joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004fd60
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
mov r15d, edx
lea r14d, [rdx - 1]
mov rdi, rcx
xor r12d, r12d
nop word [rax + rax]
mov esi, r12d
mov ebp, r12d
test r14d, r14d
je 0x14004ff6a
mov r8, qword [rdi + 8]
nop dword [rax]
nop word [rax + rax]
lea ecx, [r8 + 0xff]
shl esi, cl
add esi, esi
nop dword [rax + rax]
mov r10, qword [rdi]
mov ecx, dword [r10]
cmp ecx, 0x270
jne 0x14004fe24
lea rax, [r10 + 8]
mov r9d, ecx
nop word [rax + rax]
mov r8d, dword [rax - 4]
xor r8d, dword [rax]
lea rax, [rax + 4]
btr r8d, 0x1f
xor r8d, dword [rax - 8]
mov ecx, r8d
and cl, 1
neg cl
sbb edx, edx
shr r8d, 1
and edx, 0x9908b0df
xor edx, dword [rax + 0x62c]
xor edx, r8d
mov dword [rax + 0x9b8], edx
sub r9, 1
jne 0x14004fde0
mov ecx, dword [r10]
jmp 0x14004ff07
cmp ecx, 0x4e0
jb 0x14004ff07
lea r11, [r10 + 0x9c4]
mov ebx, 0xe3
mov eax, dword [r11]
nop
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x14004fe40
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop word [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x14004fe90
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
mov ecx, r12d
mov dword [r10], r12d
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
mov edx, dword [rdi + 0x10]
cmp eax, edx
ja 0x14004fdc0
mov r8, qword [rdi + 8]
or esi, eax
lea ecx, [r8 + 0xff]
shl ebp, cl
add ebp, ebp
or ebp, edx
cmp ebp, r14d
jb 0x14004fdb0
xor edx, edx
mov eax, ebp
div r15d
mov ecx, eax
mov r8d, edx
xor edx, edx
mov eax, esi
div r15d
cmp eax, ecx
jb 0x14004ff8a
cmp r8d, r14d
jne 0x14004fd90
mov rbx, qword [rsp + 0x20]
mov eax, esi
mov rbp, qword [rsp + 0x28]
xor edx, edx
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
div r15d
mov eax, edx
pop r15
pop r14
pop r12
ret
Function at 0x140074a80
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov rbx, rcx
mov rsi, qword [rdx]
mov rbp, qword [rdx + 8]
xor r15d, r15d
cmp rsi, rbp
je 0x140074b27
mov ecx, 0x78
call fcn.14036fce4
mov r14, rax
mov qword [rsp + 0x88], rax
mov rdx, qword [rbx + 8]
sub rdx, qword [rbx]
sar rdx, 3
mov rcx, qword [rbx + 0x18]
mov rdi, qword [rcx]
mov qword [rax], rdx
lea rcx, [rax + 8]
mov rdx, rsi
call fcn.140075bc0
mov qword [r14 + 0x58], rdi
mov qword [r14 + 0x60], r15
xorps xmm0, xmm0
movups xmmword [r14 + 0x68], xmm0
mov qword [rsp + 0x80], r14
mov rdx, qword [rbx + 8]
cmp rdx, qword [rbx + 0x10]
je 0x140074b08
mov qword [rdx], r14
add qword [rbx + 8], 8
jmp 0x140074b18
lea r8, [rsp + 0x80]
mov rcx, rbx
call fcn.1400278c0
mov rax, qword [rbx + 8]
add rsi, 0x50
cmp rsi, rbp
jne 0x140074aa6
jmp 0x140074b2b
mov rax, qword [rcx + 8]
sub rax, qword [rbx]
sar rax, 3
mov qword [rsp + 0x88], rax
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0x40]
call fcn.140075c70
mov rcx, qword [rbx + 0x18]
add rcx, 0x18
mov rdx, rax
call fcn.140038aa0
mov rdi, qword [rsp + 0x48]
test rdi, rdi
je 0x140074b92
mov esi, 0xffffffff
mov eax, esi
lock xadd dword [rdi + 8], eax
cmp eax, 1
jne 0x140074b92
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax]
lock xadd dword [rdi + 0xc], esi
cmp esi, 1
jne 0x140074b92
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 8]
lock inc qword [0x1405472e8]
mov rdi, qword [rbx]
mov rsi, qword [rbx + 8]
cmp rdi, rsi
je 0x140074c19
lea rbp, [0x140074e50]
nop dword [rax]
mov rbx, qword [rdi]
mov ecx, 0x10
call fcn.14036fce4
mov qword [rax], rbx
mov qword [rax + 8], rbp
mov qword [rsp + 0x80], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r15d
mov r9, rax
lea r8, [0x140075e80]
xor edx, edx
xor ecx, ecx
call fcn.14039a510
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140074c33
cmp dword [rbx + 0x70], 0
jne 0x140074c2d
xorps xmm0, xmm0
movaps xmm1, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
movups xmmword [rbx + 0x68], xmm1
add rdi, 8
cmp rdi, rsi
jne 0x140074bb0
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.1403978dc
nop
mov dword [rsp + 0x38], r15d
mov ecx, 6
call fcn.14036d01c
int3
Function at 0x140090260
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140090291
xor eax, eax
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rcx + 0x68], 0
je 0x1400902ad
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp method.std::basic_streambuf_char__struct_std::char_traits_char__.virtual_64
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x38], rdi
mov rdi, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x1400902c9
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x1400902cb
xor ecx, ecx
mov qword [rsp + 0x30], rbx
movsxd rax, ecx
test ecx, ecx
je 0x140090305
cmp rax, rbp
mov rbx, rbp
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call fcn.14038e7d0
mov rax, qword [rsi + 0x50]
sub rdi, rbx
add r14, rbx
mov r8, rdi
sub dword [rax], ebx
mov rcx, qword [rsi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x1400903a5
mov r9, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r9], rax
jne 0x140090340
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r9], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
mov rbx, r8
cmp r8, 0xfff
jbe 0x140090380
nop dword [rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call fcn.14039aee4
sub rdi, rax
add r14, rax
mov rbx, rdi
cmp rax, 0xfff
jne 0x1400903c6
cmp rdi, rax
ja 0x140090350
mov r8, rbx
test rbx, rbx
je 0x1400903a5
mov r9, qword [rsi + 0x80]
mov r8, rdi
mov edx, 1
mov rcx, r14
call fcn.14039aee4
mov r8, rbx
sub r8, rax
sub rbp, r8
mov rbx, qword [rsp + 0x30]
mov rax, rbp
mov rbp, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
sub rbp, rdi
jmp 0x1400903a8
Function at 0x1400909e0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140546618]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x140090a0d
xor eax, eax
jmp 0x140090b31
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x140090a47
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x140090a47
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x140090b31
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x140090b24
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x140090a8a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140090a99
movsx ecx, dil
jmp 0x140090acb
movzx eax, dil
lea rdx, vtable.std::codecvt_char__char__struct__Mbstatet_.0
mov byte [rsp + 0x40], al
mov r10, qword [rcx]
cmp r10, rdx
jne 0x140090b4f
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x50], rcx
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x48], rcx
movsx ecx, al
mov rdx, qword [rbx + 0x80]
call fcn.1403934b0
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140090b29
mov rsi, qword [rsp + 0x48]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x140090b12
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call fcn.140397ba8
cmp rsi, rax
jne 0x140090b24
lea rax, [rsp + 0x40]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x50], rax
mov eax, edi
jne 0x140090b29
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14036fcc0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
lea rax, [rsp + 0x48]
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x41]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x40]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [r10 + 0x38]
test eax, eax
js 0x140090b24
cmp eax, 1
jle 0x140090ae5
cmp eax, 3
jne 0x140090b24
movzx eax, byte [rsp + 0x40]
jmp 0x140090ac8
Function at 0x1400914b0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140546618]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140091561
cmp byte [rcx + 0x71], 0
je 0x140091561
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14009150d
mov rcx, qword [rbx + 0x68]
lea rdx, vtable.std::codecvt_char__char__struct__Mbstatet_.0
mov rax, qword [rcx]
cmp rax, rdx
jne 0x140091576
mov byte [rbx + 0x71], 0
mov al, 1
jmp 0x14009150f
xor al, al
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14036fcc0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140091558
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call fcn.140397ba8
cmp rdi, rax
jne 0x14009150d
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14009150f
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14036fcc0
add rsp, 0x60
pop rbx
ret
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], r8
lea rdx, [rbx + 0x74]
lea r8, [rsp + 0x38]
lea r9, [rsp + 0x58]
call qword [rax + 0x40]
test eax, eax
je 0x140091527
sub eax, 1
je 0x14009152b
cmp eax, 2
je 0x140091505
jmp 0x14009150d

Function at 0x1400a41a0
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x150
mov rax, qword [0x140546618]
xor rax, rsp
mov qword [rsp + 0x140], rax
xor r9d, r9d
mov qword [rsp + 0x20], rcx
mov rbx, rcx
lea rdx, [rsp + 0x30]
xor ecx, ecx
lea r8d, [r9 + 0x1c]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
test eax, eax
je 0x1400a4219
lea rax, [rsp + 0x30]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400a4200
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.140005ff0
jmp 0x1400a4226
mov qword [rbx + 0x10], 1
mov word [rbx], 0x2e
mov rax, rbx
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14036fcc0
add rsp, 0x150
pop rbx
ret
Function at 0x1400c03c0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
xor r9d, r9d
mov rdi, r8
mov dword [rsp + 0x20], r9d
nop
mov r8d, edi
call qword [sym.imp.WS2_32.dll_recv]
movsxd rbx, eax
test eax, eax
jns 0x1400c040b
call fcn.140397ce4
cmp dword [rax], 4
jne 0x1400c040b
mov r9d, dword [rsp + 0x20]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
jmp 0x1400c03e0
mov rax, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x1400c0420
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x260
mov rax, qword [0x140546618]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rdi, rcx
mov qword [rsp + 0x48], rcx
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x30], edx
mov dword [rsp + 0x34], r8d
nop dword [rax + rax]
lea rax, [rsp + 0x30]
xor r9d, r9d
lea ecx, [rdi + 1]
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rsp + 0x40]
call qword [sym.imp.WS2_32.dll_select]
movsxd rbx, eax
test eax, eax
jns 0x1400c048f
call fcn.140397ce4
cmp dword [rax], 4
je 0x1400c0460
mov rax, rbx
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.14036fcc0
mov rbx, qword [rsp + 0x270]
add rsp, 0x260
pop rdi
ret

Function at 0x1400c04c0
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x260
mov rax, qword [0x140546618]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rdi, rcx
mov qword [rsp + 0x48], rcx
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x30], edx
mov dword [rsp + 0x34], r8d
nop dword [rax + rax]
lea rax, [rsp + 0x30]
xor r9d, r9d
lea ecx, [rdi + 1]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x40]
xor edx, edx
call qword [sym.imp.WS2_32.dll_select]
movsxd rbx, eax
test eax, eax
jns 0x1400c052e
call fcn.140397ce4
cmp dword [rax], 4
je 0x1400c0500
mov rax, rbx
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.14036fcc0
mov rbx, qword [rsp + 0x270]
add rsp, 0x260
pop rdi
ret
Function at 0x1400c0aa0
Capabilities:
Resolve dns

Disassembly:
push rbx
push rsi
sub rsp, 0x4f8
mov rax, qword [0x140546618]
xor rax, rsp
mov qword [rsp + 0x4e0], rax
mov rbx, r8
mov dword [rsp + 0x40], 0x80
mov rsi, rdx
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
jne 0x1400c0b8a
movzx eax, word [rsp + 0x50]
mov qword [rsp + 0x4f0], rdi
mov edi, dword [rsp + 0x40]
cmp ax, 2
je 0x1400c0aff
cmp ax, 0x17
jne 0x1400c0b0f
movzx ecx, word [rsp + 0x52]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
mov dword [rbx], eax
xor edx, edx
lea rcx, [rsp + 0xd0]
mov r8d, 0x401
call fcn.14038ebe0
xor eax, eax
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], eax
lea r8, [rsp + 0xd0]
mov r9d, 0x401
mov qword [rsp + 0x20], rax
mov edx, edi
lea rcx, [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_getnameinfo]
mov rdi, qword [rsp + 0x4f0]
test eax, eax
jne 0x1400c0b8a
lea rax, [rsp + 0xd0]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400c0b70
lea rdx, [rsp + 0xd0]
mov rcx, rsi
call fcn.140005ff0
mov rcx, qword [rsp + 0x4e0]
xor rcx, rsp
call fcn.14036fcc0
add rsp, 0x4f8
pop rsi
pop rbx
ret
mov rcx, qword [rcx + 8]
jmp 0x1400c0aa0

Function at 0x1400c58f0
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rdi, r8
mov rbx, rdx
mov r8, qword [rcx + 0x28]
mov rsi, rcx
mov rdx, qword [rcx + 0x20]
mov rcx, qword [rcx + 8]
call fcn.1400c04c0
test rax, rax
jg 0x1400c5935
mov rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rsi + 8]
mov eax, 0x7fffffff
cmp rdi, rax
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x20], rcx
cmova rdi, rax
xor r9d, r9d
mov dword [rsp + 0x40], r9d
nop word [rax + rax]
mov r8d, edi
mov rdx, rbx
call qword [sym.imp.WS2_32.dll_send]
movsxd rbx, eax
test eax, eax
jns 0x1400c598e
call fcn.140397ce4
cmp dword [rax], 4
jne 0x1400c598e
mov r9d, dword [rsp + 0x40]
mov rbx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x20]
jmp 0x1400c5960
mov rsi, qword [rsp + 0x50]
mov rax, rbx
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x1400c59b0
Capabilities:
Resolve dns

Disassembly:
push rbx
push rsi
sub rsp, 0x4f8
mov rax, qword [0x140546618]
xor rax, rsp
mov qword [rsp + 0x4e0], rax
mov rbx, r8
mov dword [rsp + 0x40], 0x80
mov rsi, rdx
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
jne 0x1400c0b8a
movzx eax, word [rsp + 0x50]
mov qword [rsp + 0x4f0], rdi
mov edi, dword [rsp + 0x40]
cmp ax, 2
je 0x1400c0aff
cmp ax, 0x17
jne 0x1400c0b0f
movzx ecx, word [rsp + 0x52]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
mov dword [rbx], eax
xor edx, edx
lea rcx, [rsp + 0xd0]
mov r8d, 0x401
call fcn.14038ebe0
xor eax, eax
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], eax
lea r8, [rsp + 0xd0]
mov r9d, 0x401
mov qword [rsp + 0x20], rax
mov edx, edi
lea rcx, [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_getnameinfo]
mov rdi, qword [rsp + 0x4f0]
test eax, eax
jne 0x1400c0b8a
lea rax, [rsp + 0xd0]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400c0b70
lea rdx, [rsp + 0xd0]
mov rcx, rsi
call fcn.140005ff0
mov rcx, qword [rsp + 0x4e0]
xor rcx, rsp
call fcn.14036fcc0
add rsp, 0x4f8
pop rsi
pop rbx
ret
mov rcx, qword [rcx + 8]
jmp 0x1400c0aa0
Function at 0x1400cc890
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov rbx, rdx
mov rbp, rcx
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x30], rdx
mov rdi, qword [rcx + 0x400]
mov r14, qword [rdx]
add rcx, 0x408
call fcn.14036d348
test eax, eax
jne 0x1400cca48
mov rcx, rdi
call fcn.14020c070
mov rdi, rax
lea rcx, [rbp + 0x408]
call fcn.14036d36c
test eax, eax
jne 0x1400cca50
test rdi, rdi
je 0x1400cc9fb
mov dword [rsp + 0x60], 1
lea r8, [rsp + 0x60]
mov edx, 0x8004667e
mov rcx, r14
call qword [sym.imp.WS2_32.dll_ioctlsocket]
xor edx, edx
mov ecx, r14d
call fcn.1402505d0
mov r15, rax
xor r9d, r9d
lea edx, [r9 + 0x66]
lea r8d, [r9 + 1]
mov rcx, rax
call fcn.14024bc90
mov r8, r15
mov rdx, r15
mov rcx, rdi
call fcn.14020c880
lea r9, [rbp + 8]
cmp qword [r9 + 0x18], 0x10
jb 0x1400cc95a
mov r9, qword [r9]
xor r8d, r8d
lea edx, [r8 + 0x37]
mov rcx, rdi
call fcn.14020b1a0
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.1400cca60
cmp al, 1
jne 0x1400cc9af
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x66]
mov rcx, r15
call fcn.14024bc90
mov dword [rsp + 0x60], 0
lea r8, [rsp + 0x60]
mov edx, 0x8004667e
mov rcx, r14
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov qword [rbx + 8], rdi
mov al, 1
jmp 0x1400cca27
mov rcx, rdi
call fcn.14020cbe0
lea rcx, [rbp + 0x408]
call fcn.14036d348
test eax, eax
jne 0x1400cca58
mov rcx, rdi
call fcn.14020b650
nop
lea rcx, [rbp + 0x408]
call fcn.14036d36c
test eax, eax
jne 0x1400cca40
mov dword [rsp + 0x60], eax
lea r8, [rsp + 0x60]
mov edx, 0x8004667e
mov rcx, r14
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov rcx, qword [rbx]
cmp rcx, 0xffffffffffffffff
je 0x1400cca25
mov edx, 2
call qword [sym.imp.WS2_32.dll_shutdown]
mov rcx, qword [rbx]
cmp rcx, 0xffffffffffffffff
je 0x1400cca25
call qword [sym.imp.WS2_32.dll_closesocket]
mov qword [rbx], 0xffffffffffffffff
xor al, al
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
mov ecx, eax
call fcn.14036cfe0
nop
mov ecx, eax
call fcn.14036cfe0
nop
mov ecx, eax
call fcn.14036cfe0
nop
mov ecx, eax
call fcn.14036cfe0
int3
Function at 0x1400cce90
Capabilities:
Convert ip address from string

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r15
sub rsp, 0x58
mov rax, qword [0x140546618]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor ebx, ebx
mov qword [rsp + 0x30], rcx
cmp qword [rcx + 0x20], 0x10
lea rsi, [rcx + 8]
mov rbp, rdx
mov byte [rsp + 0x20], 0
mov edi, 2
mov r15d, ebx
mov rdx, rsi
jb 0x1400cced4
mov rdx, qword [rsi]
lea r8, [rsp + 0x38]
mov ecx, 0x17
call qword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
je 0x1400ccef0
mov r15d, 0x10
jmp 0x1400ccf14
cmp qword [rsi + 0x18], 0x10
jb 0x1400ccefa
mov rsi, qword [rsi]
lea r8, [rsp + 0x24]
mov rdx, rsi
mov ecx, edi
call qword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
je 0x1400ccf19
mov r15d, 4
mov edi, 7
xor r9d, r9d
xor r8d, r8d
mov rcx, rbp
lea edx, [r9 + 0x55]
call fcn.14024f380
mov r12, rax
test rax, rax
je 0x1400cd002
mov qword [rsp + 0xa0], r13
mov rcx, rax
mov qword [rsp + 0x50], r14
xor r13b, r13b
xor r14b, r14b
call fcn.140250ca0
mov dword [rsp + 0x28], eax
test eax, eax
jle 0x1400ccff5
nop
test r14b, r14b
jne 0x1400ccff0
mov edx, ebx
mov rcx, r12
call fcn.140250ed0
mov rsi, rax
cmp dword [rax], edi
jne 0x1400ccfda
mov rcx, qword [rax + 8]
call fcn.140020b50
mov rcx, qword [rsi + 8]
mov rbp, rax
call fcn.14020cca0
movsxd r8, eax
cmp edi, 2
je 0x1400ccfc9
cmp edi, 7
jne 0x1400ccfda
mov r8, r15
lea rcx, [rsp + 0x38]
mov rdx, rbp
call fcn.14038e6d0
test eax, eax
je 0x1400ccfc4
mov r8, r15
lea rcx, [rsp + 0x24]
mov rdx, rbp
call fcn.14038e6d0
test eax, eax
jne 0x1400ccfda
mov r13b, 1
jmp 0x1400ccfda
mov rcx, qword [rsp + 0x30]
mov rdx, rbp
call fcn.1400cd030
movzx r14d, al
inc ebx
cmp ebx, dword [rsp + 0x28]
jl 0x1400ccf60
test r14b, r14b
jne 0x1400ccff0
test r13b, r13b
je 0x1400ccff5
mov byte [rsp + 0x20], 1
mov r13, qword [rsp + 0xa0]
mov r14, qword [rsp + 0x50]
mov rcx, r12
call fcn.140251160
movzx eax, byte [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14036fcc0
add rsp, 0x58
pop r15
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400ea040
Capabilities:
Get system firmware table

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x140546618]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rsi, rcx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0x52534d42
call qword [sym.imp.KERNEL32.dll_GetSystemFirmwareTable]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8d, edi
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
je 0x1400ea0c0
mov r9d, edi
mov r8, rax
xor edx, edx
mov ecx, 0x52534d42
call qword [sym.imp.KERNEL32.dll_GetSystemFirmwareTable]
cmp eax, edi
je 0x1400ea0c7
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor al, al
jmp 0x1400ea155
movzx edx, byte [rbx + 1]
shl edx, 0x10
movzx eax, byte [rbx + 2]
shl eax, 8
add edx, eax
movzx eax, byte [rbx + 3]
add edx, eax
mov dword [rsi + 0x5c], edx
mov eax, dword [rbx + 4]
mov dword [rsi + 0x58], eax
lea rax, vtable.std::_Func_impl_no_alloc_class__lambda_b1841b2b3d7edfd58a8a013d8118f4e5___void___.0
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rbx
lea rax, [rsp + 0x20]
mov qword [rsp + 0x58], rax
lea rdx, [rbx + 8]
lea r8, [rsp + 0x20]
mov rcx, rsi
call fcn.1400e9b50
movzx ebx, al
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x1400ea152
lea rax, [rsp + 0x20]
cmp rcx, rax
setne r9b
mov rdx, qword [rcx]
mov r8, qword [rdx + 0x20]
lea rax, [method.std::_Func_impl_no_alloc_class__lambda_9101cdd5f0e46feb3197c4e67005d9c3___bool__class_httplib::Stream____ptr64_.virtual_32]
cmp r8, rax
jne 0x1400ea174
lea rax, [rsp + 0x20]
cmp rcx, rax
je 0x1400ea152
mov edx, 0x28
call fcn.14036fd20
movzx eax, bl
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14036fcc0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
movzx edx, r9b
call r8
jmp 0x1400ea152
Function at 0x1400edaf0
Capabilities:
Hash data using sha256

Disassembly:
push rbx
sub rsp, 0xb0
mov rax, qword [0x140546618]
xor rax, rsp
mov qword [rsp + 0xa0], rax
xor eax, eax
mov dword [rsp + 0x20], 0x6a09e667
mov rbx, rcx
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x50], rax
lea r8, [r8*8]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x44], eax
mov dword [rsp + 0x24], 0xbb67ae85
mov dword [rsp + 0x28], 0x3c6ef372
mov dword [rsp + 0x2c], 0xa54ff53a
mov dword [rsp + 0x30], 0x510e527f
mov dword [rsp + 0x34], 0x9b05688c
mov dword [rsp + 0x38], 0x1f83d9ab
mov qword [rsp + 0x3c], 0x5be0cd19
call fcn.1400ed760
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.1400ed880
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.14036fcc0
add rsp, 0xb0
pop rbx
ret
mov rax, r8
mov r8, rdx
mov rdx, rcx
mov rcx, rax
jmp 0x1400edaf0