joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000cca0
Capabilities:
Read and send data from client to server
Read file on windows
Send data
Send data on socket

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x2870
call fcn.14002b060
sub rsp, rax
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x28c0], rbx
mov rax, qword [0x140041008]
xor rax, rsp
mov qword [rsp + 0x2860], rax
mov rdi, rcx
mov rsi, qword [rdx]
mov r13, qword [rdx + 8]
mov r15, qword [rdx + 0x10]
test rsi, rsi
je 0x14000ce35
xor bl, bl
lea rdx, [rcx + 0x50]
mov qword [rsp + 0x40], 7
xor ebp, ebp
mov qword [rsp + 0x38], rbp
mov word [rsp + 0x28], bp
lea rcx, [rsp + 0x28]
call fcn.140008780
mov byte [rsp + 0x48], bl
mov qword [rsp + 0x50], rbp
lea rdx, [rsp + 0x28]
cmp qword [rsp + 0x40], 8
cmovae rdx, qword [rsp + 0x28]
lea r8, [0x140038e18]
lea rcx, [rsp + 0x50]
call fcn.14001a1c4
test eax, eax
sete al
mov byte [rsp + 0x48], al
test al, al
je 0x14000cdfd
mov r12d, dword [rdi + 8]
test r12d, r12d
jle 0x14000cdfd
mov ebp, r12d
cmp byte [rsp + 0x48], 0
je 0x14000cdf0
mov r9, qword [rsp + 0x50]
mov edx, 1
mov r8d, 0x2800
lea rcx, [rsp + 0x60]
call fcn.14001ac08
mov r14, rax
test eax, eax
jle 0x14000cdf0
mov ebx, eax
lea rdi, [rsp + 0x60]
cmp byte [rsi + 0x50], 0
je 0x14000cdbf
movsxd rcx, dword [rsi + 0x4c]
xor r9d, r9d
mov r8d, ebx
mov rdx, rdi
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jle 0x14000cdbf
sub ebx, eax
cdqe
add rdi, rax
test ebx, ebx
jne 0x14000cd97
test ebx, ebx
sete al
test al, al
je 0x14000cde6
sub ebp, r14d
test r15, r15
je 0x14000cde0
mov rax, qword [r15]
mov edx, r12d
sub edx, ebp
mov r8d, r12d
mov rcx, r15
call qword [rax]
test ebp, ebp
jg 0x14000cd64
jmp 0x14000cdf8
mov dword [r13], 3
jmp 0x14000cdf8
mov dword [r13], 4
test ebp, ebp
sete bl
cmp byte [rsp + 0x48], 0
je 0x14000ce13
mov rcx, qword [rsp + 0x50]
call fcn.14001ad54
mov byte [rsp + 0x48], 0
mov r8, qword [rsp + 0x40]
cmp r8, 8
jb 0x14000ce30
inc r8
mov rdx, qword [rsp + 0x28]
lea rcx, [rsp + 0x28]
call fcn.140008c40
movzx eax, bl
jmp 0x14000ce37
xor al, al
mov rcx, qword [rsp + 0x2860]
xor rcx, rsp
call fcn.14000f1c0
mov rbx, qword [rsp + 0x28c0]
add rsp, 0x2870
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000cf70
Capabilities:
Send data
Send data on socket

Disassembly:
push rsi
push r14
push r15
sub rsp, 0x20
mov r14, qword [rdx]
mov r15, qword [rdx + 8]
mov rsi, qword [rdx + 0x10]
test r14, r14
je 0x14000d032
cmp qword [rcx + 0x68], 0x10
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
mov ebp, dword [rcx + 0x60]
mov ebx, ebp
mov qword [rsp + 0x50], rdi
lea rdi, [rcx + 0x50]
jb 0x14000cfb0
mov rdi, qword [rdi]
test ebp, ebp
je 0x14000d012
mov qword [rsp + 0x58], r12
mov r12d, 0x2800
nop
cmp byte [r14 + 0x50], 0
je 0x14000d006
movsxd rcx, dword [r14 + 0x4c]
mov r8d, ebx
cmp ebx, r12d
mov rdx, rdi
cmovge r8d, r12d
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jle 0x14000d006
sub ebx, eax
cdqe
add rdi, rax
test rsi, rsi
je 0x14000d000
mov rax, qword [rsi]
mov edx, ebp
sub edx, ebx
mov r8d, ebp
mov rcx, rsi
call qword [rax]
test ebx, ebx
jne 0x14000cfc0
jmp 0x14000d00d
mov dword [r15], 3
mov r12, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x50]
xor eax, eax
mov rbp, qword [rsp + 0x48]
test ebx, ebx
mov rbx, qword [rsp + 0x40]
sete al
add rsp, 0x20
pop r15
pop r14
pop rsi
ret
xor al, al
add rsp, 0x20
pop r15
pop r14
pop rsi
ret

Function at 0x14000d6b0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [rcx + 0x20], 0
mov rax, rdx
mov rbx, rcx
jne 0x14000d6d2
movsxd r8, r8d
call fcn.140002f40
mov al, 1
add rsp, 0x20
pop rbx
ret
mov r9, qword [rcx + 0x28]
mov qword [rsp + 0x30], rdi
movsxd rdi, r8d
cmp byte [r9 + 0x20], 0
je 0x14000d742
mov r9, qword [r9 + 0x28]
mov r8, rdi
mov edx, 1
mov rcx, rax
call fcn.14001b000
cmp rdi, rax
sete dil
test dil, dil
je 0x14000d745
mov ecx, dword [0x1400434fc]
movzx eax, dil
add ecx, eax
mov eax, dword [rbx + 0x30]
mov dword [0x1400434fc], ecx
cmp ecx, eax
jl 0x14000d745
sub ecx, eax
mov dword [0x1400434fc], ecx
mov rcx, qword [rbx + 0x28]
mov rcx, qword [rcx + 0x28]
call fcn.14001c450
movzx eax, dil
mov rdi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret
xor dil, dil
movzx eax, dil
mov rdi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret

Function at 0x14000d760
Capabilities:
Initialize winsock library

Disassembly:
push rbx
sub rsp, 0x1d0
mov rax, qword [0x140041008]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
xor eax, eax
mov qword [rcx + 0x18], reloc.WS2_32.dll_ntohs
cmp byte [0x140043500], al
mov rbx, rcx
mov qword [rcx + 0x10], rax
mov byte [rcx], al
mov dword [rcx + 0x20], eax
mov qword [rcx + 0x40], reloc.WS2_32.dll_ntohs
mov qword [rcx + 0x38], rax
mov byte [rcx + 0x28], al
mov dword [rcx + 0x48], eax
mov dword [rcx + 0x4c], 0xffffffff
mov byte [rcx + 0x50], al
jne 0x14000d7ce
mov ecx, 0x101
lea rdx, [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
setne byte [0x140043500]
mov rax, rbx
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.14000f1c0
add rsp, 0x1d0
pop rbx
ret
Function at 0x14000d7f0
Capabilities:
Initialize winsock library

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x1d0
mov rax, qword [0x140041008]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov ebx, r8d
mov qword [rcx + 0x18], reloc.WS2_32.dll_ntohs
mov qword [rcx + 0x10], 0
xor r8d, r8d
or r9, 0xffffffffffffffff
mov byte [rcx], 0
mov rdi, rcx
call fcn.1400020c0
cmp byte [0x140043500], 0
mov dword [rdi + 0x20], ebx
mov qword [rdi + 0x40], reloc.WS2_32.dll_ntohs
mov qword [rdi + 0x38], 0
mov byte [rdi + 0x28], 0
mov dword [rdi + 0x48], 0
mov dword [rdi + 0x4c], 0xffffffff
mov byte [rdi + 0x50], 0
jne 0x14000d87f
mov ecx, 0x101
lea rdx, [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
setne byte [0x140043500]
mov rax, rdi
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.14000f1c0
mov rbx, qword [rsp + 0x1f0]
add rsp, 0x1d0
pop rdi
ret

Function at 0x14000dbe0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
sub rsp, 0x20
movzx ebx, byte [rcx + 0x50]
test bl, bl
je 0x14000dc0d
movsxd r9, dword [rcx + 0x4c]
xor eax, eax
test r8d, r8d
jle 0x14000dc10
mov rcx, r9
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x14000dc0d
test bl, bl
jne 0x14000dc10
or eax, 0xffffffff
add rsp, 0x20
pop rbx
ret

Function at 0x14000dc40
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov ebx, r8d
mov rdi, rdx
mov rsi, rcx
test r8d, r8d
je 0x14000dc88
nop dword [rax]
cmp byte [rsi + 0x50], 0
je 0x14000dc88
movsxd rcx, dword [rsi + 0x4c]
xor r9d, r9d
mov r8d, ebx
mov rdx, rdi
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jle 0x14000dc88
sub ebx, eax
cdqe
add rdi, rax
test ebx, ebx
jne 0x14000dc60
mov rsi, qword [rsp + 0x38]
test ebx, ebx
mov rbx, qword [rsp + 0x30]
sete al
add rsp, 0x20
pop rdi
ret
Function at 0x14000e070
Capabilities:
Receive data
Receive data on socket
Resolve dns
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x150
mov rax, qword [0x140041008]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rdi, rcx
mov word [rsp + 0x30], 0x104
movzx ecx, word [rcx + 0x20]
call qword [sym.imp.WS2_32.dll_ntohs]
cmp qword [rdi + 0x18], 0x10
mov word [rsp + 0x32], ax
jb 0x14000e0b4
mov rbx, qword [rdi]
jmp 0x14000e0b7
mov rbx, rdi
or eax, 0xffffffff
test rbx, rbx
je 0x14000e0f9
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_inet_addr]
mov dword [rsp + 0x20], eax
cmp eax, 0xffffffff
jne 0x14000e0f9
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_gethostbyname]
test rax, rax
je 0x14000e107
mov rdx, qword [rax + 0x18]
lea rcx, [rsp + 0x20]
movsx r8, word [rax + 0x12]
mov rdx, qword [rdx]
call fcn.1400108a0
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x34], eax
mov byte [rsp + 0x38], 0
cmp eax, 0xffffffff
jne 0x14000e10b
xor al, al
jmp 0x14000e18a
mov qword [rsp + 0x168], rsi
mov ebx, 9
lea rsi, [rsp + 0x30]
nop dword [rax]
cmp byte [rdi + 0x50], 0
je 0x14000e14a
movsxd rcx, dword [rdi + 0x4c]
xor r9d, r9d
mov r8d, ebx
mov rdx, rsi
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jle 0x14000e14a
sub ebx, eax
cdqe
add rsi, rax
test ebx, ebx
jne 0x14000e120
jmp 0x14000e14e
test ebx, ebx
jne 0x14000e180
movzx ebx, byte [rdi + 0x50]
test bl, bl
je 0x14000e180
movsxd rcx, dword [rdi + 0x4c]
lea rdx, [rsp + 0x28]
xor r9d, r9d
lea r8d, [r9 + 8]
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x14000e180
test bl, bl
je 0x14000e180
xor eax, eax
cmp byte [rsp + 0x29], 0x5a
sete al
jmp 0x14000e182
xor al, al
mov rsi, qword [rsp + 0x168]
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14000f1c0
mov rbx, qword [rsp + 0x170]
add rsp, 0x150
pop rdi
ret
Function at 0x14000e860
Capabilities:
Initialize winsock library

Disassembly:
push rbx
sub rsp, 0x1d0
mov rax, qword [0x140041008]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
xor eax, eax
mov qword [rcx + 0x18], reloc.WS2_32.dll_ntohs
cmp byte [0x140043500], al
mov rbx, rcx
mov qword [rcx + 0x10], rax
mov byte [rcx], al
mov dword [rcx + 0x20], eax
mov dword [rcx + 0x24], 0xffffffff
mov byte [rcx + 0x28], al
jne 0x14000e8bc
mov ecx, 0x101
lea rdx, [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
setne byte [0x140043500]
mov rax, rbx
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.14000f1c0
add rsp, 0x1d0
pop rbx
ret

Function at 0x14000ea60
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
sub rsp, 0x20
movzx ebx, byte [rcx + 0x28]
test bl, bl
je 0x14000ea8d
movsxd r9, dword [rcx + 0x24]
xor eax, eax
test r8d, r8d
jle 0x14000ea90
mov rcx, r9
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x14000ea8d
test bl, bl
jne 0x14000ea90
or eax, 0xffffffff
add rsp, 0x20
pop rbx
ret

Function at 0x14000eac0
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov ebx, r8d
mov rdi, rdx
mov rsi, rcx
test r8d, r8d
je 0x14000eb08
nop dword [rax]
cmp byte [rsi + 0x28], 0
je 0x14000eb08
movsxd rcx, dword [rsi + 0x24]
xor r9d, r9d
mov r8d, ebx
mov rdx, rdi
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jle 0x14000eb08
sub ebx, eax
cdqe
add rdi, rax
test ebx, ebx
jne 0x14000eae0
mov rsi, qword [rsp + 0x38]
test ebx, ebx
mov rbx, qword [rsp + 0x30]
sete al
add rsp, 0x20
pop rdi
ret

Function at 0x14000eb20
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x30
movsxd rax, dword [rcx + 0x24]
mov dword [rsp + 0x48], 0x10000
mov dword [rsp + 0x40], 0x10000
test eax, eax
jle 0x14000eb93
lea r9, [rsp + 0x40]
mov dword [rsp + 0x20], 4
mov edx, 0xffff
mov r8d, 0x1002
mov rcx, rax
mov rbx, rax
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jne 0x14000eb93
lea r9, [rsp + 0x48]
mov dword [rsp + 0x20], 4
mov edx, 0xffff
mov r8d, 0x1001
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jne 0x14000eb93
mov al, 1
add rsp, 0x30
pop rbx
ret
xor al, al
add rsp, 0x30
pop rbx
ret
Function at 0x14000ec00
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r14
sub rsp, 0x20
movsxd rsi, edx
mov eax, 0x55555556
mov rbx, rcx
mov r14, r8
lea r9d, [rsi*4]
imul r9d
mov eax, edx
add edx, 4
shr eax, 0x1f
add eax, edx
movsxd rcx, eax
call fcn.14000f5b8
mov r11, rax
mov rdi, rax
test rax, rax
jne 0x14000ec55
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
xor r9d, r9d
mov r10, rsi
mov eax, r9d
test esi, esi
jle 0x14000ed19
mov qword [rsp + 0x40], rbp
inc esi
mov qword [rsp + 0x48], r15
lea rbp, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
lea r15d, [r9 + 0x3d]
nop dword [rax]
movzx edx, byte [rax + rbx]
inc rax
shl edx, 8
cmp rax, r10
jge 0x14000ec95
movzx ecx, byte [rax + rbx]
add edx, ecx
inc rax
shl edx, 8
cmp rax, r10
jge 0x14000eca6
movzx ecx, byte [rax + rbx]
add edx, ecx
movsxd rdx, edx
add r9d, 3
mov rcx, rdx
inc rax
sar rcx, 0x12
and ecx, 0x3f
movzx ecx, byte [rcx + rbp]
mov byte [rdi], cl
mov rcx, rdx
sar rcx, 0xc
and ecx, 0x3f
movzx ecx, byte [rcx + rbp]
mov byte [rdi + 1], cl
mov rcx, rdx
sar rcx, 6
and edx, 0x3f
and ecx, 0x3f
cmp rax, r10
movzx r8d, byte [rcx + rbp]
mov byte [rdi + 2], r8b
mov ecx, r8d
movzx edx, byte [rdx + rbp]
cmovg edx, r15d
cmp r9d, esi
mov byte [rdi + 3], dl
cmovg ecx, r15d
mov byte [rdi + 2], cl
add rdi, 4
cmp rax, r10
jl 0x14000ec80
mov r15, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x40]
mov byte [rdi], 0
or rax, 0xffffffffffffffff
mov qword [r14], r11
inc rax
cmp byte [r11 + rax], 0
jne 0x14000ed23
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x14000ee70
Capabilities:
Connect socket
Resolve dns
Set socket configuration

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x140041008]
xor rax, rsp
mov qword [rsp + 0x40], rax
cmp qword [rdx + 0x18], 0x10
mov edi, r9d
mov esi, r8d
mov rbx, rcx
jb 0x14000ee9a
mov rdx, qword [rdx]
mov rcx, rdx
call qword [sym.imp.WS2_32.dll_gethostbyname]
test rax, rax
je 0x14000ef71
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x58], rbp
mov ebp, 2
mov rcx, qword [rax]
mov eax, dword [rcx]
xor ecx, ecx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rcx
movzx ecx, si
mov word [rsp + 0x30], bp
mov dword [rsp + 0x34], eax
call qword [sym.imp.WS2_32.dll_htons]
mov word [rsp + 0x32], ax
mov eax, dword [rbx]
test eax, eax
jns 0x14000eef8
xor r8d, r8d
lea edx, [rbp - 1]
mov ecx, ebp
call qword [sym.imp.WS2_32.dll_socket]
mov dword [rbx], eax
mov eax, dword [rbx]
mov rbp, qword [rsp + 0x58]
test eax, eax
js 0x14000ef71
movsxd rcx, dword [rbx]
lea r8, [rsp + 0x20]
mov edx, 0x8004667e
mov dword [rsp + 0x20], 1
call qword [sym.imp.WS2_32.dll_ioctlsocket]
movsxd rcx, dword [rbx]
lea rdx, [rsp + 0x30]
mov r8d, reloc.WS2_32.dll_recv
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x14000ef75
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x14000ef75
mov ecx, dword [rbx]
mov r8d, edi
call fcn.14000f040
cmp eax, 1
je 0x14000ef75
movsxd rax, dword [rbx]
lea r8, [rsp + 0x24]
mov rcx, rax
mov dword [rsp + 0x24], 0
mov edx, 0x8004667e
call qword [sym.imp.WS2_32.dll_ioctlsocket]
xor al, al
jmp 0x14000ef9c
movsxd rax, dword [rbx]
lea r8, [rsp + 0x28]
mov rcx, rax
mov dword [rsp + 0x28], 0
mov edx, 0x8004667e
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov ecx, dword [rbx]
call fcn.14000efc0
mov al, 1
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14000f1c0
add rsp, 0x60
pop rdi
pop rsi
pop rbx
ret

Function at 0x14000efc0
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x30
mov dword [rsp + 0x48], 0x10000
mov dword [rsp + 0x40], 0x10000
test ecx, ecx
jle 0x14000f02f
movsxd rbx, ecx
lea r9, [rsp + 0x40]
mov rcx, rbx
mov dword [rsp + 0x20], 4
mov edx, 0xffff
mov r8d, 0x1002
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jne 0x14000f02f
lea r9, [rsp + 0x48]
mov dword [rsp + 0x20], 4
mov edx, 0xffff
mov r8d, 0x1001
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jne 0x14000f02f
mov al, 1
add rsp, 0x30
pop rbx
ret
xor al, al
add rsp, 0x30
pop rbx
ret
Function at 0x14000f040
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x470
mov rax, qword [0x140041008]
xor rax, rsp
mov qword [rsp + 0x460], rax
xor ebx, ebx
test r8d, r8d
js 0x14000f097
mov eax, 0x10624dd3
imul r8d
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x3e8
mov dword [rsp + 0x38], edx
sub r8d, eax
imul eax, r8d, 0x3e8
mov dword [rsp + 0x3c], eax
lea rax, [rsp + 0x38]
jmp 0x14000f09a
mov rax, rbx
movsxd rdi, ecx
lea r8, [rsp + 0x40]
inc ecx
mov qword [rsp + 0x258], rdi
xor r9d, r9d
mov qword [rsp + 0x48], rdi
xor edx, edx
mov dword [rsp + 0x250], 1
mov dword [rsp + 0x40], 1
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_select]
test eax, eax
js 0x14000f124
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], 4
lea r9, [rsp + 0x34]
mov qword [rsp + 0x20], rax
mov edx, 0xffff
mov r8d, 0x1007
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
js 0x14000f124
cmp dword [rsp + 0x34], ebx
jne 0x14000f124
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll___WSAFDIsSet]
test eax, eax
setne bl
mov eax, ebx
jmp 0x14000f127
or eax, 0xffffffff
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.14000f1c0
mov rbx, qword [rsp + 0x488]
add rsp, 0x470
pop rdi
ret

Function at 0x14000f150
Capabilities:
Resolve dns

Disassembly:
push rbx
sub rsp, 0x20
or eax, 0xffffffff
mov rbx, rcx
test rcx, rcx
je 0x14000f1a1
call qword [sym.imp.WS2_32.dll_inet_addr]
mov dword [rsp + 0x30], eax
cmp eax, 0xffffffff
jne 0x14000f1a1
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_gethostbyname]
test rax, rax
jne 0x14000f187
or eax, 0xffffffff
add rsp, 0x20
pop rbx
ret
mov rdx, qword [rax + 0x18]
lea rcx, [rsp + 0x30]
movsx r8, word [rax + 0x12]
mov rdx, qword [rdx]
call fcn.1400108a0
mov eax, dword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret

Function at 0x14000f9b0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub rsp, 0x18
mov r8, rcx
mov eax, 0x5a4d
cmp word [0x140000000], ax
jne 0x14000fa41
movsxd rax, dword [0x14000003c]
lea rdx, [0x140000000]
lea rcx, [rax + rdx]
cmp dword [rcx], 0x4550
jne 0x14000fa41
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000fa41
sub r8, rdx
movzx eax, word [rcx + 0x14]
lea rdx, [rcx + 0x18]
add rdx, rax
movzx eax, word [rcx + 6]
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
mov qword [rsp], rdx
cmp rdx, r9
je 0x14000fa25
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jb 0x14000fa1f
mov eax, dword [rdx + 8]
add eax, ecx
cmp r8, rax
jb 0x14000fa27
add rdx, 0x28
jmp 0x14000fa04
xor edx, edx
test rdx, rdx
jne 0x14000fa30
xor al, al
jmp 0x14000fa47
test dword [rdx + 0x24], 0x80000000
je 0x14000fa3d
xor al, al
jmp 0x14000fa47
mov al, 1
jmp 0x14000fa47
xor al, al
jmp 0x14000fa47
add rsp, 0x18
ret
Function at 0x140019d50
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov esi, r8d
mov ebx, edx
mov r14d, ecx
test r8d, r8d
jne 0x140019b24
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140019b24
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140019b24
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140019b24
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140019b24
cmp dword [rcx + 0x84], 0xe
jbe 0x140019b24
cmp dword [rcx + 0xf8], esi
je 0x140019b24
mov ecx, r14d
call fcn.140019c6c
mov ecx, 2
call fcn.1400202c0
nop
cmp byte [0x1400427f8], 0
jne 0x140019bee
mov r15d, 1
mov eax, r15d
xchg dword [0x1400427ec], eax
test ebx, ebx
jne 0x140019b97
mov rdi, qword [0x140041008]
mov edx, edi
and edx, 0x3f
lea ecx, [rbx + 0x40]
sub ecx, edx
xor eax, eax
ror rax, cl
xor rax, rdi
mov rcx, qword [0x1400427f0]
cmp rcx, rax
je 0x140019b8e
xor rdi, rcx
mov ecx, edx
ror rdi, cl
mov rcx, rdi
call qword [fcn.1400032a0]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rdi
lea rcx, [0x140042988]
jmp 0x140019ba3
cmp ebx, r15d
jne 0x140019ba9
lea rcx, [0x1400429a0]
call fcn.14001d588
nop
test ebx, ebx
jne 0x140019bc0
lea rdx, [0x14002e440]
lea rcx, [0x14002e418]
call fcn.14001ce4c
lea rdx, [0x14002e450]
lea rcx, [0x14002e448]
call fcn.14001ce4c
movzx eax, byte [0x1400427f8]
test esi, esi
cmove eax, r15d
mov byte [0x1400427f8], al
jmp 0x140019bee
mov ecx, 2
call fcn.140020314
test esi, esi
jne 0x140019c05
mov ecx, r14d
call fcn.140019c20
int3
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
xor r8d, r8d
xor edx, edx
jmp 0x140019ab4
Function at 0x140021948
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x1400217e8
call fcn.1400160ac
mov dword [rax], socket
call fcn.140019f70
or eax, 0xffffffff
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x1400217d0
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x1400217d0
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x10]
shr ecx, 1
test cl, 1
je 0x14002181a
lock or dword [rax + 0x14], 0x10
jmp 0x1400217d0
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x140021837
mov rcx, qword [rbp + 0x10]
call fcn.1400270e0
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.14001f13c
mov rdx, qword [rbp + 0x10]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.140021220
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x10]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 1
ja 0x14002188e
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x10]
and dword [rax + 0x10], 0
jmp 0x1400217d0
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x1400218fa
mov rcx, qword [rbp + 0x10]
call fcn.14001f13c
cmp eax, 0xffffffff
je 0x1400218e1
mov rcx, qword [rbp + 0x10]
call fcn.14001f13c
cmp eax, 0xfffffffe
je 0x1400218e1
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.14001f13c
movsxd rdi, eax
lea rsi, [0x1400429e0]
mov rcx, rbx
sar rdi, 6
call fcn.14001f13c
and eax, 0x3f
shl rax, 6
add rax, qword [rsi + rdi*8]
jmp 0x1400218e8
lea rax, [0x140041320]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x1400218fa
mov rax, qword [rbp + 0x10]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x10]
cmp dword [rax + 0x20], 0x200
jne 0x140021930
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x14002192c
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x14002192c
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x10]
dec dword [rax + 0x10]
mov rcx, qword [rax]
movzx edx, byte [rcx]
inc rcx
mov qword [rax], rcx
mov eax, edx
jmp 0x1400217d3
jmp 0x1400217a0
Function at 0x40ed60
Capabilities:
Encode data using xor

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, qword [rsp + 0x80]
test r8, r8
mov r10, rcx
mov rsi, rdx
mov rdi, r8
je 0x40ee48
lea r11, [r8 + rdx]
xor eax, eax
nop
movsx r8d, byte [rdx]
add rdx, 1
mov ecx, r8d
shl ecx, 0x11
add ecx, r8d
add eax, ecx
mov ecx, eax
shr ecx, 2
xor eax, ecx
cmp r11, rdx
jne 0x40ed90
mov edx, edi
shl edx, 0x11
add edx, edi
add eax, edx
mov ebp, eax
shr ebp, 2
xor ebp, eax
test rbx, rbx
je 0x40edc6
mov dword [rbx], ebp
xor edx, edx
mov eax, ebp
div dword [r10 + 8]
mov rax, qword [r10]
test r9, r9
lea r14, [rax + rdx*8]
je 0x40eddd
mov qword [r9], r14
mov rbx, qword [r14]
test rbx, rbx
je 0x40ee4f
xor r12d, r12d
jmp 0x40edfe
mov rax, qword [rbx]
mov r12, rbx
test rax, rax
je 0x40ee39
mov rbx, rax
cmp dword [rbx + 0x10], ebp
jne 0x40edf0
mov r13, qword [rbx + 8]
mov r8, rdi
mov rdx, rsi
mov rcx, r13
call sub.msvcrt.dll_strncmp
test eax, eax
jne 0x40edf0
cmp byte [r13 + rdi], 0
jne 0x40edf0
test r12, r12
je 0x40ee36
mov rax, qword [rbx]
mov qword [r12], rax
mov rax, qword [r14]
mov qword [rbx], rax
mov qword [r14], rbx
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
xor eax, eax
jmp 0x40edaf
xor eax, eax
jmp 0x40ee39

Function at 0x40f3b0
Capabilities:
Read file on windows

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
xor edi, edi
mov rbx, rcx
mov rcx, qword [0x005c4620]
mov rsi, rdx
call sub.msvcrt.dll_feof
test eax, eax
je 0x40f3e0
mov rax, rdi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov r9, qword [0x005c4620]
mov r8, rsi
mov edx, 1
mov rcx, rbx
call sub.msvcrt.dll_fread
mov rcx, qword [0x005c4620]
mov rdi, rax
call sub.msvcrt.dll_ferror
test eax, eax
je 0x40f3cf
call qword [sym.imp.msvcrt.dll__errno]
mov ecx, dword [rax]
call fcn.004ebae0
mov rdx, qword [0x005c4618]
lea rcx, str.cant_read_from__s:__s
mov r8, rax
call fcn.004150e0
mov rax, rdi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret