joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003c060
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x1410
call fcn.1401af620
sub rsp, rax
mov rax, qword [0x14020b010]
xor rax, rsp
mov qword [rsp + 0x1400], rax
mov esi, edx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor ebx, ebx
mov dword [rsp + 0x20], ebx
movups xmm0, xmmword [str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789]
movups xmmword [rsp + 0x13c0], xmm0
movups xmm1, xmmword [0x1401f51d0]
movups xmmword [rsp + 0x13d0], xmm1
movups xmm0, xmmword [0x1401f51e0]
movups xmmword [rsp + 0x13e0], xmm0
movsd xmm1, qword [0x1401f51f0]
movsd qword [rsp + 0x13f0], xmm1
mov eax, dword [0x1401f51f8]
mov dword [rsp + 0x13f8], eax
movzx eax, word [0x1401f51fc]
mov word [rsp + 0x13fc], ax
movzx eax, byte [0x1401f51fe]
mov byte [rsp + 0x13fe], al
mov qword [rcx], rbx
mov qword [rcx + 8], rbx
mov qword [rcx + 0x18], rbx
mov qword [rcx + 0x20], rbx
lea ecx, [rbx + 0x10]
call fcn.14008c900
mov qword [rax + 8], rbx
mov qword [rdi], rax
mov qword [rax], rdi
mov qword [rdi + 0x18], rbx
mov qword [rdi + 0x20], reloc.WS2_32.dll_ntohs
mov byte [rdi + 8], bl
mov ebx, 1
mov dword [rsp + 0x20], ebx
call fcn.1400915f0
mov dword [rsp + 0x13b4], 0xffffffff
mov dword [rsp + 0x34], eax
nop
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, ebx
mov dword [rsp + rbx*4 + 0x34], eax
inc rbx
cmp rbx, 0x270
jb 0x14003c150
mov dword [rsp + 0x30], 0x270
test esi, esi
jle 0x14003c1db
mov rbx, rsi
nop
lea rcx, [rsp + 0x30]
call fcn.14008d940
mov ecx, eax
mov eax, 0x8421085
mul ecx
mov eax, ecx
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
cmp eax, 0x4210842
jae 0x14003c180
mov eax, 0x8421085
mul ecx
mov r8d, ecx
sub r8d, edx
shr r8d, 1
add r8d, edx
shr r8d, 5
imul edx, r8d, 0x3e
sub ecx, edx
movsxd rdx, ecx
movzx edx, byte [rsp + rdx + 0x13c0]
mov rcx, rdi
call fcn.140089e90
sub rbx, 1
jne 0x14003c180
mov rax, rdi
mov rcx, qword [rsp + 0x1400]
xor rcx, rsp
call fcn.14008db20
lea r11, [rsp + 0x1410]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1400864c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x30
mov rsi, rdx
mov rdi, rcx
xor ebp, ebp
cmp byte [rcx + 0xc], bpl
je 0x140086505
mov eax, ebp
nop dword [rax]
lea r8d, [rax + 0x4c]
xor byte [rax + rcx], r8b
inc rax
cmp rax, 0xb
jb 0x1400864f0
mov byte [rcx + 0xc], bpl
lea rbx, [rcx + 0xb]
mov qword [rdx], rbp
mov qword [rdx + 8], rbp
mov qword [rdx + 0x18], rbp
mov qword [rdx + 0x20], rbp
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov ecx, reloc.WS2_32.dll_recv
call fcn.14008c900
mov qword [rsp + 0x20], rax
mov qword [rax], rsi
mov qword [rax + 8], rbp
mov qword [rsi], rax
mov qword [rsi + 0x18], rbp
mov qword [rsi + 0x20], reloc.WS2_32.dll_ntohs
mov byte [rsi + 8], 0
mov rdx, rbx
mov rcx, rdi
call fcn.14008d5c0
cmp rdi, rbx
je 0x14008656d
mov r8d, listen
mov rdx, rdi
mov rcx, rsi
call fcn.14008a1b0
nop
mov rax, rsi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x140086590
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x30
mov rsi, rdx
mov rdi, rcx
xor ebp, ebp
cmp byte [rcx + 0x12], bpl
je 0x1400865d5
mov eax, ebp
nop dword [rax]
lea r8d, [rax + 0x4c]
xor byte [rax + rcx], r8b
inc rax
cmp rax, 0x11
jb 0x1400865c0
mov byte [rcx + 0x12], bpl
lea rbx, [rcx + 0x11]
mov qword [rdx], rbp
mov qword [rdx + 8], rbp
mov qword [rdx + 0x18], rbp
mov qword [rdx + 0x20], rbp
