joyce8/EMBER2024-capa huggingface dataset:
Function at 0x37b061850
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x37b06c064]
mov rbx, rcx
test esi, esi
jle 0x37b061980
mov rax, qword [0x37b06c068]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x37b06189b
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x37b061925
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x37b061880
mov rcx, rbx
call dbg.__mingw_GetSectionForAddress
mov rdi, rax
test rax, rax
je 0x37b0619a2
mov rax, qword [0x37b06c068]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call dbg._GetPEImageBase
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x37b06c068]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x37b061987
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x37b06191e
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x37b061930
add dword [0x37b06c064], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x37b06c068]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x37b06191e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call dbg.__report_error
nop dword [rax]
xor esi, esi
jmp 0x37b0618a8
mov rax, qword [0x37b06c068]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call dbg.__report_error
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call dbg.__report_error
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x37b061d20
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x37b06c0a0]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x37b06c080]
test rbx, rbx
je 0x37b061d7c
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x37b061d73
test rsi, rsi
je 0x37b061d73
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x37b061d58
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x37b061f90
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x37b061fa8
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
je 0x37b061fb0
ret
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret
Function at 0x37b061fc0
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
movzx r8d, word [rcx + 6]
lea rax, [rcx + rax + 0x18]
test r8w, r8w
je 0x37b06200d
lea ecx, [r8 - 1]
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rcx, r8
cmp rdx, r8
jb 0x37b062004
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x37b06200f
add rax, 0x28
cmp rax, r9
jne 0x37b061ff0
xor eax, eax
ret

Function at 0x37b062010
Capabilities:
Parse pe header

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, rcx
call sym.strlen
cmp rax, 8
ja 0x37b0620a0
mov rdx, qword [0x37b069650]
xor ebx, ebx
cmp word [rdx], 0x5a4d
jne 0x37b06208e
movsxd rax, dword [rdx + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
jne 0x37b06208e
cmp word [rax + 0x18], 0x20b
jne 0x37b06208e
movzx edx, word [rax + 0x14]
lea rbx, [rax + rdx + 0x18]
movzx edx, word [rax + 6]
test dx, dx
je 0x37b0620a0
lea eax, [rdx - 1]
lea rax, [rax + rax*4]
lea rdi, [rbx + rax*8 + 0x28]
jmp 0x37b062079
add rbx, 0x28
cmp rbx, rdi
je 0x37b0620a0
mov r8d, 8
mov rdx, rsi
mov rcx, rbx
call sym.strncmp
test eax, eax
jne 0x37b062070
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
xor ebx, ebx
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret

Function at 0x37b0620b0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x37b069650]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x37b0620d0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x37b0620d8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x37b0620d0
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x37b06212d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x37b062124
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x37b0620d0
add rax, 0x28
cmp rax, r9
jne 0x37b062110
xor eax, eax
ret

Function at 0x37b062130
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x37b069650]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x37b06214f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x37b062158
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x37b06214f
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x37b062170
Capabilities:
Parse pe header

Disassembly:
mov r8, qword [0x37b069650]
xor eax, eax
cmp word [r8], 0x5a4d
jne 0x37b062190
movsxd rdx, dword [r8 + 0x3c]
add rdx, r8
cmp dword [rdx], 0x4550
je 0x37b062198
ret
cmp word [rdx + 0x18], 0x20b
jne 0x37b062190
movzx eax, word [rdx + 0x14]
movzx r8d, word [rdx + 6]
lea rax, [rdx + rax + 0x18]
test r8w, r8w
je 0x37b0621e0
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea rdx, [rax + rdx*8 + 0x28]
nop dword [rax]
test byte [rax + 0x27], 0x20
je 0x37b0621d7
test rcx, rcx
je 0x37b062190
sub rcx, 1
add rax, 0x28
cmp rax, rdx
jne 0x37b0621c8
xor eax, eax
ret
Function at 0x37b0621f0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x37b069650]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x37b06220f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x37b062218
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret

Function at 0x37b062230
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x37b069650]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x37b062250
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x37b062258
ret
cmp word [r8 + 0x18], 0x20b
jne 0x37b062250
sub rcx, rdx
movzx r9d, word [r8 + 6]
movzx edx, word [r8 + 0x14]
lea rdx, [r8 + rdx + 0x18]
test r9w, r9w
je 0x37b062250
lea eax, [r9 - 1]
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rdx + 0xc]
mov rax, r8
cmp rcx, r8
jb 0x37b0622a4
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x37b0622b0
add rdx, 0x28
cmp r9, rdx
jne 0x37b062290
xor eax, eax
ret
mov eax, dword [rdx + 0x24]
not eax
shr eax, 0x1f
ret

Function at 0x37b0622c0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov r11, qword [0x37b069650]
xor r9d, r9d
cmp word [r11], 0x5a4d
jne 0x37b0622e2
movsxd r8, dword [r11 + 0x3c]
add r8, r11
cmp dword [r8], 0x4550
je 0x37b0622f0
mov rax, r9
ret
cmp word [r8 + 0x18], 0x20b
jne 0x37b0622e2
mov eax, dword [r8 + 0x90]
test eax, eax
je 0x37b0622e2
movzx edx, word [r8 + 0x14]
movzx r10d, word [r8 + 6]
lea rdx, [r8 + rdx + 0x18]
test r10w, r10w
je 0x37b0622e2
lea r8d, [r10 - 1]
lea r8, [r8 + r8*4]
lea r10, [rdx + r8*8 + 0x28]
nop word cs:[rax + rax]
mov r9d, dword [rdx + 0xc]
mov r8, r9
cmp rax, r9
jb 0x37b062345
add r8d, dword [rdx + 8]
cmp rax, r8
jb 0x37b062358
add rdx, 0x28
cmp rdx, r10
jne 0x37b062330
xor r9d, r9d
mov rax, r9
ret
add rax, r11
jmp 0x37b062367
sub ecx, 1
add rax, 0x14
mov r8d, dword [rax + 4]
test r8d, r8d
jne 0x37b062377
mov edx, dword [rax + 0xc]
test edx, edx
je 0x37b06234e
test ecx, ecx
jg 0x37b062360
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
ret
Function at 0x140013ec0
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140013cec

Function at 0x140004000
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
cld
and rsp, 0xfffffffffffffff0
call fcn.1400040d6
push r9
push r8
push rdx
xor rdx, rdx
push rcx
mov rdx, qword gs:[rdx + 0x60]
mov rdx, qword [rdx + 0x18]
push rsi
mov rdx, qword [rdx + 0x20]
movzx rcx, word [rdx + 0x4a]
xor r9, r9
mov rsi, qword [rdx + 0x50]
xor rax, rax
lodsb al, byte [rsi]
cmp al, 0x61
jl 0x140004037
sub al, 0x20
ror r9d, 0xd
add r9d, eax
loop 0x14000402d
push rdx
push r9
mov rdx, qword [rdx + 0x20]
mov eax, dword [rdx + 0x3c]
add rax, rdx
cmp word [rax + 0x18], 0x20b
jne 0x1400040cb
mov eax, dword [rax + 0x88]
test rax, rax
je 0x1400040cb
add rax, rdx
mov r8d, dword [rax + 0x20]
push rax
add r8, rdx
mov ecx, dword [rax + 0x18]
jrcxz 0x1400040ca
xor r9, r9
dec rcx
mov esi, dword [r8 + rcx*4]
add rsi, rdx
xor rax, rax
ror r9d, 0xd
lodsb al, byte [rsi]
add r9d, eax
cmp al, ah
jne 0x140004081
add r9, qword [rsp + 8]
cmp r9d, r10d
jne 0x140004072
pop rax
mov r8d, dword [rax + 0x24]
add r8, rdx
mov cx, word [r8 + rcx*2]
mov r8d, dword [rax + 0x1c]
add r8, rdx
mov eax, dword [r8 + rcx*4]
add rax, rdx
pop r8
pop r8
pop rsi
pop rcx
pop rdx
pop r8
pop r9
pop r10
sub rsp, 0x20
push r10
jmp rax
pop rax
pop r9
pop rdx
mov rdx, qword [rdx]
jmp 0x140004021
Function at 0x14002efb0
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
mov eax, reloc.LIBEAY32.dll_Ordinal_255
call fcn.14004f210
sub rsp, rax
mov rax, qword [0x14007b940]
xor rax, rsp
mov qword [rsp + reloc.LIBEAY32.dll_Ordinal_576], rax
mov rdi, rcx
call sub.LIBEAY32.dll_Ordinal_91
mov rcx, rax
call sub.LIBEAY32.dll_Ordinal_78_1
mov rsi, rax
test rax, rax
je reloc.LIBEAY32.dll_Ordinal_255
mov r9, qword [0x14006f838]
xor r8d, r8d
mov rcx, rsi
mov qword [rsp + 0x268], rbx
lea edx, [r8 + 0x64]
call sub.LIBEAY32.dll_Ordinal_52_1
test rdi, rdi
jne reloc.LIBEAY32.dll_Ordinal_255
mov rcx, qword [0x14007c718]
call sub.SSLEAY32.dll_Ordinal_75
mov rbx, rax
jmp reloc.LIBEAY32.dll_Ordinal_255
mov rcx, rdi
mov rbx, rdi
call sub.SSLEAY32.dll_Ordinal_86
mov r8, rsi
mov rdx, rsi
mov rcx, rbx
call sub.SSLEAY32.dll_Ordinal_83
mov rcx, rbx
call sub.SSLEAY32.dll_Ordinal_43
mov ecx, eax
mov esi, eax
call sub.LIBEAY32.dll_Ordinal_107
test eax, eax
je reloc.LIBEAY32.dll_Ordinal_255
mov qword [rsp + 0x270], rbp
xor ebp, ebp
nop dword [rax]
mov rcx, qword [0x14007cc10]
lea rdx, str.DELAY_n
call sub.LIBEAY32.dll_Ordinal_86_1
mov rcx, rbx
call sub.SSLEAY32.dll_Ordinal_59
xor r9d, r9d
mov dword [rsp + 0x30], 1
xor r8d, r8d
mov qword [rsp + 0x20], rbp
lea rdx, [rsp + 0x30]
lea ecx, [rax + 1]
mov eax, eax
mov qword [rsp + 0x38], rax
call qword [sym.imp.WS2_32.dll_select]
mov rcx, rbx
call sub.SSLEAY32.dll_Ordinal_43
mov ecx, eax
mov esi, eax
call sub.LIBEAY32.dll_Ordinal_107
test eax, eax
jne reloc.LIBEAY32.dll_Ordinal_255
mov rbp, qword [rsp + 0x270]
test esi, esi
jg reloc.LIBEAY32.dll_Ordinal_255
mov rcx, qword [0x14007cc10]
lea rdx, str.ERROR_n
call sub.LIBEAY32.dll_Ordinal_86_1
mov ecx, dword [0x14007c77c]
test ecx, ecx
je reloc.LIBEAY32.dll_Ordinal_255
call sub.LIBEAY32.dll_Ordinal_680
mov rcx, qword [0x14007cc10]
lea rdx, str.verify_error:_s_n
mov r8, rax
call sub.LIBEAY32.dll_Ordinal_86_1
jmp reloc.LIBEAY32.dll_Ordinal_255
mov rcx, qword [0x14007cc10]
call sub.LIBEAY32.dll_Ordinal_250
test rdi, rdi
jne reloc.LIBEAY32.dll_Ordinal_255
mov rcx, rbx
call sub.SSLEAY32.dll_Ordinal_48
xor eax, eax
jmp reloc.LIBEAY32.dll_Ordinal_255
mov rax, rbx
mov rbx, qword [rsp + 0x268]
mov rcx, qword [rsp + reloc.LIBEAY32.dll_Ordinal_576]
xor rcx, rsp
call fcn.14004f590
mov rsi, qword [rsp + 0x278]
add rsp, reloc.LIBEAY32.dll_Ordinal_255
pop rdi
ret
Function at 0x140030140
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
mov eax, reloc.LIBEAY32.dll_Ordinal_255
call fcn.14004f210
sub rsp, rax
mov rax, qword [0x14007b940]
xor rax, rsp
mov qword [rsp + 0x420], rax
mov rbx, rdx
mov esi, r8d
mov rdi, rcx
lea rdx, str.pass:
mov rcx, rbx
mov r8d, 5
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
jne reloc.LIBEAY32.dll_Ordinal_255
lea rcx, [rbx + 5]
call sub.LIBEAY32.dll_Ordinal_170
jmp reloc.LIBEAY32.dll_Ordinal_255
mov r8d, 4
lea rdx, str.env:
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
jne reloc.LIBEAY32.dll_Ordinal_255
lea rcx, [rbx + 4]
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
jne reloc.LIBEAY32.dll_Ordinal_255
lea r8, [rbx + 4]
lea rdx, str.Cant_read_environment_variable__s_n
jmp reloc.LIBEAY32.dll_Ordinal_255
mov rcx, rax
call sub.LIBEAY32.dll_Ordinal_170
jmp reloc.LIBEAY32.dll_Ordinal_255
test esi, esi
je reloc.LIBEAY32.dll_Ordinal_255
mov rax, qword [0x14007c740]
test rax, rax
jne reloc.LIBEAY32.dll_Ordinal_255
mov r8d, 5
lea rdx, str.file:
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
jne reloc.LIBEAY32.dll_Ordinal_255
lea rdx, [0x14006fcf4]
lea rcx, [rbx + 5]
call sub.LIBEAY32.dll_Ordinal_82_1
mov qword [0x14007c740], rax
test rax, rax
jne reloc.LIBEAY32.dll_Ordinal_255
lea r8, [rbx + 5]
lea rdx, str.Cant_open_file__s_n
jmp reloc.LIBEAY32.dll_Ordinal_255
lea r8, [0x14006fe60]
mov rax, rbx
sub r8, rbx
nop dword [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne reloc.LIBEAY32.dll_Ordinal_255
inc rax
test ecx, ecx
jne reloc.LIBEAY32.dll_Ordinal_255
test edx, edx
jne reloc.LIBEAY32.dll_Ordinal_255
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
xor edx, edx
call sub.LIBEAY32.dll_Ordinal_83_1
mov qword [0x14007c740], rax
test rax, rax
jne reloc.LIBEAY32.dll_Ordinal_255
lea rdx, str.Cant_open_BIO_for_stdin_n
mov rcx, rdi
call sub.LIBEAY32.dll_Ordinal_86_1
jmp reloc.LIBEAY32.dll_Ordinal_255
mov r8d, reloc.LIBEAY32.dll_Ordinal_255
lea rdx, [rsp + 0x20]
mov rcx, rax
call sub.LIBEAY32.dll_Ordinal_76
mov ebx, eax
cmp esi, 1
je reloc.LIBEAY32.dll_Ordinal_255
mov rcx, qword [0x14007c740]
call sub.LIBEAY32.dll_Ordinal_67
mov qword [0x14007c740], 0
test ebx, ebx
jg reloc.LIBEAY32.dll_Ordinal_255
lea rdx, str.Error_reading_password_from_BIO_n
mov rcx, rdi
call sub.LIBEAY32.dll_Ordinal_86_1
jmp reloc.LIBEAY32.dll_Ordinal_255
mov edx, 0xa
lea rcx, [rsp + 0x20]
call qword [sym.imp.VCRUNTIME140.dll_strchr]
test rax, rax
je reloc.LIBEAY32.dll_Ordinal_255
mov byte [rax], 0
lea rcx, [rsp + 0x20]
call sub.LIBEAY32.dll_Ordinal_170
jmp reloc.LIBEAY32.dll_Ordinal_255
mov r8, rbx
lea rdx, str.Invalid_password_argument___s__n
mov rcx, rdi
call sub.LIBEAY32.dll_Ordinal_86_1
xor eax, eax
mov rcx, qword [rsp + 0x420]
xor rcx, rsp
call fcn.14004f590
lea r11, [rsp + 0x430]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140033a60
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
mov eax, reloc.SSLEAY32.dll_Ordinal_48
call fcn.14004f210
sub rsp, rax
mov rdi, rcx
mov ebx, edx
mov ecx, reloc.LIBEAY32.dll_Ordinal_255
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x20], 0
mov rcx, rax
mov r8d, ebx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rbx, qword [rsp + 0x40]
or ecx, reloc.LIBEAY32.dll_Ordinal_255
test eax, eax
cmovne ecx, dword [rsp + 0x50]
mov eax, ecx
add rsp, 0x30
pop rdi
ret

Function at 0x140033ac0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
mov eax, reloc.SSLEAY32.dll_Ordinal_48
call fcn.14004f210
sub rsp, rax
mov rdi, rcx
mov ebx, edx
mov ecx, reloc.LIBEAY32.dll_Ordinal_255
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x20], 0
mov rcx, rax
mov r8d, ebx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rbx, qword [rsp + 0x40]
or ecx, reloc.LIBEAY32.dll_Ordinal_255
test eax, eax
cmovne ecx, dword [rsp + 0x50]
mov eax, ecx
add rsp, 0x30
pop rdi
ret
Function at 0x1400378d0
Capabilities:
Resolve dns

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
mov eax, reloc.SSLEAY32.dll_Ordinal_32
call fcn.14004f210
sub rsp, rax
xor esi, esi
lea r14, [0x14007c9e0]
mov r15d, esi
lea r12, [0x14007c940]
or ebp, reloc.LIBEAY32.dll_Ordinal_255
mov edi, esi
mov rbx, rcx
mov ecx, dword [r14]
cmp ebp, ecx
jbe reloc.LIBEAY32.dll_Ordinal_255
mov ebp, ecx
mov r15d, edi
movsxd rax, edi
imul rdx, rax, 0xa8
test ecx, ecx
je reloc.LIBEAY32.dll_Ordinal_255
add rdx, r12
mov r8d, Ordinal_130
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
je reloc.LIBEAY32.dll_Ordinal_255
inc edi
add r14, 0xa8
cmp edi, 4
jl reloc.LIBEAY32.dll_Ordinal_255
cmp edi, 4
jne reloc.LIBEAY32.dll_Ordinal_255
inc dword [0x14007c798]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_gethostbyname]
mov r8, rax
test rax, rax
je reloc.LIBEAY32.dll_Ordinal_255
mov rax, rbx
cmp byte [rbx], sil
je reloc.LIBEAY32.dll_Ordinal_255
nop dword [rax]
cmp esi, reloc.LIBEAY32.dll_Ordinal_255
jae reloc.LIBEAY32.dll_Ordinal_255
inc rax
inc esi
cmp byte [rax], 0
jne reloc.LIBEAY32.dll_Ordinal_255
btr esi, 0x1f
cmp esi, 0x80
jae reloc.LIBEAY32.dll_Ordinal_255
movsxd rax, r15d
imul r9, rax, 0xa8
mov rcx, r9
sub rcx, rbx
add rcx, r12
movzx eax, byte [rbx]
mov byte [rcx + rbx], al
lea rbx, [rbx + 1]
test al, al
jne reloc.LIBEAY32.dll_Ordinal_255
movups xmm0, xmmword [r8]
mov edx, dword [0x14007c794]
add edx, dword [0x14007c798]
movups xmmword [r9 + r12 + 0x80], xmm0
movups xmm1, xmmword [r8 + 0x10]
mov dword [r9 + r12 + 0xa0], edx
movups xmmword [r9 + r12 + 0x90], xmm1
mov rax, r8
jmp reloc.LIBEAY32.dll_Ordinal_255
mov ecx, dword [0x14007c794]
inc ecx
movsxd rax, edi
imul rdx, rax, 0xa8
mov dword [0x14007c794], ecx
lea rax, [r12 + 0x80]
add ecx, dword [0x14007c798]
add rax, rdx
mov dword [rdx + r12 + 0xa0], ecx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x140037e90
Capabilities:
Connect socket
Set socket configuration

Disassembly:
push rbx
push rbp
push rsi
push rdi
mov eax, reloc.LIBEAY32.dll_Ordinal_88
call fcn.14004f210
sub rsp, rax
mov rax, qword [0x14007b940]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov edi, r9d
mov ebp, r8d
mov rbx, rdx
mov rsi, rcx
call fcn.1400381a0
test eax, eax
je reloc.LIBEAY32.dll_Ordinal_255
xor eax, eax
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x38], rax
mov r14d, 2
movzx ecx, bp
mov word [rsp + 0x38], r14w
mov qword [rsp + 0x40], rax
call qword [sym.imp.WS2_32.dll_htons]
movzx ecx, byte [rbx]
shl ecx, 8
mov word [rsp + 0x3a], ax
movzx eax, byte [rbx + 1]
or ecx, eax
movzx eax, byte [rbx + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 3]
shl ecx, 8
or ecx, eax
call qword [sym.imp.WS2_32.dll_htonl]
mov dword [rsp + 0x3c], eax
mov ecx, r14d
cmp edi, 1
jne reloc.LIBEAY32.dll_Ordinal_255
mov edx, edi
lea r8d, [r14 + 4]
call qword [sym.imp.WS2_32.dll_socket]
mov rbx, rax
jmp reloc.LIBEAY32.dll_Ordinal_255
mov r8d, Ordinal_22
mov edx, r14d
call qword [sym.imp.WS2_32.dll_socket]
mov ebx, eax
mov r14, qword [rsp + 0x50]
cmp ebx, reloc.LIBEAY32.dll_Ordinal_255
jne reloc.LIBEAY32.dll_Ordinal_255
lea rcx, str.socket
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_perror]
xor eax, eax
jmp reloc.LIBEAY32.dll_Ordinal_255
cmp edi, 1
jne reloc.LIBEAY32.dll_Ordinal_255
movsxd rdi, ebx
lea r9, [rsp + 0x30]
mov rcx, rdi
mov dword [rsp + 0x30], 0
mov edx, reloc.LIBEAY32.dll_Ordinal_255
mov dword [rsp + 0x20], 4
mov r8d, 8
call qword [sym.imp.WS2_32.dll_setsockopt]
mov dword [rsp + 0x30], eax
test eax, eax
jns reloc.LIBEAY32.dll_Ordinal_255
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
lea rcx, str.keepalive
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_perror]
xor eax, eax
jmp reloc.LIBEAY32.dll_Ordinal_255
movsxd rdi, ebx
lea rdx, [rsp + 0x38]
mov rcx, rdi
mov r8d, reloc.SSLEAY32.dll_Ordinal_16
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, reloc.LIBEAY32.dll_Ordinal_255
jne reloc.LIBEAY32.dll_Ordinal_255
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
lea rcx, str.connect
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_perror]
xor eax, eax
jmp reloc.LIBEAY32.dll_Ordinal_255
mov dword [rsi], ebx
mov eax, 1
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14004f590
add rsp, 0x58
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140038010
Capabilities:
Set socket configuration

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
mov eax, reloc.LIBEAY32.dll_Ordinal_80
call fcn.14004f210
sub rsp, rax
mov rax, qword [0x14007b940]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r9d
mov rbx, r8
mov edi, edx
mov r14, rcx
xor esi, esi
call fcn.1400381a0
test eax, eax
je reloc.LIBEAY32.dll_Ordinal_255
xor eax, eax
mov qword [rsp + 0x98], r15
mov qword [rsp + 0x38], rax
mov r15d, 2
movzx ecx, di
mov word [rsp + 0x38], r15w
mov qword [rsp + 0x40], rax
call qword [sym.imp.WS2_32.dll_htons]
mov word [rsp + 0x3a], ax
test rbx, rbx
jne reloc.LIBEAY32.dll_Ordinal_255
mov dword [rsp + 0x3c], esi
jmp reloc.LIBEAY32.dll_Ordinal_255
mov eax, dword [rbx]
mov dword [rsp + 0x3c], eax
mov ecx, r15d
cmp ebp, 1
jne reloc.LIBEAY32.dll_Ordinal_255
mov edx, ebp
lea r8d, [rbp + 5]
call qword [sym.imp.WS2_32.dll_socket]
mov rdi, rax
jmp reloc.LIBEAY32.dll_Ordinal_255
mov r8d, Ordinal_22
mov edx, r15d
call qword [sym.imp.WS2_32.dll_socket]
mov edi, eax
mov r15, qword [rsp + 0x98]
cmp edi, reloc.LIBEAY32.dll_Ordinal_255
je reloc.LIBEAY32.dll_Ordinal_255
movsxd rbx, edi
lea r9, [rsp + 0x30]
mov rcx, rbx
mov dword [rsp + 0x30], 1
mov edx, reloc.LIBEAY32.dll_Ordinal_255
mov dword [rsp + 0x20], 4
mov r8d, 4
call qword [sym.imp.WS2_32.dll_setsockopt]
mov r8d, reloc.SSLEAY32.dll_Ordinal_16
lea rdx, [rsp + 0x38]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_bind]
cmp eax, reloc.LIBEAY32.dll_Ordinal_255
je reloc.LIBEAY32.dll_Ordinal_255
cmp ebp, 1
jne reloc.LIBEAY32.dll_Ordinal_255
lea edx, [rbp + 0x7f]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_listen]
cmp eax, reloc.LIBEAY32.dll_Ordinal_255
je reloc.LIBEAY32.dll_Ordinal_255
mov dword [r14], edi
mov esi, 1
jmp reloc.LIBEAY32.dll_Ordinal_255
xor edx, edx
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_shutdown]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_closesocket]
mov eax, esi
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14004f590
add rsp, 0x50
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x1400381a0
Capabilities:
Initialize winsock library

Disassembly:
mov eax, reloc.SSLEAY32.dll_Ordinal_40
call fcn.14004f210
sub rsp, rax
cmp dword [0x14007c790], 0
jne reloc.LIBEAY32.dll_Ordinal_255
lea rdx, [0x140038160]
lea ecx, [rax - 0x26]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_signal]
xor edx, edx
mov dword [0x14007c790], 1
mov r8d, reloc.LIBEAY32.dll_Ordinal_255
lea rcx, [0x14007c7a0]
call sub.VCRUNTIME140.dll_memset
mov ecx, reloc.LIBEAY32.dll_Ordinal_255
lea rdx, [0x14007c7a0]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je reloc.LIBEAY32.dll_Ordinal_255
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov rcx, qword [0x14007cc10]
lea rdx, str.unable_to_start_WINSOCK__error_code_d_n
mov r8d, eax
call sub.LIBEAY32.dll_Ordinal_86_1
xor eax, eax
add rsp, 0x28
ret
mov eax, 1
add rsp, 0x28
ret