joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401b2d60
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0x100
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
mov rcx, qword [rcx]
call fcn.1401b1e20
test al, al
jne 0x1401b2f18
mov dword [rbp - 0x61], edi
mov qword [rbp - 0x59], rsi
xor esi, esi
mov dword [rbp + 0x67], esi
mov qword [rbp + 7], rsi
mov qword [rsp + 0x30], rsi
lea rax, [rbp - 0x11]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x67]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8d, [rsi + 1]
lea rdx, [rbp - 0x61]
mov rcx, qword [rbx + 8]
call qword [sym.imp.WS2_32.dll_WSARecv]
test eax, eax
je 0x1401b2dde
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
jne 0x1401b2f3f
mov rcx, qword [rbx]
call fcn.1401b1c00
mov qword [rbp + 0xf], rax
mov byte [rbp + 0x17], sil
lea rax, [rbp - 0x11]
mov qword [rbx + 0x10], rax
mov rcx, qword [rbx]
call fcn.1401b1c00
lea rdx, [rax + 0x70]
lea rcx, vtable.std::_Func_impl_no_alloc_class__lambda_ba592e99b77cc87b7eb140194ef6b88a___void___.0
mov qword [rbp - 0x51], rcx
mov qword [rbp - 0x49], rbx
lea rcx, [rbp - 0x51]
mov qword [rbp - 0x19], rcx
lea rcx, [rbp - 0x51]
call fcn.1401a04d0
mov rcx, qword [rbp - 0x19]
test rcx, rcx
je 0x1401b2e3b
mov rax, qword [rcx]
lea rdx, [rbp - 0x51]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
mov rcx, qword [rbx]
call fcn.1401b1910
mov rcx, qword [rbx]
call fcn.1401b1c00
lea rdi, [rax + 0x70]
mov rcx, qword [rdi + 0x38]
test rcx, rcx
je 0x1401b2e68
mov rax, qword [rcx]
cmp rcx, rdi
setne dl
call qword [rax + 0x20]
mov qword [rdi + 0x38], rsi
mov qword [rbx + 0x10], rsi
lea rax, [rbp + 0x67]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rbp + 0x7f]
lea rdx, [rbp - 0x11]
mov rcx, qword [rbx + 8]
call qword [sym.imp.WS2_32.dll_WSAGetOverlappedResult]
cmp eax, 1
je 0x1401b2e9e
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e3
jne 0x1401b2edb
jmp 0x1401b2eb4
mov eax, dword [rbp + 0x7f]
mov rbx, qword [rsp + 0x128]
add rsp, 0x100
pop rdi
pop rsi
pop rbp
ret
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x79], xmm0
mov qword [rbp - 0x69], rax
lea rcx, [rbp - 0x79]
call fcn.140196d90
lea rdx, [0x1403376d0]
lea rcx, [rbp - 0x79]
call fcn.140207de0
int3
mov edx, eax
lea rcx, [rbp - 0x51]
call fcn.1401b4d40
nop
mov r8, rax
lea rdx, str.TcpConnection::read__WSAGetOverlappedResult_failed_
lea rcx, [rbp + 0x1f]
call fcn.1400d48a0
nop
mov rdx, rax
lea rcx, [rbp - 0x79]
call fcn.14000cd90
lea rdx, [0x140336d50]
lea rcx, [rbp - 0x79]
call fcn.140207de0
nop
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x79], xmm0
mov qword [rbp - 0x69], rax
lea rcx, [rbp - 0x79]
call fcn.140196d90
lea rdx, [0x1403376d0]
lea rcx, [rbp - 0x79]
call fcn.140207de0
int3
mov edx, eax
lea rcx, [rbp + 0x1f]
call fcn.1401b4d40
nop
mov r8, rax
lea rdx, str.TcpConnection::read__WSARecv_failed_
lea rcx, [rbp - 0x51]
call fcn.1400d48a0
nop
mov rdx, rax
lea rcx, [rbp - 0x79]
call fcn.14000cd90
lea rdx, [0x140336d50]
lea rcx, [rbp - 0x79]
call fcn.140207de0
int3
Function at 0x1401b4000
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister
Resolve dns

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x1340]
mov eax, 0x1440
call fcn.1402065a0
sub rsp, rax
mov rdi, r8
mov rsi, rdx
mov rcx, qword [rcx]
call fcn.1401b1e20
test al, al
jne 0x1401b41c6
movdqa xmm0, xmmword [0x1402d7e40]
movdqu xmmword [rsp + 0x38], xmm0
xor ebx, ebx
mov qword [rsp + 0x48], rbx
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rbx
cmp qword [rdi + 0x18], 0x10
jb 0x1401b4068
mov rdi, qword [rdi]
lea r9, [rbp + 0x1350]
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
jne 0x1401b4186
mov rax, qword [rbp + 0x1350]
test rax, rax
je 0x1401b409f
inc rbx
mov rax, qword [rax + 0x28]
test rax, rax
jne 0x1401b4093
call fcn.1401e41d0
mov r8d, 0xffffffff
mov dword [rbp + 0x1334], r8d
mov dword [rbp - 0x4c], eax
mov edx, 1
nop dword [rax]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [rbp + rdx*4 - 0x4c], eax
inc rdx
cmp rdx, 0x270
jb 0x1401b40c0
mov dword [rbp - 0x50], 0x270
lea rax, [rbp - 0x50]
mov qword [rsp + 0x20], rax
mov ecx, 0x40
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
dec rcx
shr rax, 1
cmp rax, r8
ja 0x1401b4100
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x20]
test rbx, rbx
jne 0x1401b4126
call fcn.14005c4f0
jmp 0x1401b412e
mov rdx, rbx
call fcn.1400499d0
mov rbx, qword [rbp + 0x1350]
test rax, rax
je 0x1401b414a
nop word [rax + rax]
mov rbx, qword [rbx + 0x28]
sub rax, 1
jne 0x1401b4140
mov rax, qword [rbx + 0x20]
mov ecx, dword [rax + 4]
call qword [sym.imp.WS2_32.dll_ntohl]
mov edx, eax
mov rcx, rsi
call fcn.1401b3df0
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
mov rax, rsi
lea r11, [rsp + 0x1440]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
mov edx, eax
lea rcx, [rsp + 0x68]
call fcn.1401b4d40
nop
mov r8, rax
lea rdx, str.Ipv4Resolver::resolve__getaddrinfo_failed_
lea rcx, [rbp - 0x78]
call fcn.1400d48a0
nop
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.14000cd90
lea rdx, [0x140336d50]
lea rcx, [rsp + 0x20]
call fcn.140207de0
nop
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x20]
call fcn.140196d90
lea rdx, [0x1403376d0]
lea rcx, [rsp + 0x20]
call fcn.140207de0
int3
Function at 0x1401c8a70
Capabilities:
Initialize winsock library

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x1f0
movzx ebx, dl
mov rdi, rcx
mov eax, 1
lock xadd dword [0x140360188], eax
inc eax
cmp eax, 1
jne 0x1401c8aab
lea ecx, [rax + 1]
lea rdx, [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_WSAStartup]
xchg dword [0x14036018c], eax
test bl, bl
je 0x1401c8b4f
xor ebx, ebx
lock xadd dword [0x14036018c], ebx
test ebx, ebx
je 0x1401c8b4f
movabs rcx, 0x4d54ee85da812030
mov qword [rsp + 0x200], rsi
add rcx, qword [0x14034d050]
lea rsi, [0x14034d048]
mov dword [rsp + 0x3c], 0
cmp rcx, 1
jbe 0x1401c8b04
mov rax, qword [0x14034d048]
mov edx, ebx
mov rcx, rsi
call qword [rax + 0x30]
jmp 0x1401c8b06
mov al, 1
lea rcx, str.C:local_vcpkginstalledx64_windowsinclude_boost_asio_detail_impl_winsock_init.ipp
