joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140148432
Capabilities:
Set thread local storage value

Disassembly:
jmp 0x1402d7ab0
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.1402d7400
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1402d7af9
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x1404ac020]
jmp 0x1402d7b08
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
add rsp, 0x48
ret

Function at 0x140148716
Capabilities:
Set environment variable

Disassembly:
jmp 0x1403c1de0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xb8
lea rcx, [rsp + 0x78]
call fcn.140141669
lea rcx, [rsp + 0x48]
call fcn.140141669
call fcn.14014369e
mov r8d, eax
lea rdx, [rsp + 0x78]
mov rcx, qword [rsp + 0xc0]
call fcn.140140f0c
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x1403c1e4f
mov dword [rsp + 0x24], 0
lea rcx, [rsp + 0x48]
call fcn.1401422c6
lea rcx, [rsp + 0x78]
call fcn.1401422c6
mov eax, dword [rsp + 0x24]
jmp 0x1403c1ee0
call fcn.14014369e
mov r8d, eax
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0xc8]
call fcn.140140f0c
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
je 0x1403c1e96
mov dword [rsp + 0x2c], 0
lea rcx, [rsp + 0x48]
call fcn.1401422c6
lea rcx, [rsp + 0x78]
call fcn.1401422c6
mov eax, dword [rsp + 0x2c]
jmp 0x1403c1ee0
lea rcx, [rsp + 0x48]
call fcn.140141425
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x78]
call fcn.140141425
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0x48]
call fcn.1401422c6
lea rcx, [rsp + 0x78]
call fcn.1401422c6
mov eax, dword [rsp + 0x30]
add rsp, 0xb8
ret
Function at 0x1401487bb
Capabilities:
Receive data
Receive data on socket

Disassembly:
jmp 0x140249050
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1b8
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x2e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1d8]
mov rax, qword [0x1404746f8]
xor rax, rbp
mov qword [rbp + 0x168], rax
lea rcx, [0x1404aa5c2]
call fcn.140148ed7
mov rcx, qword [rbp + 0x190]
call fcn.140145732
movzx eax, al
test eax, eax
jne 0x1402490bf
mov rcx, qword [rbp + 0x190]
call fcn.140144ec7
movzx eax, al
test eax, eax
jne 0x1402490c4
jmp 0x1402491d0
mov rax, qword [rbp + 0x190]
add rax, 0xd0
mov rdx, rax
lea rcx, [rbp + 8]
call fcn.140143617
nop
mov dword [rbp + 0x24], 0
mov dword [rbp + 0x44], 0
mov rax, qword [rbp + 0x190]
add rax, 0x10
mov rcx, rax
call fcn.14014453a
mov dword [rbp + 0x68], eax
mov rax, qword [rbp + 0x190]
add rax, 0x10
mov rcx, rax
call fcn.1401427e4
mov qword [rbp + 0x70], rax
mov rax, qword [rbp + 0x190]
add rax, 0x140
mov rcx, rax
call fcn.140148aae
mov rax, qword [rbp + 0x190]
add rax, 0x140
xor edx, edx
mov rcx, rax
call fcn.140148df6
mov rax, qword [rbp + 0x190]
add rax, 0x140
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x44]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x24]
mov r8d, 1
lea rdx, [rbp + 0x68]
mov rax, qword [rbp + 0x190]
mov rcx, qword [rax + 8]
call qword [sym.imp.WS2_32.dll_WSARecv]
cmp eax, 0xffffffff
jne 0x1402491c7
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [rbp + 0x94], eax
cmp dword [rbp + 0x94], 0x3e5
je 0x1402491c7
mov rax, qword [rbp + 0x190]
add rax, 0x140
mov rcx, rax
call fcn.140145dc7
mov rcx, qword [rbp + 0x190]
call fcn.140142d7a
nop
lea rcx, [rbp + 8]
call fcn.140141295
lea rcx, [rbp - 0x40]
lea rdx, reloc.WS2_32.dll_connect
call fcn.140146cb8
mov rcx, qword [rbp + 0x168]
xor rcx, rbp
call fcn.140142c7b
lea rsp, [rbp + 0x178]
pop rdi
pop rbp
ret
Function at 0x140148d5b
Capabilities:
Create thread

Disassembly:
jmp 0x140345300
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x78
cmp qword [rsp + 0x90], 0
je 0x14034532c
mov dword [rsp + 0x30], 1
jmp 0x140345334
mov dword [rsp + 0x30], 0
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
jne 0x14034537d
lea rax, str.procedure___nullptr
mov qword [rsp + 0x28], rax
lea rax, [0x14040a1c8]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 0xc8
lea rdx, str.minkernelcrtsucrt_src_appcrt_startup_thread.cpp
mov ecx, 2
call fcn.14013e50e
cmp eax, 1
jne 0x14034537d
int3
cmp dword [rsp + 0x34], 0
jne 0x1403453bf
call fcn.1401414bb
mov dword [rax], reloc.WS2_32.dll_shutdown
mov qword [rsp + 0x20], 0
mov r9d, 0xc8
lea r8, str.minkernelcrtsucrt_src_appcrt_startup_thread.cpp
lea rdx, str._beginthreadex
lea rcx, str.procedure___nullptr
call fcn.140147294
xor eax, eax
jmp 0x1403454bf
mov rdx, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x90]
call fcn.140344df0
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140344bf0
lea rcx, [rsp + 0x40]
call fcn.140344c60
movzx eax, al
test eax, eax
jne 0x14034540f
mov qword [rsp + 0x50], 0
lea rcx, [rsp + 0x40]
call fcn.140344c40
mov rax, qword [rsp + 0x50]
jmp 0x1403454bf
lea rcx, [rsp + 0x40]
call fcn.140344fa0
mov ecx, dword [rsp + 0x88]
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x28], rdx
mov edx, dword [rsp + 0xa0]
mov dword [rsp + 0x20], edx
mov r9, rax
lea r8, [0x1403449a0]
mov edx, ecx
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jne 0x140345483
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1401407fa
mov qword [rsp + 0x58], 0
lea rcx, [rsp + 0x40]
call fcn.140344c40
mov rax, qword [rsp + 0x58]
jmp 0x1403454bf
cmp qword [rsp + 0xa8], 0
je 0x14034549c
mov rax, qword [rsp + 0xa8]
mov ecx, dword [rsp + 0x38]
mov dword [rax], ecx
lea rcx, [rsp + 0x40]
call fcn.140344f60
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x40]
call fcn.140344c40
mov rax, qword [rsp + 0x60]
add rsp, 0x78
ret
Function at 0x14038e2b0
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1498
call fcn.14013f189
sub rsp, rax
mov rax, qword [0x1404746f8]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov eax, dword [rsp + 0x14b8]
sar eax, 6
cdqe
lea rcx, [0x14047bdd0]
mov edx, dword [rsp + 0x14b8]
and edx, 0x3f
movsxd rdx, edx
imul rdx, rdx, 0x48
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + rdx + 0x28]
mov qword [rsp + 0x60], rax
mov eax, dword [rsp + 0x14c8]
mov rcx, qword [rsp + 0x14c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x68]
mov rdi, rax
xor eax, eax
mov ecx, reloc.WS2_32.dll_inet_ntoa
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x14c0]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rax
jae 0x14038e4a2
lea rax, [rsp + 0x147f]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x38], rax
jae 0x14038e3f6
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rax
jae 0x14038e3f6
mov rax, qword [rsp + 0x48]
movzx eax, byte [rax]
mov byte [rsp + 0x31], al
mov rax, qword [rsp + 0x48]
inc rax
mov qword [rsp + 0x48], rax
movzx eax, byte [rsp + 0x31]
mov byte [rsp + 0x30], al
movsx eax, byte [rsp + 0x30]
cmp eax, 0xa
jne 0x14038e3db
mov eax, dword [rsp + 0x70]
inc eax
mov dword [rsp + 0x70], eax
mov rax, qword [rsp + 0x38]
mov byte [rax], reloc.WS2_32.dll_listen
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx ecx, byte [rsp + 0x30]
mov byte [rax], cl
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
jmp 0x14038e378
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
mov r8d, dword [rsp + 0x40]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14038e462
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x68], eax
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, reloc.WS2_32.dll_inet_ntoa
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x14038e4c1
mov eax, dword [rsp + 0x44]
mov ecx, dword [rsp + 0x6c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6c], eax
mov eax, dword [rsp + 0x40]
cmp dword [rsp + 0x44], eax
jae 0x14038e49d
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, reloc.WS2_32.dll_inet_ntoa
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x14038e4c1
jmp 0x14038e34e
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, reloc.WS2_32.dll_inet_ntoa
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.140142c7b
add rsp, 0x1498
pop rdi
pop rsi
ret
Function at 0x14038e570
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1498
call fcn.14013f189
sub rsp, rax
mov rax, qword [0x1404746f8]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov eax, dword [rsp + 0x14b8]
sar eax, 6
cdqe
lea rcx, [0x14047bdd0]
mov edx, dword [rsp + 0x14b8]
and edx, 0x3f
movsxd rdx, edx
imul rdx, rdx, 0x48
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + rdx + 0x28]
mov qword [rsp + 0x68], rax
mov eax, dword [rsp + 0x14c8]
mov rcx, qword [rsp + 0x14c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x70]
mov rdi, rax
xor eax, eax
mov ecx, reloc.WS2_32.dll_inet_ntoa
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x14c0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x50], rax
jae 0x14038e77d
lea rax, [rsp + 0x147e]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x60]
cmp qword [rsp + 0x38], rax
jae 0x14038e6c9
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x50], rax
jae 0x14038e6c9
mov rax, qword [rsp + 0x50]
movzx eax, word [rax]
mov word [rsp + 0x40], ax
mov rax, qword [rsp + 0x50]
add rax, 2
mov qword [rsp + 0x50], rax
movzx eax, word [rsp + 0x40]
mov word [rsp + 0x30], ax
movzx eax, word [rsp + 0x30]
cmp eax, 0xa
jne 0x14038e6a9
mov eax, dword [rsp + 0x78]
add eax, 2
mov dword [rsp + 0x78], eax
mov eax, reloc.WS2_32.dll_listen
mov rcx, qword [rsp + 0x38]
mov word [rcx], ax
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx ecx, word [rsp + 0x30]
mov word [rax], cx
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
jmp 0x14038e638
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov eax, eax
shl rax, 1
mov dword [rsp + 0x44], eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
mov r8d, dword [rsp + 0x44]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14038e73d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x70], eax
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, reloc.WS2_32.dll_inet_ntoa
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x14038e79c
mov eax, dword [rsp + 0x48]
mov ecx, dword [rsp + 0x74]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x74], eax
mov eax, dword [rsp + 0x44]
cmp dword [rsp + 0x48], eax
jae 0x14038e778
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, reloc.WS2_32.dll_inet_ntoa
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x14038e79c
jmp 0x14038e60e
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, reloc.WS2_32.dll_inet_ntoa
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.140142c7b
add rsp, 0x1498
pop rdi
pop rsi
ret
Function at 0x14007c8c0
Capabilities:
Encode data using xor

Disassembly:
sub rdx, r8
sub rcx, r8
mov r10, r9
shr r9, 4
je 0x14007c8f5
nop
movdqu xmm0, xmmword [rdx + r8]
pxor xmm0, xmmword [r8]
movdqu xmmword [rcx + r8], xmm0
movdqa xmmword [r8], xmm0
lea r8, [r8 + 0x10]
dec r9
jne 0x14007c8d0
and r10, 0xf
je 0x14007c925
mov r9d, reloc.WS2_32.dll_recv
sub r9, r10
xor eax, eax
mov al, byte [rdx + r8]
xor al, byte [r8]
mov byte [rcx + r8], al
mov byte [r8], al
lea r8, [r8 + 1]
dec r10
jne 0x14007c900
xor eax, eax
mov byte [r8], al
lea r8, [r8 + 1]
dec r9
jne 0x14007c919
mov rax, r8
repz ret

Function at 0x14007c930
Capabilities:
Encode data using xor

Disassembly:
sub rdx, r8
sub rcx, r8
mov r10, r9
shr r9, 4
je 0x14007c96d
nop
movdqu xmm0, xmmword [rdx + r8]
movdqa xmm1, xmmword [r8]
pxor xmm1, xmm0
movdqu xmmword [rcx + r8], xmm1
movdqa xmmword [r8], xmm0
lea r8, [r8 + 0x10]
dec r9
jne 0x14007c940
pxor xmm1, xmm1
and r10, 0xf
je 0x14007c9a3
mov r9d, reloc.WS2_32.dll_recv
sub r9, r10
xor eax, eax
xor r11, r11
mov r11b, byte [rdx + r8]
mov al, byte [r8]
xor al, r11b
mov byte [rcx + r8], al
mov byte [r8], r11b
lea r8, [r8 + 1]
dec r10
jne 0x14007c97b
xor eax, eax
mov byte [r8], al
lea r8, [r8 + 1]
dec r9
jne 0x14007c997
mov rax, r8
repz ret
Function at 0x140136d90
Capabilities:
Get session user name

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
xor ebx, ebx
lea rdx, [rsp + 0x30]
xor ecx, ecx
mov dword [rsp + 0x30], ebx
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov ecx, dword [rsp + 0x30]
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov rdi, rax
test rax, rax
je 0x140136de0
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
cmovne rbx, rdi
mov rax, rbx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140137810
Capabilities:
Get common file path

Disassembly:
push rsi
sub rsp, 0x150
mov rax, qword [0x1403bfb80]
xor rax, rsp
mov qword [rsp + 0x130], rax
cmp byte [rcx], 0x7e
mov rsi, rcx
jne 0x140137850
inc rsi
mov edx, gethostbyaddr
mov rcx, rsi
call sub.VCRUNTIME140.dll_strchr
test rax, rax
je 0x14013785a
cmp rax, rsi
jbe 0x14013785a
mov rcx, rsi
call sub.api_ms_win_crt_string_l1_1_0.dll__strdup
jmp 0x140137947
mov qword [rsp + 0x168], rbx
mov rbx, 0xffffffffffffffff
mov qword [rsp + 0x148], rdi
mov rdi, rbx
inc rdi
cmp byte [rsi + rdi], 0
jne 0x140137874
xor edx, edx
mov qword [rsp + 0x170], rbp
mov r8d, 0x104
lea rcx, [rsp + 0x20]
call sub.VCRUNTIME140.dll_memset
mov r9d, 1
lea rdx, [rsp + 0x20]
xor ecx, ecx
lea r8d, [r9 + 0x27]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x140137990
lea rax, [rsp + 0x20]
mov rcx, rbx
nop
inc rcx
cmp byte [rax + rcx], 0
jne 0x1401378c0
inc rcx
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov rbp, rax
test rax, rax
je 0x140137990
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x140], r14
sub rax, rcx
lea rdx, [rsp + 0x20]
movzx ecx, byte [rdx]
mov byte [rax + rdx], cl
lea rdx, [rdx + 1]
test cl, cl
jne 0x1401378f2
inc rbx
cmp byte [rbx + rbp], 0
jne 0x140137900
lea rcx, [rbx + 1]
add rcx, rdi
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov r14, rax
test rax, rax
jne 0x140137960
mov rcx, rbp
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
xor eax, eax
mov r14, qword [rsp + 0x140]
mov rbp, qword [rsp + 0x170]
mov rbx, qword [rsp + 0x168]
mov rdi, qword [rsp + 0x148]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1402d88b0
add rsp, 0x150
pop rsi
ret
test rbx, rbx
je 0x140137973
mov r8, rbx
mov rdx, rbp
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
mov rcx, rbp
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
lea r8, [rdi + 1]
mov rdx, rsi
lea rcx, [r14 + rbx]
call sub.VCRUNTIME140.dll_memcpy
mov rax, r14
jmp 0x140137927
xor eax, eax
jmp 0x14013792f

Function at 0x140139f70
Capabilities:
Initialize winsock library

Disassembly:
sub rsp, 0x1d8
mov rax, qword [0x1403bfb80]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
cmp dword [0x1403bfc10], 0
jne 0x140139fd2
mov ecx, 2
lea rdx, [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x140139fc3
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.1402d88b0
add rsp, 0x1d8
ret
call fcn.140140280
mov dword [0x1403bfc10], 1
xor eax, eax
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.1402d88b0
add rsp, 0x1d8
ret
Function at 0x14013a890
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x28
lea r8, [rsp + 0x38]
mov dword [rsp + 0x38], 1
mov edx, 0x8004667e
call qword [sym.imp.WS2_32.dll_ioctlsocket]
add rsp, 0x28
ret
Function at 0x140149d70
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
sub rsp, 0x280
mov rax, qword [0x1403bfb80]
xor rax, rsp
mov qword [rsp + 0x270], rax
cmp dword [0x1403bfc40], 0
lea rax, [0x1401496f0]
mov qword [rsp + 0x28], rax
lea rbx, str.getaddrinfo
lea rax, str.getnameinfo
movzx ebp, cx
mov qword [rsp + 0x30], rax
lea rax, [0x140149b30]
mov qword [rsp + 0x38], rax
lea rax, str.freeaddrinfo
mov qword [rsp + 0x40], rax
lea rax, [0x1401496a0]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x20], rbx
jne 0x140149f3c
mov edx, 0x104
lea rcx, [rsp + 0x160]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x140149f32
lea r8, [rsp + 0x160]
mov qword [rsp + 0x290], rsi
mov edx, 0x10c
lea rcx, [rsp + 0x50]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcpy_s
lea r8, str.ws2_32
mov edx, 0x10c
lea rcx, [rsp + 0x50]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcat_s
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x140149e64
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140149ec4
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea r8, [rsp + 0x160]
mov edx, 0x10c
lea rcx, [rsp + 0x50]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcpy_s
lea r8, str.wship6
mov edx, 0x10c
lea rcx, [rsp + 0x50]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcat_s
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x140149f2a
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140149ec4
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x140149f2a
mov qword [rsp + 0x298], rdi
lea rbx, [rsp + 0x28]
xor edi, edi
mov rdx, qword [rbx - 8]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx], rax
test rax, rax
je 0x140149f19
inc edi
add rbx, 0x10
cmp edi, 3
jl 0x140149ed3
mov rax, qword [rsp + 0x28]
mov qword [0x1403bbd68], rax
mov rax, qword [rsp + 0x38]
mov qword [0x1403bbd78], rax
mov rax, qword [rsp + 0x48]
mov qword [0x1403bbd88], rax
jmp 0x140149f22
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rdi, qword [rsp + 0x298]
mov rsi, qword [rsp + 0x290]
mov dword [0x1403bfc40], 1
mov rax, rbp
lea rcx, str.H_._
add rax, rax
mov rax, qword [rcx + rax*8 + 8]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1402d88b0
mov rbx, qword [rsp + 0x2a0]
add rsp, 0x280
pop rbp
ret
Function at 0x140149f70
Capabilities:
Resolve dns

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x870
mov rax, qword [0x1403bfb80]
xor rax, rsp
mov qword [rsp + 0x860], rax
mov r13, qword [rsp + 0x8c8]
mov r14, rcx
mov dword [rsp + 0x24], r8d
xor ebp, ebp
mov dword [rsp + 0x28], edx
mov r8d, 0x400
mov qword [rsp + 0x38], rcx
xor edx, edx
lea rcx, [rsp + 0x41]
mov byte [rsp + 0x40], bpl
mov r12d, ebp
mov word [rsp + 0x20], r9w
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov byte [rsp + 0x450], bpl
mov r8d, 0x400
lea rcx, [rsp + 0x451]
call sub.VCRUNTIME140.dll_memset
mov r9d, 0x400
lea rbx, [rsp + 0x40]
mov r8, r14
mov qword [rsp + 0x30], rbx
lea rcx, [rsp + 0x40]
lea rdi, [rsp + 0x450]
lea edx, [r9 + 1]
call sub.api_ms_win_crt_string_l1_1_0.dll_strncpy_s
lea r15, [rbp - 1]
nop word [rax + rax]
mov rcx, r14
mov qword [r13], rbp
mov rsi, r13
mov byte [rdi], bpl
call qword [sym.imp.WS2_32.dll_gethostbyname]
mov r14, rax
test rax, rax
je 0x14014a17e
cmp word [rax + 0x10], 2
jne 0x14014a0a7
cmp word [rax + 0x12], 4
jne 0x14014a0a7
mov rbx, qword [rax + 0x18]
mov rax, qword [rbx]
test rax, rax
je 0x14014a0a2
nop dword [rax]
mov r9d, dword [rax]
movzx r8d, word [rsp + 0x20]
mov edx, dword [rsp + 0x24]
mov ecx, dword [rsp + 0x28]
call fcn.14014a1e0
mov qword [rsi], rax
test rax, rax
je 0x14014a177
add rbx, 8
lea rsi, [rax + 0x28]
mov rax, qword [rbx]
test rax, rax
jne 0x14014a070
mov rbx, qword [rsp + 0x30]
mov r8, qword [r14]
mov r9d, 0x400
mov rcx, rdi
lea edx, [r9 + 1]
call sub.api_ms_win_crt_string_l1_1_0.dll_strncpy_s
cmp qword [r13], rbp
jne 0x14014a120
mov rax, r15
inc rax
cmp byte [rdi + rax], bpl
jne 0x14014a0c5
test rax, rax
je 0x14014a198
mov r8, rdi
mov rax, rbx
sub r8, rbx
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x14014a0f3
inc rax
test ecx, ecx
jne 0x14014a0e0
test edx, edx
je 0x14014a198
inc r12d
cmp r12d, 0x10
je 0x14014a198
mov r14, qword [rsp + 0x38]
mov rax, rbx
mov rbx, rdi
mov rdi, rax
mov qword [rsp + 0x30], rbx
jmp 0x14014a030
cmp dword [rsp + 0x8c0], ebp
je 0x14014a1ab
nop dword [rax]
cmp byte [rdi + r15 + 1], bpl
lea r15, [r15 + 1]
jne 0x14014a130
lea rdx, [r15 + 1]
mov ecx, 1
call sub.api_ms_win_crt_heap_l1_1_0.dll_calloc
mov rbx, rax
test rax, rax
jne 0x14014a156
mov rbx, rbp
jmp 0x14014a165
mov r8, rdi
lea rdx, [r15 + 1]
mov rcx, rax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcpy_s
mov rax, qword [r13]
mov qword [rax + 0x18], rbx
mov rax, qword [r13]
cmp qword [rax + 0x18], rbp
jne 0x14014a1ab
mov ebp, 8
jmp 0x14014a1ab
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
sub ecx, 0x2af9
je 0x14014a1a6
sub ecx, 1
je 0x14014a19f
sub ecx, 1
jne 0x14014a1a6
mov ebp, 0x2afb
jmp 0x14014a1ab
mov ebp, 0x2afa
jmp 0x14014a1ab
mov ebp, 0x2af9
mov eax, ebp
mov rcx, qword [rsp + 0x860]
xor rcx, rsp
call fcn.1402d88b0
lea r11, [rsp + 0x870]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14014d180
Capabilities:
Encode data using xor

Disassembly:
xor r10d, r10d
xor al, al
mov r9, rdx
mov r11, rcx
mov edx, r10d
test r8, r8
je 0x14014d253
sub r9, rcx
cmp r8, 0x20
jb 0x14014d22d
mov rcx, r8
lea rax, [r11 + 0x10]
and rcx, 0xffffffffffffffe0
xorps xmm3, xmm3
xorps xmm2, xmm2
nop word [rax + rax]
movdqu xmm0, xmmword [rax - 0x10]
add rdx, 0x20
movdqu xmm1, xmmword [r9 + rax - 0x10]
lea rax, [rax + 0x20]
xorps xmm1, xmm0
orps xmm3, xmm1
movdqu xmm1, xmmword [r9 + rax - 0x20]
movdqu xmm0, xmmword [rax - 0x20]
xorps xmm1, xmm0
orps xmm2, xmm1
cmp rdx, rcx
jb 0x14014d1c0
orps xmm2, xmm3
movdqa xmm0, xmm2
psrldq xmm0, 8
orps xmm2, xmm0
movdqa xmm0, xmm2
psrldq xmm0, 4
orps xmm2, xmm0
movdqa xmm0, xmm2
psrldq xmm0, 2
orps xmm2, xmm0
movdqa xmm0, xmm2
psrldq xmm0, 1
orps xmm2, xmm0
movd eax, xmm2
cmp rdx, r8
jae 0x14014d253
lea rcx, [rdx + r11]
sub r8, rdx
nop dword [rax]
nop dword [rax + rax]
movzx edx, byte [r9 + rcx]
xor dl, byte [rcx]
lea rcx, [rcx + 1]
or al, dl
sub r8, 1
jne 0x14014d240
test al, al
setne r10b
mov eax, r10d
ret