joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14012aa84
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x98
mov rax, qword [0x1401a95d8]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov dword [rsp + 0x34], 0
lea rdx, [rsp + 0x78]
mov rcx, qword [rsp + 0xa0]
call fcn.14012aca0
lea rcx, [rsp + 0x40]
call fcn.140023ac8
nop
mov edx, 0x20
lea rcx, [rsp + 0x40]
call fcn.14012cea4
mov dword [rsp + 0x30], 0
jmp 0x14012aaef
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0x10
jge 0x14012ac53
mov eax, 1
imul rax, rax, 0xb
mov byte [rsp + rax + 0x60], 0x62
mov eax, 1
imul rax, rax, 0
mov byte [rsp + rax + 0x60], 0x30
mov eax, 1
imul rax, rax, 0x10
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0x11
jae 0x14012ab2e
jmp 0x14012ab33
call fcn.140171264
mov rax, qword [rsp + 0x38]
mov byte [rsp + rax + 0x60], 0
mov eax, 1
imul rax, rax, 0xd
mov byte [rsp + rax + 0x60], 0x64
mov eax, 1
imul rax, rax, 8
mov byte [rsp + rax + 0x60], 0x38
mov eax, 1
imul rax, rax, 2
mov byte [rsp + rax + 0x60], 0x32
mov eax, 1
imul rax, rax, 5
mov byte [rsp + rax + 0x60], 0x35
mov eax, 1
imul rax, rax, 0xc
mov byte [rsp + rax + 0x60], 0x63
mov eax, 1
imul rax, rax, 9
mov byte [rsp + rax + 0x60], 0x39
mov eax, 1
imul rax, rax, 7
mov byte [rsp + rax + 0x60], 0x37
mov eax, 1
imul rax, rax, 3
mov byte [rsp + rax + 0x60], 0x33
mov eax, 1
imul rax, rax, 0xf
mov byte [rsp + rax + 0x60], 0x66
mov eax, 1
imul rax, rax, 6
mov byte [rsp + rax + 0x60], 0x36
mov eax, 1
imul rax, rax, 0xa
mov byte [rsp + rax + 0x60], 0x61
mov eax, 1
imul rax, rax, 4
mov byte [rsp + rax + 0x60], 0x34
mov eax, 1
imul rax, rax, 0xe
mov byte [rsp + rax + 0x60], 0x65
mov eax, 1
imul rax, rax, 1
mov byte [rsp + rax + 0x60], 0x31
movsxd rax, dword [rsp + 0x30]
movzx eax, byte [rsp + rax + 0x78]
sar eax, 4
and eax, 0xf
cdqe
mov al, byte [rsp + rax + 0x60]
mov byte [rsp + 0x20], al
mov dl, byte [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.1400a6188
movsxd rax, dword [rsp + 0x30]
movzx eax, byte [rsp + rax + 0x78]
and eax, 0xf
cdqe
mov al, byte [rsp + rax + 0x60]
mov byte [rsp + 0x28], al
mov dl, byte [rsp + 0x28]
lea rcx, [rsp + 0x40]
call fcn.1400a6188
jmp 0x14012aae5
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0xa8]
call fcn.14002381c
mov eax, dword [rsp + 0x34]
or eax, 1
mov dword [rsp + 0x34], eax
lea rcx, [rsp + 0x40]
call fcn.140024a68
mov rax, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140171490
add rsp, 0x98
ret

Function at 0x14012ae00
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 8], rcx
mov rax, qword [rsp + 8]
mov qword [rax], 0
mov rax, qword [rsp + 8]
mov qword [rax + 8], 0
mov eax, 4
imul rax, rax, 0
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x50], 0x67452301
mov eax, 4
imul rax, rax, 1
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x50], 0xefcdab89
mov eax, 4
imul rax, rax, 2
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x50], 0x98badcfe
mov eax, 4
imul rax, rax, 3
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x50], 0x10325476
ret
Function at 0x140130eb8
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rcx
mov rax, qword [rsp + 8]
mov qword [rax + 0x20], 0
mov rax, qword [rsp + 8]
mov qword [rax + 0x28], 0
mov eax, 4
imul rax, rax, 0
mov rcx, qword [rsp + 8]
mov dword [rcx + rax], 0x6a09e667
mov eax, 4
imul rax, rax, 1
mov rcx, qword [rsp + 8]
mov dword [rcx + rax], 0xbb67ae85
mov eax, 4
imul rax, rax, 2
mov rcx, qword [rsp + 8]
mov dword [rcx + rax], 0x3c6ef372
mov eax, 4
imul rax, rax, 3
mov rcx, qword [rsp + 8]
mov dword [rcx + rax], 0xa54ff53a
mov eax, 4
imul rax, rax, 4
mov rcx, qword [rsp + 8]
mov dword [rcx + rax], 0x510e527f
mov eax, 4
imul rax, rax, 5
mov rcx, qword [rsp + 8]
mov dword [rcx + rax], 0x9b05688c
mov eax, 4
imul rax, rax, 6
mov rcx, qword [rsp + 8]
mov dword [rcx + rax], 0x1f83d9ab
mov eax, 4
imul rax, rax, 7
mov rcx, qword [rsp + 8]
mov dword [rcx + rax], 0x5be0cd19
ret
Function at 0x140136be4
Capabilities:
Encode data using xor

Disassembly:
pop rsi
pop rcx
and al, 0x6f
xor rax, 0x5c744e7b

Function at 0x14013846d
Capabilities:
Encode data using base64

Disassembly:
mov ah, 0x3f
mov esi, 0xb33cb945
mov edx, 0xb54ac13d
mov dl, 0x3d
mov esi, 0xbc44b748
mov r11d, 0xb74ab842
cmp al, 0xba

Function at 0x14013e9c8
Capabilities:
Send data
Send data on socket

Disassembly:
push rbx
sub rsp, 0x30
lea rax, [rsp + 0x48]
mov dword [rsp + 0x48], 4
lea r9, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov edx, 0xffff
mov r8d, 0x1008
mov rbx, rcx
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x14013ea15
cmp dword [rsp + 0x50], 1
jne 0x14013ea15
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_send]
add rsp, 0x30
pop rbx
ret

Function at 0x1401406c8
Capabilities:
Hash data using djb2

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x140140769
call fcn.140152000
test al, al
jne 0x140140769
xor esi, esi
or rdi, 0xffffffffffffffff
inc rdi
cmp byte [rbx + rdi], sil
jne 0x1401406f2
mov r8, rdi
mov edx, 0x2e
mov rcx, rbx
call fcn.14015bae0
test rax, rax
je 0x140140737
sub rax, rbx
mov edx, 0x2e
mov r8, rax
mov rcx, rbx
call fcn.14015bae0
mov rsi, rax
test rax, rax
je 0x140140737
inc rsi
mov rcx, rbx
sub rcx, rsi
add rdi, rcx
test rsi, rsi
cmovne rbx, rsi
lea rsi, [rbx + rdi]
mov edi, 0x1505
jmp 0x14014075e
mov cl, byte [rbx]
call fcn.14014f3bc
imul rdi, rdi, 0x21
movsx rcx, al
xor rdi, rcx
inc rbx
cmp rbx, rsi
jb 0x140140749
movzx eax, dil
jmp 0x14014076b
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14014d794
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rdi, rcx
xor ebx, ebx
lea rcx, [0x14000b350]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rsi, rax
test rax, rax
je 0x14014d8d9
lea rdx, [0x14000b360]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x14000b370]
mov rcx, rdi
mov rbp, rax
call fcn.140186d30
test rax, rax
je 0x14014d809
mov rcx, rdi
test rbp, rbp
je 0x14014d801
mov r8d, 8
jmp 0x14014d82c
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
jmp 0x14014d830
test rbp, rbp
je 0x14014d838
lea rdx, [0x14000b378]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14014d838
mov r8d, 0x800
mov rcx, rdi
xor edx, edx
call rbp
mov rbx, rax
jmp 0x14014d8d6
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov r15d, eax
test eax, eax
je 0x14014d8d6
or r14, 0xffffffffffffffff
mov rdx, r14
inc rdx
cmp byte [rdi + rdx], bl
jne 0x14014d854
lea ecx, [rax + 1]
add rcx, rdx
call qword [fcn.1401787a4]
mov rsi, rax
test rax, rax
je 0x14014d8cd
mov edx, r15d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x14014d8cd
mov rax, r14
inc rax
cmp byte [rsi + rax], bl
jne 0x14014d883
mov ecx, 0x5c
mov word [rax + rsi], cx
inc r14
cmp byte [rsi + r14], bl
jne 0x14014d894
mov rcx, rsi
sub rcx, rdi
add rcx, r14
mov al, byte [rdi]
mov byte [rcx + rdi], al
inc rdi
test al, al
jne 0x14014d8a6
mov rcx, rsi
test rbp, rbp
je 0x14014d8c4
xor edx, edx
lea r8d, [rdx + 8]
call rbp
jmp 0x14014d8ca
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
mov rcx, rsi
call qword [fcn.140178790]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret

Function at 0x14014d934
Capabilities:
Initialize winsock library

Disassembly:
sub rsp, 0x1e8
mov rax, qword [0x1401a95d8]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
test cl, 2
je 0x14014d989
mov ecx, 0x202
lea rdx, [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x14014d970
mov eax, 2
jmp 0x14014da02
movzx eax, word [rsp + 0x30]
cmp al, 2
jne 0x14014d981
shr ax, 8
cmp al, 2
je 0x14014d989
call qword [sym.imp.WS2_32.dll_WSACleanup]
jmp 0x14014d966
call fcn.140169b90
test eax, eax
jne 0x14014da02
lea rcx, [0x14000b330]
call fcn.14014d794
mov qword [0x1401aa608], rax
test rax, rax
je 0x14014d9cf
lea rdx, [0x14000b340]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1401aa600]
test rax, rax
cmovne rcx, rax
mov qword [0x1401aa600], rcx
xor edx, edx
mov dword [rsp + 0x20], 3
mov r9d, 2
xor r8d, r8d
lea ecx, [rdx + 6]
call fcn.140169794
test al, al
lea rcx, [0x1401ab9b0]
setne byte [0x1401ab9a8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xor eax, eax
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.140171490
add rsp, 0x1e8
ret
Function at 0x14015c118
Capabilities:
Move file

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
sub rsp, 0x60
mov rbx, rcx
movaps xmmword [rax - 0x18], xmm6
lea rcx, [rax - 0x38]
mov rdi, rdx
call fcn.140140d04
mov rcx, rbx
movups xmm6, xmmword [rax]
call case.0x140147e69.1
mov rcx, rdi
mov rsi, rax
call case.0x140147e69.1
mov rbx, rax
mov rdx, rax
mov edi, 1
jmp 0x14015c199
lea rcx, [rsp + 0x40]
movdqa xmmword [rsp + 0x20], xmm6
call fcn.140140d04
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
movups xmm0, xmmword [rax]
movdqu xmmword [rsp + 0x30], xmm0
call fcn.140140d7c
cmp rax, 0x3e8
ja 0x14015c1da
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rdx, rbx
mov r8d, edi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
je 0x14015c15e
test rsi, rsi
je 0x14015c1b6
mov rcx, rsi
call fcn.140178790
test rbx, rbx
je 0x14015c1c3
mov rcx, rbx
call fcn.140178790
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
movaps xmm6, xmmword [rsp + 0x50]
add rsp, 0x60
pop rdi
ret
test rsi, rsi
je 0x14015c1e7
mov rcx, rsi
call fcn.140178790
test rbx, rbx
je 0x14015c1f4
mov rcx, rbx
call fcn.140178790
mov eax, edi
jmp 0x14015c1c5
Function at 0x14015c348
Capabilities:
Resolve dns

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r12, r9
xor edi, edi
and qword [r9], rdi
xor r13d, r13d
lea r9, [rax + 0x20]
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov r14d, eax
test eax, eax
jne 0x14015c4c7
mov rbx, qword [rsp + 0x68]
test rbx, rbx
je 0x14015c4b1
mov rax, qword [rbx + 0x18]
test rax, rax
je 0x14015c3ad
or rbp, 0xffffffffffffffff
inc rbp
cmp byte [rax + rbp], 0
jne 0x14015c39f
inc rbp
jmp 0x14015c3af
xor ebp, ebp
cmp dword [rbx + 4], 2
jne 0x14015c3bd
mov r15d, reloc.WS2_32.dll_recv
jmp 0x14015c3cd
cmp dword [rbx + 4], 0x17
jne 0x14015c465
mov r15d, 0x1c
cmp qword [rbx + 0x20], 0
je 0x14015c465
cmp qword [rbx + 0x10], 0
jbe 0x14015c465
cmp qword [rbx + 0x10], r15
jb 0x14015c465
lea rcx, [rbp + 0x30]
add rcx, r15
call qword [fcn.1401787a4]
mov rsi, rax
test rax, rax
je 0x14015c473
mov ecx, dword [rbx]
mov r8, r15
mov dword [rax], ecx
mov ecx, dword [rbx + 4]
mov dword [rax + 4], ecx
mov ecx, dword [rbx + 8]
mov dword [rax + 8], ecx
mov ecx, dword [rbx + 0xc]
and qword [rax + 0x18], 0
and qword [rax + 0x28], 0
mov dword [rax + 0xc], ecx
lea rcx, [rax + 0x30]
mov qword [rax + 0x20], rcx
mov dword [rax + 0x10], r15d
mov rdx, qword [rbx + 0x20]
call fcn.140172530
test rbp, rbp
je 0x14015c452
mov rcx, qword [rsi + 0x20]
mov r8, rbp
add rcx, r15
mov qword [rsi + 0x18], rcx
mov rdx, qword [rbx + 0x18]
call fcn.140172530
test rdi, rdi
cmove rdi, rsi
test r13, r13
je 0x14015c462
mov qword [r13 + 0x28], rsi
mov r13, rsi
mov rbx, qword [rbx + 0x28]
test rbx, rbx
je 0x14015c479
jmp 0x14015c392
mov r14d, 8
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14015c489
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
test r14d, r14d
je 0x14015c4ac
test rdi, rdi
je 0x14015c4a8
mov rbx, qword [rdi + 0x28]
mov rcx, rdi
call qword [fcn.140178790]
mov rdi, rbx
test rbx, rbx
jne 0x14015c493
xor edi, edi
jmp 0x14015c4c0
test rdi, rdi
jne 0x14015c4c0
mov r14d, 0x2af9
mov ecx, r14d
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov qword [r12], rdi
mov eax, r14d
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x14015cb78
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov r8, rdx
xor edx, edx
mov rdi, rcx
call fcn.140172be0
mov r9d, 2
mov r8d, ebx
mov rdx, rdi
xor ecx, ecx
call sub.bcrypt.dll_BCryptGenRandom
mov rbx, qword [rsp + 0x30]
neg eax
sbb eax, eax
and eax, 2
add rsp, 0x20
pop rdi
ret
Function at 0x14015fd98
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
xor ebp, ebp
mov r14, rcx
xor ecx, ecx
lea edi, [rbp + 1]
jmp 0x14015fdea
mov r8d, edi
mov rdx, rbx
mov rcx, r14
mov rbp, rbx
mov esi, edi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov edi, eax
test eax, eax
je 0x14015fe24
cmp edi, esi
je 0x14015fe24
cmp edi, 0x8000
ja 0x14015fe24
cmp edi, esi
jb 0x14015fe06
mov rcx, rbx
mov rdx, rdi
call qword [fcn.1401787ac]
mov rbx, rax
test rax, rax
jne 0x14015fdbd
mov rcx, rbp
call qword [fcn.140178790]
xor ebx, ebx
mov rbp, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov rcx, rbx
jmp 0x14015fdfe

Function at 0x140164ae4
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x30
and dword [rsp + 0x48], 0
mov rbx, rcx
mov eax, dword [0x1401aa618]
mov dword [rsp + 0x50], 0x4020
mov dword [rsp + 0x58], 4
test eax, eax
jne 0x140164b40
lea r9d, [rax + 2]
mov dword [rsp + 0x20], 3
xor r8d, r8d
lea ecx, [rax + 6]
xor edx, edx
call fcn.140169794
test al, al
je 0x140164b35
mov dword [0x1401aa618], 2
jmp 0x140164b97
mov eax, 1
mov dword [0x1401aa618], eax
cmp eax, 2
je 0x140164b97
lea rax, [rsp + 0x58]
mov edx, 0xffff
lea r9, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r8d, 0x1001
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x140164b76
mov eax, dword [rsp + 0x50]
cmp dword [rsp + 0x48], eax
jg 0x140164b97
lea r9, [rsp + 0x50]
mov dword [rsp + 0x20], 4
mov edx, 0xffff
mov r8d, 0x1001
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_setsockopt]
add rsp, 0x30
pop rbx
ret
Function at 0x1401651ac
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x160
mov rax, qword [0x1401a95d8]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov r14, qword [rcx + 0x10]
mov rbp, rcx
lea rcx, [rsp + 0x38]
mov rdi, rdx
xor r13b, r13b
call fcn.140140d04
lea rsi, [r14 + 0x98]
mov rcx, rdi
lea r12, [r14 + 8]
mov r8, rsi
mov rdx, r12
movups xmm0, xmmword [rax]
movdqu xmmword [r14 + 0x108], xmm0
call fcn.140165760
mov ebx, eax
test eax, eax
jne 0x140165378
mov rdx, rdi
mov rcx, rbp
call fcn.14016562c
mov ebx, eax
test eax, eax
jne 0x140165378
cmp dword [r12], 0x17
lea rax, [0x140011300]
mov r9d, dword [r14 + 0xd0]
lea rdx, [0x1400112e8]
cmovne rdx, rax
lea r8, [r14 + 0xa0]
mov rcx, rdi
call fcn.14014bb34
cmp dword [r12], 2
je 0x14016526b
cmp dword [r12], 0x17
jne 0x1401652d3
cmp dword [r14 + 0xc], 1
jne 0x1401652d3
mov r15b, 1
cmp byte [rdi + 0xa35], r13b
je 0x1401652d6
mov rcx, qword [rsi]
lea r9, [rsp + 0x30]
mov eax, 1
mov dword [rsp + 0x20], 4
mov r8d, eax
mov dword [rsp + 0x30], eax
lea edx, [rax + 5]
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x1401652d6
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r8d, 0x100
lea rdx, [rsp + 0x50]
mov ecx, eax
call fcn.14015aba4
mov r8, rax
lea rdx, [0x1400110c0]
mov rcx, rdi
call fcn.14014bb34
jmp 0x1401652d6
xor r15b, r15b
mov rcx, qword [rsi]
call fcn.140164ae4
test r15b, r15b
je 0x1401652f7
cmp byte [rdi + 0xa3c], r13b
je 0x1401652f7
mov rdx, qword [rsi]
mov rcx, rdi
call fcn.140165810
cmp qword [rdi + 0x270], 0
je 0x140165338
mov dl, 1
mov rcx, rdi
call fcn.14013c070
mov rdx, qword [rsi]
xor r8d, r8d
mov rcx, qword [rdi + 0x278]
call qword [rdi + 0x270]
xor edx, edx
mov rcx, rdi
mov r15d, eax
call fcn.14013c070
cmp r15d, 2
jne 0x1401653c4
mov r13b, 1
cmp dword [r12], 2
je 0x14016534a
cmp dword [r12], 0x17
jne 0x1401653d4
lea rcx, [r14 + 0x18]
call fcn.14016fab8
mov r9d, dword [r12]
mov rcx, rdi
mov r8, qword [rsi]
mov rdx, qword [rbp + 0x18]
mov dword [rsp + 0x20], eax
call fcn.140164c8c
mov ebx, eax
test eax, eax
je 0x1401653d4
cmp eax, 1
jne 0x140165378
lea ebx, [rax + 6]
cmp qword [rsi], 0xffffffffffffffff
je 0x140165397
mov r9, qword [rsi]
mov r8d, 1
mov rdx, qword [rbp + 0x18]
mov rcx, rdi
call fcn.1401656e8
or qword [rsi], 0xffffffffffffffff
mov eax, ebx
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140171490
mov rbx, qword [rsp + 0x1b0]
add rsp, 0x160
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
test r15d, r15d
je 0x140165338
mov ebx, 0x2a
jmp 0x140165378
mov rcx, qword [rsi]
mov edx, 1
call fcn.14016fa94
test r13b, r13b
je 0x140165397
mov rdx, rdi
mov rcx, rbp
call fcn.14016551c
lea rcx, [rsp + 0x38]
call fcn.140140d04
movups xmm0, xmmword [rax]
movdqu xmmword [r14 + 0x118], xmm0
mov byte [rbp + 0x24], 1
jmp 0x140165397
Function at 0x14016551c
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x1c0
mov rax, qword [0x1401a95d8]
xor rax, rsp
mov qword [rsp + 0x1b0], rax
mov rbx, qword [rcx + 0x10]
mov rsi, rdx
mov r8d, 0x80
lea rcx, [rsp + 0x30]
xor edx, edx
mov dword [rsp + 0x20], r8d
call fcn.140172be0
mov rcx, qword [rbx + 0x98]
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x1401655b2
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r8d, 0x100
lea rdx, [rsp + 0xb0]
mov ecx, eax
mov ebx, eax
call fcn.14015aba4
mov r8d, ebx
lea rdx, [0x1400111d8]
mov r9, rax
mov rcx, rsi
call fcn.14014ba60
mov eax, 2
jmp 0x140165604
mov edx, dword [rsp + 0x20]
lea r9, [rbx + 0x104]
lea r8, [rbx + 0xd4]
lea rcx, [rsp + 0x30]
call fcn.14014c64c
test al, al
jne 0x140165602
call fcn.140177de4
mov ebx, dword [rax]
call fcn.140177de4
mov r8d, 0x100
lea rdx, [rsp + 0xb0]
mov ecx, ebx
mov rdi, rax
call fcn.14015aba4
mov r8d, dword [rdi]
lea rdx, [0x140011288]
jmp 0x1401655a0
xor eax, eax
mov rcx, qword [rsp + 0x1b0]
xor rcx, rsp
call fcn.140171490
lea r11, [rsp + 0x1c0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x140165810
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x1401a95d8]
xor rax, rsp
mov qword [rsp + 0x68], rax
xor eax, eax
mov dword [rsp + 0x20], 4
cmp byte [rcx + 0xa3c], al
lea r9, [rsp + 0x50]
mov rdi, rdx
mov rbx, rcx
setne al
mov edx, 0xffff
mov r8d, 8
mov dword [rsp + 0x50], eax
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x14016587a
mov r8, rdi
lea rdx, [0x1400110e0]
mov rcx, rbx
call fcn.14014bb34
jmp 0x14016590d
mov ecx, dword [rbx + 0x9bc]
mov dword [rsp + 0x58], 1
call fcn.14014d540
imul ecx, eax, 0x3e8
mov dword [rsp + 0x50], ecx
mov dword [rsp + 0x5c], ecx
mov ecx, dword [rbx + 0x9c0]
call fcn.14014d540
and qword [rsp + 0x40], 0
lea r8, [rsp + 0x58]
and qword [rsp + 0x38], 0
mov r9d, recv
imul ecx, eax, 0x3e8
mov edx, 0x98000004
lea rax, [rsp + 0x54]
mov qword [rsp + 0x30], rax
and dword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
mov dword [rsp + 0x50], ecx
mov dword [rsp + 0x60], ecx
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
je 0x14016590d
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r8d, edi
lea rdx, [0x140011108]
mov r9d, eax
mov rcx, rbx
call fcn.14014bb34
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140171490
mov rbx, qword [rsp + 0x90]
add rsp, 0x70
pop rdi
ret
Function at 0x140166d7c
Capabilities:
Check http status code

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x30
and dword [rax + 0x10], 0
mov rbp, r8
mov rbx, rdx
mov r8d, send
lea rdx, [0x14000cd68]
mov rcx, r9
mov rdi, r9
call fcn.14014f524
test eax, eax
je 0x140166dc4
mov esi, dword [rbx + 0x158]
cmp esi, 0x191
je 0x140166deb
mov r8d, reloc.WS2_32.dll_send
lea rdx, [0x14000cd80]
mov rcx, rdi
call fcn.14014f524
test eax, eax
je 0x140166e31
mov esi, dword [rbx + 0x158]
cmp esi, 0x197
jne 0x140166e31
mov rcx, rdi
call fcn.140154424
mov rdi, rax
test rax, rax
jne 0x140166e03
lea eax, [rdi + 0x1b]
jmp 0x140166f92
cmp esi, 0x197
mov r8, rdi
mov rcx, rbx
sete dl
call fcn.140155f10
mov rcx, rdi
mov ebx, eax
call qword [fcn.140178790]
test ebx, ebx
je 0x140166f90
mov eax, ebx
jmp 0x140166f92
mov r8d, reloc.WS2_32.dll_ntohs
lea rdx, [0x14000c5f0]
mov rcx, rdi
call fcn.14014f524
test eax, eax
je 0x140166e8c
mov r8d, dword [rbx + 0x158]
lea eax, [r8 - 0xc8]
cmp eax, 0x64
jae 0x140166e71
lea rdx, [0x140011528]
mov rcx, rbx
call fcn.14014bb34
jmp 0x140166f90
xor edx, edx
lea r9, [rbp + 0x298]
lea rcx, [rdi + 0xf]
lea r8d, [rdx + 0xa]
call fcn.14015b978
jmp 0x140166f90
mov esi, 5
lea r9, [0x14000ccc4]
lea rdx, [0x14000c600]
mov qword [rsp + 0x20], rsi
mov rcx, rdi
lea r8d, [rsi + 6]
call fcn.140154374
test al, al
jne 0x140166f89
lea r8d, [rsi + 0xd]
mov rcx, rdi
lea rdx, [0x14000c610]
call fcn.14014f524
test eax, eax
je 0x140166f37
mov r8d, dword [rbx + 0x158]
lea eax, [r8 - 0xc8]
cmp eax, 0x64
jae 0x140166eee
lea rdx, [0x140011560]
jmp 0x140166e64
lea r9, [0x14000b940]
mov qword [rsp + 0x20], 7
mov r8d, reloc.WS2_32.dll_select
lea rdx, [0x14000c610]
mov rcx, rdi
call fcn.140154374
test al, al
je 0x140166f90
lea rdx, [0x140011598]
mov rcx, rbx
call fcn.14014bb34
mov rcx, rbx
mov byte [rbp + 0x2a4], 1
call fcn.140169c68
jmp 0x140166f90
lea r9, [0x14000ccc4]
mov qword [rsp + 0x20], rsi
mov r8d, send
lea rdx, [0x14000cc80]
mov rcx, rdi
call fcn.140154374
test al, al
jne 0x140166f89
lea rsi, [rbx + 0x158]
mov rcx, rdi
mov r9, rsi
lea r8, [rsp + 0x48]
lea rdx, [0x1400115b8]
call fcn.140140c24
cmp eax, 2
jne 0x140166f90
mov eax, dword [rsi]
mov dword [rbx + 0x1294], eax
jmp 0x140166f90
mov byte [rbp + 0x2a5], 1
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret