joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140031160
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
jmp 0x140032980
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1400a3708]
xor rax, rsp
mov qword [rbp - 8], rax
or rdi, 0xffffffffffffffff
mov r14, r9
or rsi, rdi
mov r15d, edx
test r8d, r8d
jne 0x140032ba1
dec ecx
cmp ecx, 1
ja 0x140032ba1
test r9, r9
jne 0x1400329d5
mov ecx, 0x2726
call qword [sym.imp.WS2_32.dll_WSASetLastError]
or eax, edi
jmp 0x140032b3d
mov qword [rsp + 0x80], rbx
xor r8d, r8d
mov qword [rsp + 0x90], r12
mov r12d, 2
mov ecx, r12d
call qword [sym.imp.WS2_32.dll_socket]
mov rbx, rax
test rax, rax
js 0x140032b9c
xor eax, eax
mov ecx, 0x7f000001
mov qword [rbp - 0x28], rax
mov word [rbp - 0x28], r12w
mov qword [rbp - 0x20], rax
call qword [sym.imp.WS2_32.dll_htonl]
mov dword [rbp - 0x24], eax
lea r8d, [r12 + 0xe]
lea rdx, [rbp - 0x28]
mov rcx, rbx
xor eax, eax
mov word [rbp - 0x26], ax
call qword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
je 0x140032b5d
lea edx, [r12 - 1]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
je 0x140032b5d
xor r8d, r8d
mov edx, r15d
mov ecx, r12d
call qword [sym.imp.WS2_32.dll_socket]
mov rdi, rax
test rax, rax
js 0x140032b5d
lea r8, [rbp - 0x30]
mov dword [rbp - 0x30], reloc.WS2_32.dll_recv
lea rdx, [rbp - 0x18]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
je 0x140032b5d
cmp dword [rbp - 0x30], 0x10
jne 0x140032b55
lea r8d, [r12 + 0xe]
mov rcx, rdi
lea rdx, [rbp - 0x18]
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x140032b5d
lea r8, [rbp - 0x30]
mov dword [rbp - 0x30], reloc.WS2_32.dll_recv
lea rdx, [rbp - 0x28]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_accept]
mov rsi, rax
test rax, rax
js 0x140032b5d
cmp dword [rbp - 0x30], 0x10
jne 0x140032b55
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_closesocket]
lea r8, [rbp - 0x30]
mov rcx, rdi
lea rdx, [rbp - 0x18]
call qword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
je 0x140032b5d
cmp dword [rbp - 0x30], 0x10
jne 0x140032b55
movzx eax, word [rbp - 0x18]
cmp word [rbp - 0x28], ax
jne 0x140032b55
mov eax, dword [rbp - 0x14]
cmp dword [rbp - 0x24], eax
jne 0x140032b55
movzx eax, word [rbp - 0x16]
cmp word [rbp - 0x26], ax
jne 0x140032b55
mov qword [r14], rdi
xor eax, eax
mov qword [r14 + 8], rsi
mov rbx, qword [rsp + 0x80]
mov r12, qword [rsp + 0x90]
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140042500
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov r14d, 0x2745
jmp 0x140032b66
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r14d, eax
cmp rbx, 0xffffffffffffffff
je 0x140032b75
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_closesocket]
cmp rdi, 0xffffffffffffffff
je 0x140032b84
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
cmp rsi, 0xffffffffffffffff
je 0x140032b93
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_closesocket]
mov ecx, r14d
call qword [sym.imp.WS2_32.dll_WSASetLastError]
or eax, 0xffffffff
jmp 0x140032b2d
mov ecx, 0x273f
call qword [sym.imp.WS2_32.dll_WSASetLastError]
or eax, 0xffffffff
jmp 0x140032b3d
Function at 0x140031170
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x20
lea r8, [rsp + 0x38]
mov dword [rsp + 0x38], 1
mov edx, 0x8004667e
mov rbx, rcx
call qword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
jne 0x1400311b1
mov r8d, ebx
lea rdx, str.fcntl__d__F_GETFL_
mov rcx, rbx
call fcn.140033ff0
or eax, 0xffffffff
add rsp, 0x20
pop rbx
ret
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x140032060
Capabilities:
Resolve dns

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r15
mov rbp, rsp
sub rsp, 0x60
or esi, 0xffffffff
mov rbx, r9
mov rdi, rdx
mov r15, rcx
test r8, r8
je 0x14003209b
movups xmm0, xmmword [r8]
movups xmm1, xmmword [r8 + 0x10]
movups xmmword [rbp - 0x30], xmm0
movups xmm0, xmmword [r8 + 0x20]
movups xmmword [rbp - 0x20], xmm1
movups xmmword [rbp - 0x10], xmm0
jmp 0x1400320b8
xor eax, eax
mov qword [rbp - 0x30], rax
mov dword [rbp - 0x2c], eax
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rax
lea rax, [rbp + 0x40]
lea r8, [rbp - 0x30]
mov qword [rsp + 0x20], rax
call fcn.140032e70
test eax, eax
je 0x14003223b
cmp eax, 8
je 0x14003223b
cmp eax, 0x2af9
je 0x14003223b
cmp dword [0x1400a4bdc], 0
mov qword [rsp + 0x90], r13
jne 0x1400320fc
call fcn.140033c00
cmp dword [0x1400a4bd4], 0
mov r13d, 1
mov qword [rsp + 0x98], r14
je 0x14003215e
test rdi, rdi
je 0x14003215e
mov eax, dword [rbp - 0x28]
test eax, eax
jne 0x140032161
mov rcx, rdi
call fcn.140033a60
mov dword [rbp + 0x40], eax
mov esi, eax
test eax, eax
js 0x14003215e
mov r14d, r13d
test r15, r15
jne 0x140032157
lea rax, [rbp + 0x40]
mov r9, rbx
lea r8, [rbp - 0x30]
mov qword [rsp + 0x20], rax
mov rdx, rdi
xor ecx, ecx
call fcn.140032e70
jmp 0x14003222b
mov eax, dword [rbp - 0x28]
xor edi, edi
jmp 0x140032164
mov eax, dword [rbp - 0x28]
xor r14d, r14d
cmp dword [0x1400a4bdc], 0
jne 0x140032175
call fcn.140033c00
mov eax, dword [rbp - 0x28]
cmp dword [0x1400a4bd8], 0
je 0x1400321c5
mov ecx, dword [rbp - 0x24]
test ecx, ecx
jne 0x1400321a5
test eax, eax
je 0x1400321c5
cmp eax, 2
jne 0x140032197
mov dword [rbp - 0x24], send
jmp 0x1400321c5
cmp eax, r13d
jne 0x1400321a5
mov dword [rbp - 0x24], 6
jmp 0x1400321c5
test eax, eax
jne 0x1400321c5
test ecx, ecx
je 0x1400321c5
cmp ecx, 0x11
jne 0x1400321bb
mov dword [rbp - 0x28], 2
jmp 0x1400321c5
cmp ecx, 6
cmove eax, r13d
mov dword [rbp - 0x28], eax
and dword [rbp - 0x30], 0x7fffffff
lea r8, [rbp - 0x30]
mov r9, rbx
mov rdx, rdi
mov rcx, r15
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov edi, eax
test r14d, r14d
je 0x1400321f0
mov rdx, rbx
mov ecx, esi
call fcn.140033d50
cmp dword [0x1400a4bdc], 0
jne 0x1400321fe
call fcn.140033c00
cmp dword [0x1400a4bd8], 0
je 0x140032229
mov rcx, qword [rbx]
call fcn.140033df0
test eax, eax
jns 0x140032229
mov rcx, qword [rbx]
call fcn.140032250
mov eax, 8
mov qword [rbx], 0
jmp 0x14003222b
mov eax, edi
mov r14, qword [rsp + 0x98]
mov r13, qword [rsp + 0x90]
add rsp, 0x60
pop r15
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140032800
Capabilities:
Connect socket
Set socket configuration

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
xor esi, esi
mov r14d, r8d
mov rbp, rdx
mov rbx, rcx
cmp qword [rcx], rsi
jge 0x140032875
movzx ecx, word [rdx]
xor r8d, r8d
lea edx, [rsi + 1]
call qword [sym.imp.WS2_32.dll_socket]
mov qword [rbx], rax
mov rdi, rax
test rax, rax
js 0x1400328d1
mov esi, 1
lea r8, [rsp + 0x40]
mov edx, 0x8004667e
mov dword [rsp + 0x40], esi
mov rcx, rax
call qword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
jne 0x140032875
mov r8d, edi
lea rdx, str.fcntl__d__F_GETFL_
mov rcx, rdi
call fcn.140033ff0
jmp 0x1400328c1
mov rcx, qword [rbx]
mov r8d, r14d
mov rdx, rbp
call qword [sym.imp.WS2_32.dll_connect]
test eax, eax
jns 0x1400328d6
mov rcx, qword [rbx]
call fcn.1400311f0
lea ecx, [rax - 0x2714]
cmp ecx, 0x20
ja 0x1400328af
movabs rdx, 0x180040001
bt rdx, rcx
jae 0x1400328af
xor eax, eax
jmp 0x1400328db
cmp eax, 0x274d
jne 0x1400328bd
mov eax, 2
jmp 0x1400328db
test esi, esi
je 0x1400328d1
mov rcx, qword [rbx]
call qword [sym.imp.WS2_32.dll_closesocket]
mov qword [rbx], 0xffffffffffffffff
or eax, 0xffffffff
jmp 0x1400328db
mov eax, 1
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x140032980
Capabilities:
Connect socket
Get local ipv4 addresses
Get socket information

Disassembly:
jmp 0x140032980
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1400a3708]
xor rax, rsp
mov qword [rbp - 8], rax
or rdi, 0xffffffffffffffff
mov r14, r9
or rsi, rdi
mov r15d, edx
test r8d, r8d
jne 0x140032ba1
dec ecx
cmp ecx, 1
ja 0x140032ba1
test r9, r9
jne 0x1400329d5
mov ecx, 0x2726
call qword [sym.imp.WS2_32.dll_WSASetLastError]
or eax, edi
jmp 0x140032b3d
mov qword [rsp + 0x80], rbx
xor r8d, r8d
mov qword [rsp + 0x90], r12
mov r12d, 2
mov ecx, r12d
call qword [sym.imp.WS2_32.dll_socket]
mov rbx, rax
test rax, rax
js 0x140032b9c
xor eax, eax
mov ecx, 0x7f000001
mov qword [rbp - 0x28], rax
mov word [rbp - 0x28], r12w
mov qword [rbp - 0x20], rax
call qword [sym.imp.WS2_32.dll_htonl]
mov dword [rbp - 0x24], eax
lea r8d, [r12 + 0xe]
lea rdx, [rbp - 0x28]
mov rcx, rbx
xor eax, eax
mov word [rbp - 0x26], ax
call qword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
je 0x140032b5d
lea edx, [r12 - 1]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
je 0x140032b5d
xor r8d, r8d
mov edx, r15d
mov ecx, r12d
call qword [sym.imp.WS2_32.dll_socket]
mov rdi, rax
test rax, rax
js 0x140032b5d
lea r8, [rbp - 0x30]
mov dword [rbp - 0x30], reloc.WS2_32.dll_recv
lea rdx, [rbp - 0x18]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
je 0x140032b5d
cmp dword [rbp - 0x30], 0x10
jne 0x140032b55
lea r8d, [r12 + 0xe]
mov rcx, rdi
lea rdx, [rbp - 0x18]
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x140032b5d
lea r8, [rbp - 0x30]
mov dword [rbp - 0x30], reloc.WS2_32.dll_recv
lea rdx, [rbp - 0x28]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_accept]
mov rsi, rax
test rax, rax
js 0x140032b5d
cmp dword [rbp - 0x30], 0x10
jne 0x140032b55
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_closesocket]
lea r8, [rbp - 0x30]
mov rcx, rdi
lea rdx, [rbp - 0x18]
call qword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
je 0x140032b5d
cmp dword [rbp - 0x30], 0x10
jne 0x140032b55
movzx eax, word [rbp - 0x18]
cmp word [rbp - 0x28], ax
jne 0x140032b55
mov eax, dword [rbp - 0x14]
cmp dword [rbp - 0x24], eax
jne 0x140032b55
movzx eax, word [rbp - 0x16]
cmp word [rbp - 0x26], ax
jne 0x140032b55
mov qword [r14], rdi
xor eax, eax
mov qword [r14 + 8], rsi
mov rbx, qword [rsp + 0x80]
mov r12, qword [rsp + 0x90]
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140042500
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov r14d, 0x2745
jmp 0x140032b66
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r14d, eax
cmp rbx, 0xffffffffffffffff
je 0x140032b75
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_closesocket]
cmp rdi, 0xffffffffffffffff
je 0x140032b84
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
cmp rsi, 0xffffffffffffffff
je 0x140032b93
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_closesocket]
mov ecx, r14d
call qword [sym.imp.WS2_32.dll_WSASetLastError]
or eax, 0xffffffff
jmp 0x140032b2d
mov ecx, 0x273f
call qword [sym.imp.WS2_32.dll_WSASetLastError]
or eax, 0xffffffff
jmp 0x140032b3d
Function at 0x140033c00
Capabilities:
Resolve dns

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
push rdi
sub rsp, 0x50
xor eax, eax
mov qword [r11 - 0x38], 0xc
xor ecx, ecx
mov qword [r11 - 0x30], rax
mov qword [r11 + 0x10], rcx
lea r9, [r11 + 0x10]
mov qword [r11 + 8], rcx
lea r8, [r11 - 0x38]
lea rcx, [0x14009f498]
mov qword [r11 - 0x28], rax
lea rdx, [0x14009e32c]
mov qword [r11 - 0x20], rax
mov qword [r11 - 0x18], rax
mov qword [r11 - 0x10], rax
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov edi, 1
lea r9, [rsp + 0x60]
lea r8, [rsp + 0x20]
mov dword [rsp + 0x28], edi
lea rdx, [0x14009e35c]
mov ebx, eax
lea rcx, str.1.2.3.4
call qword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
jne 0x140033c8e
mov ecx, dword [0x1400a4bd4]
test ebx, ebx
cmovne ecx, edi
mov dword [0x1400a4bd4], ecx
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140033cab
mov eax, dword [0x1400a4bd8]
cmp dword [rcx + 0xc], 0
cmove eax, edi
mov dword [0x1400a4bd8], eax
mov rax, qword [rsp + 0x68]
test rax, rax
je 0x140033cc3
mov rcx, rax
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140033cce
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
mov dword [0x1400a4bdc], edi
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x140038b20
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rdi, rcx
call fcn.14003c7d0
movzx ecx, byte [rdi + 0x91]
xor r8d, r8d
mov rsi, rax
mov dword [rsp + 0x50], 0
lea edx, [r8 + 1]
call qword [sym.imp.WS2_32.dll_socket]
mov r9, qword [rdi + 0x88]
mov rbx, rax
test byte [r9 + 0x30], 1
je 0x140038cca
cmp rax, 0xffffffffffffffff
jne 0x140038b7c
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
jmp 0x140038cab
add r9, 0x38
mov dword [rsp + 0x20], 8
mov edx, 0xffff
mov r8d, 0x700b
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rax, qword [rdi + 0x88]
test byte [rax + 0x28], 1
jne 0x140038bb1
mov rcx, rbx
call fcn.140031170
mov rcx, qword [rdi + 0x88]
mov r8d, 1
mov rdx, rbx
mov rcx, qword [rcx + 0x48]
call fcn.14003c960
test eax, eax
jns 0x140038bea
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_closesocket]
or eax, 0xffffffff
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
movzx edx, byte [rdi + 0x90]
lea rax, [rdi + 0x28]
mov rcx, qword [rdi + 0x88]
lea r8, [rdi + 0x98]
mov qword [rsp + 0x38], rax
xor r9d, r9d
shr edx, 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], edx
mov rdx, rbx
mov qword [rdi + 0x50], rbx
mov rcx, qword [rcx + 0x38]
call qword [rsi]
test eax, eax
je 0x140038c9e
mov rax, qword [rdi + 0x88]
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x140038c47
xor ecx, ecx
call fcn.1400346c0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rdi + 0x88]
mov rcx, qword [rcx + 0x40]
call fcn.14002e1f0
mov rcx, rax
lea rdx, [rdi + 0x60]
call fcn.14002e120
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, qword [rdi + 0x88]
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x140038cca
xor ecx, ecx
call fcn.1400346e0
xor eax, eax
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
je 0x140038cca
mov rcx, qword [rdi + 0x88]
mov dword [rdi + 0x58], eax
mov rcx, qword [rcx + 0x40]
call fcn.14002e1f0
mov rcx, rax
lea rdx, [rdi + 0x60]
call fcn.14002e120
mov rbx, qword [rsp + 0x58]
xor eax, eax
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x14003a4c0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
movzx eax, byte [0x1400a50f0]
lea rdi, [0x1400a50f0]
add al, 0xff
mov r11d, edx
xor r10d, r10d
mov rbx, rcx
nop dword [rax]
nop word [rax + rax]
inc al
mov byte [0x1400a50f0], al
movzx r8d, al
mov eax, r10d
cdq
inc r10d
idiv r11d
movzx r9d, byte [r8 + rdi + 2]
movsxd rax, edx
movzx ecx, byte [rax + rbx]
movzx eax, byte [0x1400a50f1]
add cl, r9b
add al, cl
mov byte [0x1400a50f1], al
movzx ecx, al
movzx eax, byte [rcx + rdi + 2]
mov byte [r8 + rdi + 2], al
movzx eax, byte [0x1400a50f1]
mov byte [rax + rdi + 2], r9b
movzx eax, byte [0x1400a50f0]
cmp r10d, 0x100
jl 0x14003a4f0
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
mov byte [0x1400a50f1], al
ret
Function at 0x14003a570
Capabilities:
Generate random numbers via winapi

Disassembly:
sub rsp, 0x68
mov rax, qword [0x1400a3708]
xor rax, rsp
mov qword [rsp + 0x50], rax
cmp dword [0x1400a50e0], 0
jne 0x14003a5dc
mov r9d, 1
mov dword [rsp + 0x20], 0xf0000000
xor r8d, r8d
lea rcx, [0x1400a5200]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x14003a5d2
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80090016
je 0x14003a5d2
or eax, 0xffffffff
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140042500
add rsp, 0x68
ret
mov dword [0x1400a50e0], 1
mov rcx, qword [0x1400a5200]
lea r8, [rsp + 0x30]
mov edx, 0x20
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x14003a5bd
movzx eax, byte [0x1400a50f0]
lea r10, [0x1400a50f0]
add al, 0xff
xor r9d, r9d
nop word [rax + rax]
inc al
mov byte [0x1400a50f0], al
movzx edx, al
mov eax, r9d
and eax, 0x1f
inc r9d
movzx r8d, byte [rdx + r10 + 2]
movzx ecx, byte [rsp + rax + 0x30]
movzx eax, byte [0x1400a50f1]
add cl, r8b
add al, cl
mov byte [0x1400a50f1], al
movzx ecx, al
movzx eax, byte [rcx + r10 + 2]
mov byte [rdx + r10 + 2], al
movzx eax, byte [0x1400a50f1]
mov byte [rax + r10 + 2], r8b
movzx eax, byte [0x1400a50f0]
cmp r9d, 0x100
jl 0x14003a610
mov byte [0x1400a50f1], al
xor eax, eax
mov dword [0x1400a51fc], 1
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140042500
add rsp, 0x68
ret
Function at 0x14003c800
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
cmp dword [0x1400a5208], 0
mov edi, ecx
jne 0x14003c821
lea rcx, [0x1400a5210]
call fcn.14003cc40
mov edx, 0x50
lea ecx, [rdx - 0x4f]
call fcn.14002db80
mov rbx, rax
test rax, rax
jne 0x14003c841
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov eax, 2
mov qword [rsp + 0x30], rsi
test edi, edi
mov edx, 8
cmovle edi, eax
movzx eax, di
add ax, ax
movsx rcx, ax
mov word [rbx + 0x30], ax
call fcn.14002db80
mov qword [rbx + 0x38], rax
test rax, rax
je 0x14003c913
mov r9d, edi
xor r8d, r8d
xor edx, edx
or rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov qword [rbx], rax
mov dword [rbx + 0x34], 0xffffffff
test rax, rax
je 0x14003c913
xor r9d, r9d
xor edx, edx
xor ecx, ecx
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
mov qword [rbx + 0x48], rax
test rax, rax
je 0x14003c913
xor edi, edi
cmp di, word [rbx + 0x30]
jge 0x14003c8f1
mov esi, edi
nop
mov r8, rbx
lea rcx, [0x14003cab0]
xor edx, edx
call fcn.140052340
cmp rax, 0xffffffffffffffff
je 0x14003c913
mov rcx, qword [rbx + 0x38]
inc edi
mov qword [rsi + rcx], rax
add rsi, 8
inc word [rbx + 0x40]
movsx eax, word [rbx + 0x30]
cmp edi, eax
jl 0x14003c8c0
lea rcx, [rbx + 8]
mov edx, 0x3e8
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
mov rsi, qword [rsp + 0x30]
mov rax, rbx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rcx, qword [rbx]
test rcx, rcx
je 0x14003c921
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x38]
test rcx, rcx
je 0x14003c92f
call fcn.14002dc70
mov rcx, qword [rbx + 0x48]
test rcx, rcx
je 0x14003c93e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call fcn.14002dc70
mov rsi, qword [rsp + 0x30]
xor eax, eax
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400404a0
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x50
xor r12d, r12d
mov rsi, rdx
mov rdi, rcx
test rcx, rcx
je 0x1400404c7
test byte [rcx + 0x38], 0x10
mov rbp, rcx
jne 0x1400404ca
mov rbp, r12
or r13d, 0xffffffff
test rdi, rdi
je 0x14004065f
mov rdx, qword [rcx + 0x30]
test rdx, rdx
je 0x1400404e7
xor ecx, ecx
call fcn.1400346c0
mov eax, dword [rbp + 0x98]
test al, 1
jne 0x14004066e
test byte [rdi + 0x38], 2
jne 0x14004064f
test al, 2
jne 0x14004064f
mov rax, qword [rdi + 0x18]
test rax, rax
jne 0x140040518
mov r13d, r12d
jmp 0x14004064f
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], r15
test rsi, rsi
js 0x140040534
cmp rsi, rax
jbe 0x140040537
mov rsi, rax
mov edx, 1
mov rcx, rdi
call fcn.14001fd50
lea r14, [rbp + 0xb0]
mov qword [rbp + 0xa0], r12
mov rcx, r14
mov dword [rbp + 0xa8], r12d
xor edx, edx
mov r8d, 0x100
call fcn.140045920
mov rbx, qword [rdi]
mov r15d, r12d
mov qword [rbp + 0xa0], rbx
test rbx, rbx
je 0x1400405bc
mov rax, qword [rbx + 0x28]
mov edx, 0x20
add rax, qword [rbx + 0x10]
mov rcx, rbx
mov qword [r14 + 8], rax
call fcn.140020040
inc r15d
cmp rsi, qword [rbx + 0x18]
jbe 0x1400405b9
mov eax, dword [rbx + 0x18]
inc r12
mov dword [r14], eax
add r14, 0x10
sub rsi, qword [rbx + 0x18]
mov rbx, qword [rbx]
cmp r12, 0x10
jl 0x140040576
jmp 0x1400405bc
mov dword [r14], esi
mov rcx, rdi
mov dword [rbp + 0xa8], r15d
call fcn.14001ffc0
mov rax, qword [rsp + 0x90]
lea r9, [rsp + 0x80]
mov rcx, qword [rbp + 0x90]
lea rdx, [rbp + 0xb0]
xor ebx, ebx
mov r8d, r15d
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebx
call qword [sym.imp.WS2_32.dll_WSASend]
mov r15, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
test eax, eax
je 0x14004063d
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
je 0x14004063d
lea edx, [rbx + 0x20]
mov rcx, rbp
call fcn.140040a90
lea edx, [rbx + 1]
mov rcx, rdi
call fcn.14001fda0
mov rcx, rdi
call fcn.14001d7d0
jmp 0x140040647
or dword [rbp + 0x98], 2
mov r13d, ebx
mov rbx, qword [rsp + 0x88]
mov rdx, qword [rdi + 0x30]
test rdx, rdx
je 0x14004065f
xor ecx, ecx
call fcn.1400346e0
mov eax, r13d
add rsp, 0x50
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rax, [0x1400a3400]
mov r9d, 0xb9
mov qword [rsp + 0x28], rax
lea r8, [0x1400a3438]
lea rax, [0x1400a3418]
mov ecx, 0xdeaddead
lea rdx, [0x1400a3448]
mov qword [rsp + 0x20], rax
call fcn.140034040
mov ecx, 2
call fcn.14004bcdc
mov rcx, rax
lea r8, [0x1400a34a8]
lea rax, str.evbuffer_launch_write
mov r9d, 0xb9
mov qword [rsp + 0x28], rax
lea rdx, [0x1400a34b8]
lea rax, str._buf_o__read_in_progress
mov qword [rsp + 0x20], rax
call fcn.1400193c0
call fcn.140054a44
int3
Function at 0x140053bf0
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov esi, r8d
mov ebx, edx
mov r14d, ecx
test r8d, r8d
jne 0x1400539c4
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400539c4
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400539c4
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400539c4
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400539c4
cmp dword [rcx + 0x84], 0xe
jbe 0x1400539c4
cmp dword [rcx + 0xf8], esi
je 0x1400539c4
mov ecx, r14d
call fcn.140053b0c
mov ecx, 2
call fcn.140059218
nop
cmp byte [0x1400a6440], 0
jne 0x140053a8e
mov r15d, 1
mov eax, r15d
xchg dword [0x1400a6430], eax
test ebx, ebx
jne 0x140053a37
mov rdi, qword [0x1400a3708]
mov edx, edi
and edx, 0x3f
lea ecx, [rbx + 0x40]
sub ecx, edx
xor eax, eax
ror rax, cl
xor rax, rdi
mov rcx, qword [0x1400a6438]
cmp rcx, rax
je 0x140053a2e
xor rdi, rcx
mov ecx, edx
ror rdi, cl
mov rcx, rdi
call qword [fcn.1400012a0]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rdi
lea rcx, [0x1400a6798]
jmp 0x140053a43
cmp ebx, r15d
jne 0x140053a49
lea rcx, [0x1400a67b0]
call fcn.14005e760
nop
test ebx, ebx
jne 0x140053a60
lea rdx, [0x140072858]
lea rcx, [0x140072830]
call fcn.14005ea28
lea rdx, [0x140072868]
lea rcx, [0x140072860]
call fcn.14005ea28
movzx eax, byte [0x1400a6440]
test esi, esi
cmove eax, r15d
mov byte [0x1400a6440], al
jmp 0x140053a8e
mov ecx, 2
call fcn.14005926c
test esi, esi
jne 0x140053aa5
mov ecx, r14d
call fcn.140053ac0
int3
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
xor r8d, r8d
xor edx, edx
jmp 0x140053954