joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41210b
Capabilities:
Resolve dns

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xd0
or eax, 0xffffffff
test rcx, rcx
mov rbx, rcx
mov rbp, rdx
je 0x41233e
mov word [rcx + 0x40], 0x17
mov dword [rsp + 0x3c], r8d
movzx ecx, r8w
mov dword [rsp + 0x4c], 0
call qword [sym.imp.WS2_32.dll_htons]
mov r8d, dword [rsp + 0x3c]
test rbp, rbp
mov word [rbx + 0x42], ax
mov word [rbx + 0x68], r8w
je 0x412160
cmp byte [rbp], 0
jne 0x41217a
mov rax, qword [0x0048e480]
lea rcx, [0x0047c627]
movups xmm0, xmmword [rax]
movups xmmword [rbx + 0x48], xmm0
jmp 0x412271
lea rdi, [rsp + 0x58]
xor eax, eax
mov ecx, 0xc
xor edx, edx
mov qword [rsp + 0x50], 0
lea r9, [rsp + 0x50]
rep stosd dword [rdi], eax
lea r8, [rsp + 0x58]
mov dword [rsp + 0x58], 4
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
jne 0x41232c
mov rax, qword [rsp + 0x50]
mov r12, qword [sym.imp.WS2_32.dll_freeaddrinfo]
mov r9d, dword [rax + 4]
cmp r9d, 2
jne 0x412210
lea rsi, [rsp + 0x8f]
lea r8, str.::ffff:_s
mov r9, rbp
mov edx, 0x41
mov rcx, rsi
call sym.snprintf.constprop.1
lea r8, [rbx + 0x48]
mov rdx, rsi
mov ecx, 0x17
call sym.inet_pton
test eax, eax
jg 0x412266
mov rax, qword [0x0048e480]
movups xmm1, xmmword [rax]
movups xmmword [rbx + 0x48], xmm1
jmp 0x412266
cmp r9d, 0x17
jne 0x412235
mov rdi, qword [rax + 0x20]
lea rdx, [rbx + 0x48]
mov rcx, qword [rax + 0x10]
mov dword [rsp + 0x4c], 1
lea rsi, [rdi + 8]
mov rdi, rdx
rep movsb byte [rdi], byte [rsi]
jmp 0x412266
mov rax, qword [0x0048e400]
cmp dword [rax], 0
jle 0x412259
lea r8, str.unsupported_address_family:__d_n
lea rcx, str._mettle_mettle_src_network_server.c
mov edx, 0x6d
call sym.zlog_time
mov rcx, qword [rsp + 0x50]
call r12
jmp 0x41232c
mov rcx, qword [rsp + 0x50]
call r12
mov rcx, rbp
call sym.strdup
xor r8d, r8d
mov qword [rbx + 0x60], rax
mov edx, 1
mov ecx, 0x17
call qword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
mov dword [rbx + 8], eax
je 0x41232c
mov ecx, eax
call sym.make_socket_nonblocking
mov ecx, dword [rbx + 8]
lea r9, [rsp + 0x4c]
mov r8d, 0x1b
mov edx, 0x29
mov dword [rsp + 0x20], 4
call sym.posix_setsockopt
movsxd rcx, dword [rbx + 8]
lea rdx, [rbx + 0x40]
mov r8d, 0x1c
call qword [sym.imp.WS2_32.dll_bind]
inc eax
je 0x41232c
movsxd rcx, dword [rbx + 8]
mov edx, 0x10
call qword [sym.imp.WS2_32.dll_listen]
inc eax
je 0x41232c
lea rax, [sym.connect_cb]
mov rcx, qword [rbx]
lea rdx, [rbx + 0x10]
mov dword [rbx + 0x14], 0
mov dword [rbx + 0x10], 0
mov qword [rbx + 0x28], rax
mov eax, dword [rbx + 8]
mov dword [rbx + 0x18], 0
mov dword [rbx + 0x3c], 0x81
mov qword [rbx + 0x20], rbx
mov dword [rbx + 0x38], eax
call sym.ev_io_start
xor eax, eax
jmp 0x41233e
mov ecx, dword [rbx + 8]
call sym.posix_close
mov dword [rbx + 8], 0
or eax, 0xffffffff
add rsp, 0xd0
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x4123e7
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rsi
push rbx
sub rsp, 0xb8
movsxd rcx, dword [rcx + 8]
lea rbx, [rsp + 0x30]
mov rsi, rdx
mov dword [rsp + 0x2c], pe_nt_image_headers64
lea r8, [rsp + 0x2c]
mov rdx, rbx
call qword [sym.imp.WS2_32.dll_getsockname]
mov edx, eax
xor eax, eax
inc edx
je 0x412425
mov rdx, rsi
mov rcx, rbx
call sym.parse_sockaddr
add rsp, 0xb8
pop rbx
pop rsi
ret

Function at 0x413564
Capabilities:
Hash data using sha1

Disassembly:
mov qword [rcx + 0x18], 0
mov dword [rcx], 0x67452301
mov dword [rcx + 4], 0xefcdab89
mov dword [rcx + 8], 0x98badcfe
mov dword [rcx + 0xc], 0x10325476
mov dword [rcx + 0x10], 0xc3d2e1f0
ret

Function at 0x4139b0
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x38
mov edx, 0x8004667e
mov dword [rsp + 0x2c], 1
movsxd rcx, ecx
lea r8, [rsp + 0x2c]
call qword [sym.imp.WS2_32.dll_ioctlsocket]
inc eax
sete al
movzx eax, al
neg eax
add rsp, 0x38
ret

Function at 0x4145bb
Capabilities:
Resolve dns

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x168
xor eax, eax
mov rdi, rcx
mov rbx, rdx
mov dl, byte [rdi + rax]
cmp dl, 0x2f
jne 0x414660
lea rsi, [rdi + rax + 1]
movsxd rdx, eax
lea rbp, [rsp + 0x28]
mov byte [rsp + rdx + 0x34], 0
mov edx, 0x2e
mov rcx, rsi
call sym.strchr
test rax, rax
je 0x41462a
mov rdx, rbp
mov rcx, rsi
call sym.ip_pton
test eax, eax
jne 0x4146fe
lea r8, [rsp + 0x26]
mov edx, 4
mov rcx, rbp
call sym.addr_mtob
movzx esi, word [rsp + 0x26]
jmp 0x41467a
mov rcx, rsi
mov r8d, 0xa
mov rdx, rbp
call sym.strtol
mov esi, eax
mov rax, qword [rsp + 0x28]
cmp rdi, rax
je 0x4146fe
cmp byte [rax], 0
jne 0x4146fe
mov eax, esi
shr eax, 0x1f
je 0x41467a
jmp 0x4146fe
test dl, dl
mov byte [rsp + rax + 0x34], dl
je 0x414677
inc rax
cmp rax, 0x12b
jne 0x4145ce
or esi, 0xffffffff
lea rbp, [rbx + 4]
lea rdi, [rsp + 0x34]
mov rdx, rbp
mov rcx, rdi
call sym.ip_pton
test eax, eax
je 0x4146e4
mov rdx, rbp
mov rcx, rdi
call sym.eth_pton
test eax, eax
jne 0x4146ae
mov word [rbx], 1
mov word [rbx + 2], 0x30
jmp 0x4146ef
mov rdx, rbp
mov rcx, rdi
call sym.ip6_pton
test eax, eax
jne 0x4146ca
mov word [rbx], 3
mov word [rbx + 2], pe_nt_image_headers64
jmp 0x4146ef
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_gethostbyname]
test rax, rax
je 0x4146fe
mov rax, qword [rax + 0x18]
mov rax, qword [rax]
mov eax, dword [rax]
mov dword [rbx + 4], eax
mov word [rbx], 2
mov word [rbx + 2], 0x20
xor eax, eax
cmp esi, 0xffffffff
je 0x414715
movzx eax, word [rbx + 2]
cmp esi, eax
jle 0x41470f
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], 0x16
or eax, 0xffffffff
jmp 0x414715
mov word [rbx + 2], si
xor eax, eax
add rsp, 0x168
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x414dc9
Capabilities:
Get local ipv4 addresses

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
xor r12d, r12d
lea rbx, [rsp + 0x3c]
mov rsi, rcx
mov dword [rsp + 0x3c], 0x4000
mov rcx, r12
call sym.free
mov ecx, dword [rsp + 0x3c]
call sym.malloc
test rax, rax
mov r12, rax
je 0x414e27
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rbx
mov r9, rax
mov edx, 0x16
call sym.GetAdaptersAddresses
cmp eax, 0x6f
je 0x414de6
test eax, eax
je 0x414e2f
mov rcx, r12
call sym.free
or eax, 0xffffffff
jmp 0x414ec2
mov qword [rsi + 0x910], r12
mov ecx, dword [r12 + 0x64]
call sym._ifcombo_name
mov rcx, rax
call sym._ifcombo_type
cmp eax, 0x90
jg 0x414e27
cdqe
mov edi, dword [r12 + 0x6c]
mov ebp, dword [r12 + 4]
shl rax, 4
lea rbx, [rsi + rax]
mov edx, dword [rbx + 8]
cmp edx, dword [rbx + 0xc]
jne 0x414e9a
mov rcx, qword [rbx]
test rcx, rcx
je 0x414e86
add edx, edx
mov dword [rbx + 0xc], edx
movsxd rdx, edx
shl rdx, 3
call sym.realloc
jmp 0x414e97
mov dword [rbx + 0xc], 8
mov ecx, 0x40
call sym.malloc
mov qword [rbx], rax
movsxd rcx, dword [rbx + 8]
mov rdx, qword [rbx]
mov rax, rcx
lea rdx, [rdx + rcx*8]
inc eax
mov dword [rdx], ebp
mov dword [rdx + 4], edi
mov dword [rbx + 8], eax
mov r12, qword [r12 + 8]
test r12, r12
jne 0x414e36
xor eax, eax
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x415318
Capabilities:
Get routing table

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x448
lea rsi, [rsp + 0x3c]
mov rdi, rcx
mov r14, rdx
mov qword [rsp + 0x4a0], r8
mov dword [rsp + 0x3c], 0x3c
mov rcx, qword [rdi]
test rcx, rcx
je 0x415353
call sym.free
mov ecx, dword [rsp + 0x3c]
call sym.malloc
test rax, rax
mov qword [rdi], rax
jne 0x41536c
or eax, 0xffffffff
jmp 0x415468
xor r8d, r8d
mov rdx, rsi
mov rcx, rax
call sym.GetIpForwardTable
test eax, eax
mov ebx, eax
je 0x415387
cmp eax, 0x7a
je 0x415346
jmp 0x415364
lea rbp, [rsp + 0x40]
lea r13, [rsp + 0x8c]
xor esi, esi
call sym.intf_open
mov r12, rax
lea rax, [rbp + 0x22]
mov qword [rsp + 0x28], rax
mov rcx, qword [rdi]
cmp esi, dword [rcx]
jge 0x41545e
movsxd r9, esi
mov r8, qword [rsp + 0x28]
mov edx, 4
imul r15, r9, 0x38
mov word [rsp + 0x60], 2
mov word [rsp + 0x62], 0x20
mov word [rsp + 0x74], 2
mov word [rsp + 0x76], 0x20
add rcx, r15
mov eax, dword [rcx + 4]
add rcx, 8
mov dword [rsp + 0x64], eax
call sym.addr_mtob
add r15, qword [rdi]
mov r8d, 2
mov rdx, r13
mov rcx, r12
mov dword [rsp + 0x8c], 0x3b4
mov eax, dword [r15 + 0x10]
mov byte [rsp + 0x40], 0
mov dword [rsp + 0x78], eax
mov eax, dword [r15 + 0x28]
mov r9d, dword [r15 + 0x14]
mov dword [rsp + 0x88], eax
call sym.intf_get_index
test eax, eax
jne 0x415443
lea rdx, [r13 + 4]
mov r8d, 0x20
mov rcx, rbp
call sym.strlcpy
mov rdx, qword [rsp + 0x4a0]
mov rcx, rbp
call r14
test eax, eax
jne 0x41545c
inc esi
jmp 0x4153a7
mov ebx, eax
mov rcx, r12
call sym.intf_close
mov eax, ebx
add rsp, 0x448
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x4156e2
Capabilities:
Get routing table

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
mov rcx, qword [rcx]
mov rsi, rdx
test rcx, rcx
jne 0x415708
lea rcx, [rbx + 8]
mov rdx, rsi
add rsp, 0x38
pop rbx
pop rsi
jmp sym.route_loop_getipforwardtable.isra.0
mov qword [rsp + 0x28], r8
lea rdx, str.GetIpForwardTable2
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov r8, qword [rsp + 0x28]
je 0x4156f6
mov r9, r8
mov rdx, rbx
mov r8, rsi
mov rcx, rax
add rsp, 0x38
pop rbx
pop rsi
jmp sym.route_loop_getipforwardtable2
Function at 0x421940
Capabilities:
Read file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rax, 0xfffffffffffffffe
test r8, r8
mov rbx, rcx
mov rsi, rdx
jne 0x421960
add rsp, 0x38
pop rbx
pop rsi
ret
mov rax, qword [r9 + 0x48]
test rax, rax
je 0x421980
mov r9, rax
mov rdx, rsi
mov rcx, rbx
add rsp, 0x38
pop rbx
pop rsi
jmp sym.fread
mov rcx, qword [r9 + 0x20]
lea rdx, [0x0047f6c0]
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x20], r9
call sym.curlx_win32_fopen
mov r9, qword [rsp + 0x20]
test rax, rax
mov r8, qword [rsp + 0x28]
mov qword [r9 + 0x48], rax
jne 0x421969
or rax, 0xffffffffffffffff
jmp 0x421958
Function at 0x4264e0
Capabilities:
Send data
Send data on socket

Disassembly:
push rbx
sub rsp, 0x30
mov ebx, 1
test rcx, rcx
je 0x4264f7
cmp dword [rcx], 0xbab1e
je 0x426500
mov eax, ebx
add rsp, 0x30
pop rbx
ret
mov rcx, qword [rcx + 0x180]
mov ebx, 9
cmp rcx, 0xffffffffffffffff
je 0x4264f7
xor r9d, r9d
mov byte [rsp + 0x2f], 1
lea rdx, [rsp + 0x2f]
mov r8d, 1
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
js 0x426540
xor ebx, ebx
mov eax, ebx
add rsp, 0x30
pop rbx
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x4264f7
jmp 0x42652f

Function at 0x429660
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x38
xor eax, eax
lea r8, [rsp + 0x2c]
test edx, edx
mov edx, 0x8004667e
setne al
mov dword [rsp + 0x2c], eax
call qword [sym.imp.WS2_32.dll_ioctlsocket]
add rsp, 0x38
ret

Function at 0x42c850
Capabilities:
Get socket status

Disassembly:
push rbx
sub rsp, 0x40
mov r10, qword [rsp + 0x70]
test rdx, rdx
mov r11, rdx
je 0x42c868
mov eax, dword [rdx]
test eax, eax
jne 0x42c891
test r8, r8
je 0x42c874
mov eax, dword [r8]
test eax, eax
jne 0x42c891
test r9, r9
je 0x42c974
mov ebx, dword [r9]
test ebx, ebx
je 0x42c974
test r10, r10
jns 0x42c898
xor ebx, ebx
jmp 0x42c902
xor ebx, ebx
test r10, r10
js 0x42c8ee
test r10, r10
je 0x42c940
mov rax, r10
movabs rdx, 0x20c49ba5e353f7cf
lea rbx, [rsp + 0x30]
imul rdx
mov rax, r10
sar rax, 0x3f
sar rdx, 7
sub rdx, rax
mov eax, 0x7fffffff
cmp rdx, 0x7fffffff
cmovle rax, rdx
imul rdx, rdx, 0x3e8
mov dword [rsp + 0x30], eax
sub r10, rdx
imul r10, r10, 0x3e8
mov dword [rsp + 0x34], r10d
test r9, r9
je 0x42c95a
mov r10d, dword [r9]
mov eax, 0
test r10d, r10d
cmove r9, rax
test r8, r8
je 0x42c962
mov edx, dword [r8]
mov eax, 0
test edx, edx
cmove r8, rax
test r11, r11
je 0x42c970
mov eax, dword [r11]
mov edx, 0
test eax, eax
cmovne rdx, r11
add ecx, 1
mov qword [rsp + 0x20], rbx
call qword [sym.imp.WS2_32.dll_select]
add rsp, 0x40
pop rbx
ret
test r9, r9
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x34], 0
lea rbx, [rsp + 0x30]
jne 0x42c8f3
xor r9d, r9d
test r8, r8
jne 0x42c907
xor r8d, r8d
test r11, r11
jne 0x42c91a
nop word [rax + rax]
xor edx, edx
jmp 0x42c928
mov rcx, r10
call sym.Curl_wait_ms
add rsp, 0x40
pop rbx
ret

Function at 0x42d0f0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, r9
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recv]
cdqe
cmp rax, 0xffffffffffffffff
je 0x42d114
mov qword [rbx], rax
xor eax, eax
add rsp, 0x20
pop rbx
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, 0x38
cmp eax, 0x2733
mov eax, 0x51
cmovne eax, edx
mov qword [rbx], 0
add rsp, 0x20
pop rbx
ret
Function at 0x42d1c0
Capabilities:
Write file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
cmp qword [rcx + 0x6f8], 0
mov rbx, rcx
mov esi, edx
mov rbp, r8
mov r12, r9
je 0x42d220
mov edx, 1
call sym.Curl_set_in_callback
mov rax, qword [rbx + 0x650]
mov edx, esi
mov rcx, rbx
mov r9, r12
mov r8, rbp
mov qword [rsp + 0x20], rax
call qword [rbx + 0x6f8]
xor edx, edx
mov rcx, rbx
mov edi, eax
call sym.Curl_set_in_callback
mov eax, edi
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
xor edi, edi
cmp esi, 2
ja 0x42d212
mov r9, qword [rbx + 0x648]
lea rcx, [rsi + rsi*2]
lea rax, [0x00480e90]
mov r8d, 1
mov edx, 2
add rcx, rax
call sym.fwrite
mov r9, qword [rbx + 0x648]
mov r8d, 1
mov rdx, r12
mov rcx, rbp
call sym.fwrite
mov eax, edi
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x42d490
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x128
mov rsi, qword [rsp + 0x190]
movsxd rbx, edx
mov rdx, qword [rcx + 0x598]
mov rdi, rcx
lea rax, [rcx + rbx*8]
mov rbp, r8
mov r12, r9
test byte [rdx + 0x7c], 3
mov r13, qword [rax + 0x450]
je 0x42d4df
lea rdx, [sym.Curl_recv_plain]
cmp qword [rax + 0x478], rdx
je 0x42d520
xor r9d, r9d
mov r8d, r12d
mov rdx, rbp
mov rcx, r13
call qword [sym.imp.WS2_32.dll_send]
movsxd rbx, eax
mov dword [rsi], 0
cmp rbx, 0xffffffffffffffff
je 0x42d5b3
mov rax, rbx
add rsp, 0x128
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov r14, rbx
shl r14, 5
add r14, rcx
mov r8, qword [r14 + 0x4a0]
mov r15, r8
sub r15, qword [r14 + 0x4a8]
cmp qword [r14 + 0x498], 0
je 0x42d54a
test r15, r15
je 0x42d4df
mov r8, 0xffffffffffffffff
xor r9d, r9d
mov rcx, r13
mov rdx, r8
call sym.Curl_socket_check
cmp eax, 0xffffffff
je 0x42d4df
test al, 1
je 0x42d4df
shl rbx, 5
add rbx, rdi
mov rdx, qword [rbx + 0x498]
test rdx, rdx
je 0x42d60d
add rdx, qword [r14 + 0x4a8]
xor r9d, r9d
mov r8d, r15d
mov rcx, r13
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x42d4df
cdqe
add qword [r14 + 0x4a8], rax
jmp 0x42d4df
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
mov ebp, eax
je 0x42d600
lea rdx, [rsp + 0x20]
mov r8d, 0x100
mov ecx, eax
call sym.Curl_strerror
mov rcx, qword [rdi]
lea rdx, str.Send_failure:__s
mov r8, rax
call sym.Curl_failf
mov rax, qword [rdi]
mov dword [rax + 0x1138], ebp
mov dword [rsi], 0x37
jmp 0x42d504
mov dword [rsi], 0x51
xor ebx, ebx
jmp 0x42d504
mov rax, qword [rdi]
mov ecx, dword [rax + 0xac8]
mov rax, qword [0x0048e0f0]
add ecx, ecx
movsxd rcx, ecx
mov qword [rbx + 0x4a0], rcx
call qword [rax]
mov qword [rbx + 0x498], rax
mov qword [r14 + 0x4a8], 0
mov qword [r14 + 0x4b0], 0
mov rdx, qword [rbx + 0x498]
test rdx, rdx
jne 0x42d664
mov qword [rbx + 0x4a0], 0
jmp 0x42d4df
mov r15, qword [rbx + 0x4a0]
jmp 0x42d587
Function at 0x42d6b0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x128
mov rbp, qword [rsp + 0x190]
movsxd r15, edx
mov rdi, rcx
mov r13, r8
mov rsi, r15
mov r14, qword [rcx + r15*8 + 0x450]
mov r12, r9
shl rsi, 5
add rsi, rcx
mov rcx, qword [rsi + 0x498]
test rcx, rcx
je 0x42d7c0
mov rbx, qword [rsi + 0x4a8]
mov r9, qword [rsi + 0x4b0]
cmp rbx, r9
ja 0x42d780
mov ebx, 0
jne 0x42d7c0
mov rax, qword [0x0048e0e0]
shl r15, 5
add r15, rdi
call qword [rax]
mov qword [r15 + 0x498], 0
mov qword [r15 + 0x4a0], 0
mov qword [rsi + 0x4a8], 0
mov qword [rsi + 0x4b0], 0
test rbx, rbx
jle 0x42d7c0
mov dword [rbp], 0
mov rax, rbx
add rsp, 0x128
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
sub rbx, r9
lea rdx, [rcx + r9]
mov rcx, r13
cmp rbx, r12
cmova rbx, r12
mov r8, rbx
call sym.memcpy
mov rax, rbx
add rax, qword [rsi + 0x4b0]
cmp rax, qword [rsi + 0x4a8]
mov qword [rsi + 0x4b0], rax
jne 0x42d753
mov rcx, qword [rsi + 0x498]
jmp 0x42d717
xor r9d, r9d
mov r8d, r12d
mov rdx, r13
mov rcx, r14
call qword [sym.imp.WS2_32.dll_recv]
movsxd rbx, eax
mov dword [rbp], 0
cmp rbx, 0xffffffffffffffff
jne 0x42d75f
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
mov esi, eax
je 0x42d830
lea rdx, [rsp + 0x20]
mov r8d, 0x100
mov ecx, eax
call sym.Curl_strerror
mov rcx, qword [rdi]
lea rdx, str.Recv_failure:__s
mov r8, rax
call sym.Curl_failf
mov rax, qword [rdi]
mov dword [rax + 0x1138], esi
mov dword [rbp], 0x38
jmp 0x42d75f
mov dword [rbp], 0x51
jmp 0x42d75f
Function at 0x430a60
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Get local ipv4 addresses
Get socket information
Receive data
Receive data on socket
Send data
Send data on socket
Set socket configuration
Start tcp server

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x70
mov r8d, 6
mov edx, 1
mov ecx, 2
mov rdi, r9
mov dword [rsp + 0x38], 0x10
mov dword [rsp + 0x3c], 1
mov rbp, qword [sym.imp.WS2_32.dll_socket]
call rbp
cmp rax, 0xffffffffffffffff
mov rsi, rax
je 0x430ca0
mov eax, 2
mov qword [rsp + 0x40], 0
mov ecx, 0x7f000001
mov qword [rsp + 0x48], 0
mov word [rsp + 0x40], ax
lea rbx, [rsp + 0x40]
call qword [sym.imp.WS2_32.dll_htonl]
xor edx, edx
mov dword [rsp + 0x44], eax
mov qword [rdi + 8], 0xffffffffffffffff
mov word [rsp + 0x42], dx
mov qword [rdi], 0xffffffffffffffff
lea r9, [rsp + 0x3c]
mov dword [rsp + 0x20], 4
mov r8d, 4
mov edx, 0xffff
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x430c70
mov r8d, 0x10
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
je 0x430c70
lea r8, [rsp + 0x38]
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
je 0x430c70
mov edx, 1
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
je 0x430c70
xor r8d, r8d
mov edx, 1
mov ecx, 2
call rbp
cmp rax, 0xffffffffffffffff
mov qword [rdi], rax
je 0x430c70
mov r8d, 0x10
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x430c70
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_accept]
cmp rax, 0xffffffffffffffff
mov qword [rdi + 8], rax
je 0x430c70
lea rbp, [rsp + 0x50]
lea r8, [0x00480f20]
mov r9, rdi
mov edx, 0xc
mov rcx, rbp
mov rbx, rbp
call sym.curl_msnprintf
mov edx, dword [rbx]
add rbx, 4
lea eax, [rdx - 0x1010101]
not edx
and eax, edx
and eax, 0x80808080
je 0x430bd1
mov edx, eax
shr edx, 0x10
test eax, 0x8080
cmove eax, edx
lea rdx, [rbx + 2]
mov ecx, eax
cmove rbx, rdx
add cl, al
mov rdx, rbp
sbb rbx, 3
mov rcx, qword [rdi]
xor r9d, r9d
sub rbx, rbp
mov r8d, ebx
call qword [sym.imp.WS2_32.dll_send]
cdqe
cmp rbx, rax
jne 0x430c70
lea r12, [rbp + 0xc]
xor r9d, r9d
mov rcx, qword [rdi + 8]
mov r8d, 0xc
mov rdx, r12
call qword [sym.imp.WS2_32.dll_recv]
cdqe
cmp rbx, rax
jne 0x430c70
mov r8, rbx
mov rdx, r12
mov rcx, rbp
call sym.memcmp
test eax, eax
mov ebx, eax
jne 0x430c70
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_closesocket]
mov eax, ebx
add rsp, 0x70
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rbx, qword [sym.imp.WS2_32.dll_closesocket]
mov rcx, rsi
call rbx
mov rcx, qword [rdi]
call rbx
mov rcx, qword [rdi + 8]
call rbx
mov ebx, 0xffffffff
mov eax, ebx
add rsp, 0x70
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov ebx, eax
jmp 0x430c5f
Function at 0x433030
Capabilities:
Get common file path

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, rcx
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
mov rbx, rax
je 0x433130
lea rdx, str.LoadLibraryExA
mov rcx, rax
mov rbp, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rbp
lea rdx, [0x00482bec]
mov rcx, rsi
mov rdi, rax
call sym.strpbrk
test rax, rax
je 0x4330a0
test rdi, rdi
je 0x4330c0
mov r8d, 8
xor edx, edx
mov rcx, rsi
mov rax, rdi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp rax
test rdi, rdi
je 0x4330d4
lea rdx, str.AddDllDirectory
mov rcx, rbx
call rbp
test rax, rax
je 0x4330d4
mov r8d, 0x800
jmp 0x43308b
mov rcx, rsi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor edx, edx
xor ecx, ecx
mov r12, qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
call r12
test eax, eax
mov ebx, eax
je 0x433130
mov rcx, rsi
call sym.strlen
lea ecx, [rbx + 1]
add rcx, rax
mov rax, qword [0x0048e0f0]
call qword [rax]
test rax, rax
mov rbp, rax
je 0x433113
mov edx, ebx
mov rcx, rax
call r12
test eax, eax
jne 0x433140
xor ebx, ebx
mov rax, qword [0x0048e0e0]
mov rcx, rbp
call qword [rax]
mov rax, rbx
jmp 0x433132
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rcx, rbp
call sym.strlen
lea rcx, [rbp + rax + 1]
mov byte [rbp + rax], 0x5c
mov rdx, rsi
call sym.strcpy
test rdi, rdi
je 0x433171
mov r8d, 8
xor edx, edx
mov rcx, rbp
call rdi
mov rbx, rax
jmp 0x433115
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
jmp 0x433115

Function at 0x433180
Capabilities:
Initialize winsock library

Disassembly:
sub rsp, 0x1c8
and ecx, 2
je 0x4331c0
lea rdx, [rsp + 0x20]
mov ecx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x433235
mov eax, 2
add rsp, 0x1c8
ret
shr ax, 8
cmp ax, 2
jne 0x433242
nop
call sym.Curl_sspi_global_init
test eax, eax
jne 0x4331a9
lea rcx, [0x00482bff]
call sym.Curl_load_library
test rax, rax
mov qword [0x004a7668], rax
je 0x4331fd
lea rdx, str.if_nametoindex
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x4331fd
mov qword [0x004a7660], rax
xor edx, edx
mov r9d, 3
mov r8d, 2
mov ecx, 6
call sym.Curl_verify_windows_version
lea rcx, [0x004ac1d0]
test al, al
setne byte [0x004ac1c8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xor eax, eax
add rsp, 0x1c8
ret
movzx eax, word [rsp + 0x20]
cmp al, 2
je 0x4331b1
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 2
jmp 0x4331a9
Function at 0x437db0
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
call sym.read
cdqe
add rsp, 0x28
ret
Function at 0x43b620
Capabilities:
Send data
Send data on socket

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov r9d, dword [rcx + 0x18]
lea r8, [0x00483940]
mov rdi, qword [rcx + 0x78]
lea rsi, [rsp + 0x30]
mov rbx, rcx
mov edx, 0xc
mov rcx, rsi
call sym.curl_msnprintf
mov rcx, qword [rbx + 0x10]
lea r9, [rbx + 0x40]
lea r8, [rbx + 0x48]
mov rdx, rsi
call sym.Curl_getaddrinfo_ex
test eax, eax
mov esi, eax
jne 0x43b6c0
mov rcx, qword [rbx]
call dbg.pthread_mutex_lock
mov eax, dword [rbx + 8]
test eax, eax
jne 0x43b6df
mov rcx, qword [rbx + 0x30]
cmp rcx, 0xffffffffffffffff
je 0x43b69c
xor r9d, r9d
mov byte [rsp + 0x2f], 1
lea rdx, [rsp + 0x2f]
mov r8d, 1
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
js 0x43b710
mov rcx, qword [rbx]
mov dword [rbx + 8], 1
call dbg.pthread_mutex_unlock
xor eax, eax
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov rbp, qword [sym.imp.WS2_32.dll_WSAGetLastError]
call rbp
test eax, eax
jne 0x43b720
mov rcx, qword [rbx]
mov dword [rbx + 0x38], esi
call dbg.pthread_mutex_lock
mov eax, dword [rbx + 8]
test eax, eax
je 0x43b675
mov rcx, qword [rbx]
call dbg.pthread_mutex_unlock
mov rcx, rbx
call sym.destroy_thread_sync_data
mov rax, qword [0x0048e0e0]
mov rcx, rdi
call qword [rax]
xor eax, eax
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [rbx + 0x38], eax
jmp 0x43b69c
call rbp
mov edx, 8
test eax, eax
cmove eax, edx
mov dword [rbx + 0x38], eax
jmp 0x43b666