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov ecx, reloc.WS2_32.dll_recv
call fcn.14008c900
mov qword [rsp + 0x20], rax
mov qword [rax], rsi
mov qword [rax + 8], rbp
mov qword [rsi], rax
mov qword [rsi + 0x18], rbp
mov qword [rsi + 0x20], reloc.WS2_32.dll_ntohs
mov byte [rsi + 8], 0
mov rdx, rbx
mov rcx, rdi
call fcn.14008d5c0
cmp rdi, rbx
je 0x14008663d
mov r8d, reloc.WS2_32.dll_recvfrom
mov rdx, rdi
mov rcx, rsi
call fcn.14008a1b0
nop
mov rax, rsi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x140086660
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x30
mov rsi, rdx
mov rdi, rcx
xor ebp, ebp
cmp byte [rcx + 0x13], bpl
je 0x1400866a5
mov eax, ebp
nop dword [rax]
lea r8d, [rax + 0x4c]
xor byte [rax + rcx], r8b
inc rax
cmp rax, 0x12
jb 0x140086690
mov byte [rcx + 0x13], bpl
lea rbx, [rcx + 0x12]
mov qword [rdx], rbp
mov qword [rdx + 8], rbp
mov qword [rdx + 0x18], rbp
mov qword [rdx + 0x20], rbp
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov ecx, reloc.WS2_32.dll_recv
call fcn.14008c900
mov qword [rsp + 0x20], rax
mov qword [rax], rsi
mov qword [rax + 8], rbp
mov qword [rsi], rax
mov qword [rsi + 0x18], rbp
mov qword [rsi + 0x20], reloc.WS2_32.dll_ntohs
mov byte [rsi + 8], 0
mov rdx, rbx
mov rcx, rdi
call fcn.14008d5c0
cmp rdi, rbx
je 0x14008670d
mov r8d, reloc.WS2_32.dll_select
mov rdx, rdi
mov rcx, rsi
call fcn.14008a1b0
nop
mov rax, rsi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x140086730
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x30
mov rsi, rdx
mov rdi, rcx
xor ebp, ebp
cmp byte [rcx + 0xb], bpl
je 0x140086775
mov eax, ebp
nop dword [rax]
lea r8d, [rax + 0x4c]
xor byte [rax + rcx], r8b
inc rax
cmp rax, 0xa
jb 0x140086760
mov byte [rcx + 0xb], bpl
lea rbx, [rcx + 0xa]
mov qword [rdx], rbp
mov qword [rdx + 8], rbp
mov qword [rdx + 0x18], rbp
mov qword [rdx + 0x20], rbp
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov ecx, reloc.WS2_32.dll_recv
call fcn.14008c900
mov qword [rsp + 0x20], rax
mov qword [rax], rsi
mov qword [rax + 8], rbp
mov qword [rsi], rax
mov qword [rsi + 0x18], rbp
mov qword [rsi + 0x20], reloc.WS2_32.dll_ntohs
mov byte [rsi + 8], 0
mov rdx, rbx
mov rcx, rdi
call fcn.14008d5c0
cmp rdi, rbx
je 0x1400867dd
mov r8d, 0xa
mov rdx, rdi
mov rcx, rsi
call fcn.14008a1b0
nop
mov rax, rsi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x14008d940
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r10, rcx
mov r9d, 0x270
mov ecx, dword [rcx]
cmp ecx, r9d
jne 0x14008d9a1
lea r8, [r10 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x14008d960
mov ecx, dword [r10]
jmp 0x14008da8a
cmp ecx, 0x4e0
jb 0x14008da8a
lea r11, [r10 + 0x9c4]
mov qword [rsp], rbx
mov eax, dword [r11]
mov ebx, 0xe3
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x14008d9c0
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x14008da10
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
xor ecx, ecx
mov dword [r10], ecx
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x1400a0c40
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x70
lea rdi, [rsp + 0x30]
mov ecx, reloc.WS2_32.dll_recv
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x80]
mov dword [rsp + 0x54], 4
lea rax, [rsp + 0x54]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
mov r8d, 0x1008
mov edx, 0xffff
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x1400a0cb4
cmp dword [rsp + 0x34], 1
jne 0x1400a0cb4
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.WS2_32.dll_send]
mov rcx, rsp
lea rdx, reloc.WS2_32.dll_bind
call fcn.1401af580
add rsp, 0x70
pop rdi
ret

Function at 0x1400a6e90
Capabilities:
Hash data using djb2

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0x1505
mov rax, qword [rsp + 0x20]
cmp qword [rsp + 0x50], rax
jae 0x1400a6f1b
mov rax, qword [rsp + 0x28]
shl rax, 5
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x50]
movzx eax, byte [rax]
mov byte [rsp + 0x30], al
mov rax, qword [rsp + 0x50]
inc rax
mov qword [rsp + 0x50], rax
movzx ecx, byte [rsp + 0x30]
call fcn.1400c64a0
movsx rax, al
mov rcx, qword [rsp + 0x28]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
jmp 0x1400a6ebd
xor edx, edx
mov rax, qword [rsp + 0x28]
mov ecx, 0x100
div rcx
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x1400bef50
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov rax, qword [rsp + 0x50]
movzx eax, byte [rax + 0xaa8]
test eax, eax
je 0x1400bf05a
mov rax, qword [rsp + 0x50]
cmp qword [rax + 0x260], 0
je 0x1400befe5
mov rcx, qword [rsp + 0x50]
call fcn.14009ec00
mov byte [rsp + 0x30], al
mov dl, 1
mov rcx, qword [rsp + 0x50]
call fcn.14009eb90
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 0x1d8]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x68]
mov r8, qword [rsp + 0x60]
mov edx, dword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x50]
call qword [rax + 0x260]
movzx edx, byte [rsp + 0x30]
mov rcx, qword [rsp + 0x50]
call fcn.14009eb90
jmp 0x1400bf05a
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
je 0x1400bf004
cmp dword [rsp + 0x34], 1
je 0x1400bf004
cmp dword [rsp + 0x34], 2
je 0x1400bf004
jmp 0x1400bf05a
movsxd rax, dword [rsp + 0x58]
imul rax, rax, 3
lea rcx, [0x1401bddd0]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x50]
mov r9, qword [rcx + 0x1d0]
mov r8d, 1
mov edx, 2
mov rcx, rax
call fcn.140157e20
mov rax, qword [rsp + 0x50]
mov r9, qword [rax + 0x1d0]
mov r8d, 1
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
call fcn.140157e20
add rsp, 0x40
pop rdi
ret

Function at 0x1400c2ab0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x20
mov rcx, qword [rsp + 0x40]
call fcn.1400c2910
mov r8d, eax
mov rdx, qword [rsp + 0x38]
mov ecx, dword [rsp + 0x30]
call fcn.140185900
cdqe
add rsp, 0x20
pop rdi
ret
Function at 0x1400c3020
Capabilities:
Initialize winsock library

Disassembly:
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x220
lea rdi, [rsp + 0x30]
mov ecx, 0x7c
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x230]
mov rax, qword [0x14020b010]
xor rax, rsp
mov qword [rsp + 0x210], rax
mov eax, dword [rsp + 0x230]
and eax, 2
test eax, eax
je 0x1400c30f7
mov eax, 0x202
mov word [rsp + 0x30], ax
lea rdx, [rsp + 0x50]
movzx ecx, word [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [rsp + 0x1f4], eax
cmp dword [rsp + 0x1f4], 0
je 0x1400c309d
mov eax, 2
jmp 0x1400c31af
movzx eax, word [rsp + 0x50]
and rax, 0xff
movzx eax, al
movzx ecx, word [rsp + 0x30]
and rcx, 0xff
movzx ecx, cl
cmp eax, ecx
jne 0x1400c30e7
movzx eax, word [rsp + 0x50]
shr rax, 8
and rax, 0xff
movzx eax, al
movzx ecx, word [rsp + 0x30]
shr rcx, 8
and rcx, 0xff
movzx ecx, cl
cmp eax, ecx
je 0x1400c30f7
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 2
jmp 0x1400c31af
call fcn.140125850
mov dword [rsp + 0x1f8], eax
cmp dword [rsp + 0x1f8], 0
je 0x1400c3119
mov eax, dword [rsp + 0x1f8]
jmp 0x1400c31af
lea rcx, str.iphlpapi.dll
call fcn.1400c3250
mov qword [0x1403250b8], rax
cmp qword [0x1403250b8], 0
je 0x1400c316c
lea rdx, str.if_nametoindex
mov rcx, qword [0x1403250b8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x200], rax
cmp qword [rsp + 0x200], 0
je 0x1400c316c
mov rax, qword [rsp + 0x200]
mov qword [0x1403250b0], rax
mov dword [rsp + 0x20], 3
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov ecx, 6
call fcn.1401253a0
movzx eax, al
test eax, eax
je 0x1400c3199
mov byte [0x14032b0d4], 1
jmp 0x1400c31a0
mov byte [0x14032b0d4], 0
lea rcx, [0x14032b0d8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xor eax, eax
mov rdi, rax
mov rcx, rsp
lea rdx, reloc.WS2_32.dll_accept
call fcn.1401af580
mov rax, rdi
mov rcx, qword [rsp + 0x210]
xor rcx, rsp
call fcn.14008db20
add rsp, 0x220
pop rdi
ret
Function at 0x1400c3250
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x60
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x1400c328d
xor eax, eax
jmp 0x1400c3429
lea rdx, str.LoadLibraryExA
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x28], rax
lea rdx, [0x14020ca14]
mov rcx, qword [rsp + 0x70]
call fcn.1401801c0
test rax, rax
je 0x1400c32f9
cmp qword [rsp + 0x28], 0
je 0x1400c32da
mov r8d, 8
xor edx, edx
mov rcx, qword [rsp + 0x70]
call qword [rsp + Ordinal_41]
mov qword [rsp + 0x50], rax
jmp 0x1400c32ea
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
jmp 0x1400c3424
cmp qword [rsp + 0x28], 0
je 0x1400c3333
lea rdx, str.AddDllDirectory
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400c3333
mov r8d, 0x800
xor edx, edx
mov rcx, qword [rsp + 0x70]
call qword [rsp + Ordinal_41]
mov qword [rsp + 0x20], rax
jmp 0x1400c3424
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 0
je 0x1400c3424
mov rcx, qword [rsp + 0x70]
call fcn.140178870
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0x38]
inc eax
mov eax, eax
add rax, qword [rsp + 0x40]
mov rcx, rax
call qword [fcn.140162460]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x1400c3419
mov edx, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x1400c3419
mov rcx, qword [rsp + 0x48]
call fcn.140178870
mov rcx, qword [rsp + 0x48]
add rcx, rax
mov rax, rcx
lea rdx, [0x14020ca38]
mov rcx, rax
call fcn.14017fee0
mov rcx, qword [rsp + 0x48]
call fcn.140178870
mov rcx, qword [rsp + 0x48]
add rcx, rax
mov rax, rcx
mov rdx, qword [rsp + 0x70]
mov rcx, rax
call fcn.14017fee0
cmp qword [rsp + 0x28], 0
je 0x1400c33ff
mov r8d, 8
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [rsp + Ordinal_41]
mov qword [rsp + 0x58], rax
jmp 0x1400c340f
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x48]
call qword [fcn.1401585c0]
mov rax, qword [rsp + 0x20]
add rsp, 0x60
pop rdi
ret
Function at 0x1400cb120
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xa0
lea rdi, [rsp + 0x50]
mov ecx, reloc.WS2_32.dll_sendto
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0xb0]
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x84]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x64]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x4004747b
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.WS2_32.dll_WSAIoctl]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jne 0x1400cb1c1
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x64]
mov r8d, 0x1001
mov edx, 0xffff
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rcx, rsp
lea rdx, reloc.WS2_32.dll_bind
call fcn.1401af580
add rsp, 0xa0
pop rdi
ret
Function at 0x1400d1750
Capabilities:
Check for software breakpoints

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov rax, qword [rsp + 0x50]
add rax, 0xe8
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x20]
mov ecx, dword [rcx + 0x60]
mov dword [rax + 0x1350], ecx
mov rax, qword [rsp + 0x58]
movzx eax, byte [rax + 0x70f]
mov rcx, qword [rsp + 0x50]
mov dword [rcx + 0x1358], eax
mov rax, qword [rsp + 0x50]
movzx eax, byte [rax + 0x1161]
test eax, eax
je 0x1400d17c5
mov rax, qword [rsp + 0x50]
movzx eax, byte [rax + 0x1161]
mov rcx, qword [rsp + 0x58]
movzx ecx, byte [rcx + 0x70f]
cmp eax, ecx
jle 0x1400d17dc
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
movzx ecx, byte [rcx + 0x70f]
mov byte [rax + 0x1161], cl
mov rax, qword [rsp + 0x50]
cmp qword [rax + 0x1170], 0
je 0x1400d1815
mov rax, qword [rsp + 0x50]
movzx eax, byte [rax + 0x11e8]
test eax, eax
jne 0x1400d1815
mov rax, qword [rsp + 0x20]
cmp dword [rax + 0x60], 0x1a0
jne 0x1400d1815
mov rax, qword [rsp + 0x20]
mov byte [rax + 0xdd], 1
mov rax, qword [rsp + 0x58]
movzx eax, byte [rax + 0x70f]
cmp eax, 0xa
jne 0x1400d1848
lea rdx, str.HTTP_1.0__assume_close_after_body
mov rcx, qword [rsp + 0x50]
call fcn.1400bec80
mov edx, 1
mov rcx, qword [rsp + 0x58]
call fcn.1400c0090
jmp 0x1400d18b0
mov rax, qword [rsp + 0x58]
movzx eax, byte [rax + 0x70f]
cmp eax, 0x14
je 0x1400d186f
mov rax, qword [rsp + 0x20]
cmp dword [rax + 0x7c], 2
jne 0x1400d1889
mov rax, qword [rsp + 0x20]
cmp dword [rax + 0x60], 0x65
jne 0x1400d1889
xor eax, eax
test eax, eax
jne 0x1400d186f
mov rax, qword [rsp + 0x58]
mov rax, qword [rax + 0x6d0]
mov dword [rax], 2
jmp 0x1400d18b0
mov rax, qword [rsp + 0x58]
movzx eax, byte [rax + 0x70f]
cmp eax, 0xb
jl 0x1400d18b0
mov rax, qword [rsp + 0x58]
movzx eax, byte [rax + 0x2ce]
test eax, eax
jne 0x1400d18b0
xor eax, eax
test eax, eax
jne 0x1400d18aa
mov rax, qword [rsp + 0x20]
cmp dword [rax + 0x60], 0x64
jl 0x1400d18d3
mov rax, qword [rsp + 0x20]
cmp dword [rax + 0x60], 0xc8
jge 0x1400d18d3
mov dword [rsp + 0x28], 1
jmp 0x1400d18db
mov dword [rsp + 0x28], 0
cmp dword [rsp + 0x28], 0
jne 0x1400d18ec
mov dword [rsp + 0x2c], 0
jmp 0x1400d18f4
mov dword [rsp + 0x2c], 1
mov rax, qword [rsp + 0x20]
movzx ecx, byte [rsp + 0x2c]
mov byte [rax + 0xde], cl
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x60]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0xcc
je 0x1400d1942
cmp dword [rsp + 0x30], 0x130
je 0x1400d1926
jmp 0x1400d1967
mov rax, qword [rsp + 0x50]
movzx eax, byte [rax + 0x528]
test eax, eax
je 0x1400d1942
mov rax, qword [rsp + 0x50]
mov byte [rax + 0x1434], 1
mov rax, qword [rsp + 0x20]
mov qword [rax], 0
mov rax, qword [rsp + 0x20]
mov qword [rax + 8], 0
mov rax, qword [rsp + 0x20]
mov byte [rax + 0xde], 1
xor eax, eax
add rsp, 0x40
pop rdi
ret
Function at 0x1400dd8b0
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x70
lea rdi, [rsp + 0x30]
mov ecx, reloc.WS2_32.dll_recv
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x80]
cmp qword [rsp + 0x88], 0
je 0x1400dd8fa
mov rax, qword [rsp + 0x88]
cmp dword [rax], 0
jne 0x1400dd93c
cmp qword [rsp + 0x90], 0
je 0x1400dd912
mov rax, qword [rsp + 0x90]
cmp dword [rax], 0
jne 0x1400dd93c
cmp qword [rsp + 0x98], 0
je 0x1400dd92a
mov rax, qword [rsp + 0x98]
cmp dword [rax], 0
jne 0x1400dd93c
mov rcx, qword [rsp + 0xa0]
call fcn.1400dd830
jmp 0x1400dda0d
mov rdx, qword [rsp + 0xa0]
lea rcx, [rsp + 0x38]
call fcn.14012fa70
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x98], 0
je 0x1400dd97a
mov rax, qword [rsp + 0x98]
cmp dword [rax], 0
je 0x1400dd97a
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x50], rax
jmp 0x1400dd983
mov qword [rsp + 0x50], 0
cmp qword [rsp + 0x90], 0
je 0x1400dd9aa
mov rax, qword [rsp + 0x90]
cmp dword [rax], 0
je 0x1400dd9aa
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x58], rax
jmp 0x1400dd9b3
mov qword [rsp + 0x58], 0
cmp qword [rsp + 0x88], 0
je 0x1400dd9da
mov rax, qword [rsp + 0x88]
cmp dword [rax], 0
je 0x1400dd9da
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x60], rax
jmp 0x1400dd9e3
mov qword [rsp + 0x60], 0
mov eax, dword [rsp + 0x80]
inc eax
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x20], rcx
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
mov ecx, eax
call qword [sym.imp.WS2_32.dll_select]
mov rdi, rax
mov rcx, rsp
lea rdx, reloc.WS2_32.dll_accept
call fcn.1401af580
mov rax, rdi
add rsp, 0x70
pop rdi
ret
Function at 0x1400e3fc0
Capabilities:
Move file

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0xd8
lea rdi, [rsp + 0x20]
mov ecx, reloc.WLDAP32.dll_Ordinal_46
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0xf0]
mov rax, qword [0x14020b010]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov dword [rsp + 0x20], 0x3e8
lea rcx, [rsp + 0x78]
call fcn.1400a7f20
lea rcx, [rsp + 0x38]
mov rdi, rcx
mov rsi, rax
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
mov rcx, qword [rsp + 0xf0]
call fcn.14016a130
mov qword [rsp + 0x58], rax
mov rcx, qword [rsp + 0xf8]
call fcn.14016a130
mov qword [rsp + 0x60], rax
mov r8d, 1
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
je 0x1400e40a7
cmp qword [rsp + 0x58], 0
je 0x1400e407b
mov rcx, qword [rsp + 0x58]
call fcn.1401585c0
mov qword [rsp + 0x58], 0
xor eax, eax
test eax, eax
jne 0x1400e4060
cmp qword [rsp + 0x60], 0
je 0x1400e409c
mov rcx, qword [rsp + 0x60]
call fcn.1401585c0
mov qword [rsp + 0x60], 0
xor eax, eax
test eax, eax
jne 0x1400e4081
jmp 0x1400e416a
lea rax, [rsp + 0xb0]
lea rcx, [rsp + 0x38]
mov rdi, rax
mov rsi, rcx
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x88]
call fcn.1400a7f20
lea rcx, [rsp + 0xa0]
mov rdi, rcx
mov rsi, rax
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0xa0]
call fcn.1400a8030
mov qword [rsp + 0x68], rax
cmp qword [rsp + 0x68], 0
jl 0x1400e4111
movsxd rax, dword [rsp + 0x20]
cmp qword [rsp + 0x68], rax
jle 0x1400e415a
cmp qword [rsp + 0x58], 0
je 0x1400e412c
mov rcx, qword [rsp + 0x58]
call fcn.1401585c0
mov qword [rsp + 0x58], 0
xor eax, eax
test eax, eax
jne 0x1400e4111
cmp qword [rsp + 0x60], 0
je 0x1400e414d
mov rcx, qword [rsp + 0x60]
call fcn.1401585c0
mov qword [rsp + 0x60], 0
xor eax, eax
test eax, eax
jne 0x1400e4132
mov eax, 1
jmp 0x1400e416c
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400e4046
xor eax, eax
mov rdi, rax
mov rcx, rsp
lea rdx, reloc.WS2_32.dll_accept
call fcn.1401af580
mov rax, rdi
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.14008db20
add rsp, 0xd8
pop rdi
pop rsi
ret