joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4158b0
Capabilities:
Check os version
Set socket configuration

Disassembly:
push rdi
push rbx
sub rsp, 0xe8
mov eax, dword [0x0047fdd0]
mov rbx, rcx
mov dword [rsp + 0x34], 0x4020
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x3c], 4
test eax, eax
je 0x415950
cmp eax, 2
je 0x415914
lea rax, [rsp + 0x3c]
lea r9, [rsp + 0x38]
mov r8d, 0x1001
mov edx, 0xffff
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x415920
mov eax, dword [rsp + 0x34]
cmp dword [rsp + 0x38], eax
jle 0x415920
add rsp, 0xe8
pop rbx
pop rdi
ret
lea r9, [rsp + 0x34]
mov r8d, 0x1001
mov edx, 0xffff
mov rcx, rbx
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
nop
add rsp, 0xe8
pop rbx
pop rdi
ret
lea rdx, [rsp + 0x40]
xor eax, eax
mov ecx, 0x12
mov dword [0x0047fdd0], 1
mov rdi, rdx
rep stosq qword [rdi], rax
mov dword [rsp + 0x40], 0x94
mov rcx, rdx
mov dword [rdi], 0
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x4159a0
cmp dword [rsp + 0x44], 5
jbe 0x4159a0
mov dword [0x0047fdd0], 2
jmp 0x415914
mov eax, dword [0x0047fdd0]
jmp 0x4158de

Function at 0x4159b0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rsi, qword [rcx + 0x7c0]
mov rax, 0xffffffffffffffff
test rsi, rsi
je 0x415a14
mov r8, qword [rcx + 0x80]
test r8, r8
je 0x415a14
mov rbx, rcx
mov rcx, qword [r8 + 0x58]
mov rdi, rdx
lea r8, [0x00415430]
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x30], rsi
mov byte [rsp + 0x38], 0
call fcn.00424840
cmp byte [rsp + 0x38], 0
jne 0x415a20
mov qword [rbx + 0x7c0], 0
mov rax, 0xffffffffffffffff
add rsp, 0x40
pop rbx
pop rsi
pop rdi
ret
test rdi, rdi
je 0x415a28
mov qword [rdi], rsi
cmp byte [rsi + 0x1f0], 0
mov rbx, qword [rsi + 0x1a8]
jne 0x415a0d
lea rdx, [rsp + 0x2f]
mov r9d, 2
mov r8d, 1
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_recv]
mov edx, eax
mov rax, rbx
test edx, edx
je 0x415a0d
jmp 0x415a14
Function at 0x416ab0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rax, qword [rcx + 0x2b0]
mov rbx, rcx
mov rdi, r8
mov rbp, r9
test rax, rax
je 0x416af0
mov rcx, qword [rcx + 0x200]
mov qword [rsp + 0x20], rcx
mov rcx, rbx
call rax
mov esi, eax
mov eax, esi
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
xor esi, esi
cmp edx, 2
ja 0x416ae0
mov r10d, edx
mov r9, qword [rbx + 0x1f8]
lea rax, [0x00468340]
lea rcx, [r10 + r10*2]
mov r8d, 1
mov edx, 2
add rcx, rax
call sub.msvcrt.dll_fwrite
mov r9, qword [rbx + 0x1f8]
mov r8d, 1
mov rdx, rbp
mov rcx, rdi
call sub.msvcrt.dll_fwrite
mov eax, esi
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x416bd0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, r9
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recv]
cdqe
cmp rax, 0xffffffffffffffff
je 0x416bf4
mov qword [rbx], rax
xor eax, eax
add rsp, 0x20
pop rbx
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, 0x38
cmp eax, 0x2733
mov eax, 0x51
cmovne eax, edx
add rsp, 0x20
pop rbx
ret

Function at 0x417040
Capabilities:
Send data
Send data on socket

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rdi, qword [rsp + 0x70]
movsxd rax, edx
mov rsi, rcx
mov rdx, r8
mov rcx, qword [rcx + rax*8 + 0x1a8]
mov r8, r9
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_send]
movsxd rbx, eax
mov dword [rdi], 0
cmp rbx, 0xffffffffffffffff
je 0x417085
mov rax, rbx
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
mov ebp, eax
je 0x4170d0
mov rcx, rsi
mov edx, eax
call fcn.00423f60
mov rcx, qword [rsi]
lea rdx, str.Send_failure:__s
mov r8, rax
call fcn.00416f80
mov rax, qword [rsi]
mov dword [rax + 0x882c], ebp
mov rax, rbx
mov dword [rdi], 0x37
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov dword [rdi], 0x51
xor ebx, ebx
jmp 0x417079
Function at 0x4235e0
Capabilities:
Write file on windows

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
cmp qword [rcx + 0x4e0], 0
mov rsi, rcx
mov r13d, edx
je 0x4237b0
cmp qword [rcx + 0x688], 0
je 0x423611
call fcn.00423000
mov r8d, 2
mov edx, 2
mov rcx, rsi
call fcn.004265a0
mov rbx, qword [rsi + 0x698]
mov rdi, qword [rsi + 0x4e0]
test rbx, rbx
je 0x42363e
mov eax, dword [rbx + 0x14]
test eax, eax
jne 0x423680
test r13d, r13d
je 0x423661
mov rax, qword [rsi + 0x88]
mov rcx, qword [rsi + 0x698]
test rax, rax
je 0x42365c
cmp rcx, qword [rax + 0x28]
je 0x423661
call fcn.004234f0
mov edx, 2
mov rcx, rsi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
jmp fcn.004265f0
lea rdx, [rbx + 0x14]
mov rcx, rbx
call fcn.004220d0
lea rcx, [0x00468fc9]
mov rdx, rdi
call fcn.00441e60
test eax, eax
jne 0x423754
lea rdx, [0x00469068]
mov rcx, rdi
call sub.msvcrt.dll_fopen
test rax, rax
mov rbp, rax
je 0x423739
lea rcx, str._Netscape_HTTP_Cookie_File_n_http:__curl.haxx.se_docs_http_cookies.html_n_This_file_was_generated_by_libcurl__Edit_at_your_own_risk._n_n
mov r9, rax
mov r8d, 0x87
mov edx, 1
xor r14d, r14d
call sub.msvcrt.dll_fwrite
mov rbx, qword [rbx]
test rbx, rbx
je 0x423799
mov r12, qword [0x00474c20]
jmp 0x423711
lea rdx, [0x00469083]
mov r8, rax
mov rcx, rbp
call fcn.00415380
mov rcx, rdi
call qword [r12]
mov rbx, qword [rbx]
test rbx, rbx
je 0x423790
mov rcx, rbx
call fcn.00421ff0
test rax, rax
mov rdi, rax
jne 0x4236f0
lea rdx, str._n_Fatal_libcurl_error_n
mov rcx, rbp
call fcn.00415380
test r14b, r14b
je 0x4237f0
mov r8, qword [rsi + 0x4e0]
lea rdx, str.WARNING:_failed_to_save_cookies_in__s_n
mov rcx, rsi
call fcn.00416ed0
jmp 0x42363e
call qword [sym.imp.msvcrt.dll___iob_func]
lea rbp, [rax + 0x30]
lea rcx, str._Netscape_HTTP_Cookie_File_n_http:__curl.haxx.se_docs_http_cookies.html_n_This_file_was_generated_by_libcurl__Edit_at_your_own_risk._n_n
mov r8d, 0x87
mov edx, 1
mov r14d, 1
mov r9, rbp
call sub.msvcrt.dll_fwrite
mov rbx, qword [rbx]
test rbx, rbx
jne 0x4236e3
jmp 0x42363e
test r14b, r14b
jne 0x42363e
mov rcx, rbp
call sub.msvcrt.dll_fclose
jmp 0x42363e
test edx, edx
je 0x4237d0
mov rcx, qword [rcx + 0x688]
test rcx, rcx
je 0x4237d0
call fcn.00413bd0
mov qword [rsi + 0x688], 0
mov r8d, 2
mov edx, 2
mov rcx, rsi
call fcn.004265a0
jmp 0x42363e
mov rcx, rbp
call sub.msvcrt.dll_fclose
jmp 0x423739

Function at 0x4248f0
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x38
xor eax, eax
lea r8, [rsp + 0x2c]
test edx, edx
mov edx, 0x8004667e
setne al
mov dword [rsp + 0x2c], eax
call qword [sym.imp.WS2_32.dll_ioctlsocket]
add rsp, 0x38
ret
Function at 0x425820
Capabilities:
Resolve dns

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
mov qword [r9], 0
mov r13, r9
lea r9, [rsp + 0x28]
call qword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
mov ebp, eax
jne 0x42595d
mov rbx, qword [rsp + 0x28]
test rbx, rbx
je 0x4259a3
xor r12d, r12d
xor edi, edi
mov r14, qword [0x00474c30]
jmp 0x42587d
mov rbx, qword [rbx + 0x28]
test rbx, rbx
je 0x425944
cmp dword [rbx + 4], 2
jne 0x425870
cmp qword [rbx + 0x20], 0
je 0x425870
cmp qword [rbx + 0x10], 0xf
jbe 0x425870
mov ecx, 0x30
call qword [r14]
test rax, rax
mov rsi, rax
je 0x425982
mov eax, dword [rbx]
mov ecx, 0x10
mov dword [rsi], eax
mov eax, dword [rbx + 4]
mov dword [rsi + 4], eax
mov eax, dword [rbx + 8]
mov dword [rsi + 8], eax
mov eax, dword [rbx + 0xc]
mov dword [rsi + 0x10], 0x10
mov qword [rsi + 0x20], 0
mov qword [rsi + 0x18], 0
mov qword [rsi + 0x28], 0
mov dword [rsi + 0xc], eax
call qword [r14]
test rax, rax
mov rdx, rax
mov qword [rsi + 0x20], rax
je 0x425976
mov rax, qword [rbx + 0x20]
mov rcx, qword [rax]
mov qword [rdx], rcx
mov rax, qword [rax + 8]
mov qword [rdx + 8], rax
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x425923
mov rax, qword [0x00474c50]
call qword [rax]
test rax, rax
mov qword [rsi + 0x18], rax
je 0x4259b7
test rdi, rdi
cmove rdi, rsi
test r12, r12
je 0x42596e
mov rbx, qword [rbx + 0x28]
mov qword [r12 + 0x28], rsi
mov r12, rsi
test rbx, rbx
jne 0x42587d
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x425954
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
test rdi, rdi
je 0x4259a3
mov qword [r13], rdi
mov eax, ebp
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov r12, rsi
jmp 0x425870
mov rax, qword [0x00474c20]
mov rcx, rsi
call qword [rax]
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x425992
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
mov rcx, rdi
mov ebp, 8
xor edi, edi
call fcn.004257d0
jmp 0x425959
mov ecx, 0x2af9
mov ebp, 0x2af9
xor edi, edi
call qword [sym.imp.WS2_32.dll_WSASetLastError]
jmp 0x425959
mov rbx, qword [0x00474c20]
mov rcx, qword [rsi + 0x20]
call qword [rbx]
mov rcx, rsi
call qword [rbx]
jmp 0x425982
Function at 0x42bda0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rsi, qword [rcx + 0x1b0]
mov rdi, qword [rcx]
lea r12, [rsp + 0x2c]
lea rbp, [rsp + 0x30]
mov rbx, rcx
mov dword [rsp + 0x2c], 0x10
mov r8, r12
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x42be10
mov rdx, rsi
mov rcx, rbx
call fcn.00415a60
lea rdx, str.Error_accept__ing_server_connect
mov rcx, rdi
call fcn.00416f80
mov eax, 0x1e
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rdx, rbp
mov r8, r12
mov rcx, rsi
mov dword [rsp + 0x2c], 0x10
call qword [sym.imp.WS2_32.dll_accept]
mov rdx, rsi
mov rbp, rax
mov rcx, rbx
call fcn.00415a60
cmp rbp, 0xffffffffffffffff
je 0x42bde7
lea rdx, str.Connection_accepted_from_server_n
mov rcx, rdi
call fcn.00416ed0
mov qword [rbx + 0x1b0], rbp
mov edx, 1
mov rcx, rbp
call fcn.004248f0
mov rax, qword [rdi + 0x2c0]
mov byte [rbx + 0x1c9], 1
test rax, rax
je 0x42be87
mov rcx, qword [rdi + 0x2c8]
mov r8d, 1
mov rdx, rbp
call rax
test eax, eax
jne 0x42be94
xor eax, eax
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rdx, rbp
mov rcx, rbx
call fcn.00415a60
mov eax, 0x2a
mov qword [rbx + 0x1b0], 0xffffffffffffffff
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x42cd80
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
cmp dl, 1
mov rsi, rcx
mov edi, r8d
sbb ebx, ebx
and ebx, 8
add ebx, 0x41
cmp bl, byte [rcx + 0x528]
je 0x42cdd0
lea rcx, [rcx + 0x490]
lea rdx, str.TYPE__c
movsx r8d, bl
call fcn.00445f90
test eax, eax
jne 0x42cdc7
mov dword [rsi + 0x538], edi
mov byte [rsi + 0x528], bl
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov edx, r8d
mov dword [rsi + 0x538], r8d
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp fcn.0042d2f0

Function at 0x42cdf0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov rax, qword [rcx]
cmp byte [rax + 0x48f], 0
mov r8, qword [rax + 0x1f0]
je 0x42ce40
cmp qword [rcx + 0x510], 0
je 0x42ce40
movzx edx, byte [rax + 0x483]
movsx r9d, byte [rcx + 0x528]
cmp dl, 1
sbb eax, eax
and eax, 8
add eax, 0x41
cmp r9d, eax
je 0x42ce40
mov dword [r8 + 0x18], 1
mov r8d, 0x13
jmp fcn.0042cd80
jmp 0x42d290
push rbx
sub rsp, 0x20
mov rax, qword [rcx]
mov rax, qword [rax + 0x1f0]
cmp dword [rax + 0x18], 1
je 0x42d2b0
add rsp, 0x20
pop rbx
jmp fcn.0042d230
mov r8, qword [rcx + 0x510]
test r8, r8
je 0x42d2a5
mov rbx, rcx
lea rdx, str.SIZE__s
lea rcx, [rcx + 0x490]
call fcn.00445f90
test eax, eax
jne 0x42d2e0
mov dword [rbx + 0x538], 0x17
add rsp, 0x20
pop rbx
ret

Function at 0x42ce50
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx]
cmp byte [rax + 0x481], 0
jne 0x42ce6b
mov eax, dword [rax + 0x3b8]
test eax, eax
je 0x42cea1
mov r8, qword [rcx + 0x510]
test r8, r8
je 0x42cea1
mov rbx, rcx
lea rdx, str.MDTM__s
lea rcx, [rcx + 0x490]
call fcn.00445f90
test eax, eax
jne 0x42ce9b
mov dword [rbx + 0x538], 0x12
add rsp, 0x20
pop rbx
ret
add rsp, 0x20
pop rbx
jmp fcn.0042cdf0
Function at 0x42ceb0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
mov rcx, qword [rcx]
mov esi, r8d
cmp esi, 0xd
mov r8, qword [rcx + 0x1f0]
jb 0x42cf32
cmp esi, 0xe
jbe 0x42d020
cmp esi, 0xf
jne 0x42cf32
mov rax, qword [rcx + 0x380]
test dl, dl
je 0x42cf3d
test rax, rax
mov dword [rbx + 0x52c], 0
je 0x42cf80
mov r8, qword [rax]
cmp byte [r8], 0x2a
je 0x42d030
mov dword [rbx + 0x530], 0
lea rcx, [rbx + 0x490]
lea rdx, [0x0046b015]
call fcn.00445f90
test eax, eax
jne 0x42cf2b
mov dword [rbx + 0x538], esi
add rsp, 0x28
pop rbx
pop rsi
ret
test dl, dl
mov rax, qword [rcx + 0x378]
jne 0x42cee4
add dword [rbx + 0x52c], 1
test rax, rax
je 0x42cf80
mov r9d, dword [rbx + 0x52c]
test r9d, r9d
jle 0x42cef7
xor edx, edx
jmp 0x42cf65
test rax, rax
je 0x42cf80
add edx, 1
mov rax, qword [rax + 8]
cmp edx, r9d
jne 0x42cf60
test rax, rax
jne 0x42cef7
nop word [rax + rax]
cmp esi, 0xe
je 0x42d050
cmp esi, 0xf
je 0x42d043
cmp esi, 0xd
je 0x42d060
cmp byte [rbx + 0x51a], 0
jne 0x42d0da
xor eax, eax
cmp dword [rcx + 0x46c], 2
mov dword [rbx + 0x530], 0
sete al
cmp byte [rbx + 0x269], 0
mov dword [rbx + 0x534], eax
jne 0x42d0a0
mov edx, dword [rbx + 0x508]
test edx, edx
je 0x42d0da
mov rax, qword [rbx + 0x500]
lea rcx, [rbx + 0x490]
lea rdx, str.CWD__s
mov dword [rbx + 0x52c], 1
mov r8, qword [rax]
call fcn.00445f90
test eax, eax
jne 0x42cf2b
mov dword [rbx + 0x538], 0x10
jmp 0x42cf2b
mov rax, qword [rcx + 0x388]
jmp 0x42cee0
add r8, 1
mov dword [rbx + 0x530], 1
jmp 0x42cf0e
xor eax, eax
jmp 0x42cf2b
xor edx, edx
mov rcx, rbx
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.0042b1e0
mov eax, dword [r8 + 0x18]
test eax, eax
jne 0x42d08f
mov rdx, qword [rbx + 0x550]
cmp rdx, 0xffffffffffffffff
je 0x42d0e8
call fcn.00424fe0
mov rdx, qword [rbx + 0x550]
mov rcx, rbx
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.0042af80
mov dword [rbx + 0x538], 0
xor eax, eax
jmp 0x42cf2b
mov r8, qword [rbx + 0x4f8]
test r8, r8
je 0x42cfd1
lea rcx, [rbx + 0x490]
lea rdx, str.CWD__s
mov dword [rbx + 0x52c], 0
call fcn.00445f90
test eax, eax
je 0x42d00e
jmp 0x42cf2b
mov rcx, rbx
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.0042ce50
mov r8, qword [rbx + 0x510]
lea rcx, [rbx + 0x490]
lea rdx, str.SIZE__s
call fcn.00445f90
test eax, eax
jne 0x42cf2b
mov dword [rbx + 0x538], 0x18
jmp 0x42cf2b
Function at 0x42d120
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx]
mov rdx, qword [rax + 0x1f0]
mov edx, dword [rdx + 0x18]
test edx, edx
jne 0x42d191
cmp byte [rax + 0x486], 0
jne 0x42d1b0
cmp byte [rax + 0x49e], 0
je 0x42d1d2
mov r8, qword [rcx + 0x510]
mov rbx, rcx
test r8, r8
je 0x42d1e0
cmp byte [rax + 0x491], 0
lea rcx, [rcx + 0x490]
jne 0x42d1c0
lea rdx, str.PRET_RETR__s
call fcn.00445f90
test eax, eax
jne 0x42d18b
mov dword [rbx + 0x538], 0x1d
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov r8d, 0xd
mov edx, 1
mov dword [rcx + 0x538], 0xd
add rsp, 0x20
pop rbx
jmp fcn.0042ceb0
xor edx, edx
add rsp, 0x20
pop rbx
jmp fcn.0042b470
lea rdx, str.PRET_STOR__s
call fcn.00445f90
test eax, eax
je 0x42d17f
jmp 0x42d18b
add rsp, 0x20
pop rbx
jmp fcn.0042b150
mov r8, qword [rax + 0x4e8]
test r8, r8
je 0x42d20c
lea rcx, [rbx + 0x490]
lea rdx, str.PRET__s
call fcn.00445f90
test eax, eax
je 0x42d17f
jmp 0x42d18b
cmp byte [rax + 0x485], 0
lea r8, [0x0046b5ce]
lea rax, str.NLST
cmovne r8, rax
jmp 0x42d1ec

Function at 0x42d230
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx]
mov rax, qword [rax + 0x1f0]
mov eax, dword [rax + 0x18]
test eax, eax
je 0x42d280
cmp qword [rcx + 0x510], 0
je 0x42d280
mov rbx, rcx
lea rdx, str.REST__d
lea rcx, [rcx + 0x490]
xor r8d, r8d
call fcn.00445f90
test eax, eax
jne 0x42d277
mov dword [rbx + 0x538], 0x1a
add rsp, 0x20
pop rbx
ret
add rsp, 0x20
pop rbx
jmp fcn.0042d120

Function at 0x42d290
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov rax, qword [rcx]
cmp byte [rax + 0x48f], 0
mov r8, qword [rax + 0x1f0]
je 0x42ce40
cmp qword [rcx + 0x510], 0
je 0x42ce40
movzx edx, byte [rax + 0x483]
movsx r9d, byte [rcx + 0x528]
cmp dl, 1
sbb eax, eax
and eax, 8
add eax, 0x41
cmp r9d, eax
je 0x42ce40
mov dword [r8 + 0x18], 1
mov r8d, 0x13
jmp fcn.0042cd80
jmp 0x42d290
push rbx
sub rsp, 0x20
mov rax, qword [rcx]
mov rax, qword [rax + 0x1f0]
cmp dword [rax + 0x18], 1
je 0x42d2b0
add rsp, 0x20
pop rbx
jmp fcn.0042d230
mov r8, qword [rcx + 0x510]
test r8, r8
je 0x42d2a5
mov rbx, rcx
lea rdx, str.SIZE__s
lea rcx, [rcx + 0x490]
call fcn.00445f90
test eax, eax
jne 0x42d2e0
mov dword [rbx + 0x538], 0x17
add rsp, 0x20
pop rbx
ret
Function at 0x42d2f0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
cmp edx, 0x13
je 0x42d340
cmp edx, 0x14
je 0x42d350
cmp edx, 0x15
mov r8d, 0xd
je 0x42d327
xor eax, eax
cmp edx, 0x16
je 0x42d321
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov r8d, 0xe
mov dl, 1
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp fcn.0042ceb0
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp 0x42d290
mov rbx, qword [rcx]
mov rsi, rcx
cmp dword [rbx + 0x468], 2
je 0x42d410
lea r9, [0x0046b000]
xor ebp, ebp
mov r8, r9
mov rdx, qword [rbx + 0x4e8]
test rdx, rdx
je 0x42d484
lea rcx, [0x0046b604]
call fcn.00415150
test rax, rax
mov rdi, rax
je 0x42d3f1
lea rcx, [rsi + 0x490]
lea rdx, [0x0046b015]
mov r8, rax
call fcn.00445f90
test rbp, rbp
mov r12, qword [0x00474c20]
je 0x42d3cb
mov r12, qword [0x00474c20]
mov dword [rsp + 0x2c], eax
mov rcx, rbp
call qword [r12]
mov eax, dword [rsp + 0x2c]
mov dword [rsp + 0x2c], eax
mov rcx, rdi
call qword [r12]
mov eax, dword [rsp + 0x2c]
test eax, eax
jne 0x42d316
mov dword [rsi + 0x538], 0x1f
jmp 0x42d316
test rbp, rbp
je 0x42d402
mov rax, qword [0x00474c20]
mov rcx, rbp
call qword [rax]
mov eax, 0x1b
jmp 0x42d316
mov rdi, qword [rbx + 0x8948]
test rdi, rdi
je 0x42d363
cmp byte [rdi], 0
je 0x42d363
mov dl, 0x2f
mov rcx, rdi
call sub.msvcrt.dll_strchr
test rax, rax
je 0x42d363
mov rax, qword [0x00474c50]
mov rcx, rdi
call qword [rax]
test rax, rax
mov rbp, rax
je 0x42d402
mov rcx, rax
call sub.msvcrt.dll_strlen
cmp byte [rbp + rax - 1], 0x2f
je 0x42d475
mov edx, 0x2f
mov rcx, rbp
call sub.msvcrt.dll_strrchr
test rax, rax
je 0x42d475
mov byte [rax + 1], 0
mov r9, rbp
lea r8, [0x0046b602]
jmp 0x42d36f
cmp byte [rbx + 0x485], 0
lea rax, [0x0046b5ce]
lea rdx, str.NLST
cmove rdx, rax
jmp 0x42d37f
Function at 0x433360
Capabilities:
Send data
Send data on socket

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rax, qword [rcx + 0x10]
lea r8, str.Connected_for_receive
mov rbx, rcx
mov esi, edx
lea rdx, [0x0046d068]
mov rcx, qword [rax]
call fcn.00416ed0
mov dword [rbx], 1
mov rcx, rbx
call fcn.00433170
test eax, eax
je 0x4333a0
add rsp, 0x28
pop rbx
pop rsi
ret
mov edx, esi
mov rcx, rbx
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.00432e30
Function at 0x433740
Capabilities:
Send data
Send data on socket

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rax, qword [rcx + 0x10]
lea r8, str.Connected_for_transmit
mov rbx, rcx
mov esi, edx
lea rdx, [0x0046d068]
mov rcx, qword [rax]
call fcn.00416ed0
mov dword [rbx], 2
mov rcx, rbx
call fcn.00433170
test eax, eax
je 0x433780
add rsp, 0x28
pop rbx
pop rsi
ret
mov edx, esi
mov rcx, rbx
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.004333b0
Function at 0x43fb00
Capabilities:
Query environment variable

Disassembly:
push rbx
sub rsp, 0x130
call sub.msvcrt.dll_getenv
test rax, rax
mov byte [rsp + 0x20], 0
je 0x43fb50
lea rbx, [rsp + 0x20]
mov r8d, 0x104
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [rsp + 0x20], 0
je 0x43fb50
mov rax, qword [0x00474c50]
mov rcx, rbx
call qword [rax]
add rsp, 0x130
pop rbx
ret
xor eax, eax
add rsp, 0x130
pop rbx
ret
jmp 0x43fb00

Function at 0x43fb60
Capabilities:
Query environment variable

Disassembly:
push rbx
sub rsp, 0x130
call sub.msvcrt.dll_getenv
test rax, rax
mov byte [rsp + 0x20], 0
je 0x43fb50
lea rbx, [rsp + 0x20]
mov r8d, 0x104
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [rsp + 0x20], 0
je 0x43fb50
mov rax, qword [0x00474c50]
mov rcx, rbx
call qword [rax]
add rsp, 0x130
pop rbx
ret
xor eax, eax
add rsp, 0x130
pop rbx
ret
jmp 0x43fb00

Function at 0x443f10
Capabilities:
Read file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov r10, qword [rcx]
mov rbx, rcx
mov rsi, rdx
cmp dword [r10 + 8], 2
je 0x443f70
mov r9, qword [rcx + 0x10]
test r9, r9
je 0x443f90
mov edx, 1
mov rcx, rsi
call sub.msvcrt.dll_fread
test rax, rax
jne 0x443f62
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x443f57
call sub.msvcrt.dll_fclose
mov qword [rbx + 0x10], 0
mov rax, qword [rbx]
mov rax, qword [rax]
mov qword [rbx], rax
xor eax, eax
add rsp, 0x38
pop rbx
pop rsi
ret
mov r11, qword [rcx + 0x18]
xor eax, eax
test r11, r11
je 0x443f62
mov r9, qword [r10 + 0x10]
mov edx, 1
mov rcx, rsi
call r11
jmp 0x443f3c
mov rcx, qword [r10 + 0x10]
lea rdx, [0x00470840]
mov qword [rsp + 0x28], r8
call sub.msvcrt.dll_fopen
mov r9, rax
mov qword [rbx + 0x10], rax
mov r8, qword [rsp + 0x28]
test r9, r9
mov rax, 0xffffffffffffffff
jne 0x443f2f
jmp 0x443f62
Function at 0x4481d0
Capabilities:
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push rbx
sub rsp, 0x30
xor r8d, r8d
xor edx, edx
mov r9d, 1
mov rbx, rcx
mov dword [rsp + 0x20], 0xf0000000
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x448213
lea rax, [rbx + 8]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8003
mov rcx, qword [rbx]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
nop
add rsp, 0x30
pop rbx
ret

Function at 0x448220
Capabilities:
Hash data via wincrypt

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
lea rbx, [rsp + 0x20]
mov rsi, rdx
mov rdi, rcx
mov rcx, rbx
call fcn.004481d0
mov rcx, rsi
call sub.msvcrt.dll_strlen
mov rcx, rax
call fcn.00424970
xor r9d, r9d
mov r8d, eax
mov rdx, rsi
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
mov rdx, rbx
mov rcx, rdi
call fcn.00448120
nop
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret

Function at 0x448340
Capabilities:
Get hostname

Disassembly:
push rsi
push rbx
sub rsp, 0x28
movsxd rbx, edx
mov rsi, rcx
mov byte [rcx], 0
mov edx, ebx
call qword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
mov byte [rsi + rbx - 1], 0
mov ebx, eax
jne 0x448377
mov edx, 0x2e
mov rcx, rsi
call sub.msvcrt.dll_strchr
test rax, rax
je 0x448377
mov byte [rax], 0
mov eax, ebx
add rsp, 0x28
pop rbx
pop rsi
ret

Function at 0x448d60
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov eax, dword [rcx + 0x18]
mov rsi, rdx
mov edx, dword [rcx + 0x20]
mov rbx, rcx
mov ebp, r8d
add eax, eax
lea rcx, [rdx + rax + 0x18]
mov rax, qword [0x00474c30]
call qword [rax]
test rax, rax
mov rdi, rax
je 0x448e54
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
cmp dword [rbx + 0x1c], ebp
mov qword [rdi + 0x10], rax
jb 0x448e64
call qword [rbx]
mov rcx, qword [rdi + 0x10]
call qword [rbx]
test rbp, rbp
je 0x448e0e
lea r13, [rsi + rbp]
lea r12, [rsp + 0x2f]
nop dword [rax + rax]
movzx eax, byte [rsi]
add rsi, 1
mov rcx, qword [rdi + 8]
mov r8d, 1
mov rdx, r12
xor eax, 0x36
mov byte [rsp + 0x2f], al
call qword [rbx + 8]
movzx eax, byte [rsi - 1]
mov rcx, qword [rdi + 0x10]
mov r8d, 1
mov rdx, r12
xor eax, 0x5c
mov byte [rsp + 0x2f], al
call qword [rbx + 8]
cmp rsi, r13
jne 0x448dd0
mov eax, dword [rbx + 0x1c]
cmp rbp, rax
jae 0x448e54
nop word cs:[rax + rax]
mov rcx, qword [rdi + 8]
mov r8d, 1
lea rdx, [0x00470fc1]
call qword [rbx + 8]
mov rcx, qword [rdi + 0x10]
mov r8d, 1
lea rdx, [0x00470fc0]
call qword [rbx + 8]
mov eax, dword [rbx + 0x1c]
add rbp, 1
cmp rax, rbp
ja 0x448e20
mov rax, rdi
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
call qword [rbx]
mov r8d, ebp
mov rdx, rsi
mov rcx, qword [rdi + 8]
call qword [rbx + 8]
mov esi, dword [rbx + 0x18]
mov rdx, qword [rdi + 8]
add rsi, qword [rdi + 0x10]
mov rcx, rsi
call qword [rbx + 0x10]
mov ebp, dword [rbx + 0x20]
mov rcx, qword [rdi + 8]
jmp 0x448db5