joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140013c70
Capabilities:
Set socket configuration

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x48
mov rax, qword [0x140205108]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov edi, r8d
mov dword [rsp + 0x20], 1
mov rbx, rdx
lea r8, [rsp + 0x20]
mov edx, 0x8004667e
mov ebp, r9d
mov rsi, rcx
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov r8d, edi
mov rdx, rbx
mov rcx, rsi
call qword [0x1401fe250]
test eax, eax
je 0x140013cd7
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x140013cd7
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x70
jne 0x140013d1e
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
jne 0x140013ce5
xor eax, eax
jmp 0x140013d23
xorps xmm0, xmm0
imul r8d, ebp, 0x3e8
movups xmmword [rsp + 0x28], xmm0
mov eax, 0x310
mov qword [rsp + 0x28], rsi
mov edx, 1
mov word [rsp + 0x30], ax
lea rcx, [rsp + 0x28]
call qword [0x1401fe278]
test eax, eax
jle 0x140013d1e
test byte [rsp + 0x32], 0x10
jne 0x140013ce1
mov eax, reloc.WS2_32.dll_listen
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1401677c0
add rsp, 0x48
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140014090
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
movzx ebx, word [reloc.WS2_32.dll_accept]
mov eax, edx
cdq
sub eax, edx
xor edx, edx
sar eax, 1
mov r9d, edx
movsxd r10, eax
test eax, eax
jle 0x140014132
cmp r10d, 0x10
jb 0x140014132
mov r8d, r10d
xorps xmm2, xmm2
xorps xmm1, xmm1
and r8d, 0x8000000f
jge 0x1400140d6
dec r8d
or r8d, 0xfffffff0
inc r8d
mov eax, r10d
sub eax, r8d
movsxd r8, eax
nop
movdqu xmm0, xmmword [rcx + rdx*2]
add r9d, 0x10
pxor xmm2, xmm0
movdqu xmm0, xmmword [rcx + rdx*2 + 0x10]
add rdx, 0x10
pxor xmm1, xmm0
cmp rdx, r8
jl 0x1400140e0
pxor xmm1, xmm2
movdqa xmm0, xmm1
psrldq xmm0, 8
pxor xmm1, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 4
pxor xmm1, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 2
pxor xmm1, xmm0
movd eax, xmm1
xor bx, ax
movsxd rax, r9d
cmp rax, r10
jge 0x14001414c
nop word [rax + rax]
xor bx, word [rcx + rax*2]
inc rax
cmp rax, r10
jl 0x140014140
call fcn.14017643c
movzx ecx, bx
add ecx, eax
call fcn.140176468
call fcn.14017643c
mov dword [reloc.WS2_32.dll_accept], eax
add rsp, 0x20
pop rbx
jmp fcn.14017643c
Function at 0x14001e120
Capabilities:
Encode data using xor
Get hostname

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x4b0
mov rax, qword [0x140205108]
xor rax, rsp
mov qword [rsp + 0x4a0], rax
mov r15, r8
mov rsi, rdx
mov r14, rcx
xor edx, edx
mov r8d, 0x400
lea rcx, [rsp + 0xa0]
call fcn.14016b7a0
movabs rax, 0x5053534d4c544e
mov byte [rsp + 0xa8], 2
mov edx, 0x80
mov qword [rsp + 0xa0], rax
lea rcx, [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_gethostname]
lea rcx, [rsp + 0x20]
mov byte [rsp + 0x2f], 0
mov rax, 0xffffffffffffffff
nop
cmp byte [rcx + rax + 1], 0
lea rax, [rax + 1]
jne 0x14001e1a0
lea ebp, [rax + rax]
mov byte [rsp + 0xb0], 0x30
movzx eax, byte [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov byte [rsp + 0xac], bpl
xor ebx, ebx
mov byte [rsp + 0xae], bpl
mov dword [rsp + 0xb4], 0xa0818203
nop dword [rax]
movsx ecx, al
call fcn.140176898
mov byte [rsp + rbx + 0xd0], al
lea rdi, [rdi + 1]
movzx eax, byte [rdi]
mov byte [rsp + rbx + 0xd1], 0
add rbx, 2
test al, al
je 0x14001e20c
cmp rbx, 0x40
jl 0x14001e1e0
mov rcx, rsi
call fcn.1401760a4
cmp word [r14 + 0x1dc], 0x17
mov eax, 0x1e4
mov ecx, 0x1e0
mov rbx, rsi
cmovne eax, ecx
mov edi, 8
mov eax, dword [rax + r14]
mov dword [rsi + 4], eax
movzx eax, byte [r14 + 0x1de]
xor byte [rsi + 1], al
nop dword [rax]
nop dword [rax + rax]
mov edx, 8
mov rcx, rsi
call fcn.140014090
xor byte [rbx], al
lea rbx, [rbx + 1]
sub rdi, 1
jne 0x14001e250
mov rax, qword [rsi]
lea r8d, [rbp + 0x30]
mov rdx, r15
mov qword [rsp + 0xb8], rax
lea rcx, [rsp + 0xa0]
call fcn.1400135d0
mov rcx, qword [rsp + 0x4a0]
xor rcx, rsp
call fcn.1401677c0
mov rbx, qword [rsp + 0x4e0]
add rsp, 0x4b0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400251f0
Capabilities:
Set socket configuration

Disassembly:
push rbp
push rsi
sub rsp, 0x38
mov eax, 1
mov esi, edx
mov rbp, rcx
cmp edx, eax
jl 0x140025282
mov qword [rsp + 0x50], rbx
mov ebx, eax
mov qword [rsp + 0x60], rdi
lea rdi, reloc.WS2_32.dll_accept
mov qword [rsp + 0x30], r14
mov r14d, 0xfffb
mov dword [rsp + 0x58], 1
test esi, eax
je 0x140025267
mov rax, qword [rdi + 8]
movzx ecx, byte [rax]
cmp cl, 0x54
jne 0x140025242
mov edx, 6
jmp 0x14002524e
cmp cl, 0x49
mov edx, 0xffff
cmove edx, r14d
mov r8d, dword [rdi]
lea r9, [rsp + 0x58]
mov rcx, rbp
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
rol ebx, 1
add rdi, 0x10
mov eax, ebx
cmp esi, ebx
jge 0x140025223
mov r14, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x50]
add rsp, 0x38
pop rsi
pop rbp
ret

Function at 0x14002bd20
Capabilities:
Convert ip address from string

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov edi, 2
mov rbx, rcx
mov edx, edi
mov ecx, edi
xor r8d, r8d
call qword [sym.imp.WS2_32.dll_socket]
xorps xmm0, xmm0
mov ecx, 0x22c3
mov dword [0x14020f540], eax
movups xmmword [0x14020f548], xmm0
mov word [0x14020f548], di
call qword [sym.imp.WS2_32.dll_htons]
lea r8, [0x14020f54c]
mov ecx, edi
lea rdx, str.127.0.0.1
mov word [0x14020f54a], ax
call qword [sym.imp.WS2_32.dll_inet_pton]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rbx + r8], 0
jne 0x14002bd85
mov rdx, rbx
lea rcx, [0x140201498]
call fcn.1400090a0
lea rcx, [0x14020f518]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x14002ca90
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x20
mov rsi, rdx
mov rbp, rcx
mov rcx, rsi
xor edx, edx
call fcn.140176114
cmp eax, 0xffffffff
je 0x14002cabc
mov al, 1
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
mov edx, 0x5c
mov qword [rsp + 0x38], rdi
mov rcx, rsi
call fcn.14016c338
mov rdi, rax
test rax, rax
je 0x14002caf3
mov qword [rsp + 0x30], rbx
mov rdx, rsi
movzx ebx, byte [rax]
mov rcx, rbp
mov byte [rax], 0
call fcn.14002ca90
mov byte [rdi], bl
mov rbx, qword [rsp + 0x30]
mov rcx, rsi
call fcn.14017e660
mov rdi, qword [rsp + 0x38]
cmp eax, 0xffffffff
mov rbp, qword [rsp + 0x40]
setne al
add rsp, 0x20
pop rsi
ret

Function at 0x14002cd90
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x140205108]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rbx, rcx
mov ecx, reloc.WS2_32.dll_recv
call fcn.140167a7c
xor esi, esi
test rax, rax
je 0x14002cdd2
mov qword [rax], rbx
lea rcx, [0x14002cd50]
mov qword [rax + 8], rcx
jmp 0x14002cdd5
mov rax, rsi
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], esi
mov r9, rax
lea r8, [0x14002c140]
xor edx, edx
xor ecx, ecx
call fcn.140176340
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14002cf5e
movups xmm1, xmmword [rbx + 0x30]
movaps xmm0, xmmword [rsp + 0x30]
movups xmmword [rbx + 0x30], xmm0
movdqa xmmword [rsp + 0x30], xmm1
lea rcx, [rsp + 0x48]
call fcn.140030060
mov rdi, rax
add rbx, 8
cmp rbx, rax
je 0x14002ce98
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x14002ce6c
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x14002ce67
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14002cf6d
mov rcx, r8
call fcn.140167ab8
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
movups xmm0, xmmword [rdi]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rdi], 0
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x14002ced5
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002ced0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002cf6d
call fcn.140167ab8
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
mov rax, rdx
sub rax, rcx
cmp rax, 6
jb 0x14002cf18
lea rax, [rcx + 6]
mov qword [rbx + 0x10], rax
cmp rdx, 0x10
jb 0x14002cefa
mov rbx, qword [rbx]
add rbx, rcx
mov r8d, 6
lea rdx, str.Chrome
mov rcx, rbx
call fcn.14016bcc0
mov byte [rbx + 6], 0
jmp 0x14002cf38
mov qword [rsp + 0x20], 6
lea r9, str.Chrome
xor r8d, r8d
lea edx, [r8 + 6]
mov rcx, rbx
call fcn.14000ad30
nop
cmp dword [rsp + 0x38], 0
jne 0x14002cf73
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1401677c0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
mov dword [rsp + 0x38], esi
mov ecx, 6
call fcn.1401692bc
nop
call fcn.14017d6e4
nop
call fcn.14017e3ac
int3
Function at 0x14002f3d0
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
test rcx, rcx
je 0x14002f586
push rsi
push rdi
sub rsp, 0x3b8
mov rax, qword [0x140205108]
xor rax, rsp
mov qword [rsp + 0x3a0], rax
mov rdi, rcx
mov qword [rsp + 0x3e0], rbx
lea rcx, [rsp + 0x28]
mov esi, edx
call fcn.1401760a4
mov r8, rdi
lea rdx, str._s.
lea rcx, [rsp + 0x290]
call fcn.1400031e0
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x290]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14002f565
mov qword [rsp + 0x3e8], rbp
movabs rbp, 0xd6bf94d5e57a42bd
mov qword [rsp + 0x3b0], r14
movabs r14, 0xfe624e212ac18000
nop word [rax + rax]
movzx edx, byte [rsp + 0x5c]
movzx ecx, byte [rsp + 0x5d]
cmp dl, 0x2e
jne 0x14002f49a
test cl, cl
je 0x14002f536
cmp dl, dl
jne 0x14002f49a
cmp cl, dl
jne 0x14002f49a
cmp byte [rsp + 0x5e], 0
je 0x14002f536
lea rcx, [rsp + 0x170]
call fcn.140174eb8
lea r9, [rsp + 0x5c]
mov r8, rdi
lea rdx, str._s_s
lea rcx, [rsp + 0x180]
call fcn.1400031e0
test byte [rsp + 0x30], 0x10
mov eax, dword [rsp + 0x44]
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x48]
mov dword [rsp + 0x24], eax
jne 0x14002f519
mov rcx, qword [rsp + 0x20]
mov rax, rbp
add rcx, r14
imul rcx
add rdx, rcx
sar rdx, 0x17
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov rax, qword [rsp + 0x28]
sub rax, rdx
cmp rax, 0x3f480
jle 0x14002f536
lea rcx, [rsp + 0x180]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x14002f536
mov edx, esi
lea rcx, [rsp + 0x180]
call fcn.14002f3d0
lea rcx, [rsp + 0x180]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x14002f470
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
mov r14, qword [rsp + 0x3b0]
mov rbp, qword [rsp + 0x3e8]
mov rbx, qword [rsp + 0x3e0]
mov rcx, qword [rsp + 0x3a0]
xor rcx, rsp
call fcn.1401677c0
add rsp, 0x3b8
pop rdi
pop rsi
ret
Function at 0x14002f590
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
test rcx, rcx
je 0x14002f6e4
push rbx
sub rsp, 0x390
mov rax, qword [0x140205108]
xor rax, rsp
mov qword [rsp + 0x380], rax
mov rbx, rcx
mov qword [rsp + 0x3b0], rdi
mov r8, rcx
lea rdx, str._s.
lea rcx, [rsp + 0x270]
call fcn.1400031e0
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x270]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14002f6c4
mov qword [rsp + 0x3a8], rsi
lea rsi, str._done
nop dword [rax]
nop dword [rax + rax]
xor ecx, ecx
lea rdx, [rsp + 0x4c]
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [rsi + rcx - 1]
jne 0x14002f635
cmp rcx, 6
jne 0x14002f620
jmp 0x14002f69d
movzx ecx, byte [rsp + 0x4c]
movzx eax, byte [rsp + 0x4d]
cmp cl, 0x2e
jne 0x14002f657
test al, al
je 0x14002f69d
cmp cl, cl
jne 0x14002f657
cmp al, cl
jne 0x14002f657
cmp byte [rsp + 0x4e], 0
je 0x14002f69d
lea r9, [rsp + 0x4c]
mov r8, rbx
lea rdx, str._s_s
lea rcx, [rsp + 0x160]
call fcn.1400031e0
test byte [rsp + 0x20], 0x10
lea rcx, [rsp + 0x160]
jne 0x14002f68a
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x14002f69d
call fcn.14002f590
lea rcx, [rsp + 0x160]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x14002f610
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rsi, qword [rsp + 0x3a8]
mov rdi, qword [rsp + 0x3b0]
mov rcx, qword [rsp + 0x380]
xor rcx, rsp
call fcn.1401677c0
add rsp, 0x390
pop rbx
ret

Function at 0x1400336d0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
mov eax, 0x1030
call fcn.140167760
sub rsp, rax
mov rax, qword [0x140205108]
xor rax, rsp
mov qword [rsp + 0x1020], rax
mov rax, rdx
mov rdi, rcx
mov rcx, rax
lea rdx, [0x1401a63c8]
call fcn.140171448
mov rbx, rax
test rax, rax
jne 0x14003371a
lea eax, [rbx - 1]
jmp 0x14003379a
lea rdx, [0x1401a5b44]
mov qword [rsp + 0x1050], rsi
mov rcx, rdi
call fcn.140171448
mov rdi, rax
test rax, rax
jne 0x140033740
lea esi, [rax - 2]
jmp 0x140033788
mov r9, rbx
lea rcx, [rsp + 0x20]
mov edx, 1
mov r8d, 0x1000
call fcn.14017dc98
test eax, eax
jle 0x140033772
movsxd rdx, eax
lea rcx, [rsp + 0x20]
mov r9, rdi
mov r8d, 1
call fcn.14017dfe8
mov rcx, rbx
call fcn.14017e7a0
test eax, eax
je 0x140033740
xor esi, esi
mov rcx, rdi
call fcn.140170fcc
mov rcx, rbx
call fcn.140170fcc
mov eax, esi
mov rsi, qword [rsp + 0x1050]
mov rcx, qword [rsp + 0x1020]
xor rcx, rsp
call fcn.1401677c0
mov rbx, qword [rsp + 0x1058]
add rsp, 0x1030
pop rdi
ret
Function at 0x140036d10
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
mov ecx, 0x6c8
call fcn.140167a7c
xor ebx, ebx
test rax, rax
je 0x140036d31
mov rcx, rax
call fcn.14003fdf0
jmp 0x140036d34
mov rax, rbx
lea rcx, [0x14020f6f8]
mov qword [0x14020f688], rax
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [0x14020f720]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
xor r9d, r9d
mov qword [rsp + 0x28], rbx
lea r8, [0x140033870]
mov dword [0x14020f6cc], 1
xor ecx, ecx
mov dword [rsp + 0x20], ebx
lea edx, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor r9d, r9d
mov qword [rsp + 0x28], rbx
lea r8, [0x140032d20]
mov dword [rsp + 0x20], ebx
xor ecx, ecx
lea edx, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor r9d, r9d
mov qword [rsp + 0x28], rbx
lea r8, [0x140031190]
mov dword [rsp + 0x20], ebx
xor ecx, ecx
lea edx, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_CreateThread]
add rsp, 0x30
pop rbx
ret
Function at 0x140058230
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x260
mov rax, qword [0x140205108]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rdx, qword [rcx + 0x28]
mov rsi, rcx
mov rax, qword [rcx + 0x20]
mov rdi, qword [rcx + 8]
mov qword [rsp + 0x48], rdi
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x3c], edx
mov dword [rsp + 0x40], 1
nop dword [rax + rax]
lea rax, [rsp + 0x38]
xor r9d, r9d
lea ecx, [rdi + 1]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x40]
xor edx, edx
call qword [sym.imp.WS2_32.dll_select]
movsxd rbx, eax
test eax, eax
jns 0x1400582ae
call fcn.14017e884
cmp dword [rax], 4
je 0x140058280
test rbx, rbx
jle 0x1400582f5
mov rbx, qword [rsi + 8]
xor r8d, r8d
mov rcx, rbx
xor edx, edx
call fcn.1400789d0
test rax, rax
je 0x1400582f1
jns 0x1400582d5
call fcn.14017e884
cmp dword [rax], 9
je 0x1400582f5
mov r9d, 2
lea rdx, [rsp + 0x30]
mov rcx, rbx
lea r8d, [r9 - 1]
call fcn.140077e60
test rax, rax
jle 0x1400582f5
mov al, 1
jmp 0x1400582f7
xor al, al
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1401677c0
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x140058430
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rcx]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
call qword [rax + reloc.WS2_32.dll_recv]
test al, al
jne 0x140058469
mov rax, 0xffffffffffffffff
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rdi, qword [rdi + 8]
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov r8d, esi
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_send]
movsxd rbx, eax
test eax, eax
jns 0x140058495
call fcn.14017e884
cmp dword [rax], 4
je 0x140058472
mov rbp, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140058530
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0xc0
mov rax, qword [0x140205108]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rcx, qword [rcx + 8]
mov rdi, r8
mov rbx, rdx
mov dword [rsp + 0x20], 0x80
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x140058589
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x30]
mov r9, rdi
mov r8, rbx
call fcn.140071040
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1401677c0
mov rbx, qword [rsp + 0xe8]
add rsp, 0xc0
pop rdi
ret
Function at 0x14005a350
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov rbx, rdx
mov rsi, rcx
mov rdx, qword [rcx]
mov r15, rbx
sub r15, rdx
mov rax, qword [rcx + 8]
sub rax, rdx
sar rax, 4
movabs r8, 0xfffffffffffffff
cmp rax, r8
je 0x14005a5bf
lea r13, [rax + 1]
mov rcx, qword [rcx + 0x10]
sub rcx, rdx
sar rcx, 4
mov rdx, rcx
shr rdx, 1
mov rax, r8
sub rax, rdx
cmp rcx, rax
ja 0x14005a5b9
lea rax, [rdx + rcx]
mov r14, r13
cmp rax, r13
cmovae r14, rax
cmp r14, r8
ja 0x14005a5b9
mov r12, r14
shl r12, 4
mov qword [rsp + 0xa8], r14
cmp r12, 0x1000
jb 0x14005a413
lea rcx, [r12 + 0x27]
cmp rcx, r12
jbe 0x14005a5b9
call fcn.140167a7c
test rax, rax
je 0x14005a5cb
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x14005a43c
test r12, r12
je 0x14005a432
mov rcx, r12
call fcn.140167a7c
mov rdi, rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0xa8], r14
jmp 0x14005a441
xor edi, edi
mov qword [rsp + 0xa8], r14
mov qword [rsp + 0x30], rdi
and r15, 0xfffffffffffffff0
add r15, rdi
lea rax, [r15 + 0x10]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x98], rax
mov ecx, 8
call fcn.140167a7c
mov r9, rax
test r9, r9
je 0x14005a479
mov rax, qword [rsp + 0xa0]
mov rax, qword [rax]
mov qword [r9], rax
mov qword [rsp + 0x40], r9
lea r14, [r15 + 8]
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], 0
lea r8, [0x14005af40]
xor edx, edx
xor ecx, ecx
call fcn.140176340
mov qword [r15], rax
test rax, rax
je 0x14005a5d1
mov qword [rsp + 0x98], r15
mov rcx, qword [rsi + 8]
mov rax, qword [rsi]
mov rdx, rdi
cmp rbx, rcx
jne 0x14005a4eb
cmp rax, rcx
je 0x14005a537
nop word [rax + rax]
xorps xmm0, xmm0
movups xmm1, xmmword [rax]
movups xmmword [rax], xmm0
movups xmmword [rdx], xmm1
lea rdx, [rdx + 0x10]
add rax, 0x10
cmp rax, rcx
jne 0x14005a4d0
jmp 0x14005a537
cmp rax, rbx
je 0x14005a50d
xorps xmm0, xmm0
movups xmm1, xmmword [rax]
movups xmmword [rax], xmm0
movups xmmword [rdx], xmm1
lea rdx, [rdx + 0x10]
add rax, 0x10
cmp rax, rbx
jne 0x14005a4f0
mov rcx, qword [rsi + 8]
mov qword [rsp + 0x98], rdi
lea rax, [r15 + 0x10]
cmp rbx, rcx
je 0x14005a537
sub rax, rbx
xorps xmm0, xmm0
movups xmm1, xmmword [rbx]
movups xmmword [rbx], xmm0
movups xmmword [rbx + rax], xmm1
add rbx, 0x10
cmp rbx, rcx
jne 0x14005a521
mov rax, qword [rsi]
test rax, rax
je 0x14005a590
mov rdx, qword [rsi + 8]
mov rcx, rax
cmp rax, rdx
je 0x14005a55f
nop dword [rax + rax]
cmp dword [rax + 8], 0
jne 0x14005a5c5
add rax, 0x10
cmp rax, rdx
jne 0x14005a550
mov rdx, qword [rsi + 0x10]
sub rdx, rcx
and rdx, 0xfffffffffffffff0
cmp rdx, 0x1000
jb 0x14005a58b
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14005a5cb
mov rcx, r8
call fcn.140167ab8
mov qword [rsi], rdi
shl r13, 4
add r13, rdi
mov qword [rsi + 8], r13
lea rcx, [r12 + rdi]
mov qword [rsi + 0x10], rcx
mov rax, r15
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
call fcn.1400026c0
int3
call fcn.140030110
int3
call fcn.14017e3ac
int3
call fcn.14017d6e4
nop
mov dword [r14], 0
mov ecx, 6
call fcn.1401692bc
int3
Function at 0x14005ce90
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push r12
sub rsp, 0x30
mov rdi, r8
mov rsi, rdx
sub rdi, rdx
mov r12, rcx
sar rdi, 2
test rdi, rdi
je 0x14005d073
mov qword [rsp + 0x50], rbx
mov rbx, qword [rcx + 8]
sub rbx, qword [rcx]
mov qword [rsp + 0x60], r13
sar rbx, 2
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r15
cmp rdi, 0x26f
jb 0x14005cee1
mov eax, reloc.WS2_32.dll_inet_addr
jmp 0x14005cf0f
cmp rdi, 0x44
jb 0x14005ceee
mov eax, 7
jmp 0x14005cf0f
cmp rdi, 0x27
jb 0x14005cefb
mov eax, 5
jmp 0x14005cf0f
cmp rdi, 7
jb 0x14005cf08
mov eax, 3
jmp 0x14005cf0f
lea rax, [rdi - 1]
shr rax, 1
mov r14, rdi
lea r15, [rbx + 1]
sub r14, rax
shr r14, 1
lea r13, [r14 + rax]
cmp rdi, rbx
jbe 0x14005cf28
mov r15, rdi
mov r8, rdi
mov qword [rsp + 0x58], rbp
shl r8, 2
mov edx, 0x8b8b8b8b
mov rcx, rsi
call fcn.14016b7a0
xor ecx, ecx
test r15, r15
je 0x14005cfda
nop dword [rax]
xor edx, edx
lea rax, [rcx + r14]
div rdi
mov r11d, dword [rsi + rdx*4]
lea r10, [rsi + rdx*4]
xor edx, edx
mov rax, rcx
div rdi
lea rbp, [rsi + rdx*4]
mov r8d, r11d
mov r9, rdx
lea rax, [rcx - 1]
xor edx, edx
div rdi
xor r8d, dword [rsi + rdx*4]
xor r8d, dword [rbp]
mov eax, r8d
shr eax, 0x1b
xor eax, r8d
imul edx, eax, 0x19660d
test rcx, rcx
jne 0x14005cf9d
mov rax, rbx
jmp 0x14005cfb2
cmp rcx, rbx
ja 0x14005cfaf
mov rax, qword [r12]
mov eax, dword [rax + rcx*4 - 4]
add rax, r9
jmp 0x14005cfb2
mov rax, r9
lea r8d, [rax + rdx]
lea eax, [r11 + rdx]
xor edx, edx
mov dword [r10], eax
lea rax, [rcx + r13]
div rdi
inc rcx
add dword [rsi + rdx*4], r8d
mov dword [rbp], r8d
cmp rcx, r15
jb 0x14005cf50
add r15, rdi
cmp rcx, r15
jae 0x14005d05a
inc r14
lea rbp, [rcx - 1]
inc r13
nop dword [rax]
xor edx, edx
lea rax, [r14 + rbp]
div rdi
mov r10d, dword [rsi + rdx*4]
lea r11, [rsi + rdx*4]
xor edx, edx
lea rbx, [rbp + 1]
mov rax, rbx
div rdi
mov rax, rbp
mov r9, rdx
xor edx, edx
div rdi
mov ecx, dword [rsi + rdx*4]
xor edx, edx
add ecx, dword [rsi + r9*4]
add ecx, r10d
mov eax, ecx
shr eax, 0x1b
xor eax, ecx
imul ecx, eax, 0x5d588b65
mov rax, rbp
add rax, r13
mov rbp, rbx
div rdi
xor r10d, ecx
lea rax, [rbx + 1]
mov dword [r11], r10d
mov r8d, ecx
sub r8d, r9d
xor dword [rsi + rdx*4], r8d
mov dword [rsi + r9*4], r8d
cmp rax, r15
jb 0x14005cff0
mov rbp, qword [rsp + 0x58]
mov r13, qword [rsp + 0x60]
mov r14, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x50]
mov r15, qword [rsp + 0x20]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret