joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140167430
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x140353c70]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rax, qword [rcx]
lea rdx, [rsp + 0x20]
mov rbx, r8
xorps xmm0, xmm0
add r8, 0x500
movups xmmword [rsp + 0x20], xmm0
call qword [rax + 0x20]
xor edi, edi
xorps xmm0, xmm0
movups xmmword [rbx + 0x540], xmm0
mov esi, edi
xorps xmm1, xmm1
movups xmmword [rbx + 0x510], xmm1
mov qword [rbx + 0x550], rdi
mov dword [rbx + 0x558], edi
mov qword [rbx + 0x560], rdi
mov qword [rbx + 0x568], rdi
movups xmmword [rsp + 0x20], xmm0
mov r8, qword [rbx + 0x570]
lea rdx, [rsp + 0x20]
add r8, 8
mov byte [rsp + 0x20], dil
add r8, rsi
lea rcx, [rbx + 0x500]
call fcn.140166630
inc edi
add rsi, 0x10
cmp edi, 0x100
jl 0x1401674a0
mov eax, 0x1000
lea r10, [0x1402b3740]
nop
mov r9d, 0x100
nop word [rax + rax]
mov rdx, qword [rbx + 0x570]
movzx ecx, byte [rdx + rax - 0xfea]
movzx r8d, byte [rdx + rax - 0xfe9]
mov byte [rdx + rax + 0x17], cl
mov rdx, qword [rbx + 0x570]
movzx ecx, byte [rdx + rax - 0xfeb]
mov byte [rdx + rax + 0x16], cl
mov rdx, qword [rbx + 0x570]
movzx ecx, byte [rdx + rax - 0xfec]
mov byte [rdx + rax + 0x15], cl
mov rdx, qword [rbx + 0x570]
movzx ecx, byte [rdx + rax - 0xfed]
mov byte [rdx + rax + 0x14], cl
mov rdx, qword [rbx + 0x570]
movzx ecx, byte [rdx + rax - 0xfee]
mov byte [rdx + rax + 0x13], cl
mov rdx, qword [rbx + 0x570]
movzx ecx, byte [rdx + rax - 0xfef]
mov byte [rdx + rax + 0x12], cl
mov rdx, qword [rbx + 0x570]
movzx ecx, byte [rdx + rax - 0xff0]
mov byte [rdx + rax + 0x11], cl
mov rdx, qword [rbx + 0x570]
movzx ecx, byte [rdx + rax - 0xff1]
mov byte [rdx + rax + 0x10], cl
mov rdx, qword [rbx + 0x570]
movzx ecx, byte [rdx + rax - 0xff2]
mov byte [rdx + rax + 0xf], cl
mov rdx, qword [rbx + 0x570]
movzx ecx, byte [rdx + rax - 0xff3]
mov byte [rdx + rax + 0xe], cl
mov rdx, qword [rbx + 0x570]
movzx ecx, byte [rdx + rax - 0xff4]
mov byte [rdx + rax + 0xd], cl
mov rdx, qword [rbx + 0x570]
movzx ecx, byte [rdx + rax - 0xff5]
mov byte [rdx + rax + 0xc], cl
mov rdx, qword [rbx + 0x570]
movzx ecx, byte [rdx + rax - 0xff6]
mov byte [rdx + rax + 0xb], cl
mov rdx, qword [rbx + 0x570]
movzx ecx, byte [rdx + rax - 0xff7]
mov byte [rdx + rax + 0xa], cl
mov rdx, qword [rbx + 0x570]
movzx ecx, byte [rdx + rax - 0xff8]
mov byte [rdx + rax + 9], cl
lea ecx, [r8 + r8]
mov rdx, qword [rbx + 0x570]
movzx ecx, byte [rcx + r10]
mov byte [rax + rdx + 8], cl
lea ecx, [r8 + r8]
mov rdx, qword [rbx + 0x570]
movzx ecx, byte [rcx + r10 + 1]
xor byte [rdx + rax + 9], cl
add rax, 0x10
sub r9, 1
jne 0x1401674f0
cmp rax, 0x10000
jl 0x1401674e0
mov al, 1
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1402474e0
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x14016c8b0
Capabilities:
Encrypt data using blowfish

Disassembly:
lea rax, [0x140351150]
ret

Function at 0x14016c8c0
Capabilities:
Encrypt data using blowfish

Disassembly:
lea rax, [0x1403511a0]
ret
Function at 0x14016e5d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp byte [rcx + 0x3b0], 0
mov r9, r8
mov r8, rdx
lea rdx, [rcx + 0xb0]
jne 0x14016fa10
jmp 0x14016ecd0
Function at 0x140172060
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov ebx, 0x80
mov qword [rsp + 0x40], r12
mov r14d, r9d
mov esi, r8d
mov r12, rdx
mov rdi, rcx
cmp r8d, ebx
jbe 0x140172091
mov esi, ebx
jmp 0x14017209b
mov eax, 1
cmp esi, eax
cmovb esi, eax
mov qword [rsp + 0x48], r15
mov r15d, 0x400
test r14d, r14d
jne 0x1401720b0
mov r14d, r15d
jmp 0x1401720b7
cmp r14d, r15d
cmova r14d, r15d
mov edx, esi
mov rcx, r12
call fcn.140042380
mov rcx, r12
mov ebp, esi
call fcn.1400428d0
mov r12, qword [rsp + 0x40]
cmp esi, ebx
jbe 0x1401720db
xor al, al
jmp 0x140172205
test r14d, r14d
mov r8d, esi
lea rcx, [rdi + 0xb0]
mov rdx, rax
cmove r14d, r15d
mov r15d, esi
call sub.VCRUNTIME140.dll_memcpy
lea r11, [0x1402b7ce0]
cmp esi, ebx
jae 0x140172149
lea eax, [rsi - 1]
movzx r8d, byte [rax + rdi + 0xb0]
lea rdx, [rdi + 0xb0]
add rdx, r15
nop dword [rax + rax]
mov eax, ebp
lea rdx, [rdx + 1]
sub eax, esi
inc ebp
movzx ecx, byte [rax + rdi + 0xb0]
movzx eax, r8b
add rcx, rax
movzx eax, cl
movzx r8d, byte [rax + r11]
mov byte [rdx - 1], r8b
cmp ebp, ebx
jb 0x140172120
lea eax, [r14 + 7]
mov r8d, ebx
shr eax, 3
neg r14d
sub r8d, eax
movzx ecx, r14b
and cl, 7
mov r9d, r8d
add r9, 0xb0
mov edx, 0xff
add r9, rdi
sar rdx, cl
movzx eax, byte [r9]
and rdx, rax
movzx r10d, byte [rdx + r11]
mov byte [r9], r10b
test r8d, r8d
je 0x1401721b4
nop dword [rax]
movzx eax, r10b
lea ebx, [rbx - 1]
movzx ecx, byte [rbx + rdi + 0xb0]
lea r9, [r9 - 1]
xor rcx, rax
movzx r10d, byte [rcx + r11]
mov byte [r9], r10b
add r8d, 0xffffffff
jne 0x140172190
mov r9d, 0x3f
lea r10, [rdi + 0x12e]
mov r11d, 0x100
nop word [rax + rax]
lea r8d, [r9 + r9]
movzx ecx, byte [r8 + rdi + 0xb0]
lea eax, [r8 + 1]
movzx edx, byte [rax + rdi + 0xb0]
lea r10, [r10 - 2]
imul edx, r11d
mov eax, r9d
dec r9d
add dx, cx
mov word [r10 + 2], dx
test eax, eax
jne 0x1401721d0
mov al, 1
mov r15, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret

Function at 0x140172470
Capabilities:
Encode data using add xor sub operations
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov r10d, dword [rdx + 0x458]
mov rbx, r8
mov r11d, dword [rdx + 0x45c]
movsxd rdi, r9d
test r9d, r9d
jle 0x1401724df
nop dword [rax]
nop word [rax + rax]
inc r10b
lea rbx, [rbx + 1]
movzx r10d, r10b
mov r9d, dword [rdx + r10*4 + 0x58]
lea r8, [rdx + r10*4]
lea eax, [r11 + r9]
movzx r11d, al
mov ecx, dword [rdx + r11*4 + 0x58]
mov dword [r8 + 0x58], ecx
mov dword [rdx + r11*4 + 0x58], r9d
add r9b, cl
movzx eax, r9b
movzx ecx, byte [rdx + rax*4 + 0x58]
xor byte [rbx - 1], cl
sub rdi, 1
jne 0x1401724a0
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
mov dword [rdx + 0x45c], r11d
mov dword [rdx + 0x458], r10d
ret
Function at 0x140182920
Capabilities:
Encrypt data using curve25519

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0xd0]
sub rsp, 0x1d0
mov rax, qword [0x140353c70]
xor rax, rsp
mov qword [rbp + 0xc0], rax
movups xmm0, xmmword [rdx]
mov rbx, rcx
mov ecx, 2
movups xmm1, xmmword [rdx + 0x10]
movd eax, xmm0
movups xmmword [rbp + 0xb0], xmm1
and al, 0xf8
psrldq xmm1, 0xf
movups xmmword [rbp + 0xa0], xmm0
mov byte [rbp + 0xa0], al
movd eax, xmm1
and al, 0x3f
or al, 0x40
mov byte [rbp + 0xbf], al
add r8, 8
lea rax, [rsp + 0x40]
nop dword [rax + rax]
movd xmm1, dword [r8 - 8]
xorps xmm0, xmm0
movd xmm2, dword [r8 - 4]
lea rax, [rax + 0x40]
punpcklbw xmm1, xmm0
lea r8, [r8 + 0x10]
punpcklbw xmm2, xmm0
punpcklwd xmm1, xmm0
punpcklwd xmm2, xmm0
movdqu xmmword [rax - 0x60], xmm1
movd xmm1, dword [r8 - 0x10]
punpcklbw xmm1, xmm0
punpcklwd xmm1, xmm0
movdqu xmmword [rax - 0x50], xmm2
movd xmm2, dword [r8 - 0xc]
punpcklbw xmm2, xmm0
punpcklwd xmm2, xmm0
movdqu xmmword [rax - 0x40], xmm1
movdqu xmmword [rax - 0x30], xmm2
sub rcx, 1
jne 0x140182990
lea rdx, [rbp + 0xa0]
lea rcx, [rsp + 0x20]
call fcn.140182b50
lea rdx, [rbp - 0x60]
lea rcx, [rbp - 0x60]
call fcn.140182570
lea r8, [rbp - 0x60]
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x20]
call fcn.140181a90
lea rcx, [rbp + 0x20]
call fcn.1401817d0
movzx eax, byte [rbp + 0x24]
mov byte [rbx + 1], al
movzx eax, byte [rbp + 0x28]
movzx r11d, byte [rbp + 0x20]
mov byte [rbx + 2], al
movzx eax, byte [rbp + 0x2c]
mov byte [rbx + 3], al
movzx eax, byte [rbp + 0x30]
mov byte [rbx + 4], al
movzx eax, byte [rbp + 0x34]
mov byte [rbx + 5], al
movzx eax, byte [rbp + 0x38]
mov byte [rbx + 6], al
movzx eax, byte [rbp + 0x3c]
mov byte [rbx + 7], al
movzx eax, byte [rbp + 0x40]
mov byte [rbx + 8], al
movzx eax, byte [rbp + 0x44]
mov byte [rbx + 9], al
movzx eax, byte [rbp + 0x48]
mov byte [rbx + 0xa], al
movzx eax, byte [rbp + 0x4c]
mov byte [rbx + 0xb], al
movzx eax, byte [rbp + 0x50]
mov byte [rbx + 0xc], al
movzx eax, byte [rbp + 0x54]
mov byte [rbx + 0xd], al
movzx eax, byte [rbp + 0x58]
mov byte [rbx + 0xe], al
movzx eax, byte [rbp + 0x5c]
mov byte [rbx + 0xf], al
movzx eax, byte [rbp + 0x60]
mov byte [rbx + 0x10], al
movzx eax, byte [rbp + 0x64]
mov byte [rbx + 0x11], al
movzx eax, byte [rbp + 0x68]
mov byte [rbx + 0x12], al
movzx eax, byte [rbp + 0x6c]
mov byte [rbx + 0x13], al
movzx eax, byte [rbp + 0x70]
mov byte [rbx + 0x14], al
movzx eax, byte [rbp + 0x74]
mov byte [rbx + 0x15], al
movzx eax, byte [rbp + 0x78]
mov byte [rbx + 0x16], al
movzx eax, byte [rbp + 0x7c]
mov byte [rbx + 0x17], al
movzx eax, byte [rbp + 0x80]
mov byte [rbx + 0x18], al
movzx eax, byte [rbp + 0x84]
mov byte [rbx + 0x19], al
movzx eax, byte [rbp + 0x88]
mov byte [rbx + 0x1a], al
movzx eax, byte [rbp + 0x8c]
mov byte [rbx + 0x1b], al
movzx eax, byte [rbp + 0x90]
mov byte [rbx + 0x1c], al
movzx eax, byte [rbp + 0x94]
mov byte [rbx + 0x1d], al
movzx eax, byte [rbp + 0x98]
mov byte [rbx + 0x1e], al
movzx eax, byte [rbp + 0x9c]
mov byte [rbx + 0x1f], al
xor eax, eax
mov byte [rbx], r11b
mov rcx, qword [rbp + 0xc0]
xor rcx, rsp
call fcn.1402474e0
mov rbx, qword [rsp + 0x1e8]
add rsp, 0x1d0
pop rbp
ret
Function at 0x140184840
Capabilities:
Encode data using xor

Disassembly:
mov r9, rdx
movzx r10d, r8b
neg r10d
lea rdx, [rcx + 0x7c]
lea rax, [r9 + 0x7c]
movd xmm2, r10d
pshufd xmm2, xmm2, 0
cmp rcx, rax
ja 0x140184887
cmp rdx, r9
jb 0x140184887
sub r9, rcx
mov r8d, 0x20
nop
mov edx, dword [rcx]
xor edx, dword [r9 + rcx]
lea rcx, [rcx + 4]
and edx, r10d
xor dword [rcx - 4], edx
sub r8, 1
jne 0x140184870
ret
lea rax, [rcx + 0x10]
sub r9, rcx
mov ecx, 4
nop dword [rax]
nop word [rax + rax]
movdqu xmm1, xmmword [rax - 0x10]
movdqu xmm0, xmmword [r9 + rax - 0x10]
lea rax, [rax + 0x20]
xorps xmm0, xmm1
andps xmm0, xmm2
xorps xmm0, xmm1
movdqu xmmword [rax - 0x30], xmm0
movdqu xmm1, xmmword [rax - 0x20]
movdqu xmm0, xmmword [r9 + rax - 0x20]
xorps xmm0, xmm1
andps xmm0, xmm2
xorps xmm0, xmm1
movdqu xmmword [rax - 0x20], xmm0
sub rcx, 1
jne 0x1401848a0
ret
Function at 0x140187160
Capabilities:
Encrypt data using curve25519

Disassembly:
push rbx
sub rsp, 0x2f0
mov rax, qword [0x140353c70]
xor rax, rsp
mov qword [rsp + 0x2e0], rax
mov rbx, rdx
test rcx, rcx
je 0x1401872be
test rdx, rdx
je 0x1401872be
test r8, r8
je 0x1401872be
movups xmm0, xmmword [rcx]
mov edx, 0x20
movups xmmword [r8], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [r8 + 0x10], xmm1
lea r8, [rsp + 0x2a0]
call fcn.1400b8ac0
movzx eax, byte [rsp + 0x2bf]
lea rcx, [rsp + 0x40]
and byte [rsp + 0x2a0], 0xf8
and al, 0x3f
or al, 0x40
mov byte [rsp + 0x2bf], al
xor eax, eax
nop dword [rax]
movd xmm1, dword [rsp + rax + 0x2a0]
lea rcx, [rcx + 0x40]
movd xmm2, dword [rsp + rax + 0x2a4]
xorps xmm0, xmm0
punpcklbw xmm1, xmm0
punpcklbw xmm2, xmm0
punpcklwd xmm1, xmm0
movdqu xmmword [rcx - 0x60], xmm1
movd xmm1, dword [rsp + rax + 0x2a8]
punpcklwd xmm2, xmm0
movdqu xmmword [rcx - 0x50], xmm2
movd xmm2, dword [rsp + rax + 0x2ac]
add rax, 0x10
punpcklbw xmm1, xmm0
punpcklbw xmm2, xmm0
punpcklwd xmm1, xmm0
punpcklwd xmm2, xmm0
movdqu xmmword [rcx - 0x40], xmm1
movdqu xmmword [rcx - 0x30], xmm2
cmp rax, 0x20
jl 0x1401871e0
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x220]
movups xmmword [rsp + 0xa0], xmm0
movups xmmword [rsp + 0xb0], xmm0
movups xmmword [rsp + 0xc0], xmm0
movups xmmword [rsp + 0xd0], xmm0
movups xmmword [rsp + 0xe0], xmm0
movups xmmword [rsp + 0xf0], xmm0
movups xmmword [rsp + 0x100], xmm0
movups xmmword [rsp + 0x110], xmm0
call fcn.140183260
lea rdx, [rsp + 0x220]
lea rcx, [rsp + 0x20]
call fcn.140186bb0
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.140186980
mov al, 1
jmp 0x1401872c0
xor al, al
mov rcx, qword [rsp + 0x2e0]
xor rcx, rsp
call fcn.1402474e0
add rsp, 0x2f0
pop rbx
ret
Function at 0x140189cc0
Capabilities:
Resolve dns

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x90
mov rax, qword [0x140353c70]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rdi, r9
mov rsi, r8
mov r14, rdx
mov rbx, rcx
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rax
lea r8, str.dns_gethostbyname
mov rdx, r9
lea rcx, [rsp + 0x40]
call fcn.14004ce70
nop
xor ebp, ebp
mov dword [r14], ebp
mov rcx, rsi
call fcn.140030e50
mov rax, qword [rdi]
mov r8, rbx
lea rdx, str.hostname
mov rcx, rdi
call qword [rax + 0x58]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_gethostbyname]
test rax, rax
je 0x140189db3
mov rcx, qword [rax + 0x18]
mov rdx, qword [rcx]
test rdx, rdx
je 0x140189d4c
mov ebp, dword [rdx]
mov dword [r14], ebp
mov rax, qword [rax + 0x18]
mov r9, qword [rax]
lea rax, [r9 + 3]
lea rcx, [r9 + 2]
lea rdx, [r9 + 1]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rdx
lea r8, str._b._b._b._b
mov edx, 0x28
lea rcx, [rsp + 0x58]
call fcn.14007b200
lea rdx, [rsp + 0x58]
mov rcx, rsi
call fcn.1400377d0
cmp byte [rdi + 0x169], 0
je 0x140189daf
mov r8, rsi
lea rdx, [0x1402a2f70]
mov rcx, rdi
call fcn.14004db10
mov bl, 1
jmp 0x140189db5
xor bl, bl
lea rcx, [rsp + 0x40]
call fcn.14004d020
movzx eax, bl
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1402474e0
add rsp, 0x90
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14018b660
Capabilities:
Connect socket
Connect udp socket
Create udp socket

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x140353c70]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov esi, 2
mov qword [rcx + 8], 0
mov rdi, rcx
mov edx, esi
mov ecx, esi
xor r8d, r8d
mov rbx, r9
call qword [sym.imp.WS2_32.dll_socket]
mov qword [rdi], rax
cmp rax, 0xffffffffffffffff
jne 0x14018b6bb
mov rax, qword [rbx]
lea rdx, str.Failed_to_create_a_UDP_socket.
mov rcx, rbx
call qword [rax + 0x28]
xor al, al
jmp 0x14018b72e
lea rcx, [rdi + 0x28]
mov qword [rsp + 0x28], 0
mov word [rsp + 0x20], si
call fcn.140033b70
mov rcx, rax
call qword [sym.imp.WS2_32.dll_inet_addr]
mov ecx, 0x35
mov dword [rsp + 0x24], eax
call qword [sym.imp.WS2_32.dll_htons]
mov rcx, qword [rdi]
lea rdx, [rsp + 0x20]
mov r8d, reloc.WS2_32.dll_recv
mov word [rsp + 0x22], ax
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x14018b72c
mov rax, qword [rbx]
lea rdx, str.Failed_to_specify_a_UDP_socket_destination_address.
mov rcx, rbx
call qword [rax + 0x28]
mov rcx, qword [rdi]
call qword [sym.imp.WS2_32.dll_closesocket]
xor al, al
mov qword [rdi], 0xffffffffffffffff
jmp 0x14018b72e
mov al, 1
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1402474e0
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x14018b750
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x670
mov rax, qword [0x140353c70]
xor rax, rsp
mov qword [rsp + 0x660], rax
mov rsi, qword [rsp + 0x6c0]
mov rdi, r8
mov rbx, qword [rsp + 0x6c8]
mov r14, rdx
movsxd rbp, ecx
mov rcx, r8
call fcn.140040520
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x640
call fcn.14003be60
mov rdx, rbx
mov rcx, rsi
call fcn.1401a2300
test al, al
je 0x14018b7c9
mov rax, qword [rbx]
mov rcx, rbx
mov rdx, qword [str.0W__]
call qword [rax + 0x28]
xor al, al
jmp 0x14018b865
imul rcx, rbp, 0xb8
xor r9d, r9d
lea rdx, [rsp + 0x20]
mov r8d, 0x640
mov rcx, qword [rcx + r14]
call qword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
jne 0x14018b83d
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2743
jne 0x14018b81e
mov byte [rsi + 0x2c], 1
mov ecx, eax
xor edx, edx
mov r8, rbx
call fcn.140191e70
mov rax, qword [rbx]
lea rdx, str.Failed_to_receive_DNS_query_response_on_UDP_socket.
mov rcx, rbx
call qword [rax + 0x28]
xor al, al
jmp 0x14018b865
cmp eax, 0x2733
je 0x14018b829
mov ecx, eax
jmp 0x14018b800
mov rax, qword [rbx]
lea rdx, str.Received_0_bytes.
mov rcx, rbx
call qword [rax + 0x28]
xor al, al
jmp 0x14018b865
test eax, eax
jne 0x14018b855
mov rax, qword [rbx]
lea rdx, str.Received_0_response_from_recv.
mov rcx, rbx
call qword [rax + 0x28]
xor al, al
jmp 0x14018b865
mov r8d, eax
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.14003e880
mov rcx, qword [rsp + 0x660]
xor rcx, rsp
call fcn.1402474e0
add rsp, 0x670
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14018c570
Capabilities:
Send data
Send data on socket

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x140353c70]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, qword [rsp + 0x90]
mov rsi, rcx
mov rcx, qword [rcx]
mov eax, r8d
mov rbp, rdx
cmp rcx, 0xffffffffffffffff
jne 0x14018c5b8
mov rax, qword [rdi]
lea rdx, str.Cannot_send_to_invalid_UDP_socket
mov rcx, rdi
call qword [rax + 0x28]
xor al, al
jmp 0x14018c6a5
cmp dword [rsi + 0x10], 6
jl 0x14018c5d5
mov rax, qword [rdi]
lea rdx, str.Too_many_retries_for_this_nameserver.
mov rcx, rdi
call qword [rax + 0x28]
xor al, al
jmp 0x14018c6a5
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov edx, eax
call fcn.14018cb00
test al, al
jne 0x14018c60f
lea rdx, str.Waited__but_cannot_send_on_UDP_socket_without_waiting_longer.
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x28]
mov rcx, qword [rsi]
call qword [sym.imp.WS2_32.dll_closesocket]
xor al, al
mov qword [rsi], 0xffffffffffffffff
jmp 0x14018c6a5
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x48], rbx
mov ecx, 2
call fcn.14007edd0
mov rcx, rbp
call fcn.1400428d0
movzx edx, byte [rsp + 0x30]
mov rcx, rbp
mov byte [rax], dl
movzx edx, byte [rsp + 0x31]
mov byte [rax + 1], dl
movsxd rdx, dword [rsi + 0x10]
movzx eax, byte [rsp + 0x30]
mov byte [rsi + rdx*2 + 0x14], al
movsxd rdx, dword [rsi + 0x10]
movzx eax, byte [rsp + 0x31]
mov byte [rsi + rdx*2 + 0x15], al
call fcn.140042d30
mov rcx, rbp
mov ebx, eax
call fcn.1400428d0
mov rcx, qword [rsi]
mov rdx, rax
xor r9d, r9d
mov r8d, ebx
call qword [sym.imp.WS2_32.dll_send]
mov rbx, qword [rsp + 0x48]
cmp eax, 0xffffffff
jne 0x14018c6a0
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r8, rdi
xor edx, edx
mov ecx, eax
call fcn.140191e70
lea rdx, str.Failed_to_send_DNS_query_on_UDP_socket.
jmp 0x14018c5ef
inc dword [rsi + 0x10]
mov al, 1
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1402474e0
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x14018d540
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x1b0
mov rax, qword [0x140353c70]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
mov rbx, rcx
call sub.KERNEL32.dll_GetTickCount
mov ecx, dword [rbx + 0x18]
cmp eax, ecx
jb 0x14018d5c1
cmp eax, dword [rbx + 0x28]
jb 0x14018d5c1
sub eax, ecx
mov ecx, eax
je 0x14018d643
mov r8, qword [rbx + 8]
mov eax, 1
add r8, rcx
cmove r8, rax
mov r9, qword [rbx + 0x20]
add r9, qword [rbx + 0x10]
imul rax, r9, 0x3e8
cqo
idiv r8
mov ecx, 0xffffffff
cmp rax, rcx
jg 0x14018d643
mov qword [rbx + 0x30], r9
mov qword [rbx + 0x38], rax
jmp 0x14018d643
xor edx, edx
mov r8d, 0x178
lea rcx, [rsp + 0x20]
call sub.VCRUNTIME140.dll_memset
lea rcx, [rsp + 0x20]
call fcn.14004cf80
nop
cmp byte [0x140357725], 0
je 0x14018d618
mov eax, dword [rbx + 0x44]
cmp eax, 1
jne 0x14018d5f8
lea rdx, str.resetSendPerfMon
jmp 0x14018d60b
cmp eax, 2
lea rdx, str.resetReceivePerfMon
je 0x14018d60b
lea rdx, str.resetPerformanceMon
mov rax, qword [rsp + 0x20]
lea rcx, [rsp + 0x20]
call qword [rax + 0x30]
xor esi, esi
mov dword [rbx + 0x28], esi
mov qword [rbx + 0x20], rsi
call sub.KERNEL32.dll_GetTickCount
mov dword [rbx + 0x18], eax
mov qword [rbx + 8], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x30], rsi
mov qword [rbx + 0x38], rsi
lea rcx, [rsp + 0x20]
call fcn.14004d070
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.1402474e0
lea r11, [rsp + 0x1b0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x14018dd60
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
cmp dword [rcx + 0x298], 2
je fcn.14018f100
jmp fcn.14018f210
Function at 0x14018e580
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x80
mov rax, qword [0x140353c70]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rbx, rcx
mov rcx, qword [rcx + 0x290]
cmp rcx, 0xffffffffffffffff
jne 0x14018e5af
xor al, al
jmp 0x14018e640
xor r8d, r8d
mov dword [rsp + 0x54], 1
mov dword [rsp + 0x58], r8d
test dl, dl
je 0x14018e620
mov qword [rsp + 0x40], r8
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], r8
lea r9d, [r8 + 0xc]
mov qword [rsp + 0x30], rax
mov edx, 0x98000004
mov dword [rsp + 0x28], r8d
mov qword [rsp + 0x20], r8
mov dword [rsp + 0x50], r8d
lea r8, [rsp + 0x60]
mov dword [rsp + 0x60], 1
mov dword [rsp + 0x68], 0x7148
mov dword [rsp + 0x64], 0x1d0d8
call qword [sym.imp.WS2_32.dll_WSAIoctl]
mov rcx, qword [rbx + 0x290]
lea r9, [rsp + 0x54]
jmp 0x14018e625
lea r9, [rsp + 0x58]
mov r8d, 8
mov dword [rsp + 0x20], 4
mov edx, 0xffff
call qword [sym.imp.WS2_32.dll_setsockopt]
mov al, 1
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1402474e0
add rsp, 0x80
pop rbx
ret

Function at 0x14018eac0
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx + 0x290], 0xffffffffffffffff
mov rsi, rdx
mov rdi, rcx
je 0x14018eb61
mov r8d, dword [rcx + 0xd4]
mov qword [rsp + 0x40], rbx
lea eax, [r8 - 0x1000]
cmp eax, 0x7ff000
ja 0x14018eb5c
and r8d, 0xfffff000
mov dword [rcx + 0xd4], r8d
cmp byte [rdx + 0x169], 0
je 0x14018eb35
mov rax, qword [rdx]
mov rcx, rsi
lea rdx, str.Setting_SO_RCVBUF_size
call qword [rax + 0x30]
mov r8d, dword [rdi + 0xd4]
lea rdx, str.recvBufSize
mov rcx, rsi
call fcn.14004d750
mov rcx, qword [rdi + 0x290]
lea r9, [rdi + 0xd4]
mov edx, 0xffff
mov dword [rsp + 0x20], 4
mov r8d, 0x1002
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x14018eb70
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx + 0x290], 0xffffffffffffffff
mov rsi, rdx
mov rdi, rcx
je 0x14018ec11
mov r8d, dword [rcx + 0xd0]
mov qword [rsp + 0x40], rbx
lea eax, [r8 - 0x1000]
cmp eax, 0x7ff000
ja 0x14018ec0c
and r8d, 0xfffff000
mov dword [rcx + 0xd0], r8d
cmp byte [rdx + 0x169], 0
je 0x14018ebe5
mov rax, qword [rdx]
mov rcx, rsi
lea rdx, str.Setting_SO_SNDBUF_size
call qword [rax + 0x30]
mov r8d, dword [rdi + 0xd0]
lea rdx, str.sendBufSize
mov rcx, rsi
call fcn.14004d750
mov rcx, qword [rdi + 0x290]
lea r9, [rdi + 0xd0]
mov edx, 0xffff
mov dword [rsp + 0x20], 4
mov r8d, 0x1001
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret