joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140008200
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r13
push r14
push r15
mov rsi, qword [rsp + 0x48]
xor r14d, r14d
mov rbx, qword [rsp + 0x60]
mov r12, r9
mov rcx, qword [rsp + 0x50]
mov r13, r8
mov rbp, qword [rsp + 0x58]
mov r15, rdx
mov qword [rsi], r8
mov qword [rbx], rcx
mov rax, qword [rsi]
cmp rax, r9
je 0x140008395
cmp rcx, rbp
je 0x140008395
mov r9d, 1
movzx edx, word [r15]
xor dil, dil
movzx ecx, word [rax]
mov r11d, 0x2800
mov r8d, 0x3ff
mov r10d, 0x2400
cmp r9w, dx
jae 0x14000829c
lea eax, [r10 + rcx]
cmp ax, r8w
ja 0x1400083bc
mov eax, edx
sub ecx, 0xdc00
shl eax, 0xa
or eax, ecx
jmp 0x1400082b3
mov eax, ecx
add cx, r11w
cmp cx, r8w
ja 0x1400082b3
shl eax, 0xa
mov dil, 1
sub eax, 0x35f0000
cmp eax, 0x80
jae 0x1400082c6
movzx r8d, al
mov r10d, r14d
mov r11d, r14d
jmp 0x140008313
mov r8d, eax
cmp eax, 0x800
jae 0x1400082e0
shr r8d, 6
mov r10d, r9d
or r8b, 0xc0
mov r11d, r9d
jmp 0x140008313
cmp eax, 0x10000
jae 0x1400082fa
shr r8d, 0xc
mov r10d, 2
or r8b, 0xe0
mov r11d, r10d
jmp 0x140008313
shr r8d, 0x12
mov r10d, 3
movzx r11d, dil
or r8b, 0xf0
xor r11d, 1
add r11d, r11d
lea r9d, [r11 + 1]
mov rdx, rbp
sub rdx, qword [rbx]
mov ecx, r9d
cmp rdx, rcx
jl 0x140008395
add qword [rsi], 2
test dil, dil
jne 0x140008334
cmp r10d, 3
jae 0x140008340
mov rcx, qword [rbx]
mov r9d, r11d
mov byte [rcx], r8b
inc qword [rbx]
mov r8, qword [rbx]
test r9d, r9d
jle 0x14000836e
lea ecx, [r10 + r10*2]
add ecx, ecx
nop
sub ecx, 6
mov edx, eax
shr edx, cl
dec r9d
and dl, 0x3f
or dl, 0x80
mov byte [r8], dl
inc qword [rbx]
mov r8, qword [rbx]
test r9d, r9d
jg 0x140008350
shr eax, 0xa
mov r9d, 1
test dil, dil
mov ecx, r9d
cmovne ecx, eax
mov word [r15], cx
mov rax, qword [rsi]
cmp rax, r12
je 0x140008395
cmp qword [rbx], rbp
jne 0x14000825d
cmp r13, qword [rsi]
sete r14b
mov eax, r14d
mov rbx, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
pop r15
pop r14
pop r13
pop r12
ret
mov eax, 2
jmp 0x14000839f
Function at 0x140009920
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1400dad40]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x1400099f3
cmp byte [rcx + 0x71], 0
je 0x1400099f3
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + Ordinal_26]
cmp eax, 0xffffffff
je 0x1400099ef
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400099b4
sub eax, 1
je 0x1400099b8
cmp eax, 2
jne 0x1400099ef
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400ab680
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x1400099e6
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x1400099ef
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14000999c
xor al, al
jmp 0x14000999c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400ab680
add rsp, 0x60
pop rbx
ret
Function at 0x1400181a0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x140018201
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x1400181c0
mov ecx, dword [r9]
jmp 0x1400182eb
cmp ecx, 0x4e0
jb 0x1400182eb
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
add r10, 4
mov edx, r11d
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x634]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x140018220
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
mov edx, eax
xor edx, r11d
add r10, 4
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 - 0xd4c]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x140018270
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x14002e150
Capabilities:
Hash data using djb2

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0x1505
mov rax, qword [rsp + 0x20]
cmp qword [rsp + 0x50], rax
jae 0x14002e1db
mov rax, qword [rsp + 0x28]
shl rax, 5
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x50]
movzx eax, byte [rax]
mov byte [rsp + 0x30], al
mov rax, qword [rsp + 0x50]
inc rax
mov qword [rsp + 0x50], rax
movzx ecx, byte [rsp + 0x30]
call fcn.14004ac60
movsx rax, al
mov rcx, qword [rsp + 0x28]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
jmp 0x14002e17d
xor edx, edx
mov rax, qword [rsp + 0x28]
mov ecx, 0x100
div rcx
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x140042620
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
xor r9d, r9d
mov r8d, dword [rsp + 0x60]
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_recv]
cdqe
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0xffffffffffffffff
jne 0x1400426cb
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0x2733
jne 0x14004267e
mov dword [rsp + 0x30], 1
jmp 0x140042686
mov dword [rsp + 0x30], 0
cmp dword [rsp + 0x30], 0
jne 0x140042697
mov dword [rsp + 0x34], 0
jmp 0x14004269f
mov dword [rsp + 0x34], 1
movzx eax, byte [rsp + 0x34]
mov byte [rsp + 0x2c], al
mov rax, qword [rsp + 0x68]
mov qword [rax], 0
movzx eax, byte [rsp + 0x2c]
test eax, eax
je 0x1400426c4
mov eax, 0x51
jmp 0x1400426da
mov eax, gethostname
jmp 0x1400426da
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x20]
mov qword [rax], rcx
xor eax, eax
add rsp, 0x40
pop rdi
ret

Function at 0x140042890
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x170
lea rdi, [rsp + 0x20]
mov ecx, 0x54
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x180]
mov rax, qword [0x1400dad40]
xor rax, rsp
mov qword [rsp + 0x160], rax
movsxd rax, dword [rsp + 0x188]
mov rcx, qword [rsp + 0x180]
mov rax, qword [rcx + rax*8 + 0x4c0]
mov qword [rsp + 0x20], rax
mov edx, dword [rsp + 0x188]
mov rcx, qword [rsp + 0x180]
call fcn.140042e90
xor r9d, r9d
mov r8d, dword [rsp + 0x198]
mov rdx, qword [rsp + 0x190]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_send]
cdqe
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x1a0]
mov dword [rax], 0
cmp qword [rsp + 0x28], 0xffffffffffffffff
jne 0x1400429c0
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0x2733
jne 0x14004296f
mov qword [rsp + 0x28], 0
mov rax, qword [rsp + 0x1a0]
mov dword [rax], 0x51
jmp 0x1400429c0
mov r8d, 0x100
lea rdx, [rsp + 0x50]
mov ecx, dword [rsp + 0x30]
call fcn.14001c5c0
mov r8, rax
lea rdx, str.Send_failure:__s
mov rax, qword [rsp + 0x180]
mov rcx, qword [rax]
call fcn.140042340
mov rax, qword [rsp + 0x180]
mov rax, qword [rax]
mov ecx, dword [rsp + 0x30]
mov dword [rax + 0x11b0], ecx
mov rax, qword [rsp + 0x1a0]
mov dword [rax], gethostname
mov rax, qword [rsp + 0x28]
mov rdi, rax
mov rcx, rsp
lea rdx, reloc.WS2_32.dll_accept
call fcn.1400abe64
mov rax, rdi
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1400ab680
add rsp, 0x170
pop rdi
ret
Function at 0x140042d80
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov dword [rsp + 0x30], 0
mov rax, qword [rsp + 0x50]
cmp qword [rax + 0x718], 0
je 0x140042dfc
mov dl, 1
mov rcx, qword [rsp + 0x50]
call fcn.1400267c0
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 0x670]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x68]
mov r8, qword [rsp + 0x60]
mov edx, dword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x50]
call qword [rax + 0x718]
mov dword [rsp + 0x30], eax
xor edx, edx
mov rcx, qword [rsp + 0x50]
call fcn.1400267c0
jmp 0x140042e71
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
je 0x140042e1b
cmp dword [rsp + 0x34], 1
je 0x140042e1b
cmp dword [rsp + 0x34], 2
je 0x140042e1b
jmp 0x140042e71
movsxd rax, dword [rsp + 0x58]
imul rax, rax, 3
lea rcx, [0x1400b24b0]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x50]
mov r9, qword [rcx + 0x668]
mov r8d, 1
mov edx, 2
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rax, qword [rsp + 0x50]
mov r9, qword [rax + 0x668]
mov r8d, 1
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov eax, dword [rsp + 0x30]
add rsp, 0x40
pop rdi
ret
Function at 0x140042e90
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
movsxd rax, dword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx + rax*8 + 0x4c0]
mov qword [rsp + 0x20], rax
movsxd rax, dword [rsp + 0x68]
imul rax, rax, 0x20
mov rcx, qword [rsp + 0x60]
lea rax, [rcx + rax + 0x508]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x10]
mov rax, qword [rax + 8]
sub rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x60]
mov rax, qword [rax + 0x698]
mov eax, dword [rax + 0x7c]
and eax, 3
test eax, eax
je 0x140043045
movsxd rax, dword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
lea rdx, [0x1400426f0]
cmp qword [rcx + rax*8 + 0x4e8], rdx
jne 0x140043045
mov rax, qword [rsp + 0x28]
cmp qword [rax], 0
je 0x140042f3a
cmp qword [rsp + 0x30], 0
je 0x140043045
xor r9d, r9d
mov r8, 0xffffffffffffffff
mov rdx, 0xffffffffffffffff
mov rcx, qword [rsp + 0x20]
call fcn.14005f5b0
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 0xffffffff
je 0x140043045
mov eax, dword [rsp + 0x38]
and eax, 1
test eax, eax
je 0x140043045
mov rax, qword [rsp + 0x28]
cmp qword [rax], 0
jne 0x140042fd8
mov rax, qword [rsp + 0x60]
mov rax, qword [rax]
mov eax, dword [rax + 0xb70]
shl eax, 1
cdqe
mov rcx, qword [rsp + 0x28]
mov qword [rcx + 8], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 8]
call qword [section..data]
mov rcx, qword [rsp + 0x28]
mov qword [rcx], rax
mov rax, qword [rsp + 0x28]
mov qword [rax + 0x10], 0
mov rax, qword [rsp + 0x28]
mov qword [rax + 0x18], 0
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 8]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x28]
cmp qword [rax], 0
je 0x140043038
xor eax, eax
test eax, eax
jne 0x140042fe3
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x28]
add rax, qword [rcx + 0x10]
xor r9d, r9d
mov r8d, dword [rsp + 0x30]
mov rdx, rax
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_recv]
cdqe
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
jle 0x140043036
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 0x10]
add rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x28]
mov qword [rcx + 0x10], rax
jmp 0x140043045
mov rax, qword [rsp + 0x28]
mov qword [rax + 8], 0
add rsp, 0x50
pop rdi
ret
Function at 0x140044860
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
lea rdi, [rsp + 0x20]
mov ecx, 8
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x50]
mov eax, Ordinal_27
imul rax, rax, 0
mov rcx, qword [rsp + 0x50]
movzx eax, byte [rcx + rax + 0x558]
test eax, eax
je 0x1400448ae
mov rcx, qword [rsp + 0x50]
call fcn.1400365c0
test eax, eax
jne 0x1400448ac
xor al, al
jmp 0x140044904
jmp 0x140044902
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x50]
cmp qword [rcx + rax + 0x4c0], 0xffffffffffffffff
jne 0x1400448cd
xor al, al
jmp 0x140044904
mov eax, 8
imul rax, rax, 0
mov r9d, 2
mov r8d, 1
lea rdx, [rsp + 0x24]
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx + rax + 0x4c0]
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
jne 0x140044902
xor al, al
jmp 0x140044904
mov al, 1
mov rdi, rax
mov rcx, rsp
lea rdx, reloc.WS2_32.dll_accept
call fcn.1400abe64
mov rax, rdi
add rsp, 0x40
pop rdi
ret

Function at 0x140044930
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x90
lea rdi, [rsp + 0x30]
mov ecx, Ordinal_27
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0xa0]
mov dword [rsp + 0x34], 0x4020
mov dword [rsp + 0x54], 0
mov dword [rsp + 0x74], 4
cmp dword [0x1400db860], 0
jne 0x1400449ac
mov r9d, 3
mov r8d, 2
xor edx, edx
mov ecx, 6
call fcn.1400473f0
movzx eax, al
test eax, eax
je 0x1400449a2
mov dword [0x1400db860], 2
jmp 0x1400449ac
mov dword [0x1400db860], 1
cmp dword [0x1400db860], 2
jne 0x1400449b7
jmp 0x140044a15
lea rax, [rsp + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x54]
mov r8d, 0x1001
mov edx, 0xffff
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x1400449ef
mov eax, dword [rsp + 0x34]
cmp dword [rsp + 0x54], eax
jle 0x1400449ef
jmp 0x140044a15
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x34]
mov r8d, 0x1001
mov edx, 0xffff
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rcx, rsp
lea rdx, reloc.WS2_32.dll_closesocket
call fcn.1400abe64
add rsp, 0x90
pop rdi
ret
Function at 0x140045440
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xd0
lea rdi, [rsp + 0x50]
mov ecx, reloc.WLDAP32.dll_Ordinal_32
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0xe0]
mov rax, qword [0x1400dad40]
xor rax, rsp
mov qword [rsp + 0xc8], rax
mov rax, qword [rsp + 0xe0]
movzx eax, byte [rax + 0xf2c]
test eax, eax
je 0x14004549d
mov dword [rsp + 0xc0], 1
jmp 0x1400454a8
mov dword [rsp + 0xc0], 0
mov eax, dword [rsp + 0xc0]
mov dword [rsp + 0x54], eax
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x54]
mov r8d, 8
mov edx, 0xffff
mov rcx, qword [rsp + 0xe8]
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jge 0x1400454fe
mov r8, qword [rsp + 0xe8]
lea rdx, str.Failed_to_set_SO_KEEPALIVE_on_fd__d_n
mov rcx, qword [rsp + 0xe0]
call fcn.1400421c0
jmp 0x1400455d6
mov dword [rsp + 0x78], 1
mov rax, qword [rsp + 0xe0]
mov ecx, dword [rax + 0xe8c]
call fcn.140046b10
mov dword [rsp + 0x54], eax
imul eax, dword [rsp + 0x54], 0x3e8
mov dword [rsp + 0x54], eax
mov eax, dword [rsp + 0x54]
mov dword [rsp + 0x7c], eax
mov rax, qword [rsp + 0xe0]
mov ecx, dword [rax + 0xe90]
call fcn.140046b10
mov dword [rsp + 0x54], eax
imul eax, dword [rsp + 0x54], 0x3e8
mov dword [rsp + 0x54], eax
mov eax, dword [rsp + 0x54]
mov dword [rsp + 0x80], eax
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0xa4]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, listen
lea r8, [rsp + 0x78]
mov edx, 0x98000004
mov rcx, qword [rsp + 0xe8]
call qword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
je 0x1400455d6
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r9d, eax
mov r8d, dword [rsp + 0xe8]
lea rdx, str.Failed_to_set_SIO_KEEPALIVE_VALS_on_fd__d:__d_n
mov rcx, qword [rsp + 0xe0]
call fcn.1400421c0
mov rcx, rsp
lea rdx, reloc.WS2_32.dll_closesocket
call fcn.1400abe64
mov rcx, qword [rsp + 0xc8]
xor rcx, rsp
call fcn.1400ab680
add rsp, 0xd0
pop rdi
ret
Function at 0x1400468e0
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x180
lea rdi, [rsp + 0x30]
mov ecx, 0x54
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x190]
mov rax, qword [0x1400dad40]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov dword [rsp + 0x34], 1
mov dword [rsp + 0x44], 6
mov rax, qword [rsp + 0x190]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x34]
mov r8d, 1
mov edx, dword [rsp + 0x44]
mov rcx, qword [rsp + 0x198]
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jge 0x140046992
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r8d, 0x100
lea rdx, [rsp + 0x60]
mov ecx, eax
call fcn.14001c5c0
mov r8, rax
lea rdx, str.Could_not_set_TCP_NODELAY:__s_n
mov rcx, qword [rsp + 0x48]
call fcn.1400421c0
mov rcx, rsp
lea rdx, reloc.WS2_32.dll_bind
call fcn.1400abe64
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1400ab680
add rsp, 0x180
pop rdi
ret

Function at 0x140046c80
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x20
mov rcx, qword [rsp + 0x40]
call fcn.140046ae0
mov r8d, eax
mov rdx, qword [rsp + 0x38]
mov ecx, dword [rsp + 0x30]
call sub.api_ms_win_crt_stdio_l1_1_0.dll__read
cdqe
add rsp, 0x20
pop rdi
ret
Function at 0x1400471d0
Capabilities:
Initialize winsock library

Disassembly:
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x210
lea rdi, [rsp + 0x20]
mov ecx, 0x7c
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x220]
mov rax, qword [0x1400dad40]
xor rax, rsp
mov qword [rsp + 0x200], rax
mov eax, dword [rsp + 0x220]
and eax, 2
test eax, eax
je 0x1400472a7
mov eax, 0x202
mov word [rsp + 0x20], ax
lea rdx, [rsp + 0x40]
movzx ecx, word [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [rsp + 0x1e4], eax
cmp dword [rsp + 0x1e4], 0
je 0x14004724d
mov eax, 2
jmp 0x14004735a
movzx eax, word [rsp + 0x40]
and rax, 0xff
movzx eax, al
movzx ecx, word [rsp + 0x20]
and rcx, 0xff
movzx ecx, cl
cmp eax, ecx
jne 0x140047297
movzx eax, word [rsp + 0x40]
shr rax, 8
and rax, 0xff
movzx eax, al
movzx ecx, word [rsp + 0x20]
shr rcx, 8
and rcx, 0xff
movzx ecx, cl
cmp eax, ecx
je 0x1400472a7
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 2
jmp 0x14004735a
call fcn.1400951a0
mov dword [rsp + 0x1e8], eax
cmp dword [rsp + 0x1e8], 0
je 0x1400472c9
mov eax, dword [rsp + 0x1e8]
jmp 0x14004735a
lea rcx, str.iphlpapi.dll
call fcn.140047690
mov qword [0x1400db870], rax
cmp qword [0x1400db870], 0
je 0x14004731c
lea rdx, str.if_nametoindex
mov rcx, qword [0x1400db870]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x1f0], rax
cmp qword [rsp + 0x1f0], 0
je 0x14004731c
mov rax, qword [rsp + 0x1f0]
mov qword [0x1400db868], rax
mov r9d, 3
mov r8d, 2
xor edx, edx
mov ecx, 6
call fcn.1400473f0
movzx eax, al
test eax, eax
je 0x140047344
mov byte [0x1400dc040], 1
jmp 0x14004734b
mov byte [0x1400dc040], 0
lea rcx, [0x1400dc048]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xor eax, eax
mov rdi, rax
mov rcx, rsp
lea rdx, reloc.WS2_32.dll_accept
call fcn.1400abe64
mov rax, rdi
mov rcx, qword [rsp + 0x200]
xor rcx, rsp
call fcn.1400ab680
add rsp, 0x210
pop rdi
ret
Function at 0x140047690
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x60
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x1400476cd
xor eax, eax
jmp 0x140047869
lea rdx, str.LoadLibraryExA
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x28], rax
lea rdx, [0x1400d1534]
mov rcx, qword [rsp + 0x70]
call sub.api_ms_win_crt_string_l1_1_0.dll_strpbrk
test rax, rax
je 0x140047739
cmp qword [rsp + 0x28], 0
je 0x14004771a
mov r8d, 8
xor edx, edx
mov rcx, qword [rsp + 0x70]
call qword [rsp + Ordinal_41]
mov qword [rsp + 0x50], rax
jmp 0x14004772a
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
jmp 0x140047864
cmp qword [rsp + 0x28], 0
je 0x140047773
lea rdx, str.AddDllDirectory
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140047773
mov r8d, 0x800
xor edx, edx
mov rcx, qword [rsp + 0x70]
call qword [rsp + Ordinal_41]
mov qword [rsp + 0x20], rax
jmp 0x140047864
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 0
je 0x140047864
mov rcx, qword [rsp + 0x70]
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0x38]
inc eax
mov eax, eax
add rax, qword [rsp + 0x40]
mov rcx, rax
call qword [section..data]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x140047859
mov edx, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x140047859
mov rcx, qword [rsp + 0x48]
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov rcx, qword [rsp + 0x48]
add rcx, rax
mov rax, rcx
lea rdx, [0x1400d1558]
mov rcx, rax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcpy
mov rcx, qword [rsp + 0x48]
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov rcx, qword [rsp + 0x48]
add rcx, rax
mov rax, rcx
mov rdx, qword [rsp + 0x70]
mov rcx, rax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcpy
cmp qword [rsp + 0x28], 0
je 0x14004783f
mov r8d, 8
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [rsp + Ordinal_41]
mov qword [rsp + 0x58], rax
jmp 0x14004784f
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x48]
call qword [0x1400ce008]
mov rax, qword [rsp + 0x20]
add rsp, 0x60
pop rdi
ret
Function at 0x1400507f0
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xa0
lea rdi, [rsp + 0x50]
mov ecx, reloc.WS2_32.dll_sendto
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0xb0]
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x84]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x64]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x4004747b
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.WS2_32.dll_WSAIoctl]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jne 0x140050891
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x64]
mov r8d, 0x1001
mov edx, 0xffff
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rcx, rsp
lea rdx, reloc.WS2_32.dll_bind
call fcn.1400abe64
add rsp, 0xa0
pop rdi
ret