joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14007ea10
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
mov eax, Ordinal_211
call fcn.1401ef830
sub rsp, rax
mov rax, qword [0x140310170]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rbx, qword [rcx + 0x630]
lea rax, [rsp + 0x30]
mov rdi, qword [rcx]
mov r14, rcx
mov dword [rsp + 0x30], 0x80
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov r8d, dword [rbx + 0x15c]
mov rdx, qword [rbx + 0x168]
add r8d, 4
mov rcx, qword [rbx + 0x18]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_recvfrom]
cmp dword [rbx + 0x150], 0
mov dword [rbx + 0x154], eax
jne 0x14007eab2
movsxd r8, dword [rsp + 0x30]
lea rcx, [rbx + 0xd0]
lea rdx, [rsp + 0x40]
call fcn.14020f990
mov eax, dword [rsp + 0x30]
mov dword [rbx + 0x150], eax
mov r8d, dword [rbx + 0x154]
mov qword [rsp + 0xe8], rsi
cmp r8d, 4
jge 0x14007eb0d
lea rdx, str.Received_too_short_packet
mov rcx, rdi
call fcn.140059810
mov dword [rbx + 0xc], 7
xor eax, eax
mov rsi, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1401ef4e0
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
mov rax, qword [rbx + 0x168]
movzx ecx, byte [rax]
movzx edx, byte [rax + 1]
shl ecx, 8
or edx, ecx
mov dword [rbx + 0xc], edx
sub edx, 3
je 0x14007eba2
sub edx, 1
je 0x14007ec32
sub edx, 1
je 0x14007eb73
cmp edx, 1
je 0x14007eb56
lea r8, str.Internal_error:_Unexpected_packet
mov rcx, rdi
lea rdx, [0x1402cf58c]
call fcn.140059810
jmp 0x14007ec32
add r8d, 0xfffffffe
lea rdx, [rax + 2]
mov rcx, rbx
call fcn.14007d400
test eax, eax
je 0x14007ec32
jmp 0x14007eadf
movzx ecx, byte [rax + 2]
lea rdx, [0x1402d068c]
movzx eax, byte [rax + 3]
mov r8, qword [rbx + 0x168]
shl ecx, 8
add r8, 4
or ecx, eax
mov dword [rbx + 8], ecx
mov rcx, rdi
call fcn.140059720
jmp 0x14007ec32
cmp r8d, 4
jle 0x14007ec32
movzx ecx, byte [rax + 2]
movzx eax, byte [rax + 3]
shl ecx, 8
or ecx, eax
movzx eax, word [rbx + 0x48]
inc eax
movzx eax, ax
cmp eax, ecx
jne 0x14007ec32
lea eax, [r8 - 4]
mov r8, qword [rbx + 0x168]
add r8, 4
movsxd r9, eax
test eax, eax
jne 0x14007ebea
or r9, 0xffffffffffffffff
inc r9
cmp byte [r8 + r9], 0
jne 0x14007ebe0
mov edx, 1
mov rcx, r14
call fcn.140059c70
mov esi, eax
test eax, eax
je 0x14007ec11
mov edx, 5
mov rcx, rbx
call fcn.14007e6d0
mov eax, esi
jmp 0x14007eadf
mov eax, dword [rbx + 0x154]
mov rcx, rdi
sub eax, 4
cdqe
add qword [rdi + 0xb0], rax
mov rdx, qword [rdi + 0xb0]
call fcn.14006ea60
mov rcx, r14
call fcn.14006eba0
test eax, eax
je 0x14007eadd
mov edx, 5
mov rcx, rbx
call fcn.14007e6d0
mov eax, Ordinal_46
jmp 0x14007eadf
Function at 0x140080e70
Capabilities:
Get local ipv4 addresses
Get socket information
Set socket configuration

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x40
call fcn.1401ef830
sub rsp, rax
mov rax, qword [0x140310170]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbp, qword [rcx + 0x238]
lea r8, [rsp + 0x20]
mov rsi, qword [rcx]
lea rdx, [rsp + 0x28]
mov rbx, rcx
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
mov rcx, rbp
or rdi, 0xffffffffffffffff
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x140080eea
lea r8, [rsp + 0x20]
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
lea rdx, [rsp + 0x28]
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_accept]
mov rdi, rax
mov rdx, rbp
mov rcx, rbx
call fcn.14005bb40
mov rcx, rsi
cmp rdi, 0xffffffffffffffff
jne 0x140080f0f
lea rdx, str.Error_accept__ing_server_connect
call fcn.140059810
lea eax, [rdi + 0x1f]
jmp 0x140080f7e
lea rdx, str.Connection_accepted_from_server_n
call fcn.140059720
mov byte [rbx + 0x3d4], 0
lea r8, [rsp + 0x24]
mov edx, 0x8004667e
mov qword [rbx + 0x238], rdi
mov rcx, rdi
mov dword [rsp + 0x24], 1
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov byte [rbx + 0x251], 1
mov rax, qword [rsi + 0x2c8]
test rax, rax
je 0x140080f7c
mov rcx, qword [rsi + 0x2d0]
mov r8d, 1
mov rdx, rdi
call rax
test eax, eax
je 0x140080f7c
mov rcx, rbx
call fcn.140080d60
mov eax, Ordinal_46
jmp 0x140080f7e
xor eax, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1401ef4e0
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x140081920
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rbx
mov eax, reloc.WLDAP32.dll_Ordinal_32
call fcn.1401ef830
sub rsp, rax
mov rbx, rcx
add rcx, 0x630
cmp byte [rcx + 0x8a], 0
jne 0x1400819d6
xor r9d, r9d
mov dword [rcx + 0xa0], r9d
mov edx, r9d
mov rax, qword [rbx]
cmp dword [rax + 0x54c], 2
sete dl
mov dword [rcx + 0xa4], edx
cmp byte [rbx + 0x3ca], r9b
je 0x14008199f
mov r8, qword [rcx + 0x68]
test r8, r8
je 0x14008199f
lea rdx, str.CWD__s
mov dword [rcx + 0x9c], r9d
call fcn.140098110
test eax, eax
jne 0x1400819e3
mov dword [rbx + 0x6d8], 0x10
add rsp, 0x20
pop rbx
ret
cmp dword [rcx + 0x78], r9d
je 0x1400819d6
mov r8, qword [rcx + 0x70]
lea rdx, str.CWD__s
mov dword [rcx + 0x9c], 1
mov r8, qword [r8]
call fcn.140098110
test eax, eax
jne 0x1400819e3
mov dword [rbx + 0x6d8], 0x10
add rsp, 0x20
pop rbx
ret
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.140082680
add rsp, 0x20
pop rbx
ret
Function at 0x1400823c0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rbx
mov eax, reloc.WLDAP32.dll_Ordinal_32
call fcn.1401ef830
sub rsp, rax
mov rax, qword [rcx]
mov rbx, rcx
mov rdx, qword [rax + 0x1f8]
cmp dword [rdx + 0x18], 0
je 0x140082416
cmp qword [rcx + 0x6b0], 0
je 0x140082416
add rcx, 0x630
lea rdx, str.REST__d
xor r8d, r8d
call fcn.140098110
test eax, eax
jne 0x140082420
mov dword [rbx + 0x6d8], 0x1a
add rsp, 0x20
pop rbx
ret
add rsp, 0x20
pop rbx
jmp fcn.1400822b0
add rsp, 0x20
pop rbx
ret

Function at 0x140082430
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rbx
mov eax, reloc.WLDAP32.dll_Ordinal_32
call fcn.1401ef830
sub rsp, rax
mov rbx, rcx
add rcx, 0x630
mov rax, qword [rbx]
mov rdx, qword [rax + 0x1f8]
cmp dword [rdx + 0x18], 1
jne 0x140082485
mov r8, qword [rcx + 0x80]
test r8, r8
je 0x140082485
lea rdx, str.SIZE__s
call fcn.140098110
test eax, eax
jne 0x140082492
mov dword [rbx + 0x6d8], 0x17
add rsp, 0x20
pop rbx
ret
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.1400823c0
add rsp, 0x20
pop rbx
ret

Function at 0x140082600
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov eax, Ordinal_41
call fcn.1401ef830
sub rsp, rax
mov r9, qword [rcx]
cmp byte [r9 + 0x570], 0
je 0x140082669
cmp qword [rcx + 0x6b0], 0
je 0x140082669
cmp byte [r9 + 0x563], 0
mov eax, 0x41
mov edx, 0x49
cmovne edx, eax
movsx eax, byte [rcx + 0x6c8]
cmp eax, edx
je 0x140082669
mov rax, qword [r9 + 0x1f8]
mov r8d, reloc.WS2_32.dll_send
mov dword [rax + 0x18], 1
movzx edx, byte [r9 + 0x563]
add rsp, 0x28
jmp fcn.140085180
add rsp, 0x28
jmp fcn.140082430

Function at 0x140082680
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rbx
mov eax, reloc.WLDAP32.dll_Ordinal_32
call fcn.1401ef830
sub rsp, rax
mov rax, qword [rcx]
mov rbx, rcx
add rcx, 0x630
cmp byte [rax + 0x561], 0
jne 0x1400826ae
cmp dword [rax + 0x3d0], 0
je 0x1400826da
mov r8, qword [rcx + 0x80]
test r8, r8
je 0x1400826da
lea rdx, str.MDTM__s
call fcn.140098110
test eax, eax
jne 0x1400826e7
mov dword [rbx + 0x6d8], 0x12
add rsp, 0x20
pop rbx
ret
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.140082600
add rsp, 0x20
pop rbx
ret
Function at 0x1400830c0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
mov eax, reloc.WLDAP32.dll_Ordinal_32
call fcn.1401ef830
sub rsp, rax
mov rsi, qword [rcx]
lea eax, [rdx - 0xc8]
mov ebx, dword [rcx + 0x6cc]
mov rdi, rcx
cmp eax, 0x64
jb 0x14008314a
test ebx, ebx
jne 0x140083108
lea rdx, str.disabling_EPRT_usage_n
mov rcx, rsi
call fcn.140059720
mov byte [rdi + 0x3dd], bl
inc ebx
cmp ebx, 2
jne 0x140083131
lea rdx, str.Failed_to_do_PORT
mov rcx, rsi
call fcn.140059810
lea eax, [rbx + 0x1c]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov edx, ebx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x1400819f0
lea rdx, str.Connect_data_stream_actively_n
mov rcx, rsi
call fcn.140059720
xor edx, edx
mov dword [rdi + 0x6d8], 0
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.1400864c0

Function at 0x140083480
Capabilities:
Check http status code

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
mov eax, reloc.WLDAP32.dll_Ordinal_32
call fcn.1401ef830
sub rsp, rax
xor ebx, ebx
lea eax, [rdx - 0xc8]
mov rsi, rcx
mov rcx, qword [rcx]
mov edi, r8d
cmp eax, 0x64
jb 0x1400834cd
lea rdx, str.Couldnt_set_desired_mode
call fcn.140059810
lea eax, [rbx + 0x11]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
cmp edx, 0xc8
je 0x1400834e4
mov r8d, edx
lea rdx, str.Got_a__03d_response_code_instead_of_the_assumed_200_n
call fcn.140059720
cmp edi, 0x13
jne 0x1400834f3
mov rcx, rsi
call fcn.140082430
jmp 0x140083520
cmp edi, 0x14
jne 0x140083502
mov rcx, rsi
call fcn.1400824a0
jmp 0x140083520
cmp edi, 0x15
jne 0x14008350d
lea r8d, [rdi - 8]
jmp 0x140083516
cmp edi, 0x16
jne 0x140083522
lea r8d, [rdi - 8]
mov dl, 1
mov rcx, rsi
call fcn.1400829b0
mov ebx, eax
mov rsi, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400868f0
Capabilities:
Initialize winsock library

Disassembly:
push rbx
mov eax, 0x1d0
call fcn.1401ef830
sub rsp, rax
mov rax, qword [0x140310170]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov rbx, rcx
lea rdx, [rsp + 0x20]
mov ecx, 2
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x14008693c
mov r8d, eax
lea rdx, str.WSAStartup_failed___d_
mov rcx, rbx
call fcn.140059810
jmp 0x140086966
call qword [sym.imp.WS2_32.dll_WSACleanup]
movzx eax, word [rsp + 0x20]
cmp al, 2
jne 0x140086957
shr ax, 8
test al, al
jne 0x140086957
xor eax, eax
jmp 0x14008696b
lea rdx, str.insufficient_winsock_version_to_support_telnet
mov rcx, rbx
call fcn.140059810
mov eax, 2
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.1401ef4e0
add rsp, 0x1d0
pop rbx
ret
Function at 0x140086bf0
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
mov eax, reloc.WLDAP32.dll_Ordinal_32
call fcn.1401ef830
sub rsp, rax
mov rbp, qword [rcx]
mov edi, r8d
mov esi, edx
mov byte [rsp + 0x3a], dil
mov rbx, rcx
mov byte [rsp + 0x39], sil
mov rcx, qword [rcx + 0x230]
lea r8d, [rax - 0x1d]
lea rdx, [rsp + 0x38]
mov byte [rsp + 0x38], 0xff
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x140086c5c
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rbp
mov r8d, eax
call fcn.140059810
mov rcx, qword [rbx]
lea rdx, str.SENT
mov r9d, edi
mov r8d, esi
call fcn.140086ab0
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x140086c90
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, Ordinal_41
call fcn.1401ef830
sub rsp, rax
mov rax, qword [rcx]
movsxd r10, edx
mov r9, qword [rax + 0x1f8]
mov r8d, dword [r9 + r10*4 + 0xc08]
test r8d, r8d
je 0x140086cf7
sub r8d, 2
je 0x140086cdb
cmp r8d, 1
jne 0x140086d14
cmp dword [r9 + r10*4 + 0x1008], 0
jne 0x140086d14
mov dword [r9 + r10*4 + 0x1008], r8d
add rsp, 0x28
ret
cmp dword [r9 + r10*4 + 0x1008], 1
jne 0x140086d14
mov dword [r9 + r10*4 + 0x1008], 0
add rsp, 0x28
ret
mov r8d, edx
mov dword [r9 + r10*4 + 0xc08], 2
mov edx, 0xfd
add rsp, 0x28
jmp fcn.140086bf0
add rsp, 0x28
ret

Function at 0x140086d20
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, Ordinal_41
call fcn.1401ef830
sub rsp, rax
mov rax, qword [rcx]
mov r11, rcx
movsxd r10, edx
mov r9, qword [rax + 0x1f8]
mov r8d, dword [r9 + r10*4 + 0xc08]
test r8d, r8d
je 0x140086de8
sub r8d, 2
je 0x140086d95
cmp r8d, 1
jne 0x140086dd2
mov ecx, dword [r9 + r10*4 + 0x1008]
test ecx, ecx
je 0x140086d84
cmp ecx, r8d
jne 0x140086dd2
mov dword [r9 + r10*4 + 0xc08], r8d
mov dword [r9 + r10*4 + 0x1008], 0
add rsp, 0x28
ret
mov dword [r9 + r10*4 + 0xc08], 0
add rsp, 0x28
ret
mov ecx, dword [r9 + r10*4 + 0x1008]
test ecx, ecx
je 0x140086dd7
cmp ecx, 1
jne 0x140086dd2
mov dword [r9 + r10*4 + 0xc08], 3
mov rcx, r11
mov dword [r9 + r10*4 + 0x1008], 0
mov r8d, edx
mov edx, 0xfe
add rsp, 0x28
jmp fcn.140086bf0
add rsp, 0x28
ret
mov dword [r9 + r10*4 + 0xc08], 1
add rsp, 0x28
ret
cmp dword [r9 + r10*4 + 0x1408], 1
jne 0x140086dc1
mov r8d, edx
mov dword [r9 + r10*4 + 0xc08], 1
mov edx, 0xfd
add rsp, 0x28
jmp fcn.140086bf0
Function at 0x140086e10
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, Ordinal_41
call fcn.1401ef830
sub rsp, rax
mov rax, qword [rcx]
mov r11, rcx
movsxd r10, edx
mov r9, qword [rax + 0x1f8]
mov r8d, dword [r9 + r10*4 + 0xc08]
sub r8d, 1
je 0x140086ec1
sub r8d, 1
je 0x140086e8a
cmp r8d, 1
jne 0x140086edc
mov ecx, dword [r9 + r10*4 + 0x1008]
test ecx, ecx
je 0x140086eb2
cmp ecx, r8d
jne 0x140086edc
xor eax, eax
mov dword [r9 + r10*4 + 0xc08], 2
mov r8d, edx
mov dword [r9 + r10*4 + 0x1008], eax
mov edx, 0xfd
mov rcx, r11
add rsp, 0x28
jmp fcn.140086bf0
mov ecx, dword [r9 + r10*4 + 0x1008]
test ecx, ecx
je 0x140086eb2
cmp ecx, 1
jne 0x140086edc
xor eax, eax
mov dword [r9 + r10*4 + 0xc08], eax
mov dword [r9 + r10*4 + 0x1008], eax
add rsp, 0x28
ret
xor eax, eax
mov dword [r9 + r10*4 + 0xc08], eax
add rsp, 0x28
ret
xor eax, eax
mov r8d, edx
mov edx, 0xfe
mov dword [r9 + r10*4 + 0xc08], eax
add rsp, 0x28
jmp fcn.140086bf0
add rsp, 0x28
ret

Function at 0x140086ef0
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, Ordinal_41
call fcn.1401ef830
sub rsp, rax
mov rax, qword [rcx]
movsxd r10, edx
mov r9, qword [rax + 0x1f8]
mov r8d, dword [r9 + r10*4 + 8]
test r8d, r8d
je 0x140086f54
sub r8d, 2
je 0x140086f38
cmp r8d, 1
jne 0x140086f6e
cmp dword [r9 + r10*4 + 0x408], 0
jne 0x140086f6e
mov dword [r9 + r10*4 + 0x408], r8d
add rsp, 0x28
ret
cmp dword [r9 + r10*4 + 0x408], 1
jne 0x140086f6e
mov dword [r9 + r10*4 + 0x408], 0
add rsp, 0x28
ret
mov r8d, edx
mov dword [r9 + r10*4 + 8], 2
mov edx, 0xfb
add rsp, 0x28
jmp fcn.140086bf0
add rsp, 0x28
ret

Function at 0x1400870b0
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, Ordinal_41
call fcn.1401ef830
sub rsp, rax
mov rax, qword [rcx]
mov r11, rcx
movsxd r10, edx
mov r9, qword [rax + 0x1f8]
mov r8d, dword [r9 + r10*4 + 8]
sub r8d, 1
je 0x140087151
sub r8d, 1
je 0x140087120
cmp r8d, 1
jne 0x140087169
mov ecx, dword [r9 + r10*4 + 0x408]
test ecx, ecx
je 0x140087145
cmp ecx, r8d
jne 0x140087169
xor eax, eax
mov dword [r9 + r10*4 + 8], 2
mov r8d, edx
mov dword [r9 + r10*4 + 0x408], eax
mov edx, 0xfb
mov rcx, r11
add rsp, 0x28
jmp fcn.140086bf0
mov ecx, dword [r9 + r10*4 + 0x408]
test ecx, ecx
je 0x140087145
cmp ecx, 1
jne 0x140087169
xor eax, eax
mov dword [r9 + r10*4 + 8], eax
mov dword [r9 + r10*4 + 0x408], eax
add rsp, 0x28
ret
xor eax, eax
mov dword [r9 + r10*4 + 8], eax
add rsp, 0x28
ret
xor eax, eax
mov r8d, edx
mov edx, 0xfc
mov dword [r9 + r10*4 + 8], eax
add rsp, 0x28
jmp fcn.140086bf0
add rsp, 0x28
ret
Function at 0x140087d30
Capabilities:
Send data
Send data on socket

Disassembly:
cmp edx, 0x1f
jne 0x140087ee7
push rbp
push rdi
push r14
mov eax, Ordinal_50
call fcn.1401ef830
sub rsp, rax
mov rbp, qword [rcx]
mov r14, rcx
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], r15
mov rdi, qword [rbp + 0x1f8]
lea rsi, [rdi + 0x1cb8]
lea rbx, [rdi + 0x1eb8]
mov qword [rbx], rsi
cmp rsi, rbx
jae 0x140087d82
mov byte [rsi], 0xff
inc qword [rbx]
mov rax, qword [rbx]
cmp rax, rbx
jae 0x140087d90
mov byte [rax], 0xfa
inc qword [rbx]
mov rax, qword [rbx]
cmp rax, rbx
jae 0x140087d9e
mov byte [rax], Ordinal_32
inc qword [rbx]
movzx ecx, word [rdi + 0x1ca8]
call qword [sym.imp.WS2_32.dll_htons]
movzx ecx, word [rdi + 0x1caa]
movzx r15d, ax
mov word [rsp + 0x58], ax
call qword [sym.imp.WS2_32.dll_htons]
mov rcx, qword [rbx]
movzx r8d, ax
mov word [rsp + 0x50], ax
cmp rcx, rbx
jae 0x140087dd8
mov byte [rcx], r15b
inc qword [rbx]
mov rdx, qword [rbx]
mov r15, qword [rsp + 0x20]
cmp rdx, rbx
jae 0x140087def
movzx ecx, byte [rsp + 0x59]
mov byte [rdx], cl
inc qword [rbx]
mov rax, qword [rbx]
cmp rax, rbx
jae 0x140087dfd
mov byte [rax], r8b
inc qword [rbx]
mov rcx, qword [rbx]
cmp rcx, rbx
jae 0x140087e0f
movzx eax, byte [rsp + 0x51]
mov byte [rcx], al
inc qword [rbx]
mov rax, qword [rbx]
cmp rax, rbx
jae 0x140087e1d
mov byte [rax], 0xff
inc qword [rbx]
mov rax, qword [rbx]
cmp rax, rbx
jae 0x140087e2b
mov byte [rax], 0xf0
inc qword [rbx]
mov rax, qword [rbx]
lea r8, [rdi + 0x1cba]
mov r9, rax
mov qword [rdi + 0x1ec0], rax
sub r9, rsi
mov qword [rbx], rsi
sub r9, 2
mov edx, 0x3e
mov rcx, rbp
call fcn.140087170
mov rcx, qword [r14 + 0x230]
xor r9d, r9d
mov rdx, rsi
lea r8d, [r9 + 3]
call qword [sym.imp.WS2_32.dll_send]
mov rsi, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x60]
test eax, eax
jns 0x140087e93
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rbp
mov r8d, eax
call fcn.140059810
lea rdx, [rdi + 0x1cbb]
mov r8d, 4
mov rcx, r14
call fcn.1400884f0
mov rcx, qword [r14 + 0x230]
lea rdx, [rdi + 0x1cbf]
xor r9d, r9d
lea r8d, [r9 + 2]
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x140087edf
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rbp
mov r8d, eax
call fcn.140059810
add rsp, 0x30
pop r14
pop rdi
pop rbp
ret
Function at 0x14008f110
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov eax, Ordinal_41
call fcn.1401ef830
sub rsp, rax
mov rcx, qword [rcx + 0x230]
lea r9d, [rax - 0x26]
lea r8d, [rax - 0x27]
lea rdx, [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_recv]
movsxd rcx, eax
test eax, eax
je 0x14008f17e
cmp rcx, 1
jne 0x14008f14e
mov eax, 1
add rsp, 0x28
ret
cmp rcx, 0xffffffffffffffff
jne 0x14008f185
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea ecx, [rax - 0x2733]
cmp ecx, 1
jbe 0x14008f144
cmp eax, 0xb
je 0x14008f144
add eax, 0xffffd8be
cmp eax, 0xa
ja 0x14008f185
mov ecx, 0x59d
bt ecx, eax
jae 0x14008f185
xor eax, eax
add rsp, 0x28
ret
or eax, 0xffffffff
add rsp, 0x28
ret
Function at 0x140093430
Capabilities:
Hash data using sha256

Disassembly:
push rbx
push rsi
push rdi
mov eax, 0xa0
call fcn.1401ef830
sub rsp, rax
mov rax, qword [0x140310170]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rdi, rdx
mov rsi, r8
xor edx, edx
mov rbx, rcx
lea rcx, [rsp + 0x20]
lea r8d, [rdx + 0x70]
call fcn.14020fde0
mov r8, rdi
mov dword [rsp + 0x20], 0x6a09e667
mov rdx, rbx
mov dword [rsp + 0x24], 0xbb67ae85
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x28], 0x3c6ef372
mov dword [rsp + 0x2c], 0xa54ff53a
mov dword [rsp + 0x30], 0x510e527f
mov dword [rsp + 0x34], 0x9b05688c
mov dword [rsp + 0x38], 0x1f83d9ab
mov dword [rsp + 0x3c], 0x5be0cd19
mov dword [rsp + 0x8c], reloc.WLDAP32.dll_Ordinal_32
call fcn.14009cae0
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.14009cc30
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1401ef4e0
add rsp, 0xa0
pop rdi
pop rsi
pop rbx
ret
Function at 0x140097c90
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
mov eax, reloc.WLDAP32.dll_Ordinal_32
call fcn.1401ef830
sub rsp, rax
mov r14, qword [rcx + 0x50]
mov rbx, rcx
mov rsi, qword [r14]
mov edi, dword [rsi + 0x334]
test edi, edi
jne 0x140097cca
mov edi, dword [rcx + 0x48]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r8d, eax
movabs rbp, 0x20c49ba5e353f7cf
mov eax, 0x10624dd3
mul r8d
mov r9d, edx
shr r9d, 6
imul ecx, r9d, 0x3e8
sub r8d, ecx
mov rcx, qword [rbx + 0x40]
imul r8d, r8d, 0x3e8
mov rax, rcx
shr rax, 0x20
sub r9d, ecx
imul ecx, r9d, 0x3e8
movsxd rbx, edi
sub r8d, eax
mov rax, rbp
movsxd r8, r8d
imul r8
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
sub rbx, rdx
movsxd rdx, ecx
sub rbx, rdx
cmp dword [rsi + 0x328], 0
je 0x140097db5
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r8d, eax
mov eax, 0x10624dd3
mul r8d
mov rax, rbp
mov r10d, edx
shr r10d, 6
imul ecx, r10d, 0x3e8
sub r8d, ecx
mov rcx, qword [r14 + 0x220]
imul r9d, r8d, 0x3e8
sub r10d, ecx
mov r8, rcx
imul ecx, r10d, 0x3e8
shr r8, 0x20
sub r9d, r8d
movsxd r8, r9d
imul r8
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
movsxd rax, dword [rsi + 0x328]
sub rax, rdx
movsxd rdx, ecx
sub rax, rdx
cmp rbx, rax
cmovl rax, rbx
jmp 0x140097db8
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140098700
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rdi
mov eax, Ordinal_211
call fcn.1401ef830
sub rsp, rax
mov rax, qword [0x140310170]
xor rax, rsp
mov qword [rsp + 0xc0], rax
or r9, 0xffffffffffffffff
mov rdi, r8
mov rax, r9
nop
inc rax
cmp byte [rdx + rax], 0
jne 0x140098730
mov r11d, ntohs
cmp rax, r11
jae 0x140098750
inc r9
cmp byte [rdx + r9], 0
jne 0x140098744
jmp 0x140098753
mov r9, r11
mov r8, r9
cmp r9, 1
jb 0x140098793
lea r10, [rsp + 0xb0]
sub r10, rdx
nop word [rax + rax]
movzx ecx, byte [rdx]
lea eax, [rcx - 0x61]
cmp al, 0x19
ja 0x14009877f
lea eax, [rcx - 0x20]
jmp 0x140098782
movzx eax, cl
mov byte [r10 + rdx], al
inc rdx
test cl, cl
je 0x140098793
sub r8, 1
jne 0x140098770
sub r11, r9
lea rcx, [rsp + 0xb0]
add rcx, r9
mov r8, r11
xor edx, edx
call fcn.14020fde0
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0xb0]
call fcn.140098550
mov r8d, 1
mov dword [rsp + 0x20], 0x2153474b
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x24], 0x25242340
lea rcx, [rsp + 0x20]
call fcn.14010b9e0
mov ecx, dword [rsp + 0x20]
lea rdx, [rsp + 0x30]
movzx eax, byte [rsp + 0x20]
mov byte [rdi], al
mov eax, ecx
shr eax, 8
mov byte [rdi + 1], al
mov eax, ecx
shr eax, 0x10
mov byte [rdi + 2], al
movzx eax, byte [rsp + 0x24]
shr ecx, 0x18
mov byte [rdi + 3], cl
mov ecx, dword [rsp + 0x24]
mov byte [rdi + 4], al
mov eax, ecx
shr eax, 8
mov byte [rdi + 5], al
mov eax, ecx
shr ecx, 0x18
shr eax, 0x10
mov byte [rdi + 6], al
mov byte [rdi + 7], cl
lea rcx, [rsp + 0xb7]
call fcn.140098550
mov r8d, 1
mov dword [rsp + 0x20], 0x2153474b
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x24], 0x25242340
lea rcx, [rsp + 0x20]
call fcn.14010b9e0
movzx eax, byte [rsp + 0x20]
mov ecx, dword [rsp + 0x20]
mov byte [rdi + 8], al
mov eax, ecx
shr eax, 8
mov byte [rdi + 9], al
mov eax, ecx
shr eax, 0x10
mov byte [rdi + 0xa], al
movzx eax, byte [rsp + 0x24]
shr ecx, 0x18
mov byte [rdi + 0xb], cl
mov ecx, dword [rsp + 0x24]
mov byte [rdi + 0xc], al
mov eax, ecx
shr eax, 8
mov byte [rdi + 0xd], al
mov eax, ecx
shr eax, 0x10
mov byte [rdi + 0xe], al
shr ecx, 0x18
xor eax, eax
mov byte [rdi + 0xf], cl
mov dword [rdi + 0x10], eax
mov byte [rdi + 0x14], al
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1401ef4e0
mov rbx, qword [rsp + 0xe0]
add rsp, 0xd0
pop rdi
ret