movzx eax, al
add rax, 2
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x40], rsi
lea rcx, str.throw_on_error
mov rsi, qword [rsp + 0x200]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], 0x48
mov dword [rsp + 0x34], 0x1a
test al, 1
jne 0x1401c8b63
mov rbx, qword [rsp + 0x208]
mov rax, rdi
add rsp, 0x1f0
pop rdi
ret
lea r8, [rsp + 0x20]
lea rdx, str.winsock
lea rcx, [rsp + 0x38]
call fcn.1401d3120
int3
Function at 0x1401d5c20
Capabilities:
Terminate thread

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [rcx + 0x10]
lea rdx, [rsp + 0x20]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rax, qword [rcx + 8]
mov rbx, rcx
mov r9d, 0xffffffff
mov qword [rsp + 0x28], rax
lea ecx, [r8 + 2]
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
lock xadd dword [0x1403633d0], eax
mov rcx, qword [rbx + 8]
test eax, eax
je 0x1401d5c7d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
add rsp, 0x30
pop rbx
ret
mov rdx, rcx
xor r8d, r8d
lea rcx, [fcn.14000ee10]
call qword [sym.imp.KERNEL32.dll_QueueUserAPC]
mov rcx, qword [rbx + 8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
add rsp, 0x30
pop rbx
ret
Function at 0x1401dec60
Capabilities:
Get local ipv4 addresses
Get socket information
Resolve dns
Send data
Send data on socket
Send http request
Send http request with host header

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x8c0
movzx edi, dx
mov r14, r8
mov r8d, dword [rsp + 0x910]
movzx edx, di
mov r15, r9
mov dword [r9], 0
mov rbp, rcx
call fcn.1401df810
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x1401deca9
xor eax, eax
jmp 0x1401dede5
mov qword [rsp + 0x8e0], rbx
mov rbx, qword [rsp + 0x900]
test rbx, rbx
je 0x1401ded4d
lea r8, [rsp + 0x8f8]
mov dword [rsp + 0x8f8], 0x80
lea rdx, [rsp + 0x40]
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jns 0x1401decf5
lea rcx, str.getsockname
call fcn.14021d560
jmp 0x1401ded4d
mov r9d, dword [rsp + 0x908]
lea rcx, [rsp + 0x40]
mov edx, dword [rsp + 0x8f8]
mov r8, rbx
mov dword [rsp + 0x30], 0xa
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.WS2_32.dll_getnameinfo]
mov ebx, eax
test eax, eax
je 0x1401ded4d
mov ecx, 2
call fcn.14020f614
mov rcx, rax
lea rdx, str.getnameinfo___failed_:__d_n
mov r8d, ebx
call fcn.14016d0d0
mov dword [rsp + 0x30], edi
lea rax, [0x1402d9b9c]
mov qword [rsp + 0x28], rbp
lea r8, str.GET__s_HTTP__s_r_nHost:__s:_d_r_nConnection:_Close_r_nUser_Agent:_Windows__UPnP_1.1__MiniUPnPc_2.2.2_r_n_r_n
mov r9, r14
mov qword [rsp + 0x20], rax
mov edx, 0x800
lea rcx, [rsp + 0xc0]
call fcn.1401d81f0
mov edi, eax
cmp eax, 0x800
jae 0x1401dee0a
xor ebx, ebx
test eax, eax
jle 0x1401dedbb
mov r8d, edi
movsxd rax, ebx
lea rdx, [rsp + 0xc0]
sub r8d, ebx
add rdx, rax
xor r9d, r9d
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
js 0x1401dedfe
add ebx, eax
cmp ebx, edi
jl 0x1401ded91
mov r8, qword [rsp + 0x918]
mov rdx, r15
mov rcx, rsi
call fcn.1401de570
mov rcx, rsi
mov rbx, rax
call qword [sym.imp.WS2_32.dll_closesocket]
mov rax, rbx
