joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14005abf0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x140
call fcn.1401ef830
sub rsp, rax
mov rax, qword [0x140310170]
xor rax, rsp
mov qword [rsp + 0x130], rax
cmp dword [rcx + 0xa4], 2
mov rbx, rdx
mov rsi, qword [rcx]
mov rdi, rcx
je 0x14005adee
cmp byte [rcx + 0x3ca], 0
jne 0x14005ade6
cmp byte [rcx + 0x3e6], 0
jne 0x14005ade6
lea r8, [rsp + 0x20]
mov dword [rsp + 0x20], 0x80
lea rdx, [rsp + 0xb0]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
je 0x14005ac98
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
mov rcx, rdi
mov ebx, eax
call fcn.1400755c0
mov r9, rax
lea rdx, str.getpeername___failed_with_errno__d:__s
mov r8d, ebx
mov rcx, rsi
call fcn.140059810
jmp 0x14005adee
xor edx, edx
mov dword [rsp + 0x20], 0x80
mov r8d, 0x80
lea rcx, [rsp + 0x30]
call fcn.14020fde0
lea r8, [rsp + 0x20]
mov rcx, rbx
lea rdx, [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x14005acf5
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
mov rcx, rdi
mov ebx, eax
call fcn.1400755c0
mov r9, rax
lea rdx, str.getsockname___failed_with_errno__d:__s
mov r8d, ebx
mov rcx, rsi
call fcn.140059810
jmp 0x14005adee
cmp word [rsp + 0xb0], 2
lea r8, [rdi + 0x1bc]
lea rbx, [rdi + 0x18e]
je 0x14005ad1a
mov byte [rbx], 0
mov dword [r8], 0
jmp 0x14005ad2e
mov rdx, rbx
lea rcx, [rsp + 0xb0]
call fcn.14005ab60
test al, al
jne 0x14005ad5a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rdi
mov ebx, eax
call fcn.1400755c0
mov r9, rax
lea rdx, str.ssrem_inet_ntop___failed_with_errno__d:__s
mov r8d, ebx
mov rcx, rsi
call fcn.140059810
jmp 0x14005adee
cmp word [rsp + 0x30], 2
lea r8, [rdi + 0x1f0]
movups xmm0, xmmword [rbx]
mov eax, dword [rbx + 0x28]
lea rdx, [rdi + 0x1c0]
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rdi + 0x70], xmm0
movsd xmm0, qword [rbx + 0x20]
movups xmmword [rdi + 0x80], xmm1
movsd qword [rdi + 0x90], xmm0
mov dword [rdi + 0x98], eax
movzx eax, word [rbx + 0x2c]
mov word [rdi + 0x9c], ax
je 0x14005adaf
mov byte [rdx], 0
mov dword [r8], 0
jmp 0x14005adbd
lea rcx, [rsp + 0x30]
call fcn.14005ab60
test al, al
jne 0x14005ade6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rdi
mov ebx, eax
call fcn.1400755c0
mov r9, rax
lea rdx, str.ssloc_inet_ntop___failed_with_errno__d:__s
mov r8d, ebx
mov rcx, rsi
call fcn.140059810
jmp 0x14005adee
mov rcx, rdi
call fcn.14005aa70
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1401ef4e0
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14005b3f0
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
mov eax, Ordinal_50
call fcn.1401ef830
sub rsp, rax
mov rbx, qword [rcx]
lea r9, [rsp + 0x40]
mov rax, rdx
mov dword [rsp + 0x40], 1
mov edx, 6
mov dword [rsp + 0x20], 4
mov rdi, rcx
mov rcx, rax
lea r8d, [rdx - 5]
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x14005b464
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
mov rcx, rdi
call fcn.1400755c0
mov r8, rax
lea rdx, str.Could_not_set_TCP_NODELAY:__s_n
mov rcx, rbx
call fcn.140059720
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
lea rdx, str.TCP_NODELAY_set_n
mov rcx, rbx
call fcn.140059720
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x14005b480
Capabilities:
Set socket configuration

Disassembly:
push rbx
mov eax, Ordinal_50
call fcn.1401ef830
sub rsp, rax
mov eax, dword [0x14036bc08]
mov rbx, rcx
mov dword [rsp + 0x50], 0x4020
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x58], 4
test eax, eax
jne 0x14005b4d9
call fcn.1400758a0
test al, al
je 0x14005b4cd
mov dword [0x14036bc08], 2
add rsp, 0x30
pop rbx
ret
mov dword [0x14036bc08], 1
jmp 0x14005b4de
cmp eax, 2
je 0x14005b530
lea rax, [rsp + 0x58]
mov edx, 0xffff
lea r9, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r8d, 0x1001
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x14005b50f
mov eax, dword [rsp + 0x50]
cmp dword [rsp + 0x48], eax
jg 0x14005b530
lea r9, [rsp + 0x50]
mov dword [rsp + 0x20], 4
mov edx, 0xffff
mov r8d, 0x1001
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_setsockopt]
add rsp, 0x30
pop rbx
ret
Function at 0x14005c070
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
mov eax, 0x670
call fcn.1401ef830
sub rsp, rax
mov rax, qword [0x140310170]
xor rax, rsp
mov qword [rsp + 0x660], rax
mov rbx, rcx
test rcx, rcx
je 0x14005c0b5
xor edi, edi
mov rax, rbx
mov ecx, edi
cmp qword [rax], 0xffffffffffffffff
jne 0x14005c0c8
inc ecx
add rax, 0x10
cmp ecx, 1
jb 0x14005c0a4
mov ecx, 0x2726
call qword [sym.imp.WS2_32.dll_WSASetLastError]
or eax, 0xffffffff
jmp 0x14005c1e7
mov rax, qword [rbx]
mov qword [rsp + 0x688], rbp
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x240], edi
mov dword [rsp + 0x450], edi
mov word [rbx + 0xa], di
cmp rax, 0xffffffffffffffff
je 0x14005c26d
movzx ecx, word [rbx + 8]
test cl, 7
je 0x14005c26d
or rdx, 0xffffffffffffffff
mov ebp, 1
cmp rax, rdx
cmova rdx, rax
test bpl, cl
je 0x14005c11e
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], ebp
test cl, 4
je 0x14005c132
mov qword [rsp + 0x248], rax
mov dword [rsp + 0x240], ebp
test cl, 2
je 0x14005c146
mov qword [rsp + 0x458], rax
mov dword [rsp + 0x450], ebp
cmp dword [rsp + 0x30], edi
jne 0x14005c162
cmp dword [rsp + 0x240], edi
jne 0x14005c162
cmp dword [rsp + 0x450], edi
je 0x14005c26d
mov qword [rsp + 0x690], rsi
lea esi, [rdx + 1]
nop dword [rax]
cmp dword [rsp + 0x450], edi
lea r9, [rsp + 0x450]
lea r8, [rsp + 0x240]
mov qword [rsp + 0x20], rdi
cmove r9, rdi
lea rdx, [rsp + 0x30]
cmp dword [rsp + 0x240], edi
mov ecx, esi
cmove r8, rdi
cmp dword [rsp + 0x30], edi
cmove rdx, rdi
call qword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
jne 0x14005c1d0
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
je 0x14005c170
cmp dword [0x14036bc0c], edi
jne 0x14005c1d4
cmp eax, 0x2714
je 0x14005c170
jmp 0x14005c1d4
test eax, eax
jns 0x14005c208
or eax, 0xffffffff
mov rsi, qword [rsp + 0x690]
mov rbp, qword [rsp + 0x688]
mov rcx, qword [rsp + 0x660]
xor rcx, rsp
call fcn.1401ef4e0
mov rbx, qword [rsp + 0x698]
add rsp, 0x670
pop rdi
ret
jne 0x14005c20e
xor eax, eax
jmp 0x14005c1d7
mov rcx, qword [rbx]
mov word [rbx + 0xa], di
cmp rcx, 0xffffffffffffffff
je 0x14005c266
lea rdx, [rsp + 0x30]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x14005c22d
or word [rbx + 0xa], bp
mov rcx, qword [rbx]
lea rdx, [rsp + 0x240]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x14005c246
or word [rbx + 0xa], 4
mov rcx, qword [rbx]
lea rdx, [rsp + 0x450]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x14005c25f
or word [rbx + 0xa], 2
cmp word [rbx + 0xa], di
cmovne edi, ebp
mov eax, edi
jmp 0x14005c1d7
mov ecx, 0x2726
call qword [sym.imp.WS2_32.dll_WSASetLastError]
or eax, 0xffffffff
jmp 0x14005c1df
Function at 0x140063bf0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
mov eax, reloc.WLDAP32.dll_Ordinal_32
call fcn.1401ef830
sub rsp, rax
movsxd r10, dword [rcx + 0x328]
xor edi, edi
movsxd r9, dword [rcx + 0x32c]
test r10d, r10d
mov rbx, rdx
mov r14, r8
mov edx, edi
mov rbp, rcx
setg dl
mov esi, 0x493e0
test r9d, r9d
jle 0x140063c39
or edx, 2
sub edx, 1
je 0x140063c59
sub edx, 1
je 0x140063c54
cmp edx, 1
jne 0x140063c5c
cmp r10d, r9d
cmovl r9d, r10d
movsxd rsi, r9d
jmp 0x140063c5c
mov rsi, r9
jmp 0x140063c5c
mov rsi, r10
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
mov eax, 0x10624dd3
mul ecx
mov r9d, edx
shr r9d, 6
imul eax, r9d, 0x3e8
mov dword [rsp + 0x40], r9d
sub ecx, eax
imul eax, ecx, 0x3e8
mov rcx, qword [rbp + 0x8b8]
sub r9d, ecx
mov r8, rcx
shr r8, 0x20
imul ecx, r9d, 0x3e8
mov dword [rsp + 0x44], eax
mov rax, qword [rsp + 0x40]
shr rax, 0x20
sub eax, r8d
movsxd rdx, eax
movabs rax, 0x20c49ba5e353f7cf
imul rdx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov rax, 0xffffffffffffffff
sub rsi, rdx
movsxd rdx, ecx
sub rsi, rdx
cmove rsi, rax
cmp byte [rbx + 0x3ca], dil
je 0x140063cf1
mov byte [r14], dil
jmp 0x140063e0b
mov qword [rsp + 0x48], r15
cmp byte [rbx + 0x3cd], dil
jne 0x140063d8d
cmp byte [rbx + 0x3cb], dil
mov ecx, Ordinal_211
mov r15d, 0xa8
cmovne r15d, ecx
cmp byte [rbx + 0x3cc], dil
je 0x140063d2a
mov eax, dword [rbx + 0x188]
jmp 0x140063d30
mov eax, dword [rbx + 0x184]
mov dword [rbx + 0x180], eax
mov qword [rsp + 0x40], rdi
test rsi, rsi
js 0x140063df8
mov rdx, qword [r15 + rbx + 0x10]
lea r9, [rsp + 0x40]
mov r8d, eax
mov rcx, rbx
call fcn.14005c820
cmp eax, 1
je 0x140063dcb
cmp eax, 0xfffffffe
je 0x140063df8
cmp qword [rsp + 0x40], rdi
jne 0x140063dfd
mov r8, qword [r15 + rbx + 0x18]
lea rdx, str.Couldnt_resolve_host__s
mov rcx, rbp
call fcn.140059810
mov edi, 6
jmp 0x140063dfd
cmp byte [rbx + 0x3cf], dil
mov ecx, 0x110
mov r15d, 0x148
mov qword [rsp + 0x40], rdi
cmovne r15d, ecx
test rsi, rsi
js 0x140063df8
mov r8d, dword [rbx + 0x180]
lea r9, [rsp + 0x40]
mov rdx, qword [r15 + rbx + 0x10]
mov rcx, rbx
call fcn.14005c820
cmp eax, 1
jne 0x140063dd1
mov byte [r14], 1
jmp 0x140063dfd
cmp eax, 0xfffffffe
je 0x140063df8
cmp qword [rsp + 0x40], rdi
jne 0x140063dfd
mov r8, qword [r15 + rbx + 0x18]
lea rdx, str.Couldnt_resolve_proxy__s
mov rcx, rbp
call fcn.140059810
mov edi, 5
jmp 0x140063dfd
mov edi, Ordinal_30
mov rax, qword [rsp + 0x40]
mov r15, qword [rsp + 0x48]
mov qword [rbx + 0x50], rax
mov rbx, qword [rsp + 0x50]
mov eax, edi
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x140064f20
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
mov eax, reloc.WLDAP32.dll_Ordinal_32
call fcn.1401ef830
sub rsp, rax
mov rdi, qword [rcx]
mov rsi, rdx
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r9d, eax
mov eax, 0x10624dd3
mul r9d
shr edx, 6
imul r8d, edx, 0x3e8
mov dword [rsp + 0x30], edx
mov rdx, qword [rdi + 0x8b8]
sub r9d, r8d
imul eax, r9d, 0x3e8
mov dword [rsp + 0x34], eax
mov rcx, qword [rsp + 0x30]
call fcn.140068490
movsd qword [rdi + 0x880], xmm0
mov rax, qword [rbx + 0x400]
test byte [rax + 0x78], 0x10
je 0x140064fa9
mov byte [rsi], 1
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov byte [rsi], 0
mov byte [rbx + 0x3e2], 0
cmp qword [rdi + 0x6c8], 0
je 0x140065009
mov rcx, qword [rbx + 0x430]
call qword [fcn.1402196e8]
mov qword [rbx + 0x430], 0
lea rcx, str.User_Agent:__s_r_n
mov rdx, qword [rdi + 0x6c8]
call fcn.14006acb0
mov qword [rbx + 0x430], rax
test rax, rax
jne 0x140065009
mov eax, reloc.WLDAP32.dll_Ordinal_27
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov dword [rdi + 0xc0], 0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r8d, eax
mov eax, 0x10624dd3
mul r8d
shr edx, 6
imul ecx, edx, 0x3e8
mov dword [rsp + 0x30], edx
sub r8d, ecx
imul eax, r8d, 0x3e8
mov dword [rsp + 0x34], eax
mov rax, qword [rsp + 0x30]
mov qword [rbx + 0x220], rax
cmp qword [rbx + 0x230], 0xffffffffffffffff
jne 0x140065080
mov byte [rbx + 0x3d5], 0
mov rcx, rbx
mov rdx, qword [rbx + 0x50]
call fcn.14005b880
test eax, eax
je 0x14006512b
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r8d, eax
mov eax, 0x10624dd3
mul r8d
shr edx, 6
imul ecx, edx, 0x3e8
mov dword [rsp + 0x30], edx
mov rdx, qword [rdi + 0x8b8]
sub r8d, ecx
imul eax, r8d, 0x3e8
mov dword [rsp + 0x34], eax
mov rcx, qword [rsp + 0x30]
call fcn.140068490
movsd qword [rdi + 0x888], xmm0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r8d, eax
mov eax, 0x10624dd3
mul r8d
shr edx, 6
imul ecx, edx, 0x3e8
mov dword [rsp + 0x30], edx
mov rdx, qword [rdi + 0x8b8]
sub r8d, ecx
imul eax, r8d, 0x3e8
mov dword [rsp + 0x34], eax
mov rcx, qword [rsp + 0x30]
call fcn.140068490
movsd qword [rdi + 0x890], xmm0
mov rcx, rbx
mov byte [rbx + 0x3d5], 1
mov byte [rsi], 1
mov rdx, qword [rbx + 0x230]
call fcn.14005abf0
mov rcx, rbx
call fcn.140060c90
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rsi, qword [rsp + 0x40]
mov r8d, eax
mov eax, 0x10624dd3
mul r8d
shr edx, 6
imul ecx, edx, 0x3e8
mov dword [rsp + 0x30], edx
sub r8d, ecx
imul eax, r8d, 0x3e8
mov dword [rsp + 0x34], eax
mov rax, qword [rsp + 0x30]
mov qword [rbx + 0x220], rax
xor eax, eax
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140067ee0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
mov eax, Ordinal_50
call fcn.1401ef830
sub rsp, rax
mov rbp, rdx
mov rbx, rcx
lea edx, [rax + 0x48]
mov r12, r9
lea ecx, [rax - 0x2f]
mov r15d, r8d
call qword [fcn.14021a30c]
mov qword [rbx + 0x618], rax
mov r14, rax
mov esi, 8
test rax, rax
je 0x140067fc6
xor edi, edi
mov dword [rbx + 0x600], r15d
mov dword [rbx + 0x614], edi
mov r9, r12
mov qword [rbx + 0x608], rdi
mov r8d, r15d
mov byte [rbx + 0x610], 0
mov rdx, rbp
mov rcx, rax
mov qword [rax], rdi
call fcn.140067ca0
test eax, eax
je 0x140067fc6
mov rcx, qword [rbx + 0x5f8]
call qword [fcn.1402196e8]
mov rcx, rbp
call qword [case.0x1400656b3.0]
mov qword [rbx + 0x5f8], rax
test rax, rax
je 0x140067fc6
lea r9, [r14 + 0x18]
mov qword [rsp + 0x28], rdi
lea r8, [0x140067d60]
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call fcn.14021c234
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
cmovbe rdi, rax
mov qword [r14], rdi
test rdi, rdi
jne 0x140067ffb
call fcn.1402197a8
mov esi, dword [rax]
lea rcx, [rbx + 0x5f8]
call fcn.140067e40
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor al, al
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
ret
mov al, 1
jmp 0x140067fdc
Function at 0x140075990
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
mov eax, reloc.WLDAP32.dll_Ordinal_32
call fcn.1401ef830
sub rsp, rax
lea rcx, str.kernel32
xor esi, esi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdi, rax
test rax, rax
jne 0x1400759c5
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x30], rbx
lea rdx, str.LoadLibraryExA
mov rcx, rdi
mov qword [rsp + 0x38], rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rbx, str.WS2_32.DLL
mov rbp, rax
mov rcx, rbx
lea rdx, [0x1402d2ef0]
call fcn.14021a7ac
test rax, rax
je 0x140075a23
mov rcx, rbx
test rbp, rbp
je 0x140075a15
xor edx, edx
lea r8d, [rdx + 8]
call rbp
mov rsi, rax
jmp 0x140075b07
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
jmp 0x140075b07
test rbp, rbp
je 0x140075a52
lea rdx, str.AddDllDirectory
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140075a52
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call rbp
mov rsi, rax
jmp 0x140075b07
xor edx, edx
mov qword [rsp + 0x40], r14
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov r14d, eax
test eax, eax
je 0x140075b02
lea ecx, [rax + 1]
add rcx, 0xa
call qword [fcn.14021a348]
mov rdi, rax
test rax, rax
je 0x140075af9
mov edx, r14d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x140075af9
or rax, 0xffffffffffffffff
mov rcx, rax
nop dword [rax + rax]
cmp byte [rdi + rcx + 1], sil
lea rcx, [rcx + 1]
jne 0x140075aa0
mov edx, 0x5c
mov word [rcx + rdi], dx
cmp byte [rdi + rax + 1], sil
lea rax, [rax + 1]
jne 0x140075ab4
lea rcx, [rax + rdi]
sub rcx, rbx
nop word [rax + rax]
movzx eax, byte [rbx]
mov byte [rcx + rbx], al
lea rbx, [rbx + 1]
test al, al
jne 0x140075ad0
mov rcx, rdi
test rbp, rbp
je 0x140075af0
xor edx, edx
lea r8d, [rdx + 8]
call rbp
jmp 0x140075af6
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
mov rcx, rdi
call qword [fcn.1402196e8]
mov r14, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140075c20
Capabilities:
Resolve dns

Disassembly:
push rbx
push rbp
push r12
push r14
push r15
mov eax, reloc.WLDAP32.dll_Ordinal_32
call fcn.1401ef830
sub rsp, rax
xor r12d, r12d
mov r15, r9
mov qword [r9], r12
mov ebx, r12d
lea r9, [rsp + 0x68]
mov r14d, r12d
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov ebp, eax
test eax, eax
jne 0x140075dc0
mov qword [rsp + 0x58], rdi
mov rdi, qword [rsp + 0x68]
test rdi, rdi
je 0x140075da9
mov qword [rsp + 0x50], rsi
cmp dword [rdi + 4], 2
jne 0x140075d1a
cmp qword [rdi + 0x20], r12
je 0x140075d1a
cmp qword [rdi + 0x10], 0x10
jb 0x140075d1a
mov ecx, Ordinal_50
call qword [fcn.14021a348]
mov rsi, rax
test rax, rax
je 0x140075d53
mov ecx, dword [rdi]
mov dword [rax], ecx
mov ecx, dword [rdi + 4]
mov dword [rax + 4], ecx
mov ecx, dword [rdi + 8]
mov dword [rax + 8], ecx
mov ecx, dword [rdi + 0xc]
mov dword [rax + 0xc], ecx
mov ecx, reloc.WS2_32.dll_recv
mov dword [rax + reloc.WS2_32.dll_recv], 0x10
mov qword [rax + 0x20], r12
mov qword [rax + 0x18], r12
mov qword [rax + 0x28], r12
call qword [fcn.14021a348]
mov qword [rsi + 0x20], rax
test rax, rax
je 0x140075d43
mov rcx, qword [rdi + 0x20]
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
mov rcx, qword [rdi + 0x18]
test rcx, rcx
je 0x140075d07
call qword [case.0x1400656b3.0]
mov qword [rsi + 0x18], rax
test rax, rax
je 0x140075d29
test rbx, rbx
cmove rbx, rsi
test r14, r14
je 0x140075d17
mov qword [r14 + 0x28], rsi
mov r14, rsi
mov rdi, qword [rdi + 0x28]
test rdi, rdi
jne 0x140075c72
jmp 0x140075d58
mov rcx, qword [rsi + 0x20]
mov ebp, 8
call qword [fcn.1402196e8]
mov rcx, rsi
call qword [fcn.1402196e8]
jmp 0x140075d58
mov rcx, rsi
mov ebp, 8
call qword [fcn.1402196e8]
jmp 0x140075d58
mov ebp, 8
mov rcx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x50]
test rcx, rcx
je 0x140075d6d
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
test ebp, ebp
je 0x140075da4
test rbx, rbx
je 0x140075d9f
mov rcx, qword [rbx + 0x20]
call qword [fcn.1402196e8]
mov rcx, qword [rbx + 0x18]
call qword [fcn.1402196e8]
mov rdi, qword [rbx + 0x28]
mov rcx, rbx
call qword [fcn.1402196e8]
mov rbx, rdi
test rdi, rdi
jne 0x140075d76
mov rbx, r12
jmp 0x140075db6
test rbx, rbx
jne 0x140075db6
mov ebp, 0x2af9
mov ecx, ebp
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov rdi, qword [rsp + 0x58]
mov eax, ebp
mov qword [r15], rbx
add rsp, 0x20
pop r15
pop r14
pop r12
pop rbp
pop rbx
ret
Function at 0x140078a70
Capabilities:
Get hostname

Disassembly:
push rbx
push rbp
push rdi
push r12
push r14
mov eax, 0x450
call fcn.1401ef830
sub rsp, rax
mov rax, qword [0x140310170]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov rax, qword [rcx]
mov r12, rcx
mov rdi, qword [rax + 0x8af8]
cmp byte [rdi], 0
jne 0x140078aed
mov edx, 0x401
mov byte [rsp + 0x30], 0
lea rcx, [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_gethostname]
mov byte [rsp + 0x430], 0
test eax, eax
jne 0x140078ae6
lea edx, [rax + 0x2e]
lea rcx, [rsp + 0x30]
call fcn.14021125c
test rax, rax
je 0x140078adf
mov byte [rax], 0
lea rdi, [rsp + 0x30]
jmp 0x140078aed
lea rdi, str.localhost
or rbx, 0xffffffffffffffff
inc rbx
cmp byte [rdi + rbx], 0
jne 0x140078af1
inc rbx
mov rcx, rbx
call qword [fcn.14021a348]
xor r14d, r14d
mov rbp, rax
test rax, rax
jne 0x140078b19
lea eax, [rbp + 0x1b]
jmp 0x140078bc2
mov qword [rsp + 0x488], rsi
mov qword [rsp + 0x490], r15
sub rbx, 1
je 0x140078ba3
nop
movzx esi, byte [rdi]
cmp sil, 0x25
jne 0x140078b8d
cmp rbx, 2
jbe 0x140078b93
movzx ecx, byte [rdi + 1]
call fcn.14021b410
test eax, eax
je 0x140078b93
movzx ecx, byte [rdi + 2]
call fcn.14021b410
test eax, eax
je 0x140078b93
movzx eax, byte [rdi + 1]
lea rdx, [rsp + 0x28]
mov byte [rsp + 0x20], al
lea rcx, [rsp + 0x20]
movzx eax, byte [rdi + 2]
mov r8d, reloc.WS2_32.dll_recv
mov byte [rsp + 0x21], al
mov byte [rsp + 0x22], 0
call fcn.1402194ac
add rdi, 2
mov esi, eax
sub rbx, 2
cmp sil, 0x20
jb 0x140078be1
mov byte [r14 + rbp], sil
inc rdi
inc r14
sub rbx, 1
jne 0x140078b30
mov byte [r14 + rbp], 0
xor eax, eax
mov qword [r12 + 0x6a0], rbp
mov rsi, qword [rsp + 0x488]
mov r15, qword [rsp + 0x490]
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.1401ef4e0
add rsp, 0x450
pop r14
pop r12
pop rdi
pop rbp
pop rbx
ret
mov rcx, rbp
call qword [fcn.1402196e8]
mov eax, 3
jmp 0x140078bb2
Function at 0x140079330
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, reloc.WLDAP32.dll_Ordinal_32
call fcn.1401ef830
sub rsp, rax
mov r13, qword [rsp + 0x70]
xor r14d, r14d
mov rdi, r9
mov rbp, r8
mov r15, rdx
mov r12, rcx
mov qword [r13], r14
nop dword [rax]
mov rsi, qword [r12]
xor eax, eax
mov ebx, 0x493e0
movsxd r8, dword [rsi + 0x328]
movsxd rdx, dword [rsi + 0x32c]
test r8d, r8d
setg al
test edx, edx
jle 0x140079396
or eax, 2
sub eax, 1
je 0x1400793b6
sub eax, 1
je 0x1400793b1
cmp eax, 1
jne 0x1400793b9
cmp r8d, edx
cmovl edx, r8d
movsxd rbx, edx
jmp 0x1400793b9
mov rbx, rdx
jmp 0x1400793b9
mov rbx, r8
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
mov eax, 0x10624dd3
mul ecx
mov r10d, edx
shr r10d, 6
imul eax, r10d, 0x3e8
mov dword [rsp + 0x70], r10d
sub ecx, eax
imul eax, ecx, 0x3e8
mov rcx, qword [rsi + 0x8b8]
sub r10d, ecx
mov r8, rcx
shr r8, 0x20
mov dword [rsp + 0x74], eax
mov rax, qword [rsp + 0x70]
shr rax, 0x20
sub eax, r8d
movsxd rdx, eax
movabs rax, 0x20c49ba5e353f7cf
imul rdx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul eax, r10d, 0x3e8
sub rbx, rdx
movsxd rcx, eax
sub rbx, rcx
je 0x1400794a9
test rbx, rbx
js 0x1400794a9
or r8, 0xffffffffffffffff
mov r9, rbx
or rdx, r8
mov rcx, r15
call fcn.14005bc60
test eax, eax
jle 0x1400794a4
xor r9d, r9d
mov r8d, edi
mov rdx, rbp
mov rcx, r15
call qword [sym.imp.WS2_32.dll_recv]
movsxd rcx, eax
cmp rcx, 0xffffffffffffffff
jne 0x140079482
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x140079370
mov eax, Ordinal_60
jmp 0x1400794ae
cmp rdi, rcx
je 0x140079499
test eax, eax
je 0x1400794a4
sub rdi, rcx
add rbp, rcx
add r14, rcx
jmp 0x140079370
add rcx, r14
mov qword [r13], rcx
xor eax, eax
jmp 0x1400794ae
or eax, 0xffffffff
jmp 0x1400794ae
mov eax, Ordinal_30
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14007bef0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
mov eax, reloc.WLDAP32.dll_Ordinal_32
call fcn.1401ef830
sub rsp, rax
or r8, 0xffffffffffffffff
mov rbx, rcx
mov rcx, qword [rcx + 0x230]
or rdx, r8
xor r9d, r9d
call fcn.14005bc60
test eax, eax
jne 0x14007bf22
add rsp, 0x20
pop rbx
ret
test al, 4
jne 0x14007bf81
test al, 1
je 0x14007bf81
cmp byte [rbx + 0x2b8], 0
je 0x14007bf49
mov rcx, rbx
call fcn.14008f110
test eax, eax
jne 0x14007bf77
xor al, al
xor al, 1
add rsp, 0x20
pop rbx
ret
mov rcx, qword [rbx + 0x230]
cmp rcx, 0xffffffffffffffff
je 0x14007bf3f
mov r9d, 2
lea rdx, [rsp + 0x30]
lea r8d, [r9 - 1]
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
jne 0x14007bf77
xor al, 1
add rsp, 0x20
pop rbx
ret
mov al, 1
xor al, al
add rsp, 0x20
pop rbx
ret
mov al, 1
add rsp, 0x20
pop rbx
ret