joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001b50
Capabilities:
Encode data using xor
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, r8
mov rsi, rdx
test rdx, rdx
jne 0x140001b6b
xor eax, eax
add rsp, 0x28
pop rdi
pop rsi
ret
lea rdx, [0x14029d034]
mov qword [rsp + 0x50], rbp
call fcn.1401e696c
mov rbp, rax
test rax, rax
jne 0x140001b90
mov rbp, qword [rsp + 0x50]
add rsp, 0x28
pop rdi
pop rsi
ret
mov qword [rsp + 0x40], rbx
test rdi, rdi
jne 0x140001bac
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rsi
repne scasb al, byte [rdi]
not rcx
lea rdi, [rcx - 1]
mov rcx, rdi
call fcn.1401e3610
mov rbx, rax
test rax, rax
jne 0x140001bd7
mov rcx, rbp
call fcn.1401e67bc
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
xor eax, eax
add rsp, 0x28
pop rdi
pop rsi
ret
mov r8, rdi
mov rdx, rsi
mov rcx, rax
call fcn.1401e3ed0
xor r9d, r9d
mov r11d, edi
mov r10d, edi
mov r8, r9
test edi, edi
je 0x140001c3c
mov rsi, qword [0x1402e0c48]
mov qword [rsp + 0x20], r12
lea r12, str.8437jhdf8834kmklsi7__kdf8lsdjf2__aksdjsd0__dkfk____sksldfjsa_sdasdkj23knfsmmjjd
nop dword [rax + rax]
movsx ecx, byte [r8 + rbx]
mov eax, r11d
xor edx, edx
div rsi
inc r8
inc r11d
movzx eax, byte [rdx + r12]
add r9d, ecx
xor al, cl
mov byte [r8 + rbx - 1], al
cmp r8, r10
jb 0x140001c10
mov r12, qword [rsp + 0x20]
mov eax, r9d
mov edx, 8
lea rcx, [0x14029d038]
lea r8d, [rdx - 7]
mov r9, rbp
mov qword [rsp + 0x48], rax
call fcn.1401e6b44
mov edx, 4
lea rcx, [rsp + 0x48]
lea r8d, [rdx - 3]
mov r9, rbp
call fcn.1401e6b44
mov r9, rbp
mov r8d, 1
mov rdx, rdi
mov rcx, rbx
call fcn.1401e6b44
mov rcx, rbx
call fcn.1401e36c8
mov rcx, rbp
call fcn.1401e67bc
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov eax, 1
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x140002e00
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push r12
sub rsp, 0x20
mov rbp, rdx
xor edx, edx
mov rbx, rcx
lea r8d, [rdx + 2]
mov rcx, rbp
call fcn.1401e6680
mov rcx, rbp
call fcn.1401e6564
xor r8d, r8d
xor edx, edx
mov rcx, rbp
movsxd r12, eax
call fcn.1401e6680
cmp r12d, 0x4000000
jle 0x140002e50
mov dword [rbx + 0x38], 0xfffffffe
xor al, al
add rsp, 0x20
pop r12
pop rbp
pop rbx
ret
lea eax, [r12 + 2]
mov ecx, eax
mov dword [rbx + 0x30], eax
call fcn.1401e37b4
mov qword [rbx + 0x28], rax
test rax, rax
jne 0x140002e78
mov dword [rbx + 0x38], 0xfffffffb
add rsp, 0x20
pop r12
pop rbp
pop rbx
ret
mov edx, 1
mov qword [rsp + 0x40], rsi
mov r9, rbp
lea r8d, [rdx + 0xb]
mov rcx, rax
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x58], r13
call fcn.1401e6380
mov rsi, rax
cmp rax, 0xc
jne 0x140002f3a
mov rcx, qword [rbx + 0x28]
cmp byte [rcx], 0x31
jne 0x140002f3a
cmp byte [rcx + 1], 0x32
jne 0x140002f3a
cmp byte [rcx + 2], 0x78
jne 0x140002f3a
cmp byte [rcx + 3], 0
jne 0x140002f3a
mov eax, dword [rcx + 8]
movsx r13d, byte [rcx + 4]
xor edi, edi
mov qword [rsp + 0x50], rdi
mov dword [rsp + 0x50], eax
lea eax, [r12 - 0xc]
movsxd rsi, eax
lea r8d, [rdi + 1]
mov r9, rbp
mov rdx, rsi
call fcn.1401e6380
mov rcx, qword [rbx + 0x28]
mov r9d, esi
xor r8d, r8d
mov edx, esi
call fcn.140004180
mov ecx, eax
cmp rcx, qword [rsp + 0x50]
je 0x140002f2c
mov dword [rbx + 0x38], 0xfffffffd
xor al, al
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov r13, qword [rsp + 0x58]
add rsp, 0x20
pop r12
pop rbp
pop rbx
ret
test r13d, r13d
setne dil
inc edi
mov dword [rbx + 0x38], edi
jmp 0x140002f61
xor edi, edi
mov dword [rbx + 0x38], edi
cmp r12, rax
jbe 0x140002f61
mov rcx, qword [rbx + 0x28]
mov rdx, r12
lea r8d, [rdi + 1]
sub rdx, rax
mov r9, rbp
add rcx, 0xc
call fcn.1401e6380
mov rsi, r12
test rsi, rsi
je 0x140002f12
mov rax, qword [rbx + 0x28]
mov rcx, rbx
mov byte [rsi + rax], 0
call fcn.140002f80
mov al, 1
jmp 0x140002f14
Function at 0x140003970
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push r13
push r14
sub rsp, 0x20
mov r13, r9
mov r14, r8
mov rbx, rdx
mov rbp, rcx
cmp rdx, 0xffff
jbe 0x1400039ab
mov qword [r9], 0
xor eax, eax
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r13
pop rbp
ret
mov qword [rsp + 0x40], rsi
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], r12
test rsi, rsi
je 0x1400039dd
cmp byte [rsi], 0
je 0x1400039dd
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rsi
repne scasb al, byte [rdi]
not rcx
lea r12, [rcx - 1]
jmp 0x1400039eb
mov r12, qword [0x1402e0c48]
lea rsi, str.8437jhdf8834kmklsi7__kdf8lsdjf2__aksdjsd0__dkfk____sksldfjsa_sdasdkj23knfsmmjjd
lea rax, [rdx + 4]
lea rdi, [r8 + 4]
mov qword [r9], rax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [r14]
xor ecx, eax
xor edx, edx
and ecx, 0x7ffff
xor ecx, dword [r14]
mov rax, rcx
and eax, 0x7ffff
div r12
shl edx, 0x13
xor edx, ecx
and edx, 0x1f80000
xor edx, ecx
mov dword [r14], edx
cmp rbx, 0x7f
jbe 0x140003a45
and edx, 0x1ffffff
add rdi, 2
add qword [r13], 2
mov dword [r14], edx
mov word [rdi - 2], bx
jmp 0x140003a55
mov eax, ebx
and edx, 0x1ffffff
shl eax, 0x19
or edx, eax
mov dword [r14], edx
mov edx, dword [r14]
shr edx, 0x13
and edx, 0x3f
test rbx, rbx
je 0x140003a91
sub rbp, rdi
nop word [rax + rax]
movsxd rax, edx
inc rdi
movzx ecx, byte [rax + rsi]
lea eax, [rdx + 3]
xor edx, edx
xor cl, byte [rdi + rbp - 1]
cdqe
mov byte [rdi - 1], cl
div r12
sub rbx, 1
jne 0x140003a70
mov r12, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x58]
mov eax, 1
add rsp, 0x20
pop r14
pop r13
pop rbp
ret

Function at 0x140004180
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
xor r10d, r10d
mov r11d, edx
test edx, edx
je 0x1400041de
mov qword [rsp + 0x10], rbx
mov rbx, qword [0x1402e0c48]
mov qword [rsp], rdi
lea rdi, str.8437jhdf8834kmklsi7__kdf8lsdjf2__aksdjsd0__dkfk____sksldfjsa_sdasdkj23knfsmmjjd
nop word [rax + rax]
mov eax, r9d
xor edx, edx
inc r10
div rbx
inc r9d
movzx eax, byte [rdx + rdi]
xor byte [r10 + rcx - 1], al
movsx eax, byte [r10 + rcx - 1]
add r8d, eax
cmp r10, r11
jb 0x1400041b0
mov rdi, qword [rsp]
mov rbx, qword [rsp + 0x10]
mov eax, r8d
add rsp, 8
ret
Function at 0x1400045a0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x20], r9
push rbx
sub rsp, 0x8b0
mov rax, qword [0x1402de400]
xor rax, rsp
mov qword [rsp + 0x8a0], rax
movsxd rbx, ecx
lea r8, [rsp + 0x8e0]
lea rcx, [rsp + 0x4a0]
mov rdx, r9
mov byte [rsp + 0x50], 0x56
mov byte [rsp + 0x51], 0x49
mov byte [rsp + 0x52], 0x57
mov byte [rsp + 0x53], 0x45
call fcn.1401e861c
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
test byte [reloc.WS2_32.dll_bind], 8
je 0x140004653
movsx ebx, byte [rsp + rbx + 0x50]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
movzx ecx, word [rsp + 0x66]
movzx edx, word [rsp + 0x64]
movzx r9d, word [rsp + 0x62]
movzx r8d, word [rsp + 0x60]
lea r10, [rsp + 0x4a0]
mov qword [rsp + 0x40], r10
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], edx
lea rdx, str.__02d:_02d:_02d__03d_thread:_d__c___s
lea rcx, [rsp + 0x70]
call fcn.1401e5c60
jmp 0x140004698
movzx edx, word [rsp + 0x64]
movsx ecx, byte [rsp + rbx + 0x50]
movzx eax, word [rsp + 0x66]
movzx r9d, word [rsp + 0x62]
movzx r8d, word [rsp + 0x60]
lea r10, [rsp + 0x4a0]
mov qword [rsp + 0x38], r10
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], edx
lea rcx, [rsp + 0x70]
lea rdx, str.__02d:_02d:_02d__03d__c___s
call fcn.1401e5c60
test byte [reloc.WS2_32.dll_bind], 4
je 0x1400046de
lea rdx, [0x14029d11c]
lea rcx, [0x1402e4b20]
call fcn.1401e696c
mov rbx, rax
test rax, rax
je 0x1400046de
lea rcx, [rsp + 0x70]
mov rdx, rax
call fcn.1401e840c
mov rdx, rbx
mov ecx, 0xa
call fcn.1401e82d4
mov rcx, rbx
call fcn.1401e67bc
test byte [reloc.WS2_32.dll_bind], 1
je 0x1400046f1
lea rcx, [rsp + 0x70]
call fcn.1401e8628
test byte [reloc.WS2_32.dll_bind], 2
je 0x140004712
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, [0x14029d120]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, qword [rsp + 0x8a0]
xor rcx, rsp
call fcn.1401e42a0
add rsp, 0x8b0
pop rbx
ret

Function at 0x140004730
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x830
mov rax, qword [0x1402de400]
xor rax, rsp
mov qword [rsp + 0x820], rax
mov rdi, rdx
lea rdx, [0x14029d054]
xor ebx, ebx
call fcn.1401e696c
mov rsi, rax
test rax, rax
je 0x1400047ed
lea rdx, [0x14029d034]
mov rcx, rdi
call fcn.1401e696c
mov rdi, rax
test rax, rax
je 0x1400047e5
mov ebx, 1
lea rcx, [rsp + 0x20]
mov r9, rsi
mov rdx, rbx
mov r8d, 0x800
call fcn.1401e6380
test eax, eax
jle 0x1400047dd
nop word [rax + rax]
lea rcx, [rsp + 0x20]
movsxd rdx, eax
mov r9, rdi
mov r8, rbx
call fcn.1401e6b44
lea rcx, [rsp + 0x20]
mov r9, rsi
mov r8d, 0x800
mov rdx, rbx
call fcn.1401e6380
test eax, eax
jg 0x1400047b0
mov rcx, rdi
call fcn.1401e67bc
mov rcx, rsi
call fcn.1401e67bc
mov eax, ebx
mov rcx, qword [rsp + 0x820]
xor rcx, rsp
call fcn.1401e42a0
lea r11, [rsp + 0x830]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140006ff0
Capabilities:
Resolve dns

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
jne 0x140007006
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov qword [rsp + 0x30], rdi
call sub.WS2_32.dll_inet_addr
mov edi, eax
cmp eax, 0xffffffff
jne 0x14000702d
mov rcx, rbx
call sub.WS2_32.dll_gethostbyname
test rax, rax
je 0x14000702d
mov rax, qword [rax + 0x18]
mov rcx, qword [rax]
mov edi, dword [rcx]
mov eax, edi
mov rdi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret

Function at 0x140007040
Capabilities:
Connect socket
Get socket status
Resolve dns

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x278
mov rax, qword [0x1402de400]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor r12d, r12d
mov edi, r9d
movzx r13d, r8w
mov rsi, rdx
mov rbp, rcx
test rdx, rdx
jne 0x14000707c
mov ebx, r12d
jmp 0x1400070a1
mov rcx, rdx
call sub.WS2_32.dll_inet_addr
mov ebx, eax
cmp eax, 0xffffffff
jne 0x1400070a1
mov rcx, rsi
call sub.WS2_32.dll_gethostbyname
test rax, rax
je 0x1400070a1
mov rax, qword [rax + 0x18]
mov rcx, qword [rax]
mov ebx, dword [rcx]
movzx ecx, r13w
mov dword [rsp + 0x254], ebx
call sub.WS2_32.dll_htons
mov ecx, dword [rsp + 0x254]
mov word [rsp + 0x252], ax
mov eax, 2
mov word [rsp + 0x250], ax
cmp ecx, 0xffffffff
jne 0x140007103
cmp dword [reloc.WS2_32.dll_accept], 1
jg 0x1400070fc
mov qword [rsp + 0x20], rsi
lea r9, str._s_cant_be_resolved.
lea r8d, [rax + 0x22]
lea rdx, str....._base_srcwin32TSocket.c
mov ecx, 1
call fcn.1400045a0
xor eax, eax
jmp 0x1400071f7
cmp dword [reloc.WS2_32.dll_accept], 1
jg 0x14000713b
movzx ebx, r13w
call sub.WS2_32.dll_inet_ntoa
mov r8d, 0x28
lea r9, str.Socket_connecting_to__s:_d_...
lea rdx, str....._base_srcwin32TSocket.c
lea ecx, [r8 - 0x27]
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
call fcn.1400045a0
lea rdx, [rsp + 0x250]
mov r8d, reloc.WS2_32.dll_recv
mov rcx, rbp
call sub.WS2_32.dll_connect
test eax, eax
je 0x1400071f2
call sub.WS2_32.dll_WSAGetLastError
cmp eax, 0x2733
jne 0x140007217
cmp edi, 0xffffffff
je 0x140007193
mov eax, 0x10624dd3
lea r12, [rsp + 0x30]
mul edi
shr edx, 6
mov dword [rsp + 0x30], edx
imul edx, edx, 0x3e8
sub edi, edx
imul edi, edi, 0x3e8
mov dword [rsp + 0x34], edi
xor edx, edx
lea r8, [rsp + 0x40]
xor r9d, r9d
lea ecx, [rdx + 1]
mov qword [rsp + 0x48], rbp
mov dword [rsp + 0x40], 1
mov qword [rsp + 0x20], r12
call sub.WS2_32.dll_select
test eax, eax
jle 0x140007217
lea rdx, [rsp + 0x40]
mov rcx, rbp
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x140007217
cmp dword [reloc.WS2_32.dll_accept], 1
jg 0x1400071f2
mov r8d, 0x4b
lea r9, str.Connected.
lea rdx, str....._base_srcwin32TSocket.c
lea ecx, [r8 - 0x4a]
call fcn.1400045a0
mov eax, 1
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1401e42a0
add rsp, 0x278
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
cmp dword [reloc.WS2_32.dll_accept], 1
jg 0x1400070fc
call sub.WS2_32.dll_WSAGetLastError
lea r9, str.Connect_failed__error_d
mov r8d, 0x4f
mov dword [rsp + 0x20], eax
jmp 0x1400070eb
Function at 0x140007240
Capabilities:
Get socket status

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x240
xor r9d, r9d
mov r8d, edx
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], 1
cmp edx, 0xffffffff
je 0x14000728a
mov eax, 0x10624dd3
lea r9, [r11 + 0x18]
mul r8d
shr edx, 6
mov dword [r11 + 0x18], edx
imul edx, edx, 0x3e8
sub r8d, edx
imul r8d, r8d, 0x3e8
mov dword [r11 + 0x1c], r8d
mov qword [rsp + 0x20], r9
xor r9d, r9d
lea rdx, [rsp + 0x30]
lea ecx, [r9 + 1]
xor r8d, r8d
call sub.WS2_32.dll_select
mov ebx, eax
cmp eax, 0xffffffff
je 0x1400072ae
test eax, eax
jne 0x1400072df
cmp dword [reloc.WS2_32.dll_accept], 3
jg 0x1400072df
call sub.WS2_32.dll_WSAGetLastError
mov r8d, WSASetLastError
lea r9, str.socket_error__u
lea ecx, [r8 - 0x68]
lea rdx, str....._base_srcwin32TSocket.c
mov dword [rsp + 0x20], eax
call fcn.1400045a0
mov eax, ebx
add rsp, 0x240
pop rbx
ret

Function at 0x1400072f0
Capabilities:
Get socket status

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x240
xor r9d, r9d
mov r8d, edx
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], 1
cmp edx, 0xffffffff
je 0x14000733a
mov eax, 0x10624dd3
lea r9, [r11 + 0x18]
mul r8d
shr edx, 6
mov dword [r11 + 0x18], edx
imul edx, edx, 0x3e8
sub r8d, edx
imul r8d, r8d, 0x3e8
mov dword [r11 + 0x1c], r8d
xor edx, edx
mov qword [rsp + 0x20], r9
lea r8, [rsp + 0x30]
lea ecx, [rdx + 1]
xor r9d, r9d
call sub.WS2_32.dll_select
mov ebx, eax
cmp eax, 0xffffffff
je 0x14000735c
test eax, eax
jne 0x14000738e
cmp dword [reloc.WS2_32.dll_accept], 3
jg 0x14000738e
call sub.WS2_32.dll_WSAGetLastError
lea r9, str.socket_error__u
lea rdx, str....._base_srcwin32TSocket.c
mov r8d, 0x85
mov ecx, 3
mov dword [rsp + 0x20], eax
call fcn.1400045a0
mov eax, ebx
add rsp, 0x240
pop rbx
ret
Function at 0x140007820
Capabilities:
Receive data
Receive data on socket
Resolve dns
Send data
Send data on socket

Disassembly:
push rbp
push rdi
push r12
sub rsp, 0x470
mov rax, qword [0x1402de400]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov rbp, qword [rsp + 0x4b8]
mov rdi, r9
mov r9d, dword [rsp + 0x4c8]
mov r12, rcx
call fcn.140007040
test eax, eax
je 0x140007a30
mov qword [rsp + 0x468], rbx
test rdi, rdi
mov qword [rsp + 0x460], rsi
lea rbx, [0x14028b986]
mov qword [rsp + 0x458], r13
cmovne rbx, rdi
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
xor esi, esi
repne scasb al, byte [rdi]
not rcx
lea r13, [rcx - 1]
test rbp, rbp
jne 0x14000791c
mov edi, esi
movzx ecx, word [rsp + 0x4c0]
mov byte [rsp + 0x40], 4
mov byte [rsp + 0x41], 1
call sub.WS2_32.dll_htons
lea rcx, [rsp + 0x48]
mov dword [rsp + 0x44], edi
mov word [rsp + 0x42], ax
sub rcx, rbx
nop word [rax + rax]
movzx eax, byte [rbx]
inc rbx
mov byte [rcx + rbx - 1], al
test al, al
jne 0x1400078d0
lea edi, [r13 + 9]
lea rdx, [rsp + 0x40]
xor r9d, r9d
mov r8d, edi
mov rcx, r12
call sub.WS2_32.dll_send
cmp eax, edi
je 0x14000797d
cmp dword [reloc.WS2_32.dll_accept], 3
jg 0x1400079d0
lea r9, str.Fail_to_send_SOCK4_request.
mov r8d, 0x156
jmp 0x1400079bf
mov rcx, rbp
call sub.WS2_32.dll_inet_addr
mov edi, eax
cmp eax, 0xffffffff
jne 0x140007941
mov rcx, rbp
call sub.WS2_32.dll_gethostbyname
test rax, rax
je 0x140007941
mov rax, qword [rax + 0x18]
mov rcx, qword [rax]
mov edi, dword [rcx]
cmp edi, 0xffffffff
jne 0x1400078a2
cmp dword [reloc.WS2_32.dll_accept], 3
jg 0x1400079d0
lea r9, str.The_host__s_cant_be_resolved.
lea rdx, str....._base_srcwin32TSocket.c
mov r8d, 0x14a
mov ecx, 3
mov qword [rsp + 0x20], rbp
call fcn.1400045a0
xor eax, eax
jmp 0x140007a18
mov edx, dword [rsp + 0x4c8]
mov rcx, r12
call fcn.140007240
test eax, eax
jle 0x1400079d0
xor r9d, r9d
lea rdx, [rsp + 0x30]
mov rcx, r12
lea r8d, [r9 + 8]
call sub.WS2_32.dll_recv
cmp eax, 8
je 0x1400079d4
cmp dword [reloc.WS2_32.dll_accept], 3
jg 0x1400079d0
lea r9, str.Fail_to_read_socks4_response.
mov r8d, 0x160
lea rdx, str....._base_srcwin32TSocket.c
mov ecx, 3
call fcn.1400045a0
xor eax, eax
jmp 0x140007a18
cmp dword [reloc.WS2_32.dll_accept], 1
jg 0x140007a0d
movzx ecx, byte [rsp + 0x31]
movzx edx, byte [rsp + 0x30]
lea r9, str.SOCKS4_response_read._ver_d_status_d
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], edx
lea rdx, str....._base_srcwin32TSocket.c
mov r8d, 0x165
mov ecx, 1
call fcn.1400045a0
cmp byte [rsp + 0x31], 0x5a
sete sil
mov eax, esi
mov rsi, qword [rsp + 0x460]
mov rbx, qword [rsp + 0x468]
mov r13, qword [rsp + 0x458]
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.1401e42a0
add rsp, 0x470
pop r12
pop rdi
pop rbp
ret
Function at 0x1400083e0
Capabilities:
Send data
Send data on socket

Disassembly:
push rbx
push rbp
push rsi
sub rsp, 0x50
mov rax, qword [0x1402de400]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov eax, 2
mov rbx, rcx
mov rbp, r8
lea ecx, [rax + 7]
mov rsi, rdx
mov word [rsp + 0x30], ax
call sub.WS2_32.dll_htons
mov word [rsp + 0x32], ax
test rbx, rbx
je 0x140008492
mov qword [rsp + 0x88], rdi
lea rcx, [rbx + 8]
call sub.WS2_32.dll_inet_addr
lea rcx, [rbx + 0x18]
mov edi, eax
call sub.WS2_32.dll_inet_addr
test edi, edi
je 0x140008470
not eax
xor r9d, r9d
mov rdx, rsi
or eax, edi
lea r8d, [r9 + 0x66]
mov rcx, rbp
mov dword [rsp + 0x34], eax
lea rax, [rsp + 0x30]
mov dword [rsp + 0x28], reloc.WS2_32.dll_recv
mov qword [rsp + 0x20], rax
call sub.WS2_32.dll_sendto
mov rbx, qword [rbx]
test rbx, rbx
jne 0x140008424
mov rdi, qword [rsp + 0x88]
mov eax, 1
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1401e42a0
add rsp, 0x50
pop rsi
pop rbp
pop rbx
ret
mov eax, 1
jmp 0x14000847d

Function at 0x1400085a0
Capabilities:
Create udp socket
Set socket configuration

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0xc0
mov rax, qword [0x1402de400]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov edx, 2
mov rbx, rcx
xor r8d, r8d
mov ecx, edx
mov dword [rsp + 0x30], 1
call sub.WS2_32.dll_socket
lea r9, [rsp + 0x30]
mov edx, 0xffff
mov r8d, 0x20
mov rcx, rax
mov dword [rsp + 0x20], 4
mov rdi, rax
call sub.WS2_32.dll_setsockopt
or r11, 0xffffffffffffffff
lea edx, [r11 + 0x11]
mov dword [rsp + 0x40], r11d
mov word [rsp + 0x44], r11w
lea rcx, [rsp + 0x46]
nop word [rax + rax]
mov eax, dword [rbx]
add rcx, 6
sub rdx, 1
mov dword [rcx - 6], eax
movzx eax, word [rbx + 4]
mov word [rcx - 2], ax
jne 0x140008620
lea rcx, [rsp + 0x40]
mov rdx, rdi
call fcn.1400084a0
mov rcx, rdi
call sub.WS2_32.dll_closesocket
xor eax, eax
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1401e42a0
mov rbx, qword [rsp + 0xd0]
add rsp, 0xc0
pop rdi
ret
Function at 0x140008a70
Capabilities:
Resolve dns

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rcx
push rdi
push r12
push r13
sub rsp, 0x50
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
mov r13, r9
mov rsi, rcx
xor ebp, ebp
mov qword [rcx + 8], rbp
mov dword [rcx + 0x10], ebp
mov qword [rcx + 0x18], rcx
lea rax, vtable.TPinger::PING_ITEM.0
mov qword [rcx], rax
mov qword [rcx + 0x20], r9
mov dword [rcx + 0x28], 0xffffffff
mov dword [rcx + 0x2c], ebp
mov qword [rcx + 0x38], 0xffffffffffffffff
mov dword [rcx + 0x40], r8d
mov qword [rcx + 0x48], rbp
mov eax, dword [r9 + 0x40]
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x2c], eax
mov qword [r11 - 0x38], rbp
mov qword [r11 - 0x30], rbp
mov qword [r11 - 0x28], rbp
lea rcx, [r11 - 0x40]
call fcn.140008780
nop
mov rdi, qword [rsp + 0x30]
test rdi, rdi
je 0x140008b2e
mov rbx, qword [rdi]
test rbx, rbx
je 0x140008b2e
test rbx, rbx
je 0x140008b2e
mov rcx, rbx
call sub.WS2_32.dll_inet_addr
mov ebp, eax
cmp eax, 0xffffffff
jne 0x140008b2e
mov rcx, rbx
call sub.WS2_32.dll_gethostbyname
test rax, rax
je 0x140008b2e
mov rax, qword [rax + 0x18]
mov rcx, qword [rax]
mov ebp, dword [rcx]
mov dword [rsi + 0x30], ebp
mov eax, dword [rsp + 0x2c]
mov dword [rsi + 0x34], eax
xor r8d, r8d
lea edx, [r8 + 1]
lea ecx, [rdx + 1]
call sub.WS2_32.dll_socket
mov qword [rsi + 0x38], rax
cmp dword [r13 + 0x44], 0
je 0x140008b61
lea rdx, [rsp + 0x30]
lea rcx, [rsi + 0x48]
call fcn.1400098e0
nop
mov rbx, qword [rsp + 0x40]
test rbx, rbx
je 0x140008b8a
dec dword [rbx + 0x10]
cmp dword [rbx + 0x10], 0
jg 0x140008b8a
mov rcx, qword [rbx]
test rcx, rcx
je 0x140008b81
call fcn.1401e36c8
mov rcx, rbx
call fcn.1401e32b0
nop
mov rbx, qword [rsp + 0x38]
test rbx, rbx
je 0x140008bb3
dec dword [rbx + 0x10]
cmp dword [rbx + 0x10], 0
jg 0x140008bb3
mov rcx, qword [rbx]
test rcx, rcx
je 0x140008baa
call fcn.1401e36c8
mov rcx, rbx
call fcn.1401e32b0
nop
test rdi, rdi
je 0x140008be1
dec dword [rdi + 0x10]
cmp dword [rdi + 0x10], 0
jg 0x140008bdc
mov rcx, qword [rdi]
test rcx, rcx
je 0x140008bce
call fcn.1401e36c8
mov rcx, rdi
call fcn.1401e32b0
nop
mov rax, rsi
jmp 0x140008be4
mov rax, rsi
jmp 0x140008be4
mov rax, rsi
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x140008cc0
Capabilities:
Check for time delay via gettickcount
Connect socket

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x1402de400]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov eax, dword [rcx + 0x30]
mov rbx, rcx
mov dword [rsp + 0x24], eax
mov eax, 2
mov word [rsp + 0x20], ax
movzx eax, word [rcx + 0x34]
rol ax, 8
cmp qword [rcx + 0x38], 0xffffffffffffffff
mov word [rsp + 0x22], ax
je 0x140008d76
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rbx + 0x2c], eax
mov rax, qword [rbx + 0x20]
cmp dword [rax + 0x44], 0
je 0x140008d3c
mov rcx, qword [rbx + 0x48]
test rcx, rcx
je 0x140008d21
mov rcx, qword [rcx]
test rcx, rcx
jne 0x140008d23
xor ecx, ecx
mov rdx, qword [rbx + 0x38]
mov r8, rcx
mov r9d, 0x1bb
mov rcx, rax
call fcn.140009230
mov ecx, eax
jmp 0x140008d57
mov rcx, qword [rbx + 0x38]
lea rdx, [rsp + 0x20]
mov r8d, reloc.WS2_32.dll_recv
call sub.WS2_32.dll_connect
xor ecx, ecx
test eax, eax
sete cl
test ecx, ecx
je 0x140008d76
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [rbx + 0x2c]
mov dword [rbx + 0x28], eax
cmp eax, ecx
jb 0x140008d6f
sub eax, ecx
jmp 0x140008d73
sub eax, ecx
dec eax
mov dword [rbx + 0x28], eax
mov rcx, qword [rbx + 0x20]
xor r8d, r8d
mov rdx, rbx
call fcn.140009470
xor eax, eax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1401e42a0
add rsp, 0x40
pop rbx
ret