joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2fc530550
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc531630
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc530f52
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc553108]
test eax, eax
je 0x2fc530fea
lea rax, [0x2fc5530e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc553110]
mov qword [rbp - 8], rax
jmp 0x2fc530fce
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc530fc2
cmp qword [rbp - 0x10], 0
je 0x2fc530fc2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc530f88
lea rax, [0x2fc5530e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc530feb
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc5310f0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc531118
mov eax, 0
jmp 0x2fc531166
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc531141
mov eax, 0
jmp 0x2fc531166
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc531161
mov eax, 0
jmp 0x2fc531166
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc53116c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc5311ea
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc5311e1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc5311e1
mov rax, qword [rbp - 8]
jmp 0x2fc5311ff
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc5311b4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140060020
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov r11, rsp
push rbx
push rbp
push r15
sub rsp, 0x90
mov r10, qword [r9 + 0x10]
mov rbp, rdx
mov rdx, qword [r8 + 0x10]
movabs rax, 0x7fffffffffffffff
sub rax, rdx
mov qword [rsp + 0x40], rcx
xor ebx, ebx
mov r15, rcx
cmp rax, r10
jb 0x1400601e7
cmp qword [r8 + 0x18], 0xf
mov qword [r11 - 0x20], rsi
mov qword [r11 - 0x28], rdi
mov qword [r11 - 0x30], r13
mov qword [r11 - 0x38], r14
jbe 0x140060073
mov r8, qword [r8]
cmp qword [r9 + 0x18], 0xf
jbe 0x14006007d
mov r9, qword [r9]
mov qword [rsp + 0x30], r10
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x28], r9
mov r9, r8
mov qword [rsp + 0x20], rdx
call fcn.140064440
mov r13, qword [rsp + 0x68]
lea r8, [rsp + 0x50]
mov r14, qword [rsp + 0x50]
cmp r13, 0xf
mov rsi, qword [rsp + 0x60]
movabs rdx, 0xcbf29ce484222325
cmova r8, r14
mov rcx, rbx
test rsi, rsi
je 0x1400600e5
movabs r9, 0x100000001b3
movzx eax, byte [r8 + rcx]
inc rcx
xor rdx, rax
imul rdx, r9
cmp rcx, rsi
jb 0x1400600d1
mov rcx, qword [r15 + 0xe8]
mov rax, qword [r15 + 0xd0]
and rcx, rdx
add rcx, rcx
mov rdi, qword [rax + rcx*8 + 8]
cmp rdi, qword [r15 + 0xc0]
je 0x140060153
mov r15, qword [rax + rcx*8]
nop dword [rax + rax]
cmp qword [rdi + 0x28], 0xf
lea rdx, [rdi + 0x10]
mov rax, qword [rdx + 0x10]
jbe 0x140060122
mov rdx, qword [rdx]
cmp r13, 0xf
lea rcx, [rsp + 0x50]
cmova rcx, r14
cmp rsi, rax
jne 0x140060140
mov r8, rsi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14006014b
cmp rdi, r15
je 0x14006014e
mov rdi, qword [rdi + 8]
jmp 0x140060110
mov rbx, rdi
mov r15, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x80]
test rbx, rbx
mov rsi, qword [rsp + 0x88]
cmove rbx, qword [r15 + 0xc0]
cmp r13, 0xf
jbe 0x1400601a8
lea rdx, [r13 + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x1400601a0
mov r14, qword [r14 - 8]
add rdx, 0x27
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400601a0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r14
call fcn.1401ec974
mov rax, rbp
cmp rbx, qword [r15 + 0xc0]
jne 0x1400601c1
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
movups xmmword [rbp + 0x10], xmm0
jmp 0x1400601d1
movups xmm0, xmmword [rbx + 0x30]
movups xmmword [rbp], xmm0
movups xmm1, xmmword [rbx + 0x40]
movups xmmword [rbp + 0x10], xmm1
mov r13, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
add rsp, 0x90
pop r15
pop rbp
pop rbx
ret
call fcn.14005af10
int3
Function at 0x140062930
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbp
push r13
push r15
sub rsp, 0x30
mov qword [rsp + 0x50], rbx
mov r15, rdx
mov qword [rsp + 0x58], rsi
mov r13, rcx
mov rsi, qword [r8 + 0x10]
mov r9, r8
mov qword [rsp + 0x60], rdi
mov rdi, r8
mov qword [rsp + 0x28], r12
mov r12, qword [r8 + 0x18]
cmp r12, 0xf
jbe 0x14006296b
mov r9, qword [r8]
xor ebp, ebp
movabs r8, 0xcbf29ce484222325
mov ecx, ebp
test rsi, rsi
je 0x1400629a4
movabs rdx, 0x100000001b3
nop dword [rax + rax]
movzx eax, byte [r9 + rcx]
inc rcx
xor r8, rax
imul r8, rdx
cmp rcx, rsi
jb 0x140062990
mov rcx, qword [r13 + 0x30]
mov rax, qword [r13 + 0x18]
and rcx, r8
add rcx, rcx
mov rbx, qword [rax + rcx*8 + 8]
cmp rbx, qword [r13 + 8]
je 0x140062a12
mov qword [rsp + 0x20], r14
mov r14, qword [rax + rcx*8]
nop word [rax + rax]
cmp qword [rbx + 0x28], 0xf
lea rdx, [rbx + 0x10]
mov rax, qword [rdx + 0x10]
jbe 0x1400629e2
mov rdx, qword [rdx]
mov rcx, rdi
cmp r12, 0xf
jbe 0x1400629ee
mov rcx, qword [rdi]
cmp rsi, rax
jne 0x1400629ff
mov r8, rsi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140062a0a
cmp rbx, r14
je 0x140062a0d
mov rbx, qword [rbx + 8]
jmp 0x1400629d0
mov rbp, rbx
mov r14, qword [rsp + 0x20]
mov r12, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
test rbp, rbp
je 0x140062a3b
mov qword [r15], rbp
mov rax, r15
add rsp, 0x30
pop r15
pop r13
pop rbp
ret
mov rax, qword [r13 + 8]
mov qword [r15], rax
mov rax, r15
add rsp, 0x30
pop r15
pop r13
pop rbp
ret
Function at 0x140079f60
Capabilities:
Convert ip address from string

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x88
mov rax, qword [0x14029b440]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov r13, qword [rcx]
mov ebp, r8d
mov rsi, rcx
lea r8, [rsp + 0x20]
mov ebx, 2
xor r14d, r14d
mov ecx, ebx
mov r15, r9
mov r12, qword [r13 + 0x11b0]
mov rdi, rdx
mov dword [r9], r14d
call qword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
jle 0x140079fcc
mov r9d, ebp
lea rdx, [rsp + 0x20]
mov r8, rdi
mov ecx, ebx
call fcn.140098c70
jmp 0x14007a0aa
mov ebx, reloc.WS2_32.dll_socket
lea r8, [rsp + 0x58]
mov ecx, ebx
mov rdx, rdi
call qword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
jle 0x140079ffc
mov r9d, ebp
lea rdx, [rsp + 0x58]
mov r8, rdi
mov ecx, ebx
call fcn.140098c70
jmp 0x14007a0aa
mov ecx, dword [rsi + 0x440]
sub ecx, 1
je 0x14007a020
cmp ecx, 1
je 0x14007a00f
mov ebx, r14d
call fcn.14007aaa0
test al, al
mov eax, 2
cmove ebx, eax
jmp 0x14007a025
mov ebx, 2
cmp dword [rsi + 0xbc], 3
lea r8, [0x1401f22b4]
xorps xmm0, xmm0
lea rcx, [rsp + 0x68]
movups xmmword [rsp + 0x28], xmm0
setne r14b
mov dword [rsp + 0x2c], ebx
inc r14d
mov r9d, ebp
mov edx, ntohs
mov dword [rsp + 0x30], r14d
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
call fcn.140096ab0
lea rcx, [rsp + 0x58]
call fcn.140079df0
lea r9, [rsp + 0x28]
mov r8d, ebp
mov rdx, rdi
mov rcx, rsi
movups xmm0, xmmword [rax]
movups xmmword [r12], xmm0
call fcn.14007a700
test al, al
je 0x14007a099
mov dword [r15], 1
jmp 0x14007a0a8
lea rdx, str.getaddrinfo___thread_failed_to_start_n
mov rcx, r13
call fcn.140086040
xor eax, eax
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1401ec6d0
add rsp, 0x88
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
jmp 0x140079f60
Function at 0x140085f80
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx + 0x718], 0
mov rsi, r9
mov rbp, r8
movsxd rbx, edx
mov rdi, rcx
je 0x140085fde
mov dl, 1
call fcn.140074d20
mov rax, qword [rdi + 0x670]
mov r9, rsi
mov r8, rbp
mov qword [rsp + 0x20], rax
mov edx, ebx
mov rcx, rdi
call qword [rdi + 0x718]
xor edx, edx
mov rcx, rdi
mov ebx, eax
call fcn.140074d20
mov eax, ebx
jmp 0x140086020
cmp ebx, 2
ja 0x14008601e
mov r9, qword [rdi + 0x668]
lea rdx, [0x1401f3570]
lea rcx, [rbx + rbx*2]
add rcx, rdx
mov edx, 2
lea r8d, [rdx - 1]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov r9, qword [rdi + 0x668]
mov r8d, 1
mov rdx, rsi
mov rcx, rbp
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x140086040
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rdi
sub rsp, 0x160
mov rax, qword [0x14029b440]
xor rax, rsp
mov qword [rsp + 0x140], rax
cmp byte [rcx + 0xea6], 0
mov rdi, rcx
jne 0x140086083
cmp qword [rcx + 0x678], 0
je 0x140086160
mov r8, rdx
mov qword [rsp + 0x158], rbx
mov edx, 0x100
lea r9, [rsp + 0x180]
lea rcx, [rsp + 0x30]
call fcn.140096bc0
lea rax, [rsp + 0x30]
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x1400860b1
mov rcx, qword [rdi + 0x678]
test rcx, rcx
je 0x1400860f8
cmp byte [rdi + 0x1528], 0
jne 0x1400860f8
lea rdx, [rsp + 0x30]
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rdx]
lea rdx, [rdx + 1]
mov byte [rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x1400860e0
mov byte [rdi + 0x1528], 1
cmp byte [rdi + 0xea6], 0
je 0x140086158
mov byte [rsp + rbx + 0x30], 0xa
inc rbx
cmp rbx, 0x102
jae 0x1400861b1
cmp qword [rdi + 0x718], 0
mov byte [rsp + rbx + 0x30], 0
je 0x140086179
mov dl, 1
mov rcx, rdi
call fcn.140074d20
mov rax, qword [rdi + 0x670]
lea r8, [rsp + 0x30]
mov r9, rbx
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, rdi
call qword [rdi + 0x718]
xor edx, edx
mov rcx, rdi
call fcn.140074d20
mov rbx, qword [rsp + 0x158]
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1401ec6d0
add rsp, 0x160
pop rdi
ret
mov r9, qword [rdi + 0x668]
lea rcx, [0x1401f3570]
mov edx, 2
lea r8d, [rdx - 1]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov r9, qword [rdi + 0x668]
lea rcx, [rsp + 0x30]
mov r8d, 1
mov rdx, rbx
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
jmp 0x140086158
call fcn.1401ecda0
int3
Function at 0x1400861c0
Capabilities:
Write file on windows

Disassembly:
test rcx, rcx
je 0x140086324
mov r11, rsp
mov qword [r11 + 0x10], rdx
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x20], r9
push rdi
sub rsp, 0x860
mov rax, qword [0x14029b440]
xor rax, rsp
mov qword [rsp + 0x840], rax
cmp byte [rcx + 0xea6], 0
mov rdi, rcx
je 0x14008630c
mov r8, rdx
mov qword [r11 - 0x10], rbx
mov edx, 0x801
lea r9, [r11 + 0x18]
lea rcx, [rsp + 0x30]
call fcn.140096bc0
movsxd rcx, eax
mov rbx, 0xffffffffffffffff
cmp rcx, 0x801
jb 0x140086281
mov rcx, qword [rsp + 0x878]
mov rax, rbx
nop word [rax + rax]
cmp byte [rcx + rax + 1], 0
lea rax, [rax + 1]
jne 0x140086240
cmp byte [rax + rcx - 1], 0xa
jne 0x140086268
lea r8, str...._n
mov edx, 5
lea rcx, [rsp + 0x82c]
jmp 0x14008627c
lea r8, [0x1401f35f4]
mov edx, 4
lea rcx, [rsp + 0x82d]
call fcn.140096ab0
lea rax, [rsp + 0x30]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140086286
cmp qword [rdi + 0x718], 0
je 0x1400862ce
mov dl, 1
mov rcx, rdi
call fcn.140074d20
mov rax, qword [rdi + 0x670]
lea r8, [rsp + 0x30]
mov r9, rbx
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, rdi
call qword [rdi + 0x718]
xor edx, edx
mov rcx, rdi
call fcn.140074d20
jmp 0x140086304
mov r9, qword [rdi + 0x668]
lea rcx, [0x1401f3570]
mov edx, 2
lea r8d, [rdx - 1]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov r9, qword [rdi + 0x668]
lea rcx, [rsp + 0x30]
mov r8d, 1
mov rdx, rbx
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rsp + 0x858]
mov rcx, qword [rsp + 0x840]
xor rcx, rsp
call fcn.1401ec6d0
add rsp, 0x860
pop rdi
ret
Function at 0x140088980
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
call sub.api_ms_win_crt_stdio_l1_1_0.dll__read
cdqe
add rsp, 0x28
ret

Function at 0x140089850
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp byte [0x14029b900], 0
mov esi, r8d
mov rdi, qword [rsp + 0x68]
je 0x1400898ff
test rdi, rdi
je 0x1400898ff
mov eax, dword [0x14029b904]
test eax, eax
jne 0x1400898f7
mov r8d, dword [rsp + 0x60]
lea rsi, str.recv
mov r9, rsi
lea rcx, str.LIMIT__s:_d__s_reached_memlimit_n
mov rdx, rdi
call fcn.1400895a0
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9d, dword [rsp + 0x60]
lea rdx, str.LIMIT__s:_d__s_reached_memlimit_n
mov rcx, rax
mov qword [rsp + 0x20], rsi
mov r8, rdi
call fcn.140096a80
mov rcx, qword [0x14029b8f8]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fflush
call sub.api_ms_win_crt_runtime_l1_1_0.dll__errno
mov dword [rax], ntohs
mov eax, 0xffffffff
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
dec eax
mov dword [0x14029b904], eax
call qword [sym.imp.WS2_32.dll_recv]
mov ebx, eax
test rdi, rdi
je 0x140089927
mov r8d, dword [rsp + 0x60]
lea rcx, str.RECV__s:_d_recv__lu____ld_n
mov r9d, esi
mov dword [rsp + 0x20], eax
mov rdx, rdi
call fcn.1400895a0
mov rsi, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x1400899a0
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp byte [0x14029b900], 0
mov esi, r8d
mov rdi, qword [rsp + 0x68]
je 0x140089a4f
test rdi, rdi
je 0x140089a4f
mov eax, dword [0x14029b904]
test eax, eax
jne 0x140089a47
mov r8d, dword [rsp + 0x60]
lea rsi, str.send
mov r9, rsi
lea rcx, str.LIMIT__s:_d__s_reached_memlimit_n
mov rdx, rdi
call fcn.1400895a0
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9d, dword [rsp + 0x60]
lea rdx, str.LIMIT__s:_d__s_reached_memlimit_n
mov rcx, rax
mov qword [rsp + 0x20], rsi
mov r8, rdi
call fcn.140096a80
mov rcx, qword [0x14029b8f8]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fflush
call sub.api_ms_win_crt_runtime_l1_1_0.dll__errno
mov dword [rax], ntohs
mov eax, 0xffffffff
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
dec eax
mov dword [0x14029b904], eax
call qword [sym.imp.WS2_32.dll_send]
mov ebx, eax
test rdi, rdi
je 0x140089a77
mov r8d, dword [rsp + 0x60]
lea rcx, str.SEND__s:_d_send__lu____ld_n
mov r9d, esi
mov dword [rsp + 0x20], eax
mov rdx, rdi
call fcn.1400895a0
mov rsi, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x140098ff0
Capabilities:
Convert ip address from string

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x88
mov rax, qword [0x14029b440]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov r13, qword [rcx]
mov ebp, r8d
mov rsi, rcx
lea r8, [rsp + 0x20]
mov ebx, 2
xor r14d, r14d
mov ecx, ebx
mov r15, r9
mov r12, qword [r13 + 0x11b0]
mov rdi, rdx
mov dword [r9], r14d
call qword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
jle 0x140079fcc
mov r9d, ebp
lea rdx, [rsp + 0x20]
mov r8, rdi
mov ecx, ebx
call fcn.140098c70
jmp 0x14007a0aa
mov ebx, reloc.WS2_32.dll_socket
lea r8, [rsp + 0x58]
mov ecx, ebx
mov rdx, rdi
call qword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
jle 0x140079ffc
mov r9d, ebp
lea rdx, [rsp + 0x58]
mov r8, rdi
mov ecx, ebx
call fcn.140098c70
jmp 0x14007a0aa
mov ecx, dword [rsi + 0x440]
sub ecx, 1
je 0x14007a020
cmp ecx, 1
je 0x14007a00f
mov ebx, r14d
call fcn.14007aaa0
test al, al
mov eax, 2
cmove ebx, eax
jmp 0x14007a025
mov ebx, 2
cmp dword [rsi + 0xbc], 3
lea r8, [0x1401f22b4]
xorps xmm0, xmm0
lea rcx, [rsp + 0x68]
movups xmmword [rsp + 0x28], xmm0
setne r14b
mov dword [rsp + 0x2c], ebx
inc r14d
mov r9d, ebp
mov edx, ntohs
mov dword [rsp + 0x30], r14d
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
call fcn.140096ab0
lea rcx, [rsp + 0x58]
call fcn.140079df0
lea r9, [rsp + 0x28]
mov r8d, ebp
mov rdx, rdi
mov rcx, rsi
movups xmm0, xmmword [rax]
movups xmmword [r12], xmm0
call fcn.14007a700
test al, al
je 0x14007a099
mov dword [r15], 1
jmp 0x14007a0a8
lea rdx, str.getaddrinfo___thread_failed_to_start_n
mov rcx, r13
call fcn.140086040
xor eax, eax
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1401ec6d0
add rsp, 0x88
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
jmp 0x140079f60
Function at 0x14009ce40
Capabilities:
Encode data using xor

Disassembly:
push r14
push r15
sub rsp, 0x1f8
mov rax, qword [0x14029b440]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
cmp byte [0x14029bbc0], 0
mov r14, rcx
jne 0x14009ce79
call fcn.1400d9e40
test eax, eax
je 0x14009ce97
mov byte [0x14029bbc0], 1
xor eax, eax
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.1401ec6d0
add rsp, 0x1f8
pop r15
pop r14
ret
mov rcx, qword [r14 + 0xcf8]
test rcx, rcx
je 0x14009ceb6
mov edx, 0x400
call fcn.1400daee0
call fcn.1400d9e40
test eax, eax
jne 0x14009ce79
mov qword [rsp + 0x218], rbx
xor r15d, r15d
mov qword [rsp + 0x220], rbp
mov qword [rsp + 0x228], rsi
mov qword [rsp + 0x1f0], rdi
movaps xmmword [rsp + 0x1e0], xmm6
movaps xmmword [rsp + 0x1d0], xmm7
movsd xmm7, qword [0x1401f9060]
nop dword [rax]
nop word [rax + rax]
mov rsi, r15
lea rbp, [rsp + 0x80]
nop dword [rax + rax]
lea rcx, [rsp + 0x30]
call fcn.140079df0
mov ecx, 1
movups xmm6, xmmword [rax]
movups xmmword [rsp + 0x20], xmm6
call fcn.140085f30
lea rcx, [rsp + 0x40]
lea rdi, [rsi + 3]
call fcn.140079df0
lea rcx, [rsp + 0x50]
movsxd rbx, dword [rax + 8]
call fcn.140079df0
mov rdx, rbx
lea rcx, [rdi - 2]
add rdx, qword [rax]
movq rax, xmm6
imul rdx, rdi
imul rcx, rax
shl rdx, 8
xor rdx, rcx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x20], rdx
call fcn.140079df0
lea rcx, [rsp + 0x70]
mov rbx, rax
call fcn.140079df0
mov ecx, dword [rbx + 8]
lea rbp, [rbp + 0x10]
add ecx, dword [rax]
lea eax, [rsi + 4]
imul ecx, eax
lea eax, [rsi + 2]
imul eax, dword [rsp + 0x28]
inc rsi
shl ecx, 0x10
xor ecx, eax
mov dword [rsp + 0x28], ecx
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rbp - 0x10], xmm0
cmp rsi, 4
jb 0x14009cf10
movaps xmm2, xmm7
lea rcx, [rsp + 0x80]
mov edx, 0x40
call fcn.1400d9b70
call fcn.1400d9e40
test eax, eax
je 0x14009cf00
mov edx, 0x100
mov byte [rsp + 0xc0], r15b
lea rcx, [rsp + 0xc0]
call fcn.1400dac70
movaps xmm7, xmmword [rsp + 0x1d0]
movaps xmm6, xmmword [rsp + 0x1e0]
mov rdi, qword [rsp + 0x1f0]
mov rsi, qword [rsp + 0x228]
mov rbp, qword [rsp + 0x220]
mov rbx, qword [rsp + 0x218]
cmp byte [rsp + 0xc0], r15b
je 0x14009d04d
mov edx, 0x400
lea rcx, [rsp + 0xc0]
call fcn.1400daee0
call fcn.1400d9e40
test eax, eax
jne 0x14009ce79
lea rdx, str.libcurl_is_now_using_a_weak_random_seed__n
mov rcx, r14
call fcn.1400861c0
call fcn.1400d9e40
test eax, eax
mov ecx, reloc.WLDAP32.dll_Ordinal_35
cmovne ecx, r15d
mov eax, ecx
jmp 0x14009ce7b
Function at 0x1400a1e20
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x1038
call fcn.1401ecf50
sub rsp, rax
mov rax, qword [0x14029b440]
xor rax, rsp
mov qword [rsp + 0x1020], rax
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
mov byte [rsp + 0x20], 0
test rax, rax
je 0x1400a1e97
mov r8d, 0x1000
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [rsp + 0x20], 0
je 0x1400a1e97
lea r8, str.C:Users_riskuDownloads_vcpkg_master_buildtreescurl_srcurl_7_68_0_cd669cc759libgetenv.c
mov edx, Ordinal_46
lea rcx, [rsp + 0x20]
call fcn.140089b80
mov rcx, qword [rsp + 0x1020]
xor rcx, rsp
call fcn.1401ec6d0
add rsp, 0x1038
ret
xor eax, eax
mov rcx, qword [rsp + 0x1020]
xor rcx, rsp
call fcn.1401ec6d0
add rsp, 0x1038
ret

Function at 0x1400a82c0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0xd0
mov rax, qword [0x14029b440]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rbp, qword [rcx + 0x260]
lea r8, [rsp + 0x30]
mov rsi, qword [rcx]
lea rdx, [rsp + 0x40]
mov rdi, rcx
mov dword [rsp + 0x30], 0x80
mov rcx, rbp
mov rbx, 0xffffffffffffffff
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x1400a834b
lea rax, str.C:Users_riskuDownloads_vcpkg_master_buildtreescurl_srcurl_7_68_0_cd669cc759lib_ftp.c
mov dword [rsp + 0x30], 0x80
mov r9d, 0x123
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x30]
mov rcx, rbp
lea rdx, [rsp + 0x40]
call fcn.140089330
mov rbx, rax
mov rdx, rbp
mov rcx, rdi
call fcn.140086d10
mov rcx, rsi
cmp rbx, 0xffffffffffffffff
jne 0x1400a8370
lea rdx, str.Error_accept__ing_server_connect
call fcn.140086040
lea eax, [rbx + 0x1f]
jmp 0x1400a83e9
lea rdx, str.Connection_accepted_from_server_n
call fcn.1400861c0
mov edx, 1
mov byte [rdi + 0x3f8], 0
mov rcx, rbx
mov qword [rdi + 0x260], rbx
call fcn.140095840
mov byte [rdi + 0x279], 1
cmp qword [rsi + 0x728], 0
je 0x1400a83e7
mov dl, 1
mov rcx, rsi
call fcn.140074d20
mov rcx, qword [rsi + 0x730]
mov r8d, 1
mov rdx, rbx
call qword [rsi + 0x728]
xor edx, edx
mov rcx, rsi
mov ebx, eax
call fcn.140074d20
test ebx, ebx
je 0x1400a83e7
mov rcx, rdi
call fcn.1400a8900
mov eax, Ordinal_46
jmp 0x1400a83e9
xor eax, eax
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1401ec6d0
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x1400a94c0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx]
mov rbx, rcx
add rcx, 0x798
cmp byte [rax + 0xe91], 0
jne 0x1400a94e5
cmp dword [rax + 0x9f0], 0
je 0x1400a9511
mov r8, qword [rcx + 0x88]
test r8, r8
je 0x1400a9511
lea rdx, str.MDTM__s
call fcn.1400c1420
test eax, eax
jne 0x1400a951e
mov dword [rbx + 0x850], 0x12
add rsp, 0x20
pop rbx
ret
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.1400aa390
add rsp, 0x20
pop rbx
ret