joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14014586c
Capabilities:
Parse pe header

Disassembly:
jmp 0x1402a9990
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1402a99b0
xor al, al
jmp 0x1402a9a31
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1402a99c3
xor al, al
jmp 0x1402a9a31
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x1402a99ed
xor al, al
jmp 0x1402a9a31
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x1402a9a01
xor al, al
jmp 0x1402a9a31
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x1402a9a13
xor al, al
jmp 0x1402a9a31
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x1402a9a2f
xor al, al
jmp 0x1402a9a31
mov al, 1
add rsp, 0x38
ret

Function at 0x140145b32
Capabilities:
Get common file path

Disassembly:
jmp 0x14039f9b0
push rdi
sub rsp, 0x270
mov rax, qword [0x1404655c8]
xor rax, rsp
mov qword [rsp + 0x260], rax
lea rax, [rsp + 0x50]
mov rdi, rax
xor eax, eax
mov ecx, 0x20a
rep stosb byte [rdi], al
lea rdx, [rsp + 0x50]
mov ecx, 0x105
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0x104
ja 0x14039fa09
lea rcx, [rsp + 0x50]
call fcn.14039f7a0
jmp 0x14039fadc
mov eax, dword [rsp + 0x30]
inc eax
mov eax, eax
mov dword [rsp + 0x20], Ordinal_41
lea r9, [0x1404255a0]
mov r8d, 2
mov edx, 2
mov ecx, eax
call fcn.140148373
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.140143797
lea rcx, [rsp + 0x38]
call fcn.140147905
test rax, rax
jne 0x14039fa71
call fcn.140143666
mov dword [rax], recv
mov dword [rsp + 0x40], 0
lea rcx, [rsp + 0x38]
call fcn.1401464ab
mov eax, dword [rsp + 0x40]
jmp 0x14039fadc
lea rcx, [rsp + 0x38]
call fcn.140147905
mov ecx, dword [rsp + 0x30]
inc ecx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jne 0x14039fab8
call fcn.140143666
mov dword [rax], recv
mov dword [rsp + 0x48], 0
lea rcx, [rsp + 0x38]
call fcn.1401464ab
mov eax, dword [rsp + 0x48]
jmp 0x14039fadc
lea rcx, [rsp + 0x38]
call fcn.140147905
mov rcx, rax
call fcn.14039f7a0
mov dword [rsp + 0x4c], eax
lea rcx, [rsp + 0x38]
call fcn.1401464ab
mov eax, dword [rsp + 0x4c]
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.14014432c
add rsp, 0x270
pop rdi
ret
Function at 0x140146352
Capabilities:
Terminate process

Disassembly:
jmp 0x1402ccea0
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov ecx, reloc.WS2_32.dll_socket
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x1402ccece
mov ecx, 5
int 0x29
mov r8d, 1
mov edx, 0xc0000417
mov ecx, 2
call fcn.1401472ac
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000417
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x140146ec4
Capabilities:
Get common file path

Disassembly:
jmp 0x1401a0540
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x60
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x1401a057d
xor eax, eax
jmp 0x1401a0719
lea rdx, str.LoadLibraryExA
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x28], rax
lea rdx, [0x1404551ec]
mov rcx, qword [rsp + 0x70]
call fcn.140143224
test rax, rax
je 0x1401a05e9
cmp qword [rsp + 0x28], 0
je 0x1401a05ca
mov r8d, 8
xor edx, edx
mov rcx, qword [rsp + 0x70]
call qword [rsp + Ordinal_41]
mov qword [rsp + 0x50], rax
jmp 0x1401a05da
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
jmp 0x1401a0714
cmp qword [rsp + 0x28], 0
je 0x1401a0623
lea rdx, str.AddDllDirectory
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1401a0623
mov r8d, 0x800
xor edx, edx
mov rcx, qword [rsp + 0x70]
call qword [rsp + Ordinal_41]
mov qword [rsp + 0x20], rax
jmp 0x1401a0714
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 0
je 0x1401a0714
mov rcx, qword [rsp + 0x70]
call fcn.140143f99
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0x38]
inc eax
mov eax, eax
add rax, qword [rsp + 0x40]
mov rcx, rax
call qword [fcn.140144e76]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x1401a0709
mov edx, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x1401a0709
mov rcx, qword [rsp + 0x48]
call fcn.140143f99
mov rcx, qword [rsp + 0x48]
add rcx, rax
mov rax, rcx
lea rdx, [0x140455210]
mov rcx, rax
call fcn.14014331e
mov rcx, qword [rsp + 0x48]
call fcn.140143f99
mov rcx, qword [rsp + 0x48]
add rcx, rax
mov rax, rcx
mov rdx, qword [rsp + 0x70]
mov rcx, rax
call fcn.14014331e
cmp qword [rsp + 0x28], 0
je 0x1401a06ef
mov r8d, 8
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [rsp + Ordinal_41]
mov qword [rsp + 0x58], rax
jmp 0x1401a06ff
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x48]
call qword [fcn.1401435bc]
mov rax, qword [rsp + 0x20]
add rsp, 0x60
pop rdi
ret
Function at 0x14014727a
Capabilities:
Set socket configuration

Disassembly:
jmp 0x140217f20
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x90
lea rdi, [rsp + 0x30]
mov ecx, Ordinal_27
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0xa0]
mov dword [rsp + 0x34], 0x4020
mov dword [rsp + 0x54], 0
mov dword [rsp + 0x74], 4
cmp dword [0x1404680b8], 0
jne 0x140217fa1
mov dword [rsp + 0x20], 3
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov ecx, 6
call fcn.14014686b
movzx eax, al
test eax, eax
je 0x140217f97
mov dword [0x1404680b8], 2
jmp 0x140217fa1
mov dword [0x1404680b8], 1
cmp dword [0x1404680b8], 2
jne 0x140217fac
jmp 0x14021800a
lea rax, [rsp + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x54]
mov r8d, 0x1001
mov edx, 0xffff
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x140217fe4
mov eax, dword [rsp + 0x34]
cmp dword [rsp + 0x54], eax
jle 0x140217fe4
jmp 0x14021800a
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x34]
mov r8d, 0x1001
mov edx, 0xffff
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rcx, rsp
lea rdx, reloc.WS2_32.dll_closesocket
call fcn.140146785
add rsp, 0x90
pop rdi
ret
Function at 0x140147342
Capabilities:
Print debug messages

Disassembly:
jmp 0x140390cd0
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add rsp, 0x28
ret
Function at 0x14014750e
Capabilities:
Set thread local storage value

Disassembly:
jmp 0x1402cbf00
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.1402cb850
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1402cbf49
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x14048a020]
jmp 0x1402cbf58
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
add rsp, 0x48
ret

Function at 0x14014764e
Capabilities:
Set environment variable

Disassembly:
jmp 0x1403c9150
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xb8
lea rcx, [rsp + 0x78]
call fcn.14014372e
lea rcx, [rsp + 0x48]
call fcn.14014372e
call fcn.140144895
mov r8d, eax
lea rdx, [rsp + 0x78]
mov rcx, qword [rsp + 0xc0]
call fcn.14014333c
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x1403c91bf
mov dword [rsp + 0x24], 0
lea rcx, [rsp + 0x48]
call fcn.140143dfa
lea rcx, [rsp + 0x78]
call fcn.140143dfa
mov eax, dword [rsp + 0x24]
jmp 0x1403c9250
call fcn.140144895
mov r8d, eax
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0xc8]
call fcn.14014333c
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
je 0x1403c9206
mov dword [rsp + 0x2c], 0
lea rcx, [rsp + 0x48]
call fcn.140143dfa
lea rcx, [rsp + 0x78]
call fcn.140143dfa
mov eax, dword [rsp + 0x2c]
jmp 0x1403c9250
lea rcx, [rsp + 0x48]
call fcn.1401435f8
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x78]
call fcn.1401435f8
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0x48]
call fcn.140143dfa
lea rcx, [rsp + 0x78]
call fcn.140143dfa
mov eax, dword [rsp + 0x30]
add rsp, 0xb8
ret
Function at 0x140147973
Capabilities:
Create thread

Disassembly:
jmp 0x14035e590
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x78
cmp qword [rsp + 0x90], 0
je 0x14035e5bc
mov dword [rsp + 0x30], 1
jmp 0x14035e5c4
mov dword [rsp + 0x30], 0
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
jne 0x14035e60d
lea rax, str.procedure___nullptr
mov qword [rsp + 0x28], rax
lea rax, [0x1403fc758]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, reloc.WLDAP32.dll_Ordinal_200
lea rdx, str.minkernelcrtsucrt_src_appcrt_startup_thread.cpp
mov ecx, 2
call fcn.140141bc7
cmp eax, 1
jne 0x14035e60d
int3
cmp dword [rsp + 0x34], 0
jne 0x14035e64f
call fcn.140143666
mov dword [rax], reloc.WLDAP32.dll_Ordinal_22
mov qword [rsp + 0x20], 0
mov r9d, reloc.WLDAP32.dll_Ordinal_200
lea r8, str.minkernelcrtsucrt_src_appcrt_startup_thread.cpp
lea rdx, str._beginthreadex
lea rcx, str.procedure___nullptr
call fcn.140146af5
xor eax, eax
jmp 0x14035e74f
mov rdx, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x90]
call fcn.14035e080
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.14035de80
lea rcx, [rsp + 0x40]
call fcn.14035def0
movzx eax, al
test eax, eax
jne 0x14035e69f
mov qword [rsp + 0x50], 0
lea rcx, [rsp + 0x40]
call fcn.14035ded0
mov rax, qword [rsp + 0x50]
jmp 0x14035e74f
lea rcx, [rsp + 0x40]
call fcn.14035e230
mov ecx, dword [rsp + 0x88]
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x28], rdx
mov edx, dword [rsp + 0xa0]
mov dword [rsp + 0x20], edx
mov r9, rax
lea r8, [0x14035dc30]
mov edx, ecx
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jne 0x14035e713
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140142f09
mov qword [rsp + 0x58], 0
lea rcx, [rsp + 0x40]
call fcn.14035ded0
mov rax, qword [rsp + 0x58]
jmp 0x14035e74f
cmp qword [rsp + 0xa8], 0
je 0x14035e72c
mov rax, qword [rsp + 0xa8]
mov ecx, dword [rsp + 0x38]
mov dword [rax], ecx
lea rcx, [rsp + 0x40]
call fcn.14035e1f0
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x40]
call fcn.14035ded0
mov rax, qword [rsp + 0x60]
add rsp, 0x78
ret
Function at 0x140147982
Capabilities:
Check for software breakpoints

Disassembly:
jmp 0x1401b2700
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov rax, qword [rsp + 0x50]
add rax, 0xf0
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x20]
mov ecx, dword [rcx + 0x60]
mov dword [rax + 0x1390], ecx
mov rax, qword [rsp + 0x58]
movzx eax, byte [rax + 0x70d]
mov rcx, qword [rsp + 0x50]
mov dword [rcx + 0x1398], eax
mov rax, qword [rsp + 0x50]
movzx eax, byte [rax + 0x1369]
test eax, eax
je 0x1401b2775
mov rax, qword [rsp + 0x50]
movzx eax, byte [rax + 0x1369]
mov rcx, qword [rsp + 0x58]
movzx ecx, byte [rcx + 0x70d]
cmp eax, ecx
jle 0x1401b278c
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
movzx ecx, byte [rcx + 0x70d]
mov byte [rax + 0x1369], cl
mov rax, qword [rsp + 0x50]
cmp qword [rax + 0x1180], 0
je 0x1401b27c5
mov rax, qword [rsp + 0x50]
movzx eax, byte [rax + 0x136a]
test eax, eax
jne 0x1401b27c5
mov rax, qword [rsp + 0x20]
cmp dword [rax + 0x60], 0x1a0
jne 0x1401b27c5
mov rax, qword [rsp + 0x20]
mov byte [rax + 0xdd], 1
mov rax, qword [rsp + 0x58]
movzx eax, byte [rax + 0x70d]
cmp eax, 0xa
jne 0x1401b27f8
lea rdx, str.HTTP_1.0__assume_close_after_body
mov rcx, qword [rsp + 0x50]
call fcn.1401470a9
mov edx, 1
mov rcx, qword [rsp + 0x58]
call fcn.140144340
jmp 0x1401b2860
mov rax, qword [rsp + 0x58]
movzx eax, byte [rax + 0x70d]
cmp eax, 0x14
je 0x1401b281f
mov rax, qword [rsp + 0x20]
cmp dword [rax + 0x7c], 2
jne 0x1401b2839
mov rax, qword [rsp + 0x20]
cmp dword [rax + 0x60], 0x65
jne 0x1401b2839
xor eax, eax
test eax, eax
jne 0x1401b281f
mov rax, qword [rsp + 0x58]
mov rax, qword [rax + 0x6d0]
mov dword [rax], 2
jmp 0x1401b2860
mov rax, qword [rsp + 0x58]
movzx eax, byte [rax + 0x70d]
cmp eax, 0xb
jl 0x1401b2860
mov rax, qword [rsp + 0x58]
movzx eax, byte [rax + 0x2ce]
test eax, eax
jne 0x1401b2860
xor eax, eax
test eax, eax
jne 0x1401b285a
mov rax, qword [rsp + 0x20]
cmp dword [rax + 0x60], 0x64
jl 0x1401b2883
mov rax, qword [rsp + 0x20]
cmp dword [rax + 0x60], 0xc8
jge 0x1401b2883
mov dword [rsp + 0x28], 1
jmp 0x1401b288b
mov dword [rsp + 0x28], 0
cmp dword [rsp + 0x28], 0
jne 0x1401b289c
mov dword [rsp + 0x2c], 0
jmp 0x1401b28a4
mov dword [rsp + 0x2c], 1
mov rax, qword [rsp + 0x20]
movzx ecx, byte [rsp + 0x2c]
mov byte [rax + 0xde], cl
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x60]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0xcc
je 0x1401b28f2
cmp dword [rsp + 0x30], 0x130
je 0x1401b28d6
jmp 0x1401b2917
mov rax, qword [rsp + 0x50]
movzx eax, byte [rax + 0x530]
test eax, eax
je 0x1401b28f2
mov rax, qword [rsp + 0x50]
mov byte [rax + 0x146c], 1
mov rax, qword [rsp + 0x20]
mov qword [rax], 0
mov rax, qword [rsp + 0x20]
mov qword [rax + 8], 0
mov rax, qword [rsp + 0x20]
mov byte [rax + 0xde], 1
xor eax, eax
add rsp, 0x40
pop rdi
ret
Function at 0x140147c98
Capabilities:
Generate random numbers via winapi

Disassembly:
jmp 0x1401cd850
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
mov r8, qword [rsp + 0x38]
xor edx, edx
mov rcx, qword [rsp + 0x30]
call fcn.140145f15
mov r9d, 2
mov r8d, dword [rsp + 0x38]
mov rdx, qword [rsp + 0x30]
xor ecx, ecx
call fcn.14014187a
test eax, eax
je 0x1401cd892
mov eax, 2
jmp 0x1401cd894
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x1401732e0
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x70
lea rdi, [rsp + 0x30]
mov ecx, reloc.WS2_32.dll_recv
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x80]
mov dword [rsp + 0x54], 4
lea rax, [rsp + 0x54]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
mov r8d, 0x1008
mov edx, 0xffff
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x140173354
cmp dword [rsp + 0x34], 1
jne 0x140173354
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.WS2_32.dll_send]
mov rcx, rsp
lea rdx, reloc.WS2_32.dll_bind
call fcn.140146785
add rsp, 0x70
pop rdi
ret

Function at 0x14017b3b0
Capabilities:
Hash data using djb2

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0x1505
mov rax, qword [rsp + 0x20]
cmp qword [rsp + 0x50], rax
jae 0x14017b43b
mov rax, qword [rsp + 0x28]
shl rax, 5
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x50]
movzx eax, byte [rax]
mov byte [rsp + 0x30], al
mov rax, qword [rsp + 0x50]
inc rax
mov qword [rsp + 0x50], rax
movzx ecx, byte [rsp + 0x30]
call fcn.140148067
movsx rax, al
mov rcx, qword [rsp + 0x28]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
jmp 0x14017b3dd
xor edx, edx
mov rax, qword [rsp + 0x28]
mov ecx, 0x3f
div rcx
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x1401a9810
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xa0
lea rdi, [rsp + 0x50]
mov ecx, reloc.WS2_32.dll_sendto
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0xb0]
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x84]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x64]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x4004747b
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.WS2_32.dll_WSAIoctl]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jne 0x1401a98b1
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x64]
mov r8d, 0x1001
mov edx, 0xffff
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rcx, rsp
lea rdx, reloc.WS2_32.dll_bind
call fcn.140146785
add rsp, 0xa0
pop rdi
ret
Function at 0x1401c34e0
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x70
lea rdi, [rsp + 0x30]
mov ecx, reloc.WS2_32.dll_recv
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x80]
cmp qword [rsp + 0x88], 0
je 0x1401c352a
mov rax, qword [rsp + 0x88]
cmp dword [rax], 0
jne 0x1401c356c
cmp qword [rsp + 0x90], 0
je 0x1401c3542
mov rax, qword [rsp + 0x90]
cmp dword [rax], 0
jne 0x1401c356c
cmp qword [rsp + 0x98], 0
je 0x1401c355a
mov rax, qword [rsp + 0x98]
cmp dword [rax], 0
jne 0x1401c356c
mov rcx, qword [rsp + 0xa0]
call fcn.140144c1e
jmp 0x1401c363d
mov rdx, qword [rsp + 0xa0]
lea rcx, [rsp + 0x38]
call fcn.14014635c
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x98], 0
je 0x1401c35aa
mov rax, qword [rsp + 0x98]
cmp dword [rax], 0
je 0x1401c35aa
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x50], rax
jmp 0x1401c35b3
mov qword [rsp + 0x50], 0
cmp qword [rsp + 0x90], 0
je 0x1401c35da
mov rax, qword [rsp + 0x90]
cmp dword [rax], 0
je 0x1401c35da
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x58], rax
jmp 0x1401c35e3
mov qword [rsp + 0x58], 0
cmp qword [rsp + 0x88], 0
je 0x1401c360a
mov rax, qword [rsp + 0x88]
cmp dword [rax], 0
je 0x1401c360a
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x60], rax
jmp 0x1401c3613
mov qword [rsp + 0x60], 0
mov eax, dword [rsp + 0x80]
inc eax
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x20], rcx
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
mov ecx, eax
call qword [sym.imp.WS2_32.dll_select]
mov rdi, rax
mov rcx, rsp
lea rdx, reloc.WS2_32.dll_accept
call fcn.140146785
mov rax, rdi
add rsp, 0x70
pop rdi
ret
Function at 0x1401d37f0
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xd0
lea rdi, [rsp + 0x30]
mov ecx, Ordinal_41
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0xe0]
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x58], 0
mov dword [rsp + 0x74], 0
mov dword [rsp + 0x94], 4
mov eax, dword [rsp + 0xf8]
mov dword [rsp + 0xb4], eax
mov r8, qword [rsp + 0xf8]
xor edx, edx
mov rcx, qword [rsp + 0xf0]
call fcn.140145f15
mov dword [rsp + 0x20], 0xf0000040
mov r9d, dword [rsp + 0x100]
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x1401d3898
jmp 0x1401d3982
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, dword [rsp + 0x108]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x1401d38c3
jmp 0x1401d395a
xor r9d, r9d
mov r8d, dword [rsp + 0xe8]
mov rdx, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x1401d38e7
jmp 0x1401d395a
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x94]
lea r8, [rsp + 0x74]
mov edx, 4
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
jne 0x1401d3912
jmp 0x1401d395a
mov eax, dword [rsp + 0x74]
cmp qword [rsp + 0xf8], rax
jae 0x1401d3922
jmp 0x1401d395a
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0xb4]
mov r8, qword [rsp + 0xf0]
mov edx, 2
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x1401d3950
jmp 0x1401d395a
xor eax, eax
test eax, eax
jne 0x1401d3898
cmp qword [rsp + 0x58], 0
je 0x1401d396d
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
cmp qword [rsp + 0x38], 0
je 0x1401d3982
xor edx, edx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, rsp
lea rdx, reloc.WS2_32.dll_getpeername
call fcn.140146785
add rsp, 0xd0
pop rdi
ret
Function at 0x1401d51e0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x34], 1
mov dword [rsp + 0x38], 0x8000
mov eax, dword [rsp + 0x34]
mov edx, eax
mov rcx, qword [rsp + 0x20]
call qword [0x140453030]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x1401d5230
mov rcx, qword [rsp + 0x20]
call qword [fcn.1401435bc]
xor eax, eax
jmp 0x1401d529b
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x20], rax
mov eax, dword [rsp + 0x34]
mov dword [rsp + 0x30], eax
mov r8d, dword [rsp + 0x30]
mov rdx, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
je 0x1401d5276
mov eax, dword [rsp + 0x30]
cmp dword [rsp + 0x34], eax
je 0x1401d5276
mov eax, dword [rsp + 0x38]
cmp dword [rsp + 0x34], eax
jbe 0x1401d5285
mov rcx, qword [rsp + 0x20]
call qword [fcn.1401435bc]
xor eax, eax
jmp 0x1401d529b
mov eax, dword [rsp + 0x30]
cmp dword [rsp + 0x34], eax
jae 0x1401d5296
mov rax, qword [rsp + 0x20]
jmp 0x1401d529b
jmp 0x1401d5203
add rsp, 0x40
pop rdi
ret

Function at 0x1401d7360
Capabilities:
Send data
Send data on socket

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
lea rdi, [rsp + 0x20]
mov ecx, recv
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x60]
mov rax, qword [rax + 0x20]
mov qword [rsp + 0x40], rax
mov eax, 1
imul rax, rax, 0
mov byte [rsp + rax + 0x24], 0xff
mov eax, 1
imul rax, rax, 1
movzx ecx, byte [rsp + 0x68]
mov byte [rsp + rax + 0x24], cl
mov eax, 1
imul rax, rax, 2
movzx ecx, byte [rsp + 0x70]
mov byte [rsp + rax + 0x24], cl
mov eax, 8
imul rax, rax, 0
xor r9d, r9d
mov r8d, 3
lea rdx, [rsp + 0x24]
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx + rax + 0x1a8]
call qword [sym.imp.WS2_32.dll_send]
cdqe
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jge 0x1401d7422
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [rsp + 0x48], eax
mov r8d, dword [rsp + 0x48]
lea rdx, [0x14045c6d0]
mov rcx, qword [rsp + 0x60]
call fcn.1401483aa
mov r9d, dword [rsp + 0x70]
mov r8d, dword [rsp + 0x68]
lea rdx, [0x14045c6ec]
mov rcx, qword [rsp + 0x60]
call fcn.1401d7090
mov rcx, rsp
lea rdx, reloc.WS2_32.dll_accept
call fcn.140146785
add rsp, 0x50
pop rdi
ret