joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401383b6
Capabilities:
Parse pe header

Disassembly:
jmp 0x1402836e0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140283700
xor al, al
jmp 0x140283781
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140283713
xor al, al
jmp 0x140283781
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14028373d
xor al, al
jmp 0x140283781
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140283751
xor al, al
jmp 0x140283781
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140283763
xor al, al
jmp 0x140283781
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14028377f
xor al, al
jmp 0x140283781
mov al, 1
add rsp, 0x38
ret

Function at 0x1401387ee
Capabilities:
Initialize winsock library

Disassembly:
jmp 0x1401753f0
push rbp
push rdi
sub rsp, 0x3d8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x8a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140447638]
xor rax, rbp
mov qword [rbp + 0x398], rax
lea rcx, reloc.WS2_32.dll_accept
call fcn.14013aa58
lea rax, str.conf_packet_athena.conf
mov qword [rbp + 8], rax
mov dword [rbp + 0x24], 0x1000
mov eax, 2
mov word [rbp + 0x204], ax
lea rdx, [rbp + 0x50]
movzx ecx, word [rbp + 0x204]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x140175471
lea rcx, str.socket_init:_WinSock_not_available__n
call fcn.140136688
jmp 0x14017557b
movzx eax, word [rbp + 0x50]
and rax, 0xff
movzx eax, al
cmp eax, 2
jne 0x140175498
movzx eax, word [rbp + 0x50]
shr rax, 8
and rax, 0xff
movzx eax, al
test eax, eax
je 0x1401754a9
lea rcx, str.socket_init:_WinSock_version_mismatch__2.0_or_compatible_required___n
call fcn.140136688
jmp 0x14017557b
mov edx, reloc.WS2_32.dll_recv
lea rcx, [0x140460bf0]
call fcn.14013aa49
mov dword [0x140460be4], eax
mov dword [0x140460c30], 0
lea rcx, str.Server_uses_e_1_37mselecte_0m_as_event_dispatcher_n
call fcn.140139577
mov r8d, 0x200
xor edx, edx
lea rcx, [0x14046cc40]
call fcn.140138aeb
mov rcx, qword [rbp + 8]
call fcn.140136f57
xor ecx, ecx
call fcn.1401756d0
mov qword [0x140460be8], rax
lea r9, [0x140139b03]
lea r8, [0x140133f19]
lea rdx, [0x1401380f0]
xor ecx, ecx
call fcn.1401720a0
mov r8d, 0x80000
xor edx, edx
lea rcx, [0x140475270]
call fcn.140138aeb
lea rdx, str.connect_check_clear
lea rcx, [0x140171b60]
call fcn.140135689
call fcn.14013984c
add rax, 0x3e8
mov dword [rsp + 0x20], 0x493e0
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140171b60]
mov rcx, rax
call fcn.14013ac29
mov edx, dword [rbp + 0x24]
lea rcx, str.Server_supports_up_to_e_1_37m_ue_0m_concurrent_connections._n
call fcn.140139577
lea rcx, [rbp - 0x30]
lea rdx, reloc.WS2_32.dll_accept
call fcn.1401394d7
mov rcx, qword [rbp + 0x398]
xor rcx, rbp
call fcn.140136af2
lea rsp, [rbp + 0x3a8]
pop rdi
pop rbp
ret
Function at 0x140138fcd
Capabilities:
Terminate process

Disassembly:
jmp 0x1402abaf0
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov ecx, reloc.WS2_32.dll_socket
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x1402abb1e
mov ecx, 5
int 0x29
mov r8d, 1
mov edx, 0xc0000417
mov ecx, 2
call fcn.14013a166
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000417
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x140139b99
Capabilities:
Set current directory

Disassembly:
jmp 0x1403907d0
mov qword [rsp + 8], rcx
sub rsp, 0x68
lea rcx, [rsp + 0x30]
call fcn.140135cc4
call fcn.140137141
mov r8d, eax
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x70]
call fcn.14013580f
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x14039081d
mov dword [rsp + 0x24], 0
lea rcx, [rsp + 0x30]
call fcn.1401364ee
mov eax, dword [rsp + 0x24]
jmp 0x140390842
lea rcx, [rsp + 0x30]
call fcn.140135b66
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov dword [rsp + 0x28], eax
lea rcx, [rsp + 0x30]
call fcn.1401364ee
mov eax, dword [rsp + 0x28]
add rsp, 0x68
ret
Function at 0x14013a201
Capabilities:
Print debug messages

Disassembly:
jmp 0x14035d440
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add rsp, 0x28
ret
Function at 0x14013a409
Capabilities:
Set thread local storage value

Disassembly:
jmp 0x1402a5f50
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.1402a58a0
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1402a5f99
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x140539020]
jmp 0x1402a5fa8
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
add rsp, 0x48
ret

Function at 0x14013a5a3
Capabilities:
Set environment variable

Disassembly:
jmp 0x140390680
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xb8
lea rcx, [rsp + 0x78]
call fcn.140135cc4
lea rcx, [rsp + 0x48]
call fcn.140135cc4
call fcn.140137141
mov r8d, eax
lea rdx, [rsp + 0x78]
mov rcx, qword [rsp + 0xc0]
call fcn.14013580f
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x1403906ef
mov dword [rsp + 0x24], 0
lea rcx, [rsp + 0x48]
call fcn.1401364ee
lea rcx, [rsp + 0x78]
call fcn.1401364ee
mov eax, dword [rsp + 0x24]
jmp 0x140390780
call fcn.140137141
mov r8d, eax
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0xc8]
call fcn.14013580f
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
je 0x140390736
mov dword [rsp + 0x2c], 0
lea rcx, [rsp + 0x48]
call fcn.1401364ee
lea rcx, [rsp + 0x78]
call fcn.1401364ee
mov eax, dword [rsp + 0x2c]
jmp 0x140390780
lea rcx, [rsp + 0x48]
call fcn.140135b66
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x78]
call fcn.140135b66
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0x48]
call fcn.1401364ee
lea rcx, [rsp + 0x78]
call fcn.1401364ee
mov eax, dword [rsp + 0x30]
add rsp, 0xb8
ret
Function at 0x14013aa49
Capabilities:
Get hostname
Resolve dns

Disassembly:
jmp 0x140175210
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x268
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x62
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x288]
mov rax, qword [0x140447638]
xor rax, rbp
mov qword [rbp + 0x238], rax
lea rcx, reloc.WS2_32.dll_accept
call fcn.14013aa58
mov dword [rbp + 4], 0
cmp qword [rbp + 0x260], 0
je 0x140175277
cmp dword [rbp + 0x268], 0
jg 0x14017527e
xor eax, eax
jmp 0x14017535b
mov edx, 0xff
lea rcx, [rbp + 0x30]
call qword [sym.imp.WS2_32.dll_gethostname]
cmp eax, 0xffffffff
jne 0x1401752aa
lea rcx, str.socket_getips:_No_hostname_defined__n
call fcn.140136688
xor eax, eax
jmp 0x14017535b
lea rcx, [rbp + 0x30]
call qword [sym.imp.WS2_32.dll_gethostbyname]
mov qword [rbp + 0x168], rax
cmp qword [rbp + 0x168], 0
jne 0x1401752d8
lea rcx, str.socket_getips:_Cannot_resolve_our_own_hostname_to_an_IP_address_n
call fcn.140136688
xor eax, eax
jmp 0x14017535b
mov rax, qword [rbp + 0x168]
mov rax, qword [rax + 0x18]
mov qword [rbp + 0x148], rax
jmp 0x1401752f4
mov eax, dword [rbp + 4]
inc eax
mov dword [rbp + 4], eax
mov eax, dword [rbp + 0x268]
cmp dword [rbp + 4], eax
jge 0x140175338
movsxd rax, dword [rbp + 4]
mov rcx, qword [rbp + 0x148]
cmp qword [rcx + rax*8], 0
je 0x140175338
movsxd rax, dword [rbp + 4]
mov rcx, qword [rbp + 0x148]
mov rax, qword [rcx + rax*8]
mov ecx, dword [rax]
call qword [sym.imp.WS2_32.dll_ntohl]
movsxd rcx, dword [rbp + 4]
mov rdx, qword [rbp + 0x260]
mov dword [rdx + rcx*4], eax
jmp 0x1401752ec
cmp dword [rbp + 4], 0
jne 0x140175358
movsxd rax, dword [rbp + 4]
mov rcx, qword [rbp + 0x260]
mov dword [rcx + rax*4], 0x7f000001
mov eax, dword [rbp + 4]
inc eax
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, reloc.WS2_32.dll_accept
call fcn.1401394d7
mov rax, rdi
mov rcx, qword [rbp + 0x238]
xor rcx, rbp
call fcn.140136af2
lea rsp, [rbp + 0x248]
pop rdi
pop rbp
ret

Function at 0x14013acab
Capabilities:
Resolve dns

Disassembly:
jmp 0x140172d30
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rcx, reloc.WS2_32.dll_accept
call fcn.14013aa58
mov rcx, qword [rbp + 0x100]
call qword [sym.imp.WS2_32.dll_gethostbyname]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
je 0x140172d8c
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rbp + 8]
mov rcx, qword [rcx + 0x18]
mov rax, qword [rax + rcx]
mov ecx, dword [rax]
call qword [sym.imp.WS2_32.dll_ntohl]
mov dword [rbp + 0xd4], eax
jmp 0x140172d96
mov dword [rbp + 0xd4], 0
mov eax, dword [rbp + 0xd4]
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret
Function at 0x14013b147
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x140366e30
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x98
mov rax, qword [0x140447638]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov dword [rsp + 0x28], 0
jmp 0x140366e6c
mov eax, dword [rsp + 0x28]
inc eax
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0x20
jge 0x140366e98
movsxd rax, dword [rsp + 0x28]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0x20
jae 0x140366e87
jmp 0x140366e8c
call fcn.140138785
mov rax, qword [rsp + 0x48]
mov byte [rsp + rax + 0x68], 0
jmp 0x140366e62
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
movzx eax, byte [rax]
and eax, 7
mov ecx, 1
mov dword [rsp + 0x40], ecx
movzx ecx, al
mov eax, dword [rsp + 0x40]
shl eax, cl
mov rcx, qword [rsp + 0x30]
movzx ecx, byte [rcx]
sar ecx, 3
movsxd rcx, ecx
movzx ecx, byte [rsp + rcx + 0x68]
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x30]
movzx ecx, byte [rcx]
sar ecx, 3
movsxd rcx, ecx
mov byte [rsp + rcx + 0x68], al
mov rax, qword [rsp + 0x30]
movzx eax, byte [rax]
mov dword [rsp + 0x44], eax
mov rax, qword [rsp + 0x30]
inc rax
mov qword [rsp + 0x30], rax
cmp dword [rsp + 0x44], 0
jne 0x140366ea5
cmp qword [rsp + 0xa0], 0
je 0x140366f25
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x50], rax
jmp 0x140366f35
mov rax, qword [rsp + 0xb0]
mov rax, qword [rax]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea rax, [rsp + 0x20]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov rax, qword [rax]
movzx eax, byte [rax]
sar eax, 3
cdqe
movzx eax, byte [rsp + rax + 0x68]
mov rcx, qword [rsp + 0x38]
mov rcx, qword [rcx]
movzx ecx, byte [rcx]
and ecx, 7
mov edx, 1
shl edx, cl
mov ecx, edx
and eax, ecx
test eax, eax
je 0x140366f96
mov rax, qword [rsp + 0x20]
movsx eax, byte [rax]
test eax, eax
je 0x140366f96
mov rax, qword [rsp + 0x20]
inc rax
mov qword [rsp + 0x20], rax
jmp 0x140366f49
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x58], rax
jmp 0x140366faf
mov rax, qword [rsp + 0x20]
inc rax
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
movsx eax, byte [rax]
test eax, eax
je 0x140367006
mov rax, qword [rsp + 0x38]
mov rax, qword [rax]
movzx eax, byte [rax]
sar eax, 3
cdqe
movzx eax, byte [rsp + rax + 0x68]
mov rcx, qword [rsp + 0x38]
mov rcx, qword [rcx]
movzx ecx, byte [rcx]
and ecx, 7
mov edx, 1
shl edx, cl
mov ecx, edx
and eax, ecx
test eax, eax
je 0x140367004
mov rax, qword [rsp + 0x20]
mov byte [rax], 0
mov rax, qword [rsp + 0x20]
inc rax
mov qword [rsp + 0x20], rax
jmp 0x140367006
jmp 0x140366fa2
mov rax, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x20]
mov qword [rax], rcx
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x20], rax
je 0x14036702e
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x60], rax
jmp 0x140367037
mov qword [rsp + 0x60], 0
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140136af2
add rsp, 0x98
ret
Function at 0x1403787e0
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1498
call fcn.1401345ea
sub rsp, rax
mov rax, qword [0x140447638]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov eax, dword [rsp + 0x14b8]
sar eax, 6
cdqe
lea rcx, [0x140518280]
mov edx, dword [rsp + 0x14b8]
and edx, 0x3f
movsxd rdx, edx
imul rdx, rdx, 0x48
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + rdx + 0x28]
mov qword [rsp + 0x60], rax
mov eax, dword [rsp + 0x14c8]
mov rcx, qword [rsp + 0x14c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x68]
mov rdi, rax
xor eax, eax
mov ecx, reloc.WS2_32.dll_inet_ntoa
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x14c0]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rax
jae 0x1403789d2
lea rax, [rsp + 0x147f]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x38], rax
jae 0x140378926
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rax
jae 0x140378926
mov rax, qword [rsp + 0x48]
movzx eax, byte [rax]
mov byte [rsp + 0x31], al
mov rax, qword [rsp + 0x48]
inc rax
mov qword [rsp + 0x48], rax
movzx eax, byte [rsp + 0x31]
mov byte [rsp + 0x30], al
movsx eax, byte [rsp + 0x30]
cmp eax, 0xa
jne 0x14037890b
mov eax, dword [rsp + 0x70]
inc eax
mov dword [rsp + 0x70], eax
mov rax, qword [rsp + 0x38]
mov byte [rax], reloc.WS2_32.dll_listen
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx ecx, byte [rsp + 0x30]
mov byte [rax], cl
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
jmp 0x1403788a8
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
mov r8d, dword [rsp + 0x40]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140378992
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x68], eax
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, reloc.WS2_32.dll_inet_ntoa
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x1403789f1
mov eax, dword [rsp + 0x44]
mov ecx, dword [rsp + 0x6c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6c], eax
mov eax, dword [rsp + 0x40]
cmp dword [rsp + 0x44], eax
jae 0x1403789cd
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, reloc.WS2_32.dll_inet_ntoa
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x1403789f1
jmp 0x14037887e
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, reloc.WS2_32.dll_inet_ntoa
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.140136af2
add rsp, 0x1498
pop rdi
pop rsi
ret
Function at 0x140378aa0
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1498
call fcn.1401345ea
sub rsp, rax
mov rax, qword [0x140447638]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov eax, dword [rsp + 0x14b8]
sar eax, 6
cdqe
lea rcx, [0x140518280]
mov edx, dword [rsp + 0x14b8]
and edx, 0x3f
movsxd rdx, edx
imul rdx, rdx, 0x48
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + rdx + 0x28]
mov qword [rsp + 0x68], rax
mov eax, dword [rsp + 0x14c8]
mov rcx, qword [rsp + 0x14c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x70]
mov rdi, rax
xor eax, eax
mov ecx, reloc.WS2_32.dll_inet_ntoa
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x14c0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x50], rax
jae 0x140378cad
lea rax, [rsp + 0x147e]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x60]
cmp qword [rsp + 0x38], rax
jae 0x140378bf9
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x50], rax
jae 0x140378bf9
mov rax, qword [rsp + 0x50]
movzx eax, word [rax]
mov word [rsp + 0x40], ax
mov rax, qword [rsp + 0x50]
add rax, 2
mov qword [rsp + 0x50], rax
movzx eax, word [rsp + 0x40]
mov word [rsp + 0x30], ax
movzx eax, word [rsp + 0x30]
cmp eax, 0xa
jne 0x140378bd9
mov eax, dword [rsp + 0x78]
add eax, 2
mov dword [rsp + 0x78], eax
mov eax, reloc.WS2_32.dll_listen
mov rcx, qword [rsp + 0x38]
mov word [rcx], ax
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx ecx, word [rsp + 0x30]
mov word [rax], cx
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
jmp 0x140378b68
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov eax, eax
shl rax, 1
mov dword [rsp + 0x44], eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
mov r8d, dword [rsp + 0x44]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140378c6d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x70], eax
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, reloc.WS2_32.dll_inet_ntoa
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x140378ccc
mov eax, dword [rsp + 0x48]
mov ecx, dword [rsp + 0x74]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x74], eax
mov eax, dword [rsp + 0x44]
cmp dword [rsp + 0x48], eax
jae 0x140378ca8
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, reloc.WS2_32.dll_inet_ntoa
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x140378ccc
jmp 0x140378b3e
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, reloc.WS2_32.dll_inet_ntoa
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.140136af2
add rsp, 0x1498
pop rdi
pop rsi
ret
Function at 0x18075e210
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.18075e397
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x18075e241
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x18075e227
add dl, dl
jne 0x18075e24e
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x18075e2ae
xor eax, eax
add dl, dl
jne 0x18075e25d
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x18075e365
add dl, dl
jne 0x18075e26e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x18075e27b
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x18075e288
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x18075e295
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x18075e2a2
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x18075e236
mov eax, 1
add dl, dl
jne 0x18075e2be
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x18075e2cb
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x18075e2b3
sub eax, ebx
mov ebx, 1
jne 0x18075e304
mov ecx, 1
add dl, dl
jne 0x18075e2e6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x18075e2f3
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x18075e2db
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18075e236
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x18075e320
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x18075e32d
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x18075e315
cmp eax, 0x7d00
jae 0x18075e353
cmp eax, 0x500
jb 0x18075e34e
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18075e236
cmp eax, 0x7f
ja 0x18075e356
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18075e236
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x18075e38a
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x18075e236
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140001000
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
movsxd rax, dword [rcx + 0x3c]
xor r11d, r11d
mov rdi, rdx
mov rbx, rcx
mov esi, dword [rax + rcx + 0x88]
add rsi, rcx
mov ebp, dword [rsi + 0x18]
test ebp, ebp
je 0x1400010b4
mov r15d, dword [rsi + 0x24]
mov r12d, dword [rsi + 0x20]
lea rax, [r15 + r11*2]
movzx r14d, word [rax + rbx]
lea rax, [r12 + r11*4]
mov r9d, dword [rax + rbx]
add r9, rbx
test rdi, rdi
je 0x1400010ac
test r9, r9
je 0x1400010ac
mov r10, rdi
sub r10, r9
nop dword [rax]
nop dword [rax + rax]
movsx ecx, byte [r10 + r9]
movsx edx, byte [r9]
lea r9, [r9 + 1]
lea eax, [rcx - 0x41]
cmp ax, 0x19
lea r8d, [rcx + 0x20]
lea eax, [rdx + 0x20]
cmova r8w, cx
lea ecx, [rdx - 0x41]
cmp cx, 0x19
cmova ax, dx
test r8w, r8w
jne 0x1400010a6
test ax, ax
je 0x1400010d1
cmp r8w, ax
je 0x140001070
inc r11d
cmp r11d, ebp
jb 0x140001040
xor eax, eax
mov rbx, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
pop r15
pop r14
pop r12
ret
mov ecx, dword [rsi + 0x1c]
add rcx, rbx
mov eax, dword [rcx + r14*4]
add rax, rbx
jmp 0x1400010b6