mov rbx, qword [rsp + 0x8e0]
lea r11, [rsp + 0x8c0]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
lea rcx, str.send
call fcn.14021d560
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
jmp 0x1401deddd
Function at 0x1401df1b0
Capabilities:
Send data
Send data on socket
Send http request
Send http request with host header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r14
sub rsp, 0x260
mov rsi, qword [rsp + 0x2a8]
mov rbx, 0xffffffffffffffff
mov rdi, rbx
mov rbp, r8
mov r14, rdx
mov r12, rcx
inc rdi
cmp byte [rsi + rdi], 0
jne 0x1401df1e6
mov byte [rsp + 0x50], 0
cmp r9w, 0x50
je 0x1401df215
movzx r9d, r9w
lea r8, str.:_hu
mov edx, 8
lea rcx, [rsp + 0x50]
call fcn.1401d81f0
mov rax, qword [rsp + 0x2a0]
lea r8, str.POST__s_HTTP__s_r_nHost:__s_s_r_nUser_Agent:_Windows__UPnP_1.1__MiniUPnPc_2.2.2_r_nContent_Length:__d_r_nContent_Type:_text_xml_r_nSOAPAction:___s__r_nConnection:_Close_r_nCache_Control:_no_cache_r_nPragma:_no_cache_r_n_r_n
mov rcx, qword [rsp + 0x2b0]
mov r9, r14
mov qword [rsp + 0x40], rax
mov edx, 0x200
mov dword [rsp + 0x38], edi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x60]
call fcn.1401d81f0
movsxd r14, eax
cmp r14d, 0x200
jae 0x1401df2fb
mov qword [rsp + 0x280], r15
lea r15d, [r14 + rdi]
movsxd rcx, r15d
call fcn.140218fdc
mov rbp, rax
test rax, rax
je 0x1401df2f3
mov r8, r14
lea rdx, [rsp + 0x60]
mov rcx, rax
call fcn.140207eb0
movsxd r8, edi
lea rcx, [r14 + rbp]
mov rdx, rsi
call fcn.140207eb0
xor r9d, r9d
mov r8d, r15d
mov rdx, rbp
mov rcx, r12
call qword [sym.imp.WS2_32.dll_send]
mov edi, eax
test eax, eax
jns 0x1401df2e9
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, 2
mov ebx, eax
call fcn.14020f614
mov rcx, rax
lea r8, str.send
mov r9d, ebx
lea rdx, str.Socket_error:__s___d_n
call fcn.14016d0d0
mov rcx, rbp
call fcn.14020c804
mov ebx, edi
mov r15, qword [rsp + 0x280]
lea r11, [rsp + 0x260]
mov eax, ebx
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r12
pop rdi
ret
Function at 0x1401df810
Capabilities:
Connect socket
Resolve dns

Disassembly:
mov rax, rsp
push rbx
push rsi
push rdi
push r14
sub rsp, 0xa8
mov qword [rax + 0x10], rbp
xorps xmm0, xmm0
xor ebp, ebp
mov qword [rax - 0x28], r15
xorps xmm1, xmm1
movzx r9d, dx
mov r14d, r8d
mov r15, rcx
movdqu xmmword [rsp + 0x2c], xmm0
mov edi, 1
lea edx, [rbp + 8]
movdqu xmmword [rsp + 0x3c], xmm1
mov dword [rax - 0x7c], ebp
lea r8, [0x1402da18c]
lea rcx, [rax + 0x20]
mov qword [rsp + 0x20], 8
mov dword [rsp + 0x28], edi
call fcn.1401d81f0
cmp byte [r15], 0x5b
jne 0x1401df8cf
movzx eax, byte [r15 + 1]
lea rbx, [r15 + 1]
test al, al
je 0x1401df8c5
mov esi, ebp
cmp al, 0x5d
je 0x1401df8c5
cmp rsi, 0x40
jge 0x1401df8c5
movsxd rcx, edi
lea rdx, [0x1402d9ba4]
add rcx, r15
mov byte [rsp + rsi + 0x50], al
mov r8d, 3
call fcn.14021d350
test eax, eax
jne 0x1401df8b3
add edi, 2
add rbx, 2
movzx eax, byte [rbx + 1]
inc rbx
inc ebp
inc rsi
inc edi
test al, al
jne 0x1401df882
movsxd rax, ebp
mov byte [rsp + rax + 0x50], 0
jmp 0x1401df8e2
mov r8d, 0x40
lea rcx, [rsp + 0x50]
mov rdx, r15
call fcn.14020c830
lea r9, [rsp + 0xd0]
mov byte [rsp + 0x90], 0
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0xe8]
lea rcx, [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov r15, qword [rsp + 0xa0]
mov esi, eax
mov rbp, qword [rsp + 0xd8]
test eax, eax
je 0x1401df950
mov ecx, 2
call fcn.14020f614
mov rcx, rax
lea rdx, str.getaddrinfo___error_:__d_n
mov r8d, esi
call fcn.14016d0d0
mov rax, 0xffffffffffffffff
add rsp, 0xa8
pop r14
pop rdi
pop rsi
pop rbx
ret
mov rbx, qword [rsp + 0xd0]
mov rdi, 0xffffffffffffffff
test rbx, rbx
je 0x1401df9ca
cmp rdi, 0xffffffffffffffff
je 0x1401df973
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
mov r8d, dword [rbx + 0xc]
mov edx, dword [rbx + 8]
mov ecx, dword [rbx + 4]
call qword [sym.imp.WS2_32.dll_socket]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1401df9b9
mov rax, qword [rbx + 0x20]
mov rdx, rax
cmp word [rax], 0x17
jne 0x1401df9a6
test r14d, r14d
je 0x1401df9a6
mov dword [rax + 0x18], r14d
mov rdx, qword [rbx + 0x20]
mov r8d, dword [rbx + 0x10]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_connect]
mov esi, eax
test eax, eax
jns 0x1401df9c2
mov rbx, qword [rbx + 0x28]
test rbx, rbx
jne 0x1401df964
mov rbx, qword [rsp + 0xd0]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
cmp rdi, 0xffffffffffffffff
jne 0x1401dfa12
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea ecx, [rdi + 3]
mov ebx, eax
call fcn.14020f614
mov rcx, rax
lea r8, str.socket
mov r9d, ebx
lea rdx, str.Socket_error:__s___d_n
call fcn.14016d0d0
mov rax, rdi
add rsp, 0xa8
pop r14
pop rdi
pop rsi
pop rbx
ret
test esi, esi
jns 0x1401dfa5e
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, 2
mov ebx, eax
call fcn.14020f614
mov rcx, rax
lea r8, str.connect
mov r9d, ebx
lea rdx, str.Socket_error:__s___d_n
call fcn.14016d0d0
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
mov rax, 0xffffffffffffffff
add rsp, 0xa8
pop r14
pop rdi
pop rsi
pop rbx
ret
mov rax, rdi
add rsp, 0xa8
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x1401dfda0
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x250
mov rsi, rdx
mov qword [rsp + 0x48], rcx
mov eax, 0x10624dd3
mov dword [rsp + 0x40], 1
imul r9d
mov edi, r8d
mov rbx, rcx
sar edx, 6
xor r8d, r8d
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x3e8
mov dword [rsp + 0x30], edx
lea rdx, [rsp + 0x40]
sub r9d, eax
imul eax, r9d, 0x3e8
xor r9d, r9d
lea ecx, [r9 + 0x40]
mov dword [rsp + 0x34], eax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_select]
test eax, eax
jns 0x1401dfe47
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, 2
mov ebx, eax
call fcn.14020f614
mov rcx, rax
lea r8, str.select
mov r9d, ebx
lea rdx, str.Socket_error:__s___d_n
call fcn.14016d0d0
mov eax, 0xffffffff
jmp 0x1401dfea5
jne 0x1401dfe4d
xor eax, eax
jmp 0x1401dfea5
xor r9d, r9d
mov r8d, edi
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_recv]
mov edi, eax
test eax, eax
jns 0x1401dfe90
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, 2
mov ebx, eax
call fcn.14020f614
mov rcx, rax
lea r8, str.recv
mov r9d, ebx
lea rdx, str.Socket_error:__s___d_n
call fcn.14016d0d0
mov rax, qword [rsp + 0x280]
test rax, rax
je 0x1401dfea3
mov dword [rax], 0
mov eax, edi
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x1401fc54c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
lea r9, [rdx + rdx]
movabs r8, 0xcbf29ce484222325
xor edx, edx
test r9, r9
je 0x1401e623e
movzx eax, byte [rdx + rcx]
movabs r10, 0x100000001b3
xor r8, rax
inc rdx
imul r8, r10
cmp rdx, r9
jb 0x1401e6221
mov rax, r8
ret
sub r8, rdx
mov rcx, rdx
sar r8, 1
mov rdx, r8
jmp 0x1401e620c

Function at 0x1402192dc
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x140219167
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140219167
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140219167
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140219167
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140219167
cmp dword [rcx + 0x84], 0xe
jbe 0x140219167
cmp dword [rcx + 0xf8], 0
je 0x140219167
mov ecx, ebx
call fcn.140219208
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.140218fe4
cmp dword [rbp + 0x20], 0
je 0x1402191b4
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1402191bc
int3
xor r8d, r8d
xor edx, edx
jmp 0x140219100
Function at 0x1402347a0
Capabilities:
Accept command line arguments

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x70
xor ebx, ebx
mov dword [rsp + 0x40], ebx
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x40]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [rsp + 0x50], rax
mov rdi, rax
test rax, rax
jne 0x1402347dd
lea rax, [rbx - 1]
add rsp, 0x70
pop r15
pop rdi
pop rbx
ret
mov eax, dword [rsp + 0x40]
mov r15, 0xffffffffffffffff
inc eax
mov qword [rsp + 0x98], rsi
movsxd rcx, eax
mov eax, 8
mul rcx
mov qword [rsp + 0x60], r14
cmovo rax, r15
mov rcx, rax
call fcn.1402066c0
mov r14, rax
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x40]
test eax, eax
je 0x1402348dc
mov qword [rsp + 0x90], rbp
mov qword [rsp + 0xa0], r12
mov r12, r14
mov qword [rsp + 0x68], r13
mov r13, rdi
sub r13, r14
mov r14d, ebx
nop dword [rax]
nop word [rax + rax]
mov rbp, qword [r12 + r13]
mov r9d, r15d
mov qword [rsp + 0x38], rbx
mov r8, rbp
mov qword [rsp + 0x30], rbx
xor edx, edx
mov dword [rsp + 0x28], ebx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rdi, eax
mov rcx, rdi
call fcn.1402066c0
mov qword [rsp + 0x38], rbx
mov r9d, r15d
mov qword [rsp + 0x30], rbx
mov r8, rbp
mov dword [rsp + 0x28], edi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov qword [r12], rsi
lea r12, [r12 + 8]
mov eax, dword [rsp + 0x40]
inc r14d
cmp r14d, eax
jne 0x140234850
mov r14, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov r13, qword [rsp + 0x68]
mov r12, qword [rsp + 0xa0]
mov rbp, qword [rsp + 0x90]
cdqe
mov rcx, rdi
mov qword [r14 + rax*8], rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [rsp + 0x40]
mov rdx, r14
call fcn.14003f890
mov esi, eax
cmp dword [rsp + 0x40], ebx
je 0x14023491b
mov rdi, r14
mov rcx, qword [rdi]
test rcx, rcx
je 0x14023491b
call fcn.140205dc4
inc ebx
add rdi, 8
cmp ebx, dword [rsp + 0x40]
jne 0x140234902
mov rcx, r14
call fcn.140205dc4
mov r14, qword [rsp + 0x60]
mov eax, esi
mov rsi, qword [rsp + 0x98]
add rsp, 0x70
pop r15
pop rdi
pop rbx
ret
Function at 0x140001050
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x88
xor eax, eax
mov r14, r8
mov rbx, rdx
mov qword [rsp + 0x50], rax
mov rdi, rcx
mov qword [rsp + 0x58], rax
lea rdx, str.1.3.1
mov qword [rsp + 0x60], rax
lea r8d, [rax + 0x58]
mov dword [rsp + 0x28], eax
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
mov rsi, r9
mov ebp, eax
call fcn.14000b640
mov r15d, eax
test eax, eax
je 0x1400010d3
lea rdx, [rbx + 0x12]
mov r8d, eax
lea rcx, str.Failed_to_extract__s:_inflateInit___failed_with_return_code__d__n
call fcn.140002b20
lea eax, [rbp - 1]
add rsp, 0x88
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov ecx, 0x2000
mov qword [rsp + 0x80], r13
call fcn.140015580
mov r13, rax
test rax, rax
jne 0x140001109
lea r8, [rbx + 0x12]
lea rdx, str.Failed_to_extract__s:_failed_to_allocate_temporary_input_buffer__n
lea rcx, str.malloc
call fcn.140002880
jmp 0x140001264
mov ecx, 0x2000
call fcn.140015580
mov rbp, rax
test rax, rax
jne 0x140001137
lea r8, [rbx + 0x12]
lea rdx, str.Failed_to_extract__s:_failed_to_allocate_temporary_output_buffer__n
lea rcx, str.malloc
call fcn.140002880
jmp 0x140001264
mov qword [rsp + 0xd0], r12
mov r15d, 0xffffffff
mov r12d, dword [rbx + 8]
nop dword [rax]
mov eax, 0x2000
mov rbx, r12
cmp r12, rax
mov r9, rdi
mov edx, 1
mov rcx, r13
cmova rbx, rax
mov r8, rbx
call fcn.140010acc
cmp rax, rbx
jne 0x14000125c
mov rcx, rdi
call fcn.140010840
test eax, eax
jne 0x14000125c
sub r12, rbx
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
nop word [rax + rax]
mov ebx, 0x2000
mov qword [rsp + 0x30], rbp
xor edx, edx
mov dword [rsp + 0x38], ebx
lea rcx, [rsp + 0x20]
call fcn.140009a80
mov edi, eax
mov r15d, 0xffffffff
lea ecx, [rax + 4]
cmp ecx, 2
jbe 0x140001241
cmp eax, 2
je 0x14000123c
mov ecx, dword [rsp + 0x38]
sub rbx, rcx
test r14, r14
je 0x140001203
mov r9, r14
lea edx, [r15 + 2]
mov r8, rbx
mov rcx, rbp
call fcn.14001120c
cmp rax, rbx
jne 0x1400011fe
mov rcx, r14
call fcn.140010840
test eax, eax
je 0x140001219
mov edi, r15d
jmp 0x140001241
test rsi, rsi
je 0x140001219
mov r8, rbx
mov rdx, rbp
mov rcx, rsi
call fcn.14002acf0
add rsi, rbx
cmp dword [rsp + 0x38], 0
je 0x1400011a0
cmp edi, 1
je 0x140001237
test r12, r12
je 0x140001241
mov rdi, qword [rsp + 0xc0]
jmp 0x140001150
xor r15d, r15d
jmp 0x14000125c
mov edi, 0xfffffffd
mov rdx, qword [rsp + 0xc8]
lea rcx, str.Failed_to_extract__s:_decompression_resulted_in_return_code__d__n
add rdx, 0x12
mov r8d, edi
call fcn.140002b20
mov r12, qword [rsp + 0xd0]
lea rcx, [rsp + 0x20]
call fcn.14000b320
mov rcx, r13
call fcn.14001556c
mov rcx, rbp
call fcn.14001556c
mov r13, qword [rsp + 0x80]
mov eax, r15d
add rsp, 0x88
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret