
mov r8d, reloc.SinoSPE.dll_Ordinal_16
lea rdx, [rsp + 0x20]
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_connect]
test eax, eax
jne 0x1401dc10c
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rsi + r8], dil
jne 0x1401dc050
xor r9d, r9d
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x1401dc0ec
mov r8d, dword [rsp + 0xb0]
xor r9d, r9d
dec r8d
mov rdx, r14
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x1401dc0ac
test rbx, rbx
je 0x1401dc096
mov dword [rbx], 0xffffffff
cdqe
mov rcx, rbp
mov byte [rax + r14], dil
call qword [sym.imp.WS2_32.dll_closesocket]
mov eax, edi
jmp 0x1401dc156
jne 0x1401dc0cc
test rbx, rbx
je 0x1401dc0b9
mov dword [rbx], 5
mov rcx, rbp
mov byte [r14], dil
call qword [sym.imp.WS2_32.dll_closesocket]
mov eax, edi
jmp 0x1401dc156
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
test rbx, rbx
je 0x1401dc13c
mov rcx, rbp
mov dword [rbx], 4
call qword [sym.imp.WS2_32.dll_closesocket]
mov eax, edi
jmp 0x1401dc156
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
test rbx, rbx
je 0x1401dc13c
mov rcx, rbp
mov dword [rbx], 3
call qword [sym.imp.WS2_32.dll_closesocket]
mov eax, edi
jmp 0x1401dc156
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
test rbx, rbx
je 0x1401dc13c
mov rcx, rbp
mov dword [rbx], r13d
call qword [sym.imp.WS2_32.dll_closesocket]
mov eax, edi
jmp 0x1401dc156
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
test rbx, rbx
je 0x1401dc13c
mov dword [rbx], 1
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_closesocket]
mov eax, edi
jmp 0x1401dc156
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
test rbx, rbx
je 0x1401dc156
mov dword [rbx], edi
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1403ca460
add rsp, 0x48
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1401dc180
Capabilities:
Check if file exists
Read file on windows

Disassembly:
push rbx
push r14
sub rsp, 0x38
mov rax, qword [0x1404af540]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp qword [rcx + 0x10], 0
mov r14, rdx
mov rbx, rcx
je 0x1401dc27b
cmp qword [rcx + 0x18], 7
jbe 0x1401dc1b2
mov rcx, qword [rcx]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1401dc27b
cmp qword [rbx + 0x18], 7
mov qword [rsp + 0x20], 0
jbe 0x1401dc1d3
mov rbx, qword [rbx]
lea r8, [0x1404397e4]
mov rdx, rbx
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen_s]
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x1401dc27b
mov qword [rsp + 0x60], rsi
xor edx, edx
mov r8d, 2
mov qword [rsp + 0x30], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
mov rcx, rdi
call fcn.1403ca480
mov rcx, qword [rsp + 0x20]
xor r8d, r8d
xor edx, edx
mov rsi, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
mov r9, qword [rsp + 0x20]
mov r8, rdi
mov edx, 1
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov edx, edi
mov rcx, rsi
call fcn.1401dbdf0
mov rcx, rsi
mov dword [r14], eax
call fcn.1403ca488
mov rdi, qword [rsp + 0x30]
mov al, 1
mov rsi, qword [rsp + 0x60]
jmp 0x1401dc27d
xor al, al
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1403ca460
add rsp, 0x38
pop r14
pop rbx
ret
Function at 0x1401dc2a0
Capabilities:
Check if file exists
Parse pe header
Read file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x1404af540]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp qword [rcx + 0x10], 0
mov rbx, rcx
je 0x1401dc439
cmp qword [rcx + 0x18], 7
jbe 0x1401dc2cd
mov rcx, qword [rcx]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1401dc439
mov qword [rsp + 0x50], rsi
xor esi, esi
cmp qword [rbx + 0x18], 7
mov qword [rsp + 0x20], rsi
jbe 0x1401dc2f1
mov rbx, qword [rbx]
lea r8, [0x1404397e4]
mov rdx, rbx
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen_s]
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x1401dc41f
xor edx, edx
mov qword [rsp + 0x48], rbp
mov r8d, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rbp, eax
cmp ebp, 0x200
jl 0x1401dc40f
mov rcx, rbp
mov qword [rsp + 0x58], rdi
call fcn.1403ca480
mov rcx, qword [rsp + 0x20]
xor r8d, r8d
xor edx, edx
mov rdi, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
mov r9, qword [rsp + 0x20]
mov r8, rbp
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp rax, rbp
jne 0x1401dc402
cmp byte [rdi], 0x4d
jne 0x1401dc402
cmp byte [rdi + 1], 0x5a
jne 0x1401dc402
mov edx, dword [rdi + 0x3c]
lea eax, [rbp - 0xe0]
cmp edx, eax
jae 0x1401dc402
cmp byte [rdx + rdi], 0x50
mov r8d, edx
jne 0x1401dc402
lea eax, [rdx + 1]
cmp byte [rax + rdi], 0x45
jne 0x1401dc402
lea eax, [rdx + 4]
mov ecx, 0x14c
movzx eax, word [rax + rdi]
cmp ax, cx
jne 0x1401dc3c9
sub ebp, edx
lea ebx, [rdx + 0x70]
lea rcx, [r8 + 0x74]
lea edx, [rbp - 0x74]
jmp 0x1401dc3e8
mov ecx, 0x8664
cmp ax, cx
jne 0x1401dc402
sub ebp, edx
lea ebx, [rdx + 0x80]
lea rcx, [r8 + 0x84]
lea edx, [rbp - 0x84]
add rcx, rdi
call fcn.1401dbdf0
mov ecx, dword [rbx + rdi]
cmp ecx, eax
jne 0x1401dc3fe
mov esi, 1
jmp 0x1401dc402
neg ecx
sbb esi, esi
mov rcx, rdi
call fcn.1403ca488
mov rdi, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rbp, qword [rsp + 0x48]
mov eax, esi
mov rsi, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1403ca460
add rsp, 0x30
pop rbx
ret
xor eax, eax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1403ca460
add rsp, 0x30
pop rbx
ret
Function at 0x1401df640
Capabilities:
Resolve dns

Disassembly:
sub rsp, 0x28
lea rcx, str.www.baidu.com
call qword [sym.imp.WS2_32.dll_gethostbyname]
test rax, rax
setne al
add rsp, 0x28
ret