joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140053d9d
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
mov r9, rcx
add qword [rcx + 0x10], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x140053dd8
mov r15d, 8
sub r15, r11
cmp r15, r8
mov rax, r8
cmovb rax, r15
cmp rax, 3
jbe 0x140053de0
mov r14d, dword [rdx]
mov r10d, 4
jmp 0x140053de6
xor r15d, r15d
jmp 0x140053e96
xor r10d, r10d
xor r14d, r14d
mov rcx, r10
or rcx, 1
cmp rcx, rax
jae 0x140053e09
movzx edi, word [rdx + r10]
lea ecx, [r10*8]
shl rdi, cl
or r14, rdi
or r10, 2
cmp r10, rax
jae 0x140053e20
movzx eax, byte [rdx + r10]
shl r10d, 3
mov ecx, r10d
shl rax, cl
or r14, rax
lea ecx, [r11*8]
shl r14, cl
or r14, qword [r9 + 0x38]
mov qword [r9 + 0x38], r14
cmp r15, r8
jbe 0x140053e40
add r11, r8
jmp 0x140053f67
mov rcx, qword [r9 + 0x30]
mov rdi, qword [r9 + 0x28]
mov rax, qword [r9 + 0x18]
add rax, rdi
rol rdi, 0xd
xor rcx, r14
xor rdi, rax
rol rax, 0x20
mov rsi, qword [r9 + 0x20]
add rsi, rcx
rol rcx, 0x10
xor rcx, rsi
add rax, rcx
rol rcx, 0x15
xor rcx, rax
add rsi, rdi
rol rdi, 0x11
mov qword [r9 + 0x30], rcx
xor rdi, rsi
rol rsi, 0x20
mov qword [r9 + 0x28], rdi
mov qword [r9 + 0x20], rsi
xor rax, r14
mov qword [r9 + 0x18], rax
sub r8, r15
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r15, r8
jae 0x140053f0c
mov rax, qword [r9 + 0x30]
mov rsi, qword [r9 + 0x18]
mov rcx, qword [r9 + 0x20]
mov rdi, qword [r9 + 0x28]
add rsi, rdi
rol rdi, 0xd
mov rbx, qword [rdx + r15]
xor rdi, rsi
rol rsi, 0x20
xor rax, rbx
add rcx, rax
rol rax, 0x10
xor rax, rcx
add rsi, rax
rol rax, 0x15
add rcx, rdi
rol rdi, 0x11
xor rdi, rcx
rol rcx, 0x20
xor rax, rsi
xor rsi, rbx
add r15, 8
cmp r15, r8
jb 0x140053eb9
mov qword [r9 + 0x30], rax
mov qword [r9 + 0x18], rsi
mov qword [r9 + 0x28], rdi
mov qword [r9 + 0x20], rcx
cmp r11d, 3
jbe 0x140053f1e
mov esi, dword [rdx + r15]
mov r8d, 4
jmp 0x140053f23
xor r8d, r8d
xor esi, esi
mov rax, r8
or rax, 1
cmp rax, r11
jae 0x140053f49
lea rax, [r8 + r15]
movzx eax, word [rdx + rax]
lea ecx, [r8*8]
shl rax, cl
or rsi, rax
or r8, 2
cmp r8, r11
jae 0x140053f63
add r15, r8
movzx eax, byte [rdx + r15]
shl r8d, 3
mov ecx, r8d
shl rax, cl
or rsi, rax
mov qword [r9 + 0x38], rsi
mov qword [r9 + 0x40], r11
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140054de3
Capabilities:
Inspect section memory permissions

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rcx
mov rdi, qword [rcx + 0x18]
mov rax, qword [rdi + 0xa0]
mov rcx, qword [rcx + 8]
cmp rax, 3
jb 0x140054e29
mov rdx, rcx
sub rdx, qword [rsi + 0x10]
jb 0x140054e29
mov rbp, qword [rdi + 0x40]
add rbp, rbp
lea rbp, [rbp + rbp*4]
cmp rdx, rbp
jbe 0x140054feb
mov qword [rsi + 0x10], rcx
inc rax
mov qword [rdi + 0xa0], rax
mov rcx, qword [rdi + 0x48]
test rcx, rcx
je 0x140055000
mov eax, dword [rsi + 0x20]
and eax, 0xbfffffff
xor edx, edx
div rcx
cmp rax, qword [rdi + 0x40]
jae 0x140055000
mov rcx, qword [rdi + 0x30]
shl rax, 4
mov r13, qword [rcx + rax]
lock inc qword [r13]
jle 0x140055000
mov r15, qword [rcx + rax + 8]
mov eax, dword [rsi + 0x24]
cmp rax, 0x20000000
jae 0x140054ec1
mov rcx, qword [rdi + 0x48]
test rcx, rcx
je 0x140055000
xor edx, edx
div rcx
cmp rax, qword [rdi + 0x40]
jae 0x140055000
mov rcx, qword [rdi + 0x30]
shl rax, 4
mov r12, qword [rcx + rax]
lock inc qword [r12]
jle 0x140055000
mov rax, qword [rcx + rax + 8]
mov qword [rsp + 0x20], rax
jmp 0x140054ec4
xor r12d, r12d
mov rax, qword [rdi + 0x98]
add rax, qword [rdi + 0x80]
shl rax, 2
mov qword [rdi + 0xa8], rax
mov qword [rdi + 0x60], 0
lea rcx, [rdi + 0x10]
call fcn.140054293
mov rbx, qword [rdi + 0x10]
test rbx, rbx
je 0x140054f06
mov rcx, qword [rdi + 0x18]
lea r8, [rbx + 0x11]
mov dl, 0xff
call fcn.140092ff0
xor eax, eax
mov qword [rdi + 0x28], rax
lea rcx, [rbx + 1]
shr rcx, 3
lea rdx, [rcx*8]
sub rdx, rcx
cmp rbx, 8
cmovb rdx, rbx
mov qword [rdi + 0x20], rdx
mov rbx, qword [rdi + 0x30]
mov rbp, qword [rdi + 0x40]
mov qword [rdi + 0x40], rax
test rbp, rbp
je 0x140054f64
shl rbp, 4
xor r14d, r14d
mov rax, qword [rbx + r14]
lock dec qword [rax]
jne 0x140054f5b
mov rcx, qword [rbx + r14]
mov rdx, qword [rbx + r14 + 8]
call fcn.14004b500
add r14, 0x10
cmp rbp, r14
jne 0x140054f43
mov rax, qword [rdi + 0x80]
test rax, rax
je 0x140054f8a
mov rcx, qword [rdi + 0x70]
shl rax, 2
xor edx, edx
mov dword [rcx + rdx], 0x80000000
add rdx, 4
cmp rax, rdx
jne 0x140054f7a
mov rcx, rsi
mov rdx, r13
mov r8, r15
call fcn.140055004
test eax, eax
je 0x140055000
mov ebx, edx
mov rdi, qword [rsi]
cmp byte [rdi + 0x31b], 0
jne 0x140054fc8
mov rcx, rdi
call fcn.1400555c4
test rax, rax
je 0x140054fc8
mov eax, ebx
or eax, 0x40000000
cmp byte [rdi + 0x31c], 0
cmove ebx, eax
mov dword [rsi + 0x20], ebx
mov bl, 1
test r12, r12
je 0x140054fed
mov rcx, rsi
mov rdx, r12
mov r8, qword [rsp + 0x20]
call fcn.140055004
test eax, eax
je 0x140055000
mov dword [rsi + 0x24], edx
jmp 0x140054fed
xor ebx, ebx
mov eax, ebx
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
ud2
Function at 0x140082714
Capabilities:
Get client handle via schannel
Get outbound credentials handle via credssp

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0xd0
movaps xmmword [rsp + 0xc0], xmm6
mov r8, rdx
mov r14, rcx
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0xa0], xmm0
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x70], xmm0
mov dword [rsp + 0x60], 4
mov dword [rsp + 0xa8], 0x400010
mov rax, qword [rdx]
test rax, rax
je 0x140082788
mov ecx, dword [r8 + 0x10]
mov dword [rsp + 0x88], ecx
mov qword [rsp + 0x90], rax
mov r9, qword [r8 + 0x18]
test r9, r9
je 0x1400827e0
mov rcx, qword [r8 + 0x28]
test rcx, rcx
je 0x1400827d7
xor ebx, ebx
lea rdi, [0x140082990]
xor edx, edx
movzx eax, byte [r9 + rbx]
mov esi, 0x20
movsxd rax, dword [rdi + rax*4]
add rax, rdi
jmp rax
mov esi, 0x80
jmp case.0x1400827b6.0
mov esi, 0x800
jmp case.0x1400827b6.0
mov esi, 0x200
or edx, esi
inc rbx
cmp rcx, rbx
jne 0x1400827a5
jmp 0x1400827d9
xor edx, edx
mov dword [rsp + 0x98], edx
mov r15, qword [r8 + 0x40]
mov ebx, 8
mov rax, r15
mul rbx
jo case.0x1400827b6.4
mov rdi, rax
mov rsi, qword [r8 + 0x30]
test rax, rax
je 0x14008281a
mov edx, 8
mov rcx, rdi
call fcn.14000bb90
mov rbx, rax
test rax, rax
je 0x140082972
lea rax, [rsi + r15*8]
cmp rsi, rax
je 0x140082854
lea rcx, [r15*8]
movabs rax, 0x7fffffff8
lea rax, [rax + r15*8]
shr rax, 3
xor edx, edx
mov rdi, qword [rsi + rdx]
mov qword [rbx + rdx], rdi
add rdx, 8
cmp rcx, rdx
jne 0x14008283f
inc eax
jmp 0x140082856
xor eax, eax
mov dword [rsp + 0x64], eax
mov qword [rsp + 0x68], rbx
lea rax, [0x140443478]
mov qword [rsp + 0x48], rax
mov rax, qword [0x140443490]
cmp rax, 3
jne 0x140082939
mov rax, qword [rsp + 0x48]
mov rdx, qword [rax]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
xor ecx, ecx
mov r8d, 2
xor r9d, r9d
call sub.secur32.dll_AcquireCredentialsHandleA
test eax, eax
je 0x1400828d4
shl rax, 0x20
mov qword [r14 + 8], rax
mov qword [r14 + 0x10], 0
mov eax, 1
jmp 0x140082905
movaps xmm6, xmmword [rsp + 0x50]
mov ecx, 0x20
mov edx, 8
call fcn.14000bb90
test rax, rax
je 0x14008297c
movaps xmm0, xmmword [0x140098750]
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm6
mov qword [r14 + 8], rax
xor eax, eax
mov qword [r14], rax
shl r15, 3
test r15, r15
je 0x140082922
mov rcx, qword [0x140443578]
xor edx, edx
mov r8, rbx
call sub.kernel32.dll_HeapFree
movaps xmm6, xmmword [rsp + 0xc0]
add rsp, 0xd0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
lea rax, [rsp + 0x48]
lea rcx, [rsp + 0xb0]
mov qword [rcx], rax
lea r8, [rsp + 0xb8]
mov qword [r8], rcx
lea rcx, [0x140443490]
lea r9, [0x14043d398]
xor edx, edx
call fcn.140096ca7
jmp 0x14008287c
ud2
mov edx, 8
mov rcx, rdi
jmp 0x140082986
mov ecx, 0x20
mov edx, 8
call fcn.1400949bf
ud2
Function at 0x1400849df
Capabilities:
Write file on windows

Disassembly:
push rsi
sub rsp, 0x30
mov rax, r8
mov rsi, rcx
lea r10, [rsp + 0x2c]
mov dword [r10], 0
mov ecx, 0xffffffff
cmp r9, rcx
mov r8d, 0xffffffff
cmovb r8d, r9d
mov qword [rsp + 0x20], 0
mov rcx, rdx
mov rdx, rax
mov r9, r10
call qword [sym.imp.kernel32.dll_WriteFile]
test eax, eax
je 0x140084a30
mov eax, dword [rsp + 0x2c]
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x140084a4b
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], 0
mov eax, 1
mov qword [rsi], rax
add rsp, 0x30
pop rsi
ret

Function at 0x140084d2e
Capabilities:
Generate random numbers via winapi

Disassembly:
sub rsp, 0x38
xorps xmm0, xmm0
lea rdx, [rsp + 0x20]
movaps xmmword [rdx], xmm0
xor ecx, ecx
mov r8d, 0x10
mov r9d, 2
call qword [sym.imp.bcrypt.dll_BCryptGenRandom]
test eax, eax
jne 0x140084d64
mov rax, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
add rsp, 0x38
ret
call sub.kernel32.dll_GetLastError
ud2

Function at 0x140085164
Capabilities:
Get common file path

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x448
mov qword [rsp + 0x28], rcx
xor ebx, ebx
lea rcx, [rsp + 0x48]
mov r8d, 0x400
xor edx, edx
call fcn.140092ff0
mov r13, qword [0x14043e2d0]
lea rax, [rsp + 0x30]
mov qword [rax], r13
xorps xmm0, xmm0
movups xmmword [rax + 8], xmm0
mov esi, 0x200
mov r14, qword [sym.imp.kernel32.dll_SetLastError]
mov r15, qword [sym.imp.kernel32.dll_GetCurrentDirectoryW]
cmp rsi, 0x201
jae 0x1400851d2
lea rbp, [rsp + 0x48]
mov rdi, rbp
mov r12d, 0x200
jmp 0x1400851f6
mov r8, rsi
sub r8, rbx
mov rax, qword [rsp + 0x38]
sub rax, rbx
cmp rax, r8
jb 0x140085234
mov qword [rsp + 0x40], rsi
mov rbx, rsi
mov rdi, r13
mov r12, rsi
mov rbp, r13
xor ecx, ecx
call r14
mov ecx, esi
mov rdx, rbp
call r15
mov ebp, eax
test eax, eax
jne 0x140085213
call qword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x140085265
mov ebp, ebp
cmp rsi, rbp
jne 0x14008522a
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14008522a
add rsi, rsi
jmp 0x1400851b9
cmp rsi, rbp
mov rsi, rbp
jbe 0x1400851b9
jmp 0x140085248
lea rcx, [rsp + 0x30]
mov rdx, rbx
call fcn.140096c66
mov r13, qword [rsp + 0x30]
jmp 0x1400851e5
cmp r12, rbp
jb 0x1400852bc
mov rsi, qword [rsp + 0x28]
lea rcx, [rsi + 8]
mov rdx, rdi
mov r8, rbp
call fcn.1400852ea
xor eax, eax
jmp 0x140085285
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
mov rsi, qword [rsp + 0x28]
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], 0
mov eax, 1
mov qword [rsi], rax
mov rax, qword [rsp + 0x38]
shl rax, 1
test rax, rax
je 0x1400852a7
mov rcx, qword [0x140443578]
xor edx, edx
mov r8, r13
call sub.kernel32.dll_HeapFree
nop
add rsp, 0x448
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
ud2
Function at 0x140085f2d
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x468
mov rsi, rcx
lea r12, [rsp + 0x68]
mov rcx, r12
call fcn.140086139
cmp dword [r12], 1
jne 0x140085f66
lea rcx, [rsp + 0x68]
call fcn.140086258
jmp 0x140086050
mov r13, qword [rsp + 0x70]
test r13, r13
je 0x140086050
mov qword [rsp + 0x28], rsi
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x20], rax
xor r15d, r15d
mov r8d, 0x400
mov rcx, r12
xor edx, edx
call fcn.140092ff0
mov rbx, qword [0x14043e2d0]
lea rax, [rsp + 0x30]
mov qword [rax], rbx
xorps xmm0, xmm0
movups xmmword [rax + 8], xmm0
mov edi, 0x200
cmp rdi, 0x201
jae 0x140085fc8
mov rbp, r12
mov r14d, 0x200
mov rsi, r12
jmp 0x140085fec
mov r8, rdi
sub r8, r15
mov rax, qword [rsp + 0x38]
sub rax, r15
cmp rax, r8
jb 0x14008603c
mov qword [rsp + 0x40], rdi
mov r15, rdi
mov rbp, rbx
mov r14, rdi
mov rsi, rbx
xor ecx, ecx
call qword [sym.imp.kernel32.dll_SetLastError]
mov rcx, r13
mov rdx, rsi
mov r8d, edi
call qword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
mov esi, eax
test eax, eax
jne 0x140086017
call qword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x1400860ac
mov esi, esi
cmp rdi, rsi
jne 0x14008602e
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14008602e
add rdi, rdi
jmp 0x140085fb1
cmp rdi, rsi
mov rdi, rsi
jbe 0x140085fb1
jmp 0x14008605c
lea rcx, [rsp + 0x30]
mov rdx, r15
call fcn.140096c66
mov rbx, qword [rsp + 0x30]
jmp 0x140085fdb
mov qword [rsi], 0
jmp 0x140086120
cmp r14, rsi
jb 0x140086135
lea rdi, [rsp + 0x50]
mov rcx, rdi
mov rdx, rbp
mov r8, rsi
call fcn.1400852ea
mov rax, qword [rsp + 0x38]
shl rax, 1
test rax, rax
je 0x140086097
mov rcx, qword [0x140443578]
xor edx, edx
mov r8, rbx
call sub.kernel32.dll_HeapFree
mov rax, qword [rdi + 0x10]
mov rcx, qword [rsp + 0x28]
mov qword [rcx + 0x10], rax
movups xmm0, xmmword [rdi]
movups xmmword [rcx], xmm0
jmp 0x140086101
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
lea rsi, [rsp + 0x50]
mov qword [rsi], rax
mov qword [rsi + 8], 0
mov qword [rsi - 8], 1
mov rax, qword [rsp + 0x38]
shl rax, 1
test rax, rax
je 0x1400860ed
mov rcx, qword [0x140443578]
xor edx, edx
mov r8, rbx
call sub.kernel32.dll_HeapFree
mov rax, qword [rsp + 0x28]
mov qword [rax], 0
mov rcx, rsi
call fcn.140001eb0
mov rax, qword [rsp + 0x20]
shl rax, 1
test rax, rax
je 0x140086120
mov rcx, qword [0x140443578]
xor edx, edx
mov r8, r13
call sub.kernel32.dll_HeapFree
nop
add rsp, 0x468
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
ud2
Function at 0x1400890b4
Capabilities:
Resolve dns

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x60
mov r14d, r9d
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x140443580]
cmp rax, 3
jne 0x1400891d5
lea rbp, [rsp + 0x30]
mov rcx, rbp
mov rdx, rbx
mov r8, rdi
call fcn.140088d5b
cmp dword [rbp], 1
mov rdi, qword [rbp + 0x10]
jne 0x140089130
cmp qword [rsp + 0x48], 0
je 0x140089111
mov rcx, qword [0x140443578]
xor edx, edx
mov r8, rdi
call sub.kernel32.dll_HeapFree
lea rax, str.data_provided_contains_a_nul_byte
mov qword [rsi + 0x10], rax
mov qword [rsi + 8], 0x1402
mov qword [rsi], 1
jmp 0x1400891c9
lea r8, [rsp + 0x30]
mov rbx, qword [r8 + 8]
xorps xmm0, xmm0
movaps xmmword [r8], xmm0
movaps xmmword [r8 + 0x20], xmm0
movaps xmmword [r8 + 0x10], xmm0
mov dword [r8 + 8], 1
lea r9, [rsp + 0x28]
mov qword [r9], 0
mov rcx, rbx
xor edx, edx
call qword [sym.imp.ws2_32.dll_getaddrinfo]
test eax, eax
je 0x140089199
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
mov eax, eax
shl rax, 0x18
xor ecx, ecx
mov byte [rsi + 8], cl
mov byte [rsi + 0x17], cl
mov qword [rsi + 9], rax
mov word [rsi + 0x15], 0
mov dword [rsi + 0x11], 0
mov eax, 1
jmp 0x1400891ad
mov rax, qword [rsp + 0x28]
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], r14w
xor eax, eax
mov qword [rsi], rax
mov byte [rbx], 0
test rdi, rdi
je 0x1400891c9
mov rcx, qword [0x140443578]
xor edx, edx
mov r8, rbx
call sub.kernel32.dll_HeapFree
nop
add rsp, 0x60
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
call fcn.140096f03
jmp 0x1400890db

Function at 0x14008c46e
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rsi, rcx
cmp edx, 1
mov eax, 0x17
mov edi, 2
cmove edi, eax
mov dword [rsp + 0x28], 0x81
mov dword [rsp + 0x20], 0
mov ecx, edi
mov edx, 1
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ws2_32.dll_WSASocketW]
cmp rax, 0xffffffffffffffff
je 0x14008c4bd
mov qword [rsi + 8], rax
mov qword [rsi], 0
jmp 0x14008c535
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
cmp eax, 0x2726
je 0x14008c4d1
cmp eax, 0x2739
jne 0x14008c51e
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0
mov ecx, edi
mov edx, 1
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ws2_32.dll_WSASocketW]
cmp rax, 0xffffffffffffffff
je 0x14008c518
mov rdi, rax
mov rcx, rax
mov edx, 1
xor r8d, r8d
call qword [sym.imp.kernel32.dll_SetHandleInformation]
test eax, eax
je 0x14008c53c
mov qword [rsi + 8], rdi
jmp 0x14008c4b4
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], 0
mov qword [rsi], 1
add rsp, 0x38
pop rdi
pop rsi
ret
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], 0
mov qword [rsi], 1
mov rcx, rdi
add rsp, 0x38
pop rdi
pop rsi
jmp qword [sym.imp.ws2_32.dll_closesocket]
Function at 0x14008c5f7
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x38
xor r10d, r10d
cmp dword [rdx], 1
jne 0x14008c668
mov r9, rdx
mov eax, 0x3e8
mul qword [rdx + 8]
mov r10d, 0xffffffff
jo 0x14008c668
mov r9d, dword [r9 + 0x10]
mov edx, r9d
imul rdx, rdx, 0x431bde83
shr rdx, 0x32
add rax, rdx
jb 0x14008c668
imul edx, r9d, 0x68c26139
ror edx, 6
xor r11d, r11d
cmp edx, 0x10c7
setae r11b
lea r9, [rax + r11]
mov edx, 0xffffffff
cmp r9, rdx
mov r10d, 0xffffffff
cmovae r9d, r10d
add rax, r11
jb 0x14008c668
mov r10d, r9d
test r9d, r9d
je 0x14008c6b0
lea r9, [rsp + 0x34]
mov dword [r9], r10d
mov dword [rsp + 0x20], 4
mov edx, 0xffff
call qword [sym.imp.ws2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x14008c68c
mov al, 4
jmp 0x14008c69c
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
mov ecx, eax
shl rcx, 0x18
xor edx, edx
xor eax, eax
shld rdx, rcx, 8
shl rcx, 8
movzx eax, al
or rax, rcx
add rsp, 0x38
ret
lea rdx, str.cannot_set_a_0_duration_timeout
mov eax, 0x1402
jmp 0x14008c6ab

Function at 0x14008c6be
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rsi
sub rsp, 0x20
mov rax, r8
mov rsi, rcx
cmp r9, 0x7fffffff
mov r8d, 0x7fffffff
cmovb r8d, r9d
mov rcx, rdx
mov rdx, rax
xor r9d, r9d
call qword [sym.imp.ws2_32.dll_recv]
cmp eax, 0xffffffff
je 0x14008c6fd
cdqe
mov qword [rsi + 8], rax
mov qword [rsi], 0
jmp 0x14008c729
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
cmp eax, 0x274a
jne 0x14008c712
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
jmp 0x14008c729
shl rax, 0x20
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], 0
mov qword [rsi], 1
add rsp, 0x20
pop rsi
ret

Function at 0x14008c72f
Capabilities:
Send data
Send data on socket

Disassembly:
push rsi
sub rsp, 0x20
mov rax, r8
mov rsi, rcx
cmp r9, 0x7fffffff
mov r8d, 0x7fffffff
cmovb r8d, r9d
mov rcx, rdx
mov rdx, rax
xor r9d, r9d
call qword [sym.imp.ws2_32.dll_send]
cmp eax, 0xffffffff
je 0x14008c769
cdqe
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x14008c784
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], 0
mov eax, 1
mov qword [rsi], rax
add rsp, 0x20
pop rsi
ret
Function at 0x140090215
Capabilities:
Delete file

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x40
mov r8, rdx
mov rdx, rcx
lea rsi, [rsp + 0x20]
mov rcx, rsi
call fcn.140089596
cmp dword [rsi], 1
mov rdi, qword [rsi + 0x10]
mov r15, qword [rsi + 8]
jne 0x140090251
mov rsi, r15
shrd rsi, rdi, 8
shr rdi, 8
mov rbx, rdi
jmp 0x1400902b0
mov r14, qword [rsp + 0x28]
mov rcx, r15
call qword [sym.imp.kernel32.dll_DeleteFileW]
test eax, eax
je 0x140090282
mov r15b, 4
shl rdi, 1
test rdi, rdi
je 0x140090280
mov rcx, qword [0x140443578]
xor edx, edx
mov r8, r14
call sub.kernel32.dll_HeapFree
jmp 0x1400902b0
call qword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
shl rsi, 0x18
xor ebx, ebx
xor r15d, r15d
shl rdi, 1
test rdi, rdi
je 0x1400902b0
mov rcx, qword [0x140443578]
xor r15d, r15d
xor edx, edx
mov r8, r14
call sub.kernel32.dll_HeapFree
shld rbx, rsi, 8
shl rsi, 8
movzx eax, r15b
or rax, rsi
mov rdx, rbx
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x1400902cf
Capabilities:
Move file

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x40
mov r12, r9
mov rbx, r8
mov r8, rdx
mov rdx, rcx
lea rsi, [rsp + 0x20]
mov rcx, rsi
call fcn.140089596
cmp dword [rsi], 1
mov r13, qword [rsi + 0x10]
mov r15, qword [rsi + 8]
jne 0x140090318
mov rbx, r15
shrd rbx, r13, 8
shr r13, 8
mov rdi, r13
jmp 0x1400903bd
lea rsi, [rsp + 0x20]
mov r14, qword [rsi + 8]
mov rcx, rsi
mov rdx, rbx
mov r8, r12
call fcn.140089596
cmp dword [rsi], 1
jne 0x140090366
mov r15, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x30]
mov rdi, rbx
shr rdi, 8
shld rbx, r15, 0x38
shl r13, 1
test r13, r13
je 0x1400903bd
mov rcx, qword [0x140443578]
xor edx, edx
mov r8, r14
call sub.kernel32.dll_HeapFree
jmp 0x1400903bd
mov r12, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rcx, r15
mov rdx, r12
mov r8d, 1
call qword [sym.imp.kernel32.dll_MoveFileExW]
test eax, eax
je 0x1400903e0
shl rsi, 1
test rsi, rsi
je 0x1400903a0
mov rcx, qword [0x140443578]
xor edx, edx
mov r8, r12
call sub.kernel32.dll_HeapFree
mov r15b, 4
shl r13, 1
test r13, r13
je 0x1400903bd
mov rcx, qword [0x140443578]
xor edx, edx
mov r8, r14
call sub.kernel32.dll_HeapFree
shld rdi, rbx, 8
shl rbx, 8
movzx eax, r15b
or rax, rbx
mov rdx, rdi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call qword [sym.imp.kernel32.dll_GetLastError]
mov ebx, eax
shl rbx, 0x18
xor edi, edi
xor r15d, r15d
shl rsi, 1
test rsi, rsi
je 0x14009034a
mov rcx, qword [0x140443578]
xor r15d, r15d
xor edx, edx
mov r8, r12
call sub.kernel32.dll_HeapFree
jmp 0x14009034a
Function at 0x140090417
Capabilities:
Copy file

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rbx, r9
mov rdi, rcx
lea rsi, [rsp + 0x38]
mov rcx, rsi
call fcn.140089596
cmp dword [rsi], 1
mov r12, qword [rsi + 0x10]
mov rsi, qword [rsi + 8]
jne 0x140090458
mov qword [rdi + 8], rsi
mov qword [rdi + 0x10], r12
mov qword [rdi], 1
jmp 0x140090525
mov r8, qword [rsp + 0xb0]
lea r15, [rsp + 0x38]
mov r14, qword [r15 + 8]
mov rcx, r15
mov rdx, rbx
call fcn.140089596
cmp dword [r15], 1
jne 0x14009048c
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rdi + 8], xmm0
mov qword [rdi], 1
jmp 0x14009050b
lea r9, [rsp + 0x38]
mov r15, qword [r9 + 8]
mov rbx, qword [r9 + 0x10]
xor eax, eax
mov qword [r9], rax
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 0
lea r8, [0x140090534]
mov rcx, rsi
mov rdx, r15
call qword [sym.imp.kernel32.dll_CopyFileExW]
test eax, eax
je 0x1400904d4
mov rax, qword [rsp + 0x38]
mov qword [rdi + 8], rax
mov qword [rdi], 0
jmp 0x1400904f1
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
mov qword [rdi + 8], rax
mov qword [rdi + 0x10], 0
mov qword [rdi], 1
shl rbx, 1
test rbx, rbx
je 0x14009050b
mov rcx, qword [0x140443578]
xor edx, edx
mov r8, r15
call sub.kernel32.dll_HeapFree
shl r12, 1
test r12, r12
je 0x140090525
mov rcx, qword [0x140443578]
xor edx, edx
mov r8, r14
call sub.kernel32.dll_HeapFree
nop
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x1400905a0
Capabilities:
Connect socket

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rdi, r8
mov rsi, rcx
cmp rdx, 1
jne 0x1400905bd
mov qword [rsi + 8], rdi
mov qword [rsi + 0x10], r9
jmp 0x1400905eb
mov rax, qword [0x140443580]
cmp rax, 3
jne 0x140090661
mov edx, dword [rdi]
lea rbx, [rsp + 0x28]
mov rcx, rbx
call fcn.14008c46e
cmp dword [rbx], 1
jne 0x1400905fa
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rsi + 8], xmm0
mov qword [rsi], 1
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
mov rbx, qword [rsp + 0x30]
cmp dword [rdi], 1
mov eax, 0x1c
mov r8d, 0x10
cmove r8d, eax
add rdi, 4
mov rcx, rbx
mov rdx, rdi
call qword [sym.imp.ws2_32.dll_connect]
cmp eax, 0xffffffff
je 0x140090633
mov qword [rsi + 8], rbx
mov qword [rsi], 0
jmp 0x1400905f2
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], 0
mov qword [rsi], 1
mov rcx, rbx
add rsp, 0x40
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.ws2_32.dll_closesocket]
call fcn.140096f03
jmp 0x1400905ce