joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140193e70
Capabilities:
Initialize winsock library

Disassembly:
mov eax, 0x28
call fcn.14036a3f0
sub rsp, rax
cmp dword [0x14041b850], 0
jne 0x140193f29
mov dword [0x14041b850], 1
mov r8d, 0x198
xor edx, edx
lea rcx, [0x14041b860]
call sub.VCRUNTIME140.dll_memset
lea rdx, [0x14041b860]
mov cx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x140193f29
call fcn.140141f60
lea r8, str.BIO_sock_init
mov edx, 0x99
lea rcx, str.crypto_bio_bio_sock.c
call fcn.140141fb0
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea r8, str.calling_wsastartup__
mov edx, eax
mov ecx, 2
call fcn.140142020
call fcn.140141f60
lea r8, str.BIO_sock_init
mov edx, 0x9b
lea rcx, str.crypto_bio_bio_sock.c
call fcn.140141fb0
xor r8d, r8d
mov edx, 0x7a
mov ecx, 0x20
call fcn.140142020
mov eax, 0xffffffff
jmp 0x140193f2e
mov eax, 1
add rsp, 0x28
ret

Function at 0x140193f40
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
mov eax, reloc.WS2_32.dll_getservbyport
call fcn.14036a3f0
sub rsp, rax
movsxd rax, dword [rsp + 0x40]
mov r8, qword [rsp + 0x50]
mov edx, dword [rsp + 0x48]
mov rcx, rax
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jge 0x140193fb2
call fcn.140141f60
lea r8, str.BIO_socket_ioctl
mov edx, 0xf7
lea rcx, str.crypto_bio_bio_sock.c
call fcn.140141fb0
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea r8, str.calling_ioctlsocket__
mov edx, eax
mov ecx, 2
call fcn.140142020
mov eax, dword [rsp + 0x20]
add rsp, 0x38
ret
Function at 0x140194030
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
mov eax, 0x288
call fcn.14036a3f0
sub rsp, rax
mov rax, qword [0x14041ae40]
xor rax, rsp
mov qword [rsp + 0x270], rax
cmp dword [rsp + 0x290], 0
jl 0x140194070
cmp dword [rsp + 0x290], 0x40
jl 0x14019407a
mov eax, 0xffffffff
jmp 0x1401941a3
cmp qword [rsp + 0x2a0], 0
jne 0x14019408f
mov eax, 1
jmp 0x1401941a3
xor ecx, ecx
call fcn.14018e2b0
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rsp + 0x2a0], rax
jge 0x1401940b1
xor eax, eax
jmp 0x1401941a3
mov dword [rsp + 0x60], 0
mov dword [rsp + 0x30], 0
jmp 0x1401940cd
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x60]
cmp dword [rsp + 0x30], eax
jae 0x1401940ed
mov eax, dword [rsp + 0x30]
mov ecx, dword [rsp + 0x290]
cmp qword [rsp + rax*8 + 0x68], rcx
jne 0x1401940eb
jmp 0x1401940ed
jmp 0x1401940c3
mov eax, dword [rsp + 0x60]
cmp dword [rsp + 0x30], eax
jne 0x140194118
cmp dword [rsp + 0x60], 0x40
jae 0x140194118
mov eax, dword [rsp + 0x30]
mov ecx, dword [rsp + 0x290]
mov qword [rsp + rax*8 + 0x68], rcx
mov eax, dword [rsp + 0x60]
inc eax
mov dword [rsp + 0x60], eax
xor eax, eax
test eax, eax
jne 0x1401940b9
mov dword [rsp + 0x44], 0
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x2a0]
sub rcx, rax
mov rax, rcx
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x298], 0
je 0x140194152
mov qword [rsp + 0x48], 0
jmp 0x14019415c
lea rax, [rsp + 0x60]
mov qword [rsp + 0x48], rax
cmp dword [rsp + 0x298], 0
je 0x140194172
lea rax, [rsp + 0x60]
mov qword [rsp + 0x50], rax
jmp 0x14019417b
mov qword [rsp + 0x50], 0
mov eax, dword [rsp + 0x290]
inc eax
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov r8, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x50]
mov ecx, eax
call qword [sym.imp.WS2_32.dll_select]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.14036a060
add rsp, 0x288
ret
Function at 0x140196320
Capabilities:
Resolve dns

Disassembly:
mov word [rsp + 0x20], r9w
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
mov eax, 0x48
call fcn.14036a3f0
sub rsp, rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], 0
mov rax, qword [rsp + 0x30]
mov qword [rax], 0
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 0x70]
mov byte [rcx + rax], 0
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_gethostbyname]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x140196448
mov rax, qword [rsp + 0x28]
movsx eax, word [rax + 0x10]
cmp eax, 2
jne 0x140196427
mov rax, qword [rsp + 0x28]
movsx rax, word [rax + 0x12]
cmp rax, 4
jne 0x140196427
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x38], rax
jmp 0x1401963ce
mov rax, qword [rsp + 0x38]
add rax, 8
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x140196427
mov rax, qword [rsp + 0x38]
mov rax, qword [rax]
mov r9d, dword [rax]
movzx r8d, word [rsp + 0x68]
mov edx, dword [rsp + 0x60]
mov ecx, dword [rsp + 0x58]
call fcn.140196190
mov rcx, qword [rsp + 0x30]
mov qword [rcx], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
jne 0x140196414
mov eax, 8
jmp 0x14019649d
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
add rax, 0x28
mov qword [rsp + 0x30], rax
jmp 0x1401963c0
mov r9d, 0x400
mov rax, qword [rsp + 0x28]
mov r8, qword [rax]
mov edx, 0x401
mov rcx, qword [rsp + 0x70]
call sub.api_ms_win_crt_string_l1_1_0.dll_strncpy_s
xor eax, eax
jmp 0x14019649d
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0x2af9
je 0x14019647c
cmp dword [rsp + 0x20], 0x2afa
je 0x140196483
cmp dword [rsp + 0x20], 0x2afb
je 0x14019648a
cmp dword [rsp + 0x20], 0x2afc
je 0x140196491
jmp 0x140196498
mov eax, 0x2af9
jmp 0x14019649d
mov eax, 0x2afa
jmp 0x14019649d
mov eax, 0x2afb
jmp 0x14019649d
mov eax, 0x2af9
jmp 0x14019649d
mov eax, 0x2af9
add rsp, 0x48
ret
Function at 0x1401f4ad0
Capabilities:
Send data
Send data on socket

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
mov eax, reloc.WS2_32.dll_getservbyport
call fcn.14036a3f0
sub rsp, rax
mov dword [rsp + 0x20], 0
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov rax, qword [rsp + 0x40]
movsxd rax, dword [rax + 0x38]
xor r9d, r9d
mov r8d, dword [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
mov rcx, rax
call qword [sym.imp.WS2_32.dll_send]
mov dword [rsp + 0x20], eax
mov edx, reloc.WS2_32.dll_ntohs
mov rcx, qword [rsp + 0x40]
call fcn.140162b10
cmp dword [rsp + 0x20], 0
jg 0x1401f4b51
mov ecx, dword [rsp + 0x20]
call fcn.1401f50e0
test eax, eax
je 0x1401f4b51
mov edx, 0xa
mov rcx, qword [rsp + 0x40]
call fcn.140163e90
mov eax, dword [rsp + 0x20]
add rsp, 0x38
ret
Function at 0x1401f5160
Capabilities:
Connect socket
Set socket configuration

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
mov eax, 0x48
call fcn.14036a3f0
sub rsp, rax
mov dword [rsp + 0x34], 1
cmp dword [rsp + 0x50], 0xffffffff
jne 0x1401f51c0
call fcn.140141f60
lea r8, str.BIO_connect
mov edx, 0x56
lea rcx, str.crypto_bio_bio_sock2.c
call fcn.140141fb0
xor r8d, r8d
mov edx, 0x87
mov ecx, 0x20
call fcn.140142020
xor eax, eax
jmp 0x1401f53f4
mov eax, dword [rsp + 0x60]
and eax, 8
test eax, eax
je 0x1401f51d5
mov dword [rsp + 0x30], 1
jmp 0x1401f51dd
mov dword [rsp + 0x30], 0
mov edx, dword [rsp + 0x30]
mov ecx, dword [rsp + 0x50]
call fcn.140193fc0
test eax, eax
jne 0x1401f51f5
xor eax, eax
jmp 0x1401f53f4
mov eax, dword [rsp + 0x60]
and eax, 4
test eax, eax
je 0x1401f529a
movsxd rax, dword [rsp + 0x50]
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x34]
mov r8d, 8
mov edx, 0xffff
mov rcx, rax
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x1401f529a
call fcn.140141f60
lea r8, str.BIO_connect
mov edx, 0x60
lea rcx, str.crypto_bio_bio_sock2.c
call fcn.140141fb0
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea r8, str.calling_setsockopt__
mov edx, eax
mov ecx, 2
call fcn.140142020
call fcn.140141f60
lea r8, str.BIO_connect
mov edx, 0x62
lea rcx, str.crypto_bio_bio_sock2.c
call fcn.140141fb0
xor r8d, r8d
mov edx, 0x89
mov ecx, 0x20
call fcn.140142020
xor eax, eax
jmp 0x1401f53f4
mov eax, dword [rsp + 0x60]
and eax, 0x10
test eax, eax
je 0x1401f533f
movsxd rax, dword [rsp + 0x50]
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x34]
mov r8d, 1
mov edx, 6
mov rcx, rax
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x1401f533f
call fcn.140141f60
lea r8, str.BIO_connect
mov edx, 0x6a
lea rcx, str.crypto_bio_bio_sock2.c
call fcn.140141fb0
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea r8, str.calling_setsockopt__
mov edx, eax
mov ecx, 2
call fcn.140142020
call fcn.140141f60
lea r8, str.BIO_connect
mov edx, WSAGetLastError
lea rcx, str.crypto_bio_bio_sock2.c
call fcn.140141fb0
xor r8d, r8d
mov edx, 0x8a
mov ecx, 0x20
call fcn.140142020
xor eax, eax
jmp 0x1401f53f4
mov eax, dword [rsp + 0x60]
and eax, 0x20
mov rcx, qword [rsp + 0x58]
call fcn.140194650
mov dword [rsp + 0x38], eax
mov rcx, qword [rsp + 0x58]
call fcn.1401315b0
movsxd rcx, dword [rsp + 0x50]
mov edx, dword [rsp + 0x38]
mov r8d, edx
mov rdx, rax
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x1401f53ef
mov ecx, 0xffffffff
call fcn.1401f50e0
test eax, eax
jne 0x1401f53eb
call fcn.140141f60
lea r8, str.BIO_connect
mov edx, 0xb2
lea rcx, str.crypto_bio_bio_sock2.c
call fcn.140141fb0
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea r8, str.calling_connect__
mov edx, eax
mov ecx, 2
call fcn.140142020
call fcn.140141f60
lea r8, str.BIO_connect
mov edx, 0xb4
lea rcx, str.crypto_bio_bio_sock2.c
call fcn.140141fb0
xor r8d, r8d
mov edx, 0x67
mov ecx, 0x20
call fcn.140142020
xor eax, eax
jmp 0x1401f53f4
mov eax, 1
add rsp, 0x48
ret
Function at 0x1401f7650
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov byte [rsp + 0x20], r9b
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
mov eax, 0x18
call fcn.14036a3f0
sub rsp, rax
movzx eax, byte [rsp + 0x38]
and eax, 1
mov dword [rsp], eax
cmp qword [rsp + 0x30], 0
je 0x1401f76ae
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 8], rax
mov rax, qword [rsp + 0x30]
dec rax
mov qword [rsp + 0x30], rax
cmp qword [rsp + 8], 0
je 0x1401f7716
mov rax, qword [rsp + 0x28]
dec rax
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x38]
xor eax, ecx
mov ecx, dword [rsp]
add ecx, eax
mov eax, ecx
mov dword [rsp], eax
mov rax, qword [rsp + 0x20]
dec rax
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
movzx ecx, byte [rsp]
mov byte [rax], cl
mov eax, dword [rsp]
shr eax, 8
mov dword [rsp], eax
jmp 0x1401f76ae
add rsp, 0x18
ret
Function at 0x1402219d0
Capabilities:
Check for software breakpoints

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
mov eax, 0x48
call fcn.14036a3f0
sub rsp, rax
mov dword [rsp + 0x28], 0
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x68]
cmp dword [rsp + 0x70], eax
jne 0x140221a26
mov rax, qword [rsp + 0x30]
movzx eax, byte [rax]
cmp eax, 0x6a
je 0x140221a5f
mov rax, qword [rsp + 0x30]
movzx eax, byte [rax]
cmp eax, 0x6b
je 0x140221a5f
call fcn.140141f60
lea r8, str.RSA_padding_check_X931
mov edx, 0x43
lea rcx, str.crypto_rsa_rsa_x931.c
call fcn.140141fb0
xor r8d, r8d
mov edx, 0x89
mov ecx, 4
call fcn.140142020
mov eax, 0xffffffff
jmp 0x140221bdc
mov rax, qword [rsp + 0x30]
movzx eax, byte [rax]
mov dword [rsp + 0x2c], eax
mov rax, qword [rsp + 0x30]
inc rax
mov qword [rsp + 0x30], rax
cmp dword [rsp + 0x2c], 0x6b
jne 0x140221b6c
mov eax, dword [rsp + 0x68]
sub eax, 3
mov dword [rsp + 0x24], eax
mov dword [rsp + 0x28], 0
jmp 0x140221aa2
mov eax, dword [rsp + 0x28]
inc eax
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x24]
cmp dword [rsp + 0x28], eax
jge 0x140221b1d
mov rax, qword [rsp + 0x30]
movzx eax, byte [rax]
mov byte [rsp + 0x20], al
mov rax, qword [rsp + 0x30]
inc rax
mov qword [rsp + 0x30], rax
movzx eax, byte [rsp + 0x20]
cmp eax, 0xba
jne 0x140221ad3
jmp 0x140221b1d
movzx eax, byte [rsp + 0x20]
cmp eax, 0xbb
je 0x140221b18
call fcn.140141f60
lea r8, str.RSA_padding_check_X931
mov edx, 0x4e
lea rcx, str.crypto_rsa_rsa_x931.c
call fcn.140141fb0
xor r8d, r8d
mov edx, 0x8a
mov ecx, 4
call fcn.140142020
mov eax, 0xffffffff
jmp 0x140221bdc
jmp 0x140221a98
mov eax, dword [rsp + 0x28]
mov ecx, dword [rsp + 0x24]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x28], 0
jne 0x140221b6a
call fcn.140141f60
lea r8, str.RSA_padding_check_X931
mov edx, 0x56
lea rcx, str.crypto_rsa_rsa_x931.c
call fcn.140141fb0
xor r8d, r8d
mov edx, 0x8a
mov ecx, 4
call fcn.140142020
mov eax, 0xffffffff
jmp 0x140221bdc
jmp 0x140221b77
mov eax, dword [rsp + 0x68]
sub eax, 2
mov dword [rsp + 0x24], eax
movsxd rax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x30]
movzx eax, byte [rcx + rax]
cmp eax, 0xcc
je 0x140221bc2
call fcn.140141f60
lea r8, str.RSA_padding_check_X931
mov edx, 0x5f
lea rcx, str.crypto_rsa_rsa_x931.c
call fcn.140141fb0
xor r8d, r8d
mov edx, 0x8b
mov ecx, 4
call fcn.140142020
mov eax, 0xffffffff
jmp 0x140221bdc
mov eax, dword [rsp + 0x24]
mov r8d, eax
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x50]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [rsp + 0x24]
add rsp, 0x48
ret
Function at 0x1402cc740
Capabilities:
Hash data using sha512

Disassembly:
mov qword [rsp + 8], rcx
mov eax, reloc.WS2_32.dll_getservbyport
call fcn.14036a3f0
sub rsp, rax
mov r8d, 0xf0
xor edx, edx
mov rcx, qword [rsp + 0x40]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x20], 0
jmp 0x1402cc778
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 8
jge 0x1402cc79f
movsxd rax, dword [rsp + 0x20]
lea rcx, [0x1403f4e90]
movsxd rdx, dword [rsp + 0x20]
mov r8, qword [rsp + 0x40]
mov rax, qword [rcx + rax*8]
mov qword [r8 + rdx*8], rax
jmp 0x1402cc76e
add rsp, 0x38
ret

Function at 0x1402d65b0
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rcx
mov eax, reloc.WS2_32.dll_getservbyport
call fcn.14036a3f0
sub rsp, rax
mov r8d, 0x80
xor edx, edx
mov rcx, qword [rsp + 0x40]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x20], 0
jmp 0x1402d65e8
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 8
jge 0x1402d660e
movsxd rax, dword [rsp + 0x20]
lea rcx, [0x1403f50c0]
movsxd rdx, dword [rsp + 0x20]
mov r8, qword [rsp + 0x40]
mov eax, dword [rcx + rax*4]
mov dword [r8 + rdx*4], eax
jmp 0x1402d65de
add rsp, 0x38
ret
Function at 0x1403633a0
Capabilities:
Send data
Send data on socket

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
mov eax, reloc.WS2_32.dll_getservbyport
call fcn.14036a3f0
sub rsp, rax
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x40]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 5
je 0x1403633f7
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x40]
call fcn.140364810
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jg 0x1403633f7
mov eax, dword [rsp + 0x20]
jmp 0x1403634b4
mov rax, qword [rsp + 0x28]
cmp qword [rax + 0x40], 0
je 0x140363453
mov edx, reloc.WS2_32.dll_ntohs
mov rcx, qword [rsp + 0x40]
call fcn.140162b10
mov r8d, dword [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0x40]
call fcn.140163fb0
mov dword [rsp + 0x20], eax
mov edx, reloc.WS2_32.dll_ntohs
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0x40]
call fcn.140163ed0
mov edx, eax
mov rcx, qword [rsp + 0x40]
call fcn.140163e90
mov eax, dword [rsp + 0x20]
jmp 0x1403634b4
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov rax, qword [rsp + 0x40]
movsxd rax, dword [rax + 0x38]
xor r9d, r9d
mov r8d, dword [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
mov rcx, rax
call qword [sym.imp.WS2_32.dll_send]
mov dword [rsp + 0x20], eax
mov edx, reloc.WS2_32.dll_ntohs
mov rcx, qword [rsp + 0x40]
call fcn.140162b10
cmp dword [rsp + 0x20], 0
jg 0x1403634b0
mov ecx, dword [rsp + 0x20]
call fcn.1401f50e0
test eax, eax
je 0x1403634b0
mov edx, 0xa
mov rcx, qword [rsp + 0x40]
call fcn.140163e90
mov eax, dword [rsp + 0x20]
add rsp, 0x38
ret

Function at 0x140368700
Capabilities:
Send data
Send data on socket

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
mov eax, 0x48
call fcn.14036a3f0
sub rsp, rax
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 0x40]
mov qword [rsp + 0x38], rax
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov rax, qword [rsp + 0x38]
cmp dword [rax + 0x38], 0
je 0x140368762
mov rax, qword [rsp + 0x50]
movsxd rax, dword [rax + 0x38]
xor r9d, r9d
mov r8d, dword [rsp + 0x60]
mov rdx, qword [rsp + 0x58]
mov rcx, rax
call qword [sym.imp.WS2_32.dll_send]
mov dword [rsp + 0x30], eax
jmp 0x1403687ad
mov rax, qword [rsp + 0x38]
mov rcx, rax
call fcn.140194650
mov dword [rsp + 0x34], eax
mov rax, qword [rsp + 0x38]
mov rcx, rax
call fcn.1401315b0
mov rcx, qword [rsp + 0x50]
movsxd rcx, dword [rcx + 0x38]
mov edx, dword [rsp + 0x34]
mov dword [rsp + 0x28], edx
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, dword [rsp + 0x60]
mov rdx, qword [rsp + 0x58]
call qword [sym.imp.WS2_32.dll_sendto]
mov dword [rsp + 0x30], eax
mov edx, reloc.WS2_32.dll_ntohs
mov rcx, qword [rsp + 0x50]
call fcn.140162b10
cmp dword [rsp + 0x30], 0
jg 0x1403687ed
mov ecx, dword [rsp + 0x30]
call fcn.140369ab0
test eax, eax
je 0x1403687ed
mov edx, 0xa
mov rcx, qword [rsp + 0x50]
call fcn.140163e90
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov rcx, qword [rsp + 0x38]
mov dword [rcx + 0x3c], eax
mov eax, dword [rsp + 0x30]
add rsp, 0x48
ret
Function at 0x140369b60
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 8], rcx
mov eax, 0x58
call fcn.14036a3f0
sub rsp, rax
mov rax, qword [rsp + 0x60]
mov rax, qword [rax + 0x40]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 0x48]
call fcn.1401ed1a0
test eax, eax
jne 0x140369d0d
mov dword [rsp + 0x34], 4
mov rax, qword [rsp + 0x60]
movsxd rax, dword [rax + 0x38]
lea rcx, [rsp + 0x34]
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x30]
mov r8d, 0x1006
mov edx, 0xffff
mov rcx, rax
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jge 0x140369c06
call fcn.140141f60
lea r8, str.dgram_adjust_rcv_timeout
mov edx, 0x13a
lea rcx, str.crypto_bio_bss_dgram.c
call fcn.140141fb0
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea r8, str.calling_getsockopt__
mov edx, eax
mov ecx, 2
call fcn.140142020
jmp 0x140369c23
movsxd rax, dword [rsp + 0x30]
imul rax, rax, 0xf4240
mov rcx, rax
call fcn.1401b3920
mov rcx, qword [rsp + 0x38]
mov qword [rcx + 0x50], rax
call fcn.140309ea0
mov rdx, rax
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 0x48]
call fcn.1401ed1f0
mov qword [rsp + 0x40], rax
mov ecx, 0x3e8
call fcn.1401b3920
mov rdx, rax
mov rcx, qword [rsp + 0x40]
call fcn.1401ed0f0
test eax, eax
jge 0x140369c68
mov ecx, 0x3e8
call fcn.1401b3920
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 0x50]
call fcn.1401ed1a0
test eax, eax
jne 0x140369c91
mov rdx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 0x50]
call fcn.1401ed0f0
test eax, eax
jl 0x140369d0d
mov rcx, qword [rsp + 0x40]
call fcn.1401315b0
xor edx, edx
mov ecx, 0xf4240
div rcx
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x60]
movsxd rax, dword [rax + 0x38]
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x30]
mov r8d, 0x1006
mov edx, 0xffff
mov rcx, rax
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jge 0x140369d0d
call fcn.140141f60
lea r8, str.dgram_adjust_rcv_timeout
mov edx, 0x158
lea rcx, str.crypto_bio_bss_dgram.c
call fcn.140141fb0
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea r8, str.calling_setsockopt__
mov edx, eax
mov ecx, 2
call fcn.140142020
add rsp, 0x58
ret

Function at 0x140369df0
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 8], rcx
mov eax, 0x48
call fcn.14036a3f0
sub rsp, rax
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 0x40]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 0x48]
call fcn.1401ed1a0
test eax, eax
jne 0x140369ea6
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 0x50]
call fcn.1401315b0
xor edx, edx
mov ecx, 0xf4240
div rcx
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x50]
movsxd rax, dword [rax + 0x38]
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x30]
mov r8d, 0x1006
mov edx, 0xffff
mov rcx, rax
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jge 0x140369ea6
call fcn.140141f60
lea r8, str.dgram_reset_rcv_timeout
mov edx, 0x187
lea rcx, str.crypto_bio_bss_dgram.c
call fcn.140141fb0
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea r8, str.calling_setsockopt__
mov edx, eax
mov ecx, 2
call fcn.140142020
add rsp, 0x48
ret
Function at 0x140369eb0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 8], rcx
mov eax, reloc.WS2_32.dll_getservbyport
call fcn.14036a3f0
sub rsp, rax
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x40]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x1c
mov rax, qword [rsp + 0x28]
add rax, 0x1c
mov rcx, qword [rsp + 0x40]
movsxd rcx, dword [rcx + 0x38]
lea r8, [rsp + 0x20]
mov rdx, rax
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jge 0x140369f0d
mov rax, qword [rsp + 0x28]
add rax, 0x1c
mov rcx, rax
call fcn.140194360
add rsp, 0x38
ret

Function at 0x14036abf8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14036ac42
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14036ac42
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14036ac42
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14036ac42
cmp dword [rcx + 0x84], 0xe
jbe 0x14036ac42
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14036ac44
xor al, al
add rsp, 0x28
ret
Function at 0x140078810
Capabilities:
Encode data using xor

Disassembly:
call 0x1ad93c6ab
push 0x1657b1d3
invalid

Function at 0x14095b058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.14095b1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x14095b089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14095b06f
add dl, dl
jne 0x14095b096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14095b0f6
xor eax, eax
add dl, dl
jne 0x14095b0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14095b1ad
add dl, dl
jne 0x14095b0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14095b0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14095b0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14095b0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x14095b0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14095b07e
mov eax, 1
add dl, dl
jne 0x14095b106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14095b113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14095b0fb
sub eax, ebx
mov ebx, 1
jne 0x14095b14c
mov ecx, 1
add dl, dl
jne 0x14095b12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14095b13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14095b123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14095b07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x14095b168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14095b175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14095b15d
cmp eax, 0x7d00
jae 0x14095b19b
cmp eax, 0x500
jb 0x14095b196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14095b07e
cmp eax, 0x7f
ja 0x14095b19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14095b07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x14095b1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14095b07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20