joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140802070
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0x59b8898f
xchg qword [rsp + 0x90], rbp
mov r13, qword [rsp + 0x10]
xor dword [rsp + rsi - 0x59b88967], esi
shl si, 0xb3
xor dword [rsp + rsi - 0x59b7ffb0], 0x41872409
or byte [rsp + rsi - 0x59b7ffd8], sil
cmp dword [rsp + rsi - 0x59b7fff8], esi
mov rsi, qword [rsp + rsi - 0x59b7ff88]
call fcn.140757c3d
ja 0x1408020dc
cmp eax, 0xd5917fcd
cmp ebx, dword [rdi]
xor dword [rbp - 0x32feb036], esp
cld
fild qword [rdi - 0x5e306213]
mov r12b, 0xf7
test byte [rdx + 0x65], bh
sub ah, byte [rdi - 0x10b5da98]
jle 0x1408020bd
je 0x1408020d9
dec dword [rdi + 0x25]
and rax, 0xfffffffffd3bc0a5
movsd dword [rdi], dword [rsi]
sar byte [rbx], 0xfd
adc dword [rax - 0x73878891], esp
invalid

Function at 0x140803d15
Capabilities:
Get thread local storage value

Disassembly:
neg r8b
add qword [rsp], 0x913a4
mov r15, r8
movsx r15w, r15b
push r12
call fcn.14079e4dc
cmp byte [rcx - 0x44fc3e75], bl
neg dword [rsi + 0x47]
sub bh, bh
push 0x4b
and byte [rbx], al
mov bl, bl
xor al, 0xe2
pop rsi
xor edx, eax
cmp eax, dword [rcx + 0x52]
push r10
add byte [rsp + r9*8 + 0x38], 0x11
call fcn.1407819f6

Function at 0x140803d57
Capabilities:
Get thread local storage value

Disassembly:
mov bp, 0xb726
bswap rbp
xchg qword [rsp + 0x18], rdi
shr bpl, 0xae
call fcn.1407a14aa

Function at 0x140805794
Capabilities:
Execute syscall

Disassembly:
lea r15, [r12*2 - 0x62ce56ca]
mov r9, r15
mov qword [rsp + 0x38], rbx
push r15
jg 0x140774118
call fcn.1406ede27
setl r13b
xor r13, rsi
mov qword [rsp + 8], rsi
lea rax, [rax - 0x54f427fd]
cmp r13d, 0xc9a43828
push rcx
lea rsi, [r13*4 - 0x4c436dda]
not r13b
ja 0x1406f938b
xchg qword [rsp + 0x28], rax
mov rsi, qword [rsp + 0x20]
jl 0x140805771
mov rax, qword [rax]
jl 0x1407bf34d
xor sil, r13b
jl 0x1406d4560
call fcn.14077d2f1
call fcn.1407b01f3
push r11
pushfq
movabs r11, 0xb1816c91a79509b1
shr r11d, 0xd9
or r11b, 0xab
mov rbp, qword [rsp + r11*2 - 0x1d6]
shr r11d, 0xda
bswap r11
lea r11, [r11*4 - 0x274319e9]
lea rbp, [rbp + r11*2 + 0x4e8633d3]
push r10
movabs r10, 0xf4180d84b70fb316
add qword [rsp + r11*2 + 0x4e8633ea], 0xfffffffffffef498
add r11d, r11d
xor r10, 0xffffffffa7155c3f
mov qword [rsp + 0x28], rbp
mov r11b, 0xb9
add r10, 0x2bac88b1
neg r10b
jl 0x1406d5075
shr r11w, 0x4f
nop
test r10b, 0x8b
push r10
push rcx
jbe 0x1406d445d
jo 0x140780b23
shr word [rsp + 8], 0xc5
mov rbp, qword [rsp + 0x28]
mov rbp, qword [rbp + riz]
cmovb r10w, word [rsp + 0xc]
lea r10, [r11*4 + 0x4839739e]
and r10w, 0xabc
mov word [rsp + 8], r10w
mov rcx, r10
lea rbp, [rbp - 0x276ce3d3]
test cx, 0xa921
mov r10d, 0x2c27be21
ja 0x1406dd3cd
mov rcx, qword [rsp + 0x10]
and word [rsp + 0x10], 0x3004
call fcn.1407632be
add al, 0x65
and dword [rax], eax
add byte [rax], al
mov al, 0x9d
insd dword [rdi], dx
add dl, cl
popfq
insd dword [rdi], dx
add byte [rcx + rcx], ch
outsb dx, byte [rsi]
add byte [rax - 0x75], cl
pop rsp
and al, 0x10
call fcn.14079b47d
syscall
push r12
mov qword [rsp], 0x68ace0cf
call fcn.14080de8f
ret
Function at 0x14109e0a5
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
xor r9w, r9w
add r11b, r11b
cmovns r10w, r12w
mov qword [rsp + 0x10], rdi
sub r11b, 2
movsx rbx, r8w
sub edi, edi
movsx r10d, r9w
inc r9b
movzx ebx, r8b
movsx r8, r11w
mov r11, rcx
jmp 0x14109e0e6
mov r8, rdi
mov r9d, r12d
jmp 0x14109e0f4
nop
bswap r9w
movzx r9d, byte [r11]
cmovge r10w, ax
mov r10b, 0x1a
movzx r10d, byte [rdx]
jmp 0x14109e10e
inc r11
jmp 0x14109e116
inc rdx
cmp r10w, di
test bl, bl
jmp 0x14109e124
je 0x14109e159
mov ecx, r8d
btr eax, 0x90
movzx ax, spl
mov eax, 0x6289b093
clc
stc
rol eax, cl
cmp r8d, r8d
jmp 0x14109e147
add al, r8b
cmc
cmp r9, 0xffffffffdaa4f99d
xor r9b, al
inc r8
stc
test r9b, r9b
jmp 0x14109e161
je 0x14109e175
cmp r9b, r10b
jmp 0x14109e16f
je 0x14109e0f9
cmp r9b, r10b
jmp 0x14109e17d
jae 0x14109e1a0
or eax, 0xffffffff
mov rbx, qword [rsp + 8]
not di
movsxd rdi, r12d
sete dil
mov rdi, qword [rsp + 0x10]
jmp 0x14109e19f
ret
mov rbx, qword [rsp + 8]
mov al, dh
mov rax, 0xffffffff831f42bd
seta dil
movzx rax, dx
jmp 0x14109e1bb
mov eax, edi
seto dil
mov rdi, qword [rsp + 0x10]
jmp 0x14109e1cb
ret
Function at 0x1400021dc
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r15
sub rsp, 0x30
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor esi, esi
xor eax, eax
lock cmpxchg qword [0x140004650], rbx
je 0x140002228
cmp rax, rbx
jne 0x14000221b
mov ebx, 1
mov esi, ebx
jmp 0x14000222d
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140002200
mov ebx, 1
mov eax, dword [0x140004658]
cmp eax, ebx
jne 0x140002243
mov ecx, 0x1f
call fcn.140135000
jmp 0x1400022a8
mov eax, dword [0x140004658]
test eax, eax
jne 0x1400022a2
mov dword [0x140004658], ebx
lea r15, [0x1400033b0]
lea rdi, [0x140003398]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], eax
cmp rdi, r15
jae 0x140002294
test eax, eax
jne 0x140002298
cmp qword [rdi], 0
je 0x140002289
mov rax, qword [rdi]
mov rcx, qword [0x140003378]
call rcx
mov dword [rsp + 0x20], eax
add rdi, 8
mov qword [rsp + 0x28], rdi
jmp 0x14000226a
test eax, eax
je 0x1400022a8
mov eax, 0xff
jmp 0x140002384
mov dword [0x140004064], ebx
mov eax, dword [0x140004658]
cmp eax, ebx
jne 0x1400022cf
lea rdx, [0x140003390]
lea rcx, [0x140003380]
call sub.msvcrt.dll__initterm
mov dword [0x140004658], 2
test esi, esi
jne 0x1400022dc
xor eax, eax
xchg qword [0x140004650], rax
cmp qword [0x140004660], 0
je 0x140002310
lea rcx, [0x140004660]
call fcn.140002540
test eax, eax
je 0x140002310
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x140004660]
mov r9, qword [0x140003378]
call r9
mov r8, qword [0x140004078]
mov rdx, qword [0x140004070]
mov ecx, dword [0x140004068]
call fcn.140001800
mov dword [0x140004060], eax
cmp dword [0x140004080], 0
jne 0x140002340
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x140004064], 0
jne 0x140002355
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x140004060]
jmp 0x140002384
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r15
ret
sub rsp, 0x28
call fcn.1400025c0
add rsp, 0x28
jmp 0x1400021dc

Function at 0x140002450
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14000249c
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140002494
cmp dword [rcx + 0x3c], edx
jl 0x140002494
cmp dword [rcx + 0x3c], 0x10000000
jae 0x140002494
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x14000249c
mov rax, rdx
add rsp, 0x18
ret
Function at 0x140005b50
Capabilities:
Get common file path

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
lea rcx, [0x1401af750]
xor esi, esi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdi, rax
test rax, rax
jne 0x140005b7a
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret
lea rdx, str.LoadLibraryExA
mov rcx, rax
mov qword [rsp + 0x40], rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1401af738]
mov rcx, rbx
mov rbp, rax
call fcn.1401876e0
test rax, rax
je 0x140005bdc
mov rcx, rbx
test rbp, rbp
je 0x140005bc6
xor edx, edx
lea r8d, [rdx + 8]
call rbp
mov rbp, qword [rsp + 0x40]
mov rsi, rax
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbp, qword [rsp + 0x40]
mov rsi, rax
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret
test rbp, rbp
je 0x140005c13
lea rdx, str.AddDllDirectory
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140005c13
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call rbp
mov rbp, qword [rsp + 0x40]
mov rsi, rax
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x50], r13
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov r13d, eax
test eax, eax
je 0x140005cd7
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasb al, byte [rdi]
mov qword [rsp + 0x48], r12
not rcx
lea rax, [rcx - 1]
lea ecx, [r13 + 1]
add rcx, rax
call qword [section..data]
mov r12, rax
test rax, rax
je 0x140005cc9
mov edx, r13d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x140005cc9
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r12
repne scasb al, byte [rdi]
mov eax, 0x5c
mov rdi, r12
not rcx
mov word [rcx + r12 - 1], ax
or rcx, 0xffffffffffffffff
xor eax, eax
repne scasb al, byte [rdi]
not rcx
lea rdx, [rcx - 1]
add rdx, r12
sub rdx, rbx
nop word [rax + rax]
movzx eax, byte [rbx]
inc rbx
mov byte [rdx + rbx - 1], al
test al, al
jne 0x140005ca0
mov rcx, r12
test rbp, rbp
je 0x140005cc0
xor edx, edx
lea r8d, [rdx + 8]
call rbp
jmp 0x140005cc6
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
mov rcx, r12
call qword [fcn.14017eed8]
mov r12, qword [rsp + 0x48]
mov r13, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x40]
mov rax, rsi
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret
Function at 0x140005cf0
Capabilities:
Initialize winsock library

Disassembly:
sub rsp, 0x1c8
test cl, 2
je 0x140005d34
lea rdx, [rsp + 0x20]
mov ecx, 0x202
call qword [sym.imp.WSOCK32.dll_WSAStartup]
test eax, eax
jne 0x140005d27
movzx eax, word [rsp + 0x20]
cmp al, 2
jne 0x140005d21
shr ax, 8
cmp al, 2
je 0x140005d34
call qword [sym.imp.WSOCK32.dll_WSACleanup]
mov eax, 2
add rsp, 0x1c8
ret
call fcn.14001c610
test eax, eax
jne 0x140005da8
lea rcx, str.iphlpapi.dll
call fcn.140005b50
mov qword [0x14021b528], rax
test rax, rax
je 0x140005d7a
lea rdx, str.if_nametoindex
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14021b530]
test rax, rax
cmovne rcx, rax
mov qword [0x14021b530], rcx
xor edx, edx
lea r9d, [rdx + 3]
lea r8d, [rdx + 2]
lea ecx, [rdx + 6]
call fcn.14001c860
xor ecx, ecx
test eax, eax
setne cl
mov dword [0x14021e670], ecx
lea rcx, [0x14021e668]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xor eax, eax
add rsp, 0x1c8
ret
Function at 0x14000fcb0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, r9
xor r9d, r9d
call qword [sym.imp.WSOCK32.dll_recv]
movsxd rcx, eax
cmp rcx, 0xffffffffffffffff
jne 0x14000fcf7
call qword [sym.imp.WSOCK32.dll_WSAGetLastError]
xor ecx, ecx
mov edx, 0x51
cmp eax, 0x2733
mov eax, Ordinal_60
mov qword [rbx], 0
sete cl
test ecx, ecx
cmovne eax, edx
add rsp, 0x20
pop rbx
ret
mov qword [rbx], rcx
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x14000fda0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp dword [rcx + 0x1030], 0
mov rsi, r9
mov rbp, r8
movsxd rbx, edx
mov rdi, rcx
je 0x14000fe52
cmp qword [rcx + 0x720], 0
je 0x14000fe0e
mov edx, 1
call fcn.14000d940
mov r11, qword [rdi + 0x678]
mov r9, rsi
mov r8, rbp
mov edx, ebx
mov rcx, rdi
mov qword [rsp + 0x20], r11
call qword [rdi + 0x720]
xor edx, edx
mov rcx, rdi
mov ebx, eax
call fcn.14000d940
mov eax, ebx
jmp 0x14000fe54
test edx, edx
js 0x14000fe52
cmp ebx, 2
jg 0x14000fe52
mov r9, qword [rdi + 0x670]
lea rdx, [0x1401b04c8]
lea rcx, [rbx + rbx*2]
add rcx, rdx
mov edx, 2
lea r8d, [rdx - 1]
call fcn.1401802e0
mov r9, qword [rdi + 0x670]
mov r8d, 1
mov rdx, rsi
mov rcx, rbp
call fcn.1401802e0
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x14000fe70
Capabilities:
Write file on windows

Disassembly:
test rcx, rcx
je 0x14000ffbf
mov rax, rsp
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], r8
mov qword [rax + 0x20], r9
push rbx
sub rsp, 0x850
cmp dword [rcx + 0x1030], 0
mov rbx, rcx
je 0x14000ffb7
mov r8, rdx
lea r9, [rax + 0x18]
lea rcx, [rsp + 0x30]
mov edx, 0x801
mov qword [rax - 0x10], rdi
call fcn.14001adf0
cmp eax, 0x801
jb 0x14000ff0b
mov rdx, qword [rsp + 0x868]
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
cmp byte [rcx + rdx - 2], 0xa
jne 0x14000fef2
lea r8, str...._n
lea edx, [rax + 5]
lea rcx, [rsp + 0x82c]
jmp 0x14000ff06
lea r8, [0x1401b04e0]
mov edx, 4
lea rcx, [rsp + 0x82d]
call fcn.14001ae60
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x30]
repne scasb al, byte [rdi]
not rcx
lea rdi, [rcx - 1]
cmp dword [rbx + 0x1030], eax
je 0x14000ffaf
cmp qword [rbx + 0x720], rax
je 0x14000ff79
lea edx, [rax + 1]
mov rcx, rbx
call fcn.14000d940
mov rdx, qword [rbx + 0x678]
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rdx
mov r9, rdi
mov rcx, rbx
xor edx, edx
call qword [rbx + 0x720]
xor edx, edx
mov rcx, rbx
call fcn.14000d940
mov rdi, qword [rsp + 0x848]
add rsp, 0x850
pop rbx
ret
mov r9, qword [rbx + 0x670]
mov edx, 2
lea rcx, [0x1401b04c8]
lea r8d, [rdx - 1]
call fcn.1401802e0
mov r9, qword [rbx + 0x670]
lea rcx, [rsp + 0x30]
mov r8d, 1
mov rdx, rdi
call fcn.1401802e0
mov rdi, qword [rsp + 0x848]
add rsp, 0x850
pop rbx
repz ret
Function at 0x14000ffd0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
sub rsp, 0x150
cmp dword [rcx + 0x1030], 0
mov rbx, rcx
jne 0x140010001
cmp qword [rcx + 0x680], 0
je 0x14001010d
mov r8, rdx
lea r9, [rsp + 0x170]
lea rcx, [rsp + 0x30]
mov edx, 0x100
mov qword [rsp + 0x148], rdi
call fcn.14001adf0
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x30]
repne scasb al, byte [rdi]
not rcx
lea rdi, [rcx - 1]
mov rcx, qword [rbx + 0x680]
test rcx, rcx
je 0x14001006a
cmp dword [rbx + 0x181c], eax
jne 0x14001006a
lea rdx, [rsp + 0x30]
movzx eax, byte [rdx]
inc rcx
inc rdx
mov byte [rcx - 1], al
test al, al
jne 0x140010050
mov dword [rbx + 0x181c], 1
cmp dword [rbx + 0x1030], 0
mov byte [rsp + rdi + 0x30], 0xa
je 0x140010105
cmp qword [rbx + 0x720], 0
je 0x1400100ce
mov edx, 1
mov rcx, rbx
call fcn.14000d940
mov rdx, qword [rbx + 0x678]
lea r9, [rdi + 1]
mov qword [rsp + 0x20], rdx
lea r8, [rsp + 0x30]
mov rcx, rbx
xor edx, edx
call qword [rbx + 0x720]
xor edx, edx
mov rcx, rbx
call fcn.14000d940
mov rdi, qword [rsp + 0x148]
add rsp, 0x150
pop rbx
ret
mov r9, qword [rbx + 0x670]
mov edx, 2
lea rcx, [0x1401b04c8]
lea r8d, [rdx - 1]
call fcn.1401802e0
mov r9, qword [rbx + 0x670]
lea rdx, [rdi + 1]
lea rcx, [rsp + 0x30]
mov r8d, 1
call fcn.1401802e0
mov rdi, qword [rsp + 0x148]
add rsp, 0x150
pop rbx
ret

Function at 0x140010420
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
movsxd rcx, edx
mov rax, qword [rbx + 0x748]
mov rbp, qword [rbx + rcx*8 + 0x4c0]
mov rdi, rcx
shl rdi, 5
mov rsi, qword [rdi + rbx + 0x510]
sub rsi, qword [rdi + rbx + 0x518]
test byte [rax + 0x7c], 3
je 0x140010539
lea rax, [0x140010120]
cmp qword [rbx + rcx*8 + 0x4e8], rax
jne 0x140010539
cmp qword [rdi + rbx + 0x508], 0
je 0x140010493
test rsi, rsi
je 0x140010539
or r8, 0xffffffffffffffff
xor r9d, r9d
mov rcx, rbp
or rdx, r8
call fcn.14003b030
cmp eax, 0xffffffff
je 0x140010539
test al, 1
je 0x140010539
cmp qword [rdi + rbx + 0x508], 0
jne 0x14001050b
mov rax, qword [rbx]
mov ecx, dword [rax + 0xbe8]
add ecx, ecx
movsxd rcx, ecx
mov qword [rdi + rbx + 0x510], rcx
call qword [section..data]
mov qword [rdi + rbx + 0x508], rax
test rax, rax
jne 0x1400104f1
mov eax, reloc.WLDAP32.dll_Ordinal_27
jmp 0x14001053b
mov rsi, qword [rdi + rbx + 0x510]
xor eax, eax
mov qword [rdi + rbx + 0x518], rax
mov qword [rdi + rbx + 0x520], rax
mov rdx, qword [rdi + rbx + 0x508]
xor r9d, r9d
mov r8d, esi
add rdx, qword [rdi + rbx + 0x518]
mov rcx, rbp
call qword [sym.imp.WSOCK32.dll_recv]
movsxd rcx, eax
test eax, eax
jle 0x140010539
add qword [rdi + rbx + 0x518], rcx
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140010550
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x120
movsxd rax, edx
mov rbx, r9
mov rdi, r8
mov rsi, qword [rcx + rax*8 + 0x4c0]
mov rbp, rcx
call fcn.140010420
test eax, eax
je 0x140010598
mov rax, qword [rsp + 0x150]
mov dword [rax], reloc.WLDAP32.dll_Ordinal_27
or rax, 0xffffffffffffffff
jmp 0x140010613
xor r9d, r9d
mov r8d, ebx
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.WSOCK32.dll_send]
mov rsi, qword [rsp + 0x150]
movsxd rbx, eax
mov dword [rsi], 0
cmp rbx, 0xffffffffffffffff
jne 0x140010610
call qword [sym.imp.WSOCK32.dll_WSAGetLastError]
mov edi, eax
cmp eax, 0x2733
jne 0x1400105da
xor ebx, ebx
mov dword [rsi], 0x51
jmp 0x140010610
lea rdx, [rsp + 0x20]
mov r8d, 0x100
mov ecx, eax
call fcn.140004870
mov rcx, qword [rbp]
lea rdx, str.Send_failure:__s
mov r8, rax
call fcn.14000ffd0
mov r11, qword [rbp]
mov dword [r11 + 0x1378], edi
mov dword [rsi], Ordinal_60
mov rax, rbx
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x140013b30
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
call fcn.14019242c
cdqe
add rsp, 0x28
ret

Function at 0x140014f40
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
test rcx, rcx
je 0x14001501f
mov rdx, rcx
lea r8, [rsp + 0x40]
mov ecx, 2
call fcn.140042880
test eax, eax
jne 0x14001501f
lea r8, [rsp + 0x20]
lea ecx, [rax + 0x17]
mov rdx, rbx
call fcn.140042880
test eax, eax
jne 0x14001501f
or rcx, 0xffffffffffffffff
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], rdi
xor eax, eax
mov rdi, rbx
xor esi, esi
repne scasb al, byte [rdi]
lea edx, [rsi + 0x2e]
not rcx
lea r8, [rcx - 1]
lea rdi, [rcx - 1]
mov rcx, rbx
call fcn.1400428d0
test rax, rax
je 0x140014fdb
sub rax, rbx
lea edx, [rsi + 0x2e]
mov rcx, rbx
mov r8, rax
call fcn.1400428d0
mov rsi, rax
test rax, rax
je 0x140014fdb
inc rsi
mov rcx, rbx
sub rcx, rsi
add rdi, rcx
test rsi, rsi
cmovne rbx, rsi
lea rsi, [rbx + rdi]
mov edi, 0x1505
cmp rbx, rsi
jae 0x14001500b
movzx ecx, byte [rbx]
call fcn.140019e20
inc rbx
movsx rcx, al
imul rdi, rdi, 0x21
xor rdi, rcx
cmp rbx, rsi
jb 0x140014ff0
mov rsi, qword [rsp + 0x48]
movzx eax, dil
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop rbx
ret
xor eax, eax
add rsp, 0x30
pop rbx
ret
Function at 0x140017410
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x60
xor esi, esi
mov rdi, rdx
mov rbx, rcx
mov eax, esi
lea r9, [rsp + 0x70]
lea r8d, [rsi + 8]
cmp dword [rcx + 0x1068], eax
mov edx, 0xffff
mov rcx, rdi
setne al
mov dword [rsp + 0x20], 4
mov dword [rsp + 0x70], eax
call qword [sym.imp.WSOCK32.dll_setsockopt]
test eax, eax
jns 0x14001747e
lea rdx, str.Failed_to_set_SO_KEEPALIVE_on_fd__d_n
mov r8, rdi
mov rcx, rbx
call fcn.14000fe70
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x88]
add rsp, 0x60
pop rdi
ret
mov ecx, dword [rbx + 0xf44]
mov dword [rsp + 0x50], 1
call fcn.140013af0
mov ecx, dword [rbx + 0xf48]
imul eax, eax, 0x3e8
mov dword [rsp + 0x70], eax
mov dword [rsp + 0x54], eax
call fcn.140013af0
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rsi
lea r8, [rsp + 0x50]
mov r9d, reloc.WSOCK32.dll_ioctlsocket
mov edx, 0x98000004
imul eax, eax, 0x3e8
mov dword [rsp + 0x70], eax
mov dword [rsp + 0x58], eax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x30], rax
mov rcx, rdi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
je 0x140017510
call qword [sym.imp.WSOCK32.dll_WSAGetLastError]
lea rdx, str.Failed_to_set_SIO_KEEPALIVE_VALS_on_fd__d:__d_n
mov r8d, edi
mov r9d, eax
mov rcx, rbx
call fcn.14000fe70
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x88]
add rsp, 0x60
pop rdi
ret
Function at 0x140017ed0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x1a0
mov rsi, rcx
mov rbx, rdx
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x80
mov dword [rsp + 0x1c0], 0x80
call fcn.140175ab0
lea r8, [rsp + 0x1c0]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.WSOCK32.dll_getsockname]
test eax, eax
je 0x140017f5d
call qword [sym.imp.WSOCK32.dll_WSAGetLastError]
lea rdx, [rsp + 0xa0]
mov r8d, 0x100
mov ecx, eax
mov ebx, eax
call fcn.140004870
mov rcx, qword [rsi]
lea rdx, str.getsockname___failed_with_errno__d:__s
mov r9, rax
mov r8d, ebx
call fcn.14000ffd0
mov rbx, qword [rsp + 0x1b8]
add rsp, 0x1a0
pop rsi
ret
movzx ecx, word [rsp + 0x20]
cmp ecx, 2
je 0x140017faf
cmp ecx, 0x17
jne 0x140017fb6
lea rdx, [rsp + 0x28]
lea r8, [rsi + 0x430]
mov r9d, reloc.WLDAP32.dll_Ordinal_46
call fcn.140043bb0
test rax, rax
je 0x140017fb6
movzx ecx, word [rsp + 0x22]
call qword [sym.imp.WSOCK32.dll_ntohs]
movzx r11d, ax
mov dword [rsi + 0x460], r11d
mov rbx, qword [rsp + 0x1b8]
add rsp, 0x1a0
pop rsi
ret
lea rdx, [rsp + 0x24]
jmp 0x140017f71
mov byte [rsi + 0x430], 0
mov qword [rsp + 0x1b0], rdi
mov dword [rsi + 0x460], 0
call fcn.140180dcc
mov dword [rax], 0x273f
call fcn.140180dcc
mov rbx, rax
call fcn.140180dcc
mov ecx, dword [rbx]
lea rdx, [rsp + 0xa0]
mov r8d, 0x100
mov rdi, rax
call fcn.140004870
mov r8d, dword [rdi]
mov rcx, qword [rsi]
lea rdx, str.ssloc_inet_ntop___failed_with_errno__d:__s
mov r9, rax
call fcn.14000ffd0
mov rdi, qword [rsp + 0x1b0]
mov rbx, qword [rsp + 0x1b8]
add rsp, 0x1a0
pop rsi
ret

Function at 0x140018250
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x30
mov eax, dword [0x14021b630]
mov rbx, rcx
mov dword [rsp + 0x50], 0x4020
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x58], 4
test eax, eax
jne 0x1400182ad
lea r9d, [rax + 3]
lea r8d, [rax + 2]
lea ecx, [rax + 6]
xor edx, edx
call fcn.14001c860
test eax, eax
je 0x1400182a1
mov dword [0x14021b630], 2
add rsp, 0x30
pop rbx
ret
mov dword [0x14021b630], 1
jmp 0x1400182b2
cmp eax, 2
je 0x140018304
lea rax, [rsp + 0x58]
lea r9, [rsp + 0x48]
mov edx, 0xffff
mov r8d, 0x1001
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.WSOCK32.dll_getsockopt]
test eax, eax
jne 0x1400182e3
mov eax, dword [rsp + 0x50]
cmp dword [rsp + 0x48], eax
jg 0x140018304
lea r9, [rsp + 0x50]
mov edx, 0xffff
mov r8d, 0x1001
mov rcx, rbx
mov dword [rsp + 0x20], 4
call qword [sym.imp.WSOCK32.dll_setsockopt]
add rsp, 0x30
pop rbx
ret

Function at 0x1400183e0
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub rsp, 0x28
cmp dword [rcx + 0x558], 0
je 0x1400183fd
call fcn.140006c60
test eax, eax
jne 0x140018428
xor eax, eax
add rsp, 0x28
ret
mov rcx, qword [rcx + 0x4c0]
cmp rcx, 0xffffffffffffffff
je 0x1400183f6
mov r9d, 2
lea rdx, [rsp + 0x30]
lea r8d, [r9 - 1]
call qword [sym.imp.WSOCK32.dll_recv]
test eax, eax
jne 0x140018428
add rsp, 0x28
ret
mov eax, 1
add rsp, 0x28
ret