joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140146fa0
Capabilities:
Get file size

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0xf0
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
cmp qword [rcx + 0x38], 0
je 0x140146fe1
mov rdx, r8
call fcn.1401468f0
cmp dword [rsi], 0
jne 0x140147165
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], rsi
lea rax, vtable.std::_Func_impl_no_alloc_class__lambda_eebc3b3392b4020876e6114a6359e3ec___void___.0
mov qword [rsp + 0x58], rax
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rsp + 0x60], xmm0
lea rax, [rsp + 0x58]
mov qword [rsp + 0x90], rax
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0xa0]
call fcn.140123d80
nop
xor ebp, ebp
mov rcx, qword [rsp + 0x90]
test rcx, rcx
je 0x140147049
mov rax, qword [rcx]
lea rdx, [rsp + 0x58]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
mov qword [rsp + 0x90], rbp
mov rcx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x140147056
mov rcx, qword [rbx]
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0xc0000000
lea r8d, [r9 + 5]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rdi], rax
cmp rax, 0xffffffffffffffff
je 0x140147158
lea rdx, [rsp + 0x100]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x140147158
mov rax, qword [rsp + 0x100]
mov qword [rdi + 0x30], rax
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], ebp
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 4]
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov qword [rdi + 8], rax
test rax, rax
je 0x140147158
mov qword [rsp + 0x20], rbp
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf001f
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rdi + 0x38], rax
test rax, rax
je 0x140147158
lea rcx, [rdi + 0x10]
cmp rcx, rbx
je 0x140147118
mov r8, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140147110
mov rbx, qword [rbx]
mov rdx, rbx
call fcn.140016660
mov dword [rsp + 0x40], ebp
lea rbx, [0x1402c6b40]
mov r8, rbx
lea rdx, [0x140061770]
lea rcx, [0x1402c6b38]
call fcn.14014a3d8
test eax, eax
je 0x14014717e
mov qword [rsp + 0x48], rbx
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rsi], xmm0
lea rcx, [rsp + 0xa0]
call fcn.140123e70
nop
lea rcx, [rsp + 0xa0]
call fcn.140123e10
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.14018bf90
nop
int3
Function at 0x1401471a0
Capabilities:
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x60
mov rbx, rdx
lea rsi, [0x1402c6b40]
mov rdi, rcx
lea rdx, [0x140061770]
mov r8, rsi
lea rcx, [0x1402c6b38]
call fcn.14014a3d8
test eax, eax
je 0x1401472be
cmp qword [rbx + 0x18], 0x10
mov rdx, rbx
jb 0x1401471e7
mov rdx, qword [rbx]
add rdi, 0x10
mov rcx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x1401471f8
mov rcx, qword [rdi]
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
je 0x14014724a
cmp rdi, rbx
je 0x140147226
cmp qword [rbx + 0x18], 0x10
mov r8, qword [rbx + 0x10]
jb 0x14014721b
mov rbx, qword [rbx]
mov rdx, rbx
mov rcx, rdi
call fcn.140016660
mov r8, rsi
mov dword [rsp + 0x20], 0
lea rdx, [0x140061770]
lea rcx, [0x1402c6b38]
call fcn.14014a3d8
test eax, eax
je 0x1401472be
jmp 0x14014726e
mov r8, rsi
lea rdx, [0x140061770]
lea rcx, [0x1402c6b38]
call fcn.14014a3d8
test eax, eax
je 0x1401472be
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
mov qword [rsp + 0x28], rsi
movaps xmm0, xmmword [rsp + 0x20]
movd eax, xmm0
test eax, eax
jne 0x140147290
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
lea r8, str.MemoryMappedFile::rename
movdqa xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.1400753c0
lea rdx, [0x1402aaeb0]
lea rcx, [rsp + 0x30]
call fcn.140187364
int3
call fcn.14018bf90
int3

Function at 0x1401472d0
Capabilities:
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rdx + 0x18], 0x10
mov rsi, r8
mov rbx, rdx
jb 0x1401472ef
mov rdx, qword [rdx]
cmp qword [rcx + 0x28], 0x10
lea rdi, [rcx + 0x10]
mov rcx, rdi
jb 0x140147300
mov rcx, qword [rdi]
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
je 0x140147359
cmp rdi, rbx
je 0x14014732e
cmp qword [rbx + 0x18], 0x10
mov r8, qword [rbx + 0x10]
jb 0x140147323
mov rbx, qword [rbx]
mov rdx, rbx
mov rcx, rdi
call fcn.140016660
lea rbx, [0x1402c6b40]
mov dword [rsp + 0x20], 0
mov r8, rbx
lea rdx, [0x140061770]
lea rcx, [0x1402c6b38]
call fcn.14014a3d8
test eax, eax
je 0x1401473a1
jmp 0x140147384
lea rbx, [0x1402c6b40]
mov r8, rbx
lea rdx, [0x140061770]
lea rcx, [0x1402c6b38]
call fcn.14014a3d8
test eax, eax
je 0x1401473a1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
mov qword [rsp + 0x28], rbx
movups xmm0, xmmword [rsp + 0x20]
mov rbx, qword [rsp + 0x40]
movups xmmword [rsi], xmm0
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
call fcn.14018bf90
int3
Function at 0x1401488b0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister
Resolve dns

Disassembly:
push rbp
lea rbp, [rsp - 0x1340]
mov eax, 0x1440
call fcn.14016a1b0
sub rsp, rax
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x1458], rbx
mov qword [rsp + 0x1460], rsi
mov qword [rsp + 0x1468], rdi
mov rdi, r8
mov rsi, rdx
mov rcx, qword [rcx]
call fcn.140146050
test al, al
jne 0x140148a96
movdqa xmm0, xmmword [0x140208bf0]
movdqu xmmword [rsp + 0x40], xmm0
xor ebx, ebx
mov qword [rsp + 0x50], rbx
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], rbx
cmp qword [rdi + 0x18], 0x10
jb 0x14014892b
mov rdi, qword [rdi]
lea r9, [rbp + 0x1350]
lea r8, [rsp + 0x40]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
jne 0x140148a56
mov rax, qword [rbp + 0x1350]
test rax, rax
je 0x14014896c
nop word [rax + rax]
inc rbx
mov rax, qword [rax + 0x28]
test rax, rax
jne 0x140148960
call fcn.14014a96c
mov r9d, 0xffffffff
mov dword [rbp + 0x1334], r9d
mov dword [rbp - 0x4c], eax
mov r8d, 1
mov edx, r8d
nop word [rax + rax]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, r8d
mov dword [rbp + rdx*4 - 0x4c], eax
inc r8d
inc rdx
cmp rdx, 0x270
jl 0x140148990
mov dword [rbp - 0x50], 0x270
lea rax, [rbp - 0x50]
mov qword [rsp + 0x20], rax
mov ecx, 0x40
mov rax, 0xffffffffffffffff
nop
dec rcx
shr rax, 1
cmp rax, r9
ja 0x1401489d0
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x20]
test rbx, rbx
jne 0x1401489f6
call fcn.14007b3f0
jmp 0x1401489fe
mov rdx, rbx
call fcn.140078650
mov rbx, qword [rbp + 0x1350]
test rax, rax
je 0x140148a1a
nop word [rax + rax]
mov rbx, qword [rbx + 0x28]
sub rax, 1
jne 0x140148a10
mov rax, qword [rbx + 0x20]
mov ecx, dword [rax + 4]
call qword [sym.imp.WS2_32.dll_ntohl]
mov edx, eax
mov rcx, rsi
call fcn.140149280
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
mov rax, rsi
lea r11, [rsp + 0x1440]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
mov edx, eax
lea rcx, [rsp + 0x70]
call fcn.1401492a0
nop
mov r8, rax
lea rdx, str.Ipv4Resolver::resolve__getaddrinfo_failed_
lea rcx, [rbp - 0x70]
call fcn.140067db0
nop
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.140075360
lea rdx, [0x1402aad00]
lea rcx, [rsp + 0x20]
call fcn.140187364
nop
xor eax, eax
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x20]
call fcn.140147480
lea rdx, [0x1402abe68]
lea rcx, [rsp + 0x20]
call fcn.140187364
int3
Function at 0x14016d4e8
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x14016d4fb
add rsp, 0x48
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, ax
lea rcx, [rsp + 0x20]
or edx, 0x80070000
test eax, eax
cmovle edx, eax
call fcn.14016db08
lea rdx, [0x1402ac1c0]
lea rcx, [rsp + 0x20]
call fcn.140187364
int3

Function at 0x140177d44
Capabilities:
Set thread local storage value

Disassembly:
mov ecx, dword [0x1402c8f28]
xor edx, edx
jmp fcn.14016d4e8

Function at 0x1401786cc
Capabilities:
Set thread local storage value

Disassembly:
mov rdx, rcx
mov ecx, dword [0x1402c8f28]
jmp fcn.14016d4e8

Function at 0x140183e28
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rcx + 0x98], rdx
mov r8, rcx
mov r9, qword [rdx + 0x1a8]
add rcx, 0x40
lea rdx, [0x140183ee4]
mov r9, qword [r9 + 8]
jmp fcn.1401756fc

Function at 0x140183ebc
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rcx + 0x98], rdx
mov r8, rcx
mov r9, qword [rdx + 0x1a8]
add rcx, 0x40
lea rdx, [0x140183ef4]
mov r9, qword [r9 + 8]
jmp fcn.1401756fc

Function at 0x140192844
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x1401926d7
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1401926d7
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1401926d7
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1401926d7
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1401926d7
cmp dword [rcx + 0x84], 0xe
jbe 0x1401926d7
cmp dword [rcx + 0xf8], 0
je 0x1401926d7
mov ecx, ebx
call fcn.140192778
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.140192574
cmp dword [rbp + 0x20], 0
je 0x140192724
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14019272c
int3
xor r8d, r8d
xor edx, edx
jmp 0x140192670
Function at 0x1401b7e90
Capabilities:
Get local ipv4 addresses
Get socket information
Resolve dns
Send data
Send data on socket
Send http request
Send http request with host header

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x8c0
mov r15, r8
mov dword [r9], 0
mov r8d, dword [rsp + 0x910]
mov r14, r9
movzx edi, dx
mov rsi, rcx
call fcn.1401b8a40
movsxd rbp, eax
test eax, eax
jns 0x1401b7ed4
xor eax, eax
jmp 0x1401b800b
mov qword [rsp + 0x8e0], rbx
mov rbx, qword [rsp + 0x900]
test rbx, rbx
je 0x1401b7f78
mov rcx, rbp
mov dword [rsp + 0x8f8], 0x80
lea r8, [rsp + 0x8f8]
lea rdx, [rsp + 0x40]
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jns 0x1401b7f20
lea rcx, str.getsockname
call fcn.1401b9c48
jmp 0x1401b7f78
mov r9d, dword [rsp + 0x908]
lea rcx, [rsp + 0x40]
mov edx, dword [rsp + 0x8f8]
mov r8, rbx
mov dword [rsp + 0x30], 0xa
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.WS2_32.dll_getnameinfo]
mov ebx, eax
test eax, eax
je 0x1401b7f78
mov ecx, 2
call fcn.14018abf8
mov rcx, rax
lea rdx, str.getnameinfo___failed_:__d_n
mov r8d, ebx
call fcn.1400335e0
movzx eax, di
lea r8, str.GET__s_HTTP__s_r_nHost:__s:_d_r_nConnection:_Close_r_nUser_Agent:_Windows__UPnP_1.0__MiniUPnPc_1.9_r_n_r_n
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0xc0]
lea rax, [0x140220c4c]
mov qword [rsp + 0x28], rsi
mov r9, r15
mov qword [rsp + 0x20], rax
mov edx, 0x800
call fcn.1401b48e0
xor ebx, ebx
mov edi, eax
test eax, eax
jle 0x1401b7fea
nop dword [rax]
nop dword [rax + rax]
movsxd rcx, ebx
lea rdx, [rsp + 0xc0]
mov r8d, edi
add rdx, rcx
mov rcx, rbp
sub r8d, ebx
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
js 0x1401b8024
add ebx, eax
cmp ebx, edi
jl 0x1401b7fc0
mov rdx, r14
mov ecx, ebp
call sym.hekatonwallet.exe_getHTTPResponse
mov rcx, rbp
mov rbx, rax
call qword [sym.imp.WS2_32.dll_closesocket]
mov rax, rbx
mov rbx, qword [rsp + 0x8e0]
lea r11, [rsp + 0x8c0]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
lea rcx, str.send
call fcn.1401b9c48
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
jmp 0x1401b8003
Function at 0x1401b83d0
Capabilities:
Send data
Send data on socket
Send http request
Send http request with host header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x260
mov rsi, qword [rsp + 0x2a8]
mov rbx, r8
mov rbp, rdx
movsxd r15, ecx
mov rdi, 0xffffffffffffffff
inc rdi
cmp byte [rsi + rdi], 0
jne 0x1401b8403
mov byte [rsp + 0x50], 0
cmp r9w, 0x50
je 0x1401b8432
movzx r9d, r9w
lea r8, str.:_hu
mov edx, 8
lea rcx, [rsp + 0x50]
call fcn.1401b48e0
mov rax, qword [rsp + 0x2a0]
lea r8, str.POST__s_HTTP__s_r_nHost:__s_s_r_nUser_Agent:_Windows__UPnP_1.0__MiniUPnPc_1.9_r_nContent_Length:__d_r_nContent_Type:_text_xml_r_nSOAPAction:___s__r_nConnection:_Close_r_nCache_Control:_no_cache_r_nPragma:_no_cache_r_n_r_n
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x38], edi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
mov r9, rbp
mov rax, qword [rsp + 0x2b0]
mov edx, 0x200
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
call fcn.1401b48e0
movsxd rbx, eax
lea r14d, [rbx + rdi]
movsxd rcx, r14d
call fcn.140192a24
mov rbp, rax
test rax, rax
je 0x1401b84ec
mov r8, rbx
lea rdx, [rsp + 0x60]
mov rcx, rbp
call fcn.140187b30
movsxd r8, edi
lea rcx, [rbx + rbp]
mov rdx, rsi
call fcn.140187b30
mov rcx, r15
xor r9d, r9d
mov r8d, r14d
mov rdx, rbp
call qword [sym.imp.WS2_32.dll_send]
mov ebx, eax
test eax, eax
jns 0x1401b84e2
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r8d, eax
lea rdx, str.send
lea rcx, str.Socket_error:__s___d_n
call fcn.140033630
mov rcx, rbp
call fcn.14018aac4
mov eax, ebx
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x1401b8a40
Capabilities:
Connect socket
Resolve dns

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0xa0
xor edi, edi
movzx r9d, dx
xorps xmm0, xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x2c], xmm0
mov dword [rax - 0x6c], edi
mov r14d, r8d
movdqu xmmword [rax - 0x7c], xmm1
mov rsi, rcx
mov qword [rsp + 0x20], 8
mov ebx, 1
lea edx, [rdi + 8]
lea r8, [0x140221598]
mov dword [rsp + 0x28], ebx
lea rcx, [rax + 0x20]
call fcn.1401b48e0
cmp byte [rsi], 0x5b
jne 0x1401b8b04
movzx edx, byte [rsi + 1]
lea rcx, [rsi + 1]
test dl, dl
je 0x1401b8afa
mov eax, dword [0x140220dd0]
mov r8d, edi
movzx r9d, byte [0x140220dd2]
nop dword [rax]
cmp dl, 0x5d
je 0x1401b8afa
cmp r8, 0x40
jge 0x1401b8afa
mov byte [rsp + r8 + 0x50], dl
movsxd rdx, ebx
add rdx, rsi
cmp word [rdx], ax
jne 0x1401b8ae8
cmp byte [rdx + 2], r9b
jne 0x1401b8ae8
add ebx, 2
add rcx, 2
movzx edx, byte [rcx + 1]
inc rcx
inc edi
inc r8
inc ebx
test dl, dl
jne 0x1401b8ac0
movsxd rax, edi
mov byte [rsp + rax + 0x50], 0
jmp 0x1401b8b17
mov r8d, 0x40
lea rcx, [rsp + 0x50]
mov rdx, rsi
call fcn.1401b9a60
lea r9, [rsp + 0xc0]
mov byte [rsp + 0x90], 0
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0xd8]
lea rcx, [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov ebp, eax
test eax, eax
je 0x1401b8b6b
mov ecx, 2
call fcn.14018abf8
mov rcx, rax
lea rdx, str.getaddrinfo___error_:__d_n
mov r8d, ebp
call fcn.1400335e0
mov eax, 0xffffffff
jmp 0x1401b8c26
mov rbx, qword [rsp + 0xc0]
mov edi, 0xffffffff
test rbx, rbx
je 0x1401b8be1
nop dword [rax]
mov r8d, dword [rbx + 0xc]
mov edx, dword [rbx + 8]
mov ecx, dword [rbx + 4]
call qword [sym.imp.WS2_32.dll_socket]
mov rdi, rax
test eax, eax
js 0x1401b8bd0
mov rcx, qword [rbx + 0x20]
mov rdx, rcx
cmp word [rcx], 0x17
jne 0x1401b8bb1
test r14d, r14d
je 0x1401b8bb1
mov dword [rcx + 0x18], r14d
mov rdx, qword [rbx + 0x20]
mov r8d, dword [rbx + 0x10]
movsxd rsi, eax
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_connect]
mov ebp, eax
test eax, eax
jns 0x1401b8bd9
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_closesocket]
mov rbx, qword [rbx + 0x28]
test rbx, rbx
jne 0x1401b8b80
mov rbx, qword [rsp + 0xc0]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
test edi, edi
jns 0x1401b8c11
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.socket
mov r8d, eax
lea rcx, str.Socket_error:__s___d_n
call fcn.140033630
mov eax, 0xffffffff
jmp 0x1401b8c26
test ebp, ebp
jns 0x1401b8c24
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.connect
jmp 0x1401b8bfb
mov eax, edi
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x1401b8c40
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x250
mov rsi, rdx
movsxd rbx, ecx
mov eax, 0x10624dd3
mov qword [rsp + 0x48], rbx
imul r9d
mov edi, r8d
mov dword [rsp + 0x40], 1
sar edx, 6
xor r8d, r8d
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x3e8
mov dword [rsp + 0x30], edx
lea rdx, [rsp + 0x40]
sub r9d, eax
imul eax, r9d, 0x3e8
xor r9d, r9d
lea ecx, [r9 + 0x40]
mov dword [rsp + 0x34], eax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_select]
test eax, eax
jns 0x1401b8cd8
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r8d, eax
lea rdx, str.select
lea rcx, str.Socket_error:__s___d_n
call fcn.140033630
mov eax, 0xffffffff
jmp 0x1401b8d14
jne 0x1401b8cde
xor eax, eax
jmp 0x1401b8d14
xor r9d, r9d
mov r8d, edi
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_recv]
mov ebx, eax
test eax, eax
jns 0x1401b8d12
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r8d, eax
lea rdx, str.recv
lea rcx, str.Socket_error:__s___d_n
call fcn.140033630
mov eax, ebx
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x4e8360
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r10, qword [0x0068bcc0]
xor r8d, r8d
cmp word [r10], 0x5a4d
mov r9, rcx
jne 0x4e83d2
mov rcx, r10
call fcn.004e8250
test eax, eax
je 0x4e83d2
movsxd rax, dword [r10 + 0x3c]
mov rcx, r9
sub rcx, r10
add r10, rax
movzx eax, word [r10 + 0x14]
lea r8, [r10 + rax + 0x18]
movzx eax, word [r10 + 6]
test eax, eax
je 0x4e83cf
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [r8 + rax*8 + 0x28]
mov edx, dword [r8 + 0xc]
mov rax, rdx
cmp rcx, rdx
jb 0x4e83c6
add eax, dword [r8 + 8]
cmp rcx, rax
jb 0x4e83d2
add r8, 0x28
cmp r8, r9
jne 0x4e83b1
xor r8d, r8d
mov rax, r8
add rsp, 0x28
ret

Function at 0x18000c910
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push r14
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rdi
mov r14, r9
mov rbx, qword [0x180020580]
lea r8, [0x1800129b8]
mov edx, 0x6a
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
test rax, rax
jne 0x18000c95c
xor al, al
jmp 0x18000ca07
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
test rax, rax
je 0x18000c955
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x28], xmm0
mov r8, rax
lea rcx, [rsp + 0x28]
call fcn.18000cc10
nop
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov edx, eax
mov rcx, r14
call fcn.18000ca90
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
jne 0x18000c9b2
xor sil, sil
jmp 0x18000c9c6
mov r8, rbx
mov rdx, rax
mov rcx, qword [r14]
call sub.VCRUNTIME140.dll_memcpy
test ebx, ebx
setne sil
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x18000ca03
mov edi, 0xffffffff
mov eax, edi
lock xadd dword [rcx + 8], eax
sub eax, 1
jne 0x18000ca03
mov rbx, qword [rsp + 0x30]
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x18000ca03
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rcx]
call qword [rdx + 8]
movzx eax, sil
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop r14
ret
Function at 0x1400110d2
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Initialize winsock library
Resolve dns

Disassembly:
jmp 0x140011900
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x3d8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x8e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x3f8]
mov rax, qword [section..data]
xor rax, rbp
mov qword [rbp + 0x3a8], rax
lea rcx, [0x1400240f6]
call fcn.1400113d4
lea rdx, [rbp + 0x10]
mov cx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
mov r8d, 6
mov edx, 1
mov ecx, 2
call qword [sym.imp.WS2_32.dll_socket]
mov qword [rbp + 0x1c8], rax
cmp qword [rbp + 0x1c8], 0xffffffffffffffff
jne 0x140011996
mov rdx, qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rcx, str.create_fail:_d
call fcn.1400111cc
jmp 0x140011a5b
mov rax, qword [rbp + 0x3d0]
mov rcx, rax
call qword [sym.imp.WS2_32.dll_gethostbyname]
mov qword [rbp + 0x1e8], rax
cmp qword [rbp + 0x1e8], 0
jne 0x1400119cf
mov rdx, qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rcx, [0x14001af80]
call fcn.1400111cc
jmp 0x140011a5b
mov eax, 2
mov word [rbp + 0x208], ax
mov cx, 0x50
call qword [sym.imp.WS2_32.dll_htons]
mov word [rbp + 0x20a], ax
lea rcx, str.127.0.0.1
call qword [sym.imp.WS2_32.dll_inet_addr]
mov dword [rbp + 0x20c], eax
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rbp + 0x1e8]
mov rcx, qword [rcx + 0x18]
mov r8d, 4
mov rdx, qword [rcx + rax]
lea rcx, [rbp + 0x20c]
call fcn.1400111ea
mov r8d, 0x10
lea rdx, [rbp + 0x208]
mov rcx, qword [rbp + 0x1c8]
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x140011a5b
mov rdx, qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rcx, str.connect_fail__d
call fcn.1400111cc
lea rcx, [rbp - 0x20]
lea rdx, [0x14001ad40]
call fcn.14001135c
mov rcx, qword [rbp + 0x3a8]
xor rcx, rbp
call fcn.1400111e5
lea rsp, [rbp + 0x3b8]
pop rdi
pop rbp
ret

Function at 0x140011230
Capabilities:
Terminate process

Disassembly:
jmp 0x140013770
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x1400112c6
Capabilities:
Parse pe header

Disassembly:
jmp 0x140014ac0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140014ae0
xor al, al
jmp 0x140014b61
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140014af3
xor al, al
jmp 0x140014b61
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140014b1d
xor al, al
jmp 0x140014b61
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140014b31
xor al, al
jmp 0x140014b61
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140014b43
xor al, al
jmp 0x140014b61
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140014b5f
xor al, al
jmp 0x140014b61
mov al, 1
add rsp, 0x38
ret