joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400a867e
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
mov rbx, r8
mov rsi, rcx
test rdx, rdx
je 0x1400a86a9
mov qword [rsi + 8], rbx
mov qword [rsi], 1
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
call fcn.1400a114e
cmp word [rbx], 0
mov eax, 2
mov ebp, 0x17
cmove ebp, eax
mov dword [rsp + 0x28], 0x81
and dword [rsp + 0x20], 0
mov ecx, ebp
mov edx, 2
xor r8d, r8d
xor r9d, r9d
call sub.WS2_32.dll_WSASocketW
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1400a8710
cmp word [rbx], 0
je 0x1400a8780
movups xmm0, xmmword [rbx + 4]
mov eax, dword [rbx + 0x14]
mov r9d, dword [rbx + 0x18]
movzx ecx, word [rbx + 0x1c]
mov r8d, 0x1c
mov r10w, 0x17
jmp 0x1400a8795
call sub.WS2_32.dll_WSAGetLastError
cmp eax, 0x2739
je 0x1400a872a
mov r14d, eax
cmp eax, 0x2726
jne 0x1400a87e8
mov dword [rsp + 0x28], 1
and dword [rsp + 0x20], 0
mov ecx, ebp
mov edx, 2
xor r8d, r8d
xor r9d, r9d
call sub.WS2_32.dll_WSASocketW
cmp rax, 0xffffffffffffffff
je 0x1400a87f2
mov rdi, rax
mov rcx, rax
mov edx, 1
xor r8d, r8d
call sub.kernel32.dll_SetHandleInformation
test eax, eax
jne 0x1400a86e7
call fcn.14006b867
mov r14, rax
mov rcx, rdi
call fcn.1400b7d5c
jmp 0x1400a87fa
mov eax, dword [rbx + 2]
movzx ecx, word [rbx + 6]
mov r8d, 0x10
mov r10w, 2
xorps xmm0, xmm0
rol cx, 8
lea rdx, [rsp + 0x34]
mov word [rdx], r10w
mov word [rdx + 2], cx
mov dword [rdx + 4], eax
movups xmmword [rdx + 8], xmm0
mov dword [rdx + 0x18], r9d
mov rcx, rdi
call sub.WS2_32.dll_bind
cmp eax, 0xffffffff
je 0x1400a87cb
mov qword [rsi + 8], rdi
and qword [rsi], 0
jmp 0x1400a869e
call fcn.140086c38
mov qword [rsi + 8], rax
mov qword [rsi], 1
mov rcx, rdi
call fcn.1400b7d5c
jmp 0x1400a869e
shl r14, 0x20
or r14, 2
jmp 0x1400a87fa
call fcn.140086c38
mov r14, rax
mov qword [rsi + 8], r14
jmp 0x1400a8697

Function at 0x1400aede2
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov rax, qword [rcx]
mov rdx, rax
xor rdx, 3
lock cmpxchg qword [rcx], rdx
jne 0x1400aede9
test al, 1
je 0x1400aee08
test al, 2
jne 0x1400aee1d
xor rax, 3
add rsp, 0x28
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x14012d498]
mov edx, 0x23
jmp 0x1400aee30
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x14012d458]
mov edx, 0x25
call fcn.140061bfa
ud2

Function at 0x1400c6210
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.1400b8930
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.1400b8930
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop dword [rax]
Function at 0x1400c6280
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x140155d74]
mov rbx, rcx
test esi, esi
jle 0x1400c63b0
mov rax, qword [0x140155d78]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x1400c62cb
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x1400c6355
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x1400c62b0
mov rcx, rbx
call fcn.1400c6cd0
mov rdi, rax
test rax, rax
je 0x1400c63d2
mov rax, qword [0x140155d78]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call fcn.1400c6e10
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x140155d78]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1400c63b7
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x1400c634e
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x1400c6360
add dword [0x140155d74], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x140155d78]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1400c634e
call qword [sym.imp.kernel32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.1400c6210
nop dword [rax]
xor esi, esi
jmp 0x1400c62d8
mov rax, qword [0x140155d78]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.1400c6210
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call fcn.1400c6210
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x1400c6940
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x140155de0]
mov rcx, r12
call qword [sym.imp.kernel32.dll_EnterCriticalSection]
mov rbx, qword [0x140155dc0]
test rbx, rbx
je 0x1400c699c
mov rbp, qword [sym.imp.kernel32.dll_TlsGetValue]
mov rdi, qword [sym.imp.kernel32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x1400c6993
test rsi, rsi
je 0x1400c6993
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x1400c6978
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.kernel32.dll_LeaveCriticalSection]
Function at 0x1400c6cd0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x14013b000]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x1400c6cf0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x1400c6cf8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x1400c6cf0
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x1400c6d4d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x1400c6d44
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x1400c6cf0
add rax, 0x28
cmp rax, r9
jne 0x1400c6d30
xor eax, eax
ret

Function at 0x1400c6d50
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14013b000]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x1400c6d6f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400c6d78
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x1400c6d6f
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x1400c6e10
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14013b000]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x1400c6e2f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x1400c6e38
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret

Function at 0x1400c7b20
Capabilities:
Authenticate hmac

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
mov eax, dword [rcx + 0x18]
add eax, eax
mov rdi, rdx
mov edx, dword [rcx + 0x20]
mov rbx, rcx
mov ebp, r8d
lea rcx, [rax + rdx + 0x18]
mov rax, qword [0x14013aec0]
call qword [rax]
mov rsi, rax
test rax, rax
je 0x1400c7c28
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
mov qword [rsi + 0x10], rax
cmp dword [rbx + 0x1c], ebp
jae 0x1400c7b96
call qword [rbx]
mov r8d, ebp
mov rdx, rdi
mov rcx, qword [rsi + 8]
call qword [rbx + 8]
mov edi, dword [rbx + 0x18]
add rdi, qword [rsi + 0x10]
mov rdx, qword [rsi + 8]
mov rcx, rdi
call qword [rbx + 0x10]
mov ebp, dword [rbx + 0x20]
mov rcx, qword [rsi + 8]
xor r12d, r12d
lea r14, [rsp + 0x2f]
call qword [rbx]
mov rcx, qword [rsi + 0x10]
call qword [rbx]
mov r13d, ebp
cmp r12, r13
jae 0x1400c7bed
mov al, byte [rdi + r12]
mov rcx, qword [rsi + 8]
mov r8d, 1
mov rdx, r14
xor eax, 0x36
mov byte [rsp + 0x2f], al
call qword [rbx + 8]
mov al, byte [rdi + r12]
mov rcx, qword [rsi + 0x10]
mov rdx, r14
mov r8d, 1
inc r12
xor eax, 0x5c
mov byte [rsp + 0x2f], al
call qword [rbx + 8]
jmp 0x1400c7baa
lea rdi, [0x14013eaa0]
lea rbp, [0x14013eab0]
mov eax, dword [rbx + 0x1c]
cmp r13, rax
jae 0x1400c7c28
mov rcx, qword [rsi + 8]
mov r8d, 1
mov rdx, rdi
inc r13
call qword [rbx + 8]
mov rcx, qword [rsi + 0x10]
mov r8d, 1
mov rdx, rbp
call qword [rbx + 8]
jmp 0x1400c7bfb
mov rax, rsi
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
Function at 0x1400d3830
Capabilities:
Write file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rbx, rcx
mov esi, edx
mov rbp, r8
mov r12, r9
test byte [rcx + 0xa1e], 0x10
je 0x1400d38f1
cmp qword [rcx + 0x260], 0
je 0x1400d38a3
call fcn.1400de780
mov rcx, rbx
mov edx, 1
mov edi, eax
call fcn.1400e5570
mov edx, esi
mov rcx, rbx
mov r9, r12
mov rax, qword [rbx + 0x1d8]
mov r8, rbp
mov qword [rsp + 0x20], rax
call qword [rbx + 0x260]
movzx edx, dil
mov rcx, rbx
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp fcn.1400e5570
cmp edx, 2
ja 0x1400d38f1
mov ecx, edx
mov r9, qword [rbx + 0x1d0]
mov edx, 2
lea rax, [0x14013f600]
lea rcx, [rcx + rcx*2]
mov r8d, 1
add rcx, rax
call sub.msvcrt.dll_fwrite
mov r9, qword [rbx + 0x1d0]
mov rdx, r12
mov rcx, rbp
mov r8d, 1
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp sub.msvcrt.dll_fwrite
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x1400d6da0
Capabilities:
Resolve dns

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rax, r9
mov qword [rsp + 0x98], r9
xor r9d, r9d
mov qword [rax], r9
lea r9, [rsp + 0x28]
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov r14d, eax
test eax, eax
jne 0x1400d6efa
mov rbx, qword [rsp + 0x28]
xor r13d, r13d
xor r12d, r12d
test rbx, rbx
je 0x1400d6eb1
mov rcx, qword [rbx + 0x18]
xor ebp, ebp
test rcx, rcx
je 0x1400d6dff
call sub.msvcrt.dll_strlen
lea rbp, [rax + 1]
mov eax, dword [rbx + 4]
cmp eax, 2
je 0x1400d6e17
mov r15d, 0x1c
cmp eax, 0x17
je 0x1400d6e1d
jmp 0x1400d6ea2
mov r15d, 0x10
cmp qword [rbx + 0x20], 0
je 0x1400d6ea2
mov rax, qword [rbx + 0x10]
cmp rax, r15
jb 0x1400d6ea2
test rax, rax
je 0x1400d6ea2
mov rax, qword [0x14013aec0]
lea rcx, [r15 + rbp + 0x30]
call qword [rax]
test rax, rax
je 0x1400d6eab
mov edx, dword [rbx]
mov rsi, qword [rbx + 0x20]
mov rcx, r15
mov dword [rax], edx
mov edx, dword [rbx + 4]
mov dword [rax + 4], edx
mov edx, dword [rbx + 8]
mov dword [rax + 8], edx
mov edx, dword [rbx + 0xc]
mov dword [rax + 0x10], r15d
mov dword [rax + 0xc], edx
xor edx, edx
mov qword [rax + 0x18], rdx
mov qword [rax + 0x28], rdx
lea rdx, [rax + 0x30]
mov qword [rax + 0x20], rdx
mov rdi, rdx
rep movsb byte [rdi], byte [rsi]
test rbp, rbp
je 0x1400d6e8f
mov qword [rax + 0x18], rdi
mov rsi, qword [rbx + 0x18]
mov rcx, rbp
rep movsb byte [rdi], byte [rsi]
test r12, r12
cmove r12, rax
test r13, r13
je 0x1400d6e9f
mov qword [r13 + 0x28], rax
mov r13, rax
mov rbx, qword [rbx + 0x28]
jmp 0x1400d6de2
mov r14d, 8
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x1400d6ec1
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
test r14d, r14d
je 0x1400d6ed9
mov rcx, r12
mov r14d, 8
xor r12d, r12d
call fcn.1400d6bc0
jmp 0x1400d6eef
test r12, r12
jne 0x1400d6eef
mov ecx, 0x2af9
mov r14d, 0x2af9
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov rax, qword [rsp + 0x98]
mov qword [rax], r12
mov eax, r14d
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400de910
Capabilities:
Get common file path

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbp, rcx
lea rcx, str.kernel32
call qword [sym.imp.kernel32.dll_GetModuleHandleA]
mov rsi, rax
test rax, rax
jne 0x1400de93b
xor ebx, ebx
jmp 0x1400dea5d
lea rdx, str.LoadLibraryExA
mov rcx, rax
mov r12, qword [sym.imp.kernel32.dll_GetProcAddress]
call r12
lea rdx, [0x140135c98]
mov rcx, rbp
mov rdi, rax
call sub.msvcrt.dll_strpbrk
mov rbx, rax
test rax, rax
je 0x1400de98a
mov r8d, 8
test rdi, rdi
jne 0x1400de9a7
mov rcx, rbp
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp qword [sym.imp.kernel32.dll_LoadLibraryA]
test rdi, rdi
je 0x1400de9be
lea rdx, str.AddDllDirectory
mov rcx, rsi
call r12
test rax, rax
je 0x1400de9be
mov r8d, 0x800
xor edx, edx
mov rcx, rbp
mov rax, rdi
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp rax
mov r13, qword [sym.imp.kernel32.dll_GetSystemDirectoryA]
xor edx, edx
xor ecx, ecx
call r13
mov r12d, eax
test eax, eax
je 0x1400de934
mov rcx, rbp
call sub.msvcrt.dll_strlen
lea ecx, [r12 + 1]
add rcx, rax
mov rax, qword [0x14013aec0]
call qword [rax]
mov rsi, rax
test rax, rax
je 0x1400dea51
mov edx, r12d
mov rcx, rax
call r13
test eax, eax
je 0x1400dea51
mov rcx, rsi
call sub.msvcrt.dll_strlen
lea rdx, [0x140135cab]
lea rcx, [rsi + rax]
call sub.msvcrt.dll_strcpy
mov rcx, rsi
call sub.msvcrt.dll_strlen
mov rdx, rbp
lea rcx, [rsi + rax]
call sub.msvcrt.dll_strcpy
test rdi, rdi
je 0x1400dea45
mov r8d, 8
xor edx, edx
mov rcx, rsi
call rdi
jmp 0x1400dea4e
mov rcx, rsi
call qword [sym.imp.kernel32.dll_LoadLibraryA]
mov rbx, rax
mov rax, qword [0x14013aeb0]
mov rcx, rsi
call qword [rax]
mov rax, rbx
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
Function at 0x1400e4700
Capabilities:
Move file

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movups xmmword [rsp + 0x40], xmm6
lea rdi, [rsp + 0x30]
mov rbx, rcx
lea r12, [rsp + 0x20]
mov rsi, rdx
mov rcx, rdi
call fcn.1400dfc50
mov rcx, rbx
movups xmm6, xmmword [rsp + 0x30]
call sub.msvcrt.dll__strdup
mov rcx, rsi
mov rbx, rax
call sub.msvcrt.dll__strdup
mov rbp, qword [sym.imp.kernel32.dll_MoveFileExA]
mov rsi, rax
mov r8d, 1
mov rdx, rsi
mov rcx, rbx
call rbp
test eax, eax
je 0x1400e4779
test rbx, rbx
je 0x1400e4768
mov rcx, rbx
call sub.msvcrt.dll_free
test rsi, rsi
je 0x1400e4775
mov rcx, rsi
call sub.msvcrt.dll_free
xor eax, eax
jmp 0x1400e47c7
mov rcx, rdi
call fcn.1400dfc50
mov rdx, r12
mov rcx, rdi
movups xmmword [rsp + 0x20], xmm6
call fcn.1400e7ca0
cmp rax, 0x3e8
jbe 0x1400e47b5
test rbx, rbx
je 0x1400e47a6
mov rcx, rbx
call sub.msvcrt.dll_free
test rsi, rsi
je 0x1400e47c2
mov rcx, rsi
call sub.msvcrt.dll_free
jmp 0x1400e47c2
mov ecx, 1
call qword [sym.imp.kernel32.dll_Sleep]
jmp 0x1400e4749
mov eax, 1
movups xmm6, xmmword [rsp + 0x40]
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x1400e5b30
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x40
xor eax, eax
mov dword [rsp + 0x38], eax
mov eax, dword [0x14010ab50]
mov rbx, rcx
mov dword [rsp + 0x34], 0x4020
mov dword [rsp + 0x3c], 4
test eax, eax
jne 0x1400e5b91
xor r8d, r8d
xor edx, edx
mov r9d, 2
mov ecx, 6
mov dword [rsp + 0x20], 3
call fcn.1400f6360
test al, al
je 0x1400e5b85
mov dword [0x14010ab50], 2
jmp 0x1400e5be9
mov dword [0x14010ab50], 1
jmp 0x1400e5b96
cmp eax, 2
je 0x1400e5be9
lea rax, [rsp + 0x3c]
lea r9, [rsp + 0x38]
mov edx, 0xffff
mov rcx, rbx
mov qword [rsp + 0x20], rax
mov r8d, 0x1001
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x1400e5bc7
mov eax, dword [rsp + 0x34]
cmp dword [rsp + 0x38], eax
jg 0x1400e5be9
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x34]
mov edx, 0xffff
mov rcx, rbx
mov r8d, 0x1001
call qword [sym.imp.WS2_32.dll_setsockopt]
nop
add rsp, 0x40
pop rbx
ret
Function at 0x1400e7c10
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
xor eax, eax
mov r9, rdx
xor edx, edx
mov r8, rcx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], edx
xor ecx, ecx
xor edx, edx
call qword [sym.imp.msvcrt.dll__beginthreadex]
lea rdx, [rax - 1]
cmp rdx, 0xfffffffffffffffe
mov edx, 0
cmovae rax, rdx
add rsp, 0x38
ret
Function at 0x1400eb050
Capabilities:
Initialize winsock library

Disassembly:
push rbx
sub rsp, 0x1d0
and cl, 2
je 0x1400eb090
lea rdx, [rsp + 0x38]
mov ecx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x1400eb089
mov eax, dword [rsp + 0x38]
cmp al, 2
jne 0x1400eb083
shr ax, 8
cmp ax, 2
je 0x1400eb090
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov ebx, 2
jmp 0x1400eb0ff
call fcn.1400e7170
mov ebx, eax
test eax, eax
jne 0x1400eb0ff
lea rcx, str.iphlpapi.dll
call fcn.1400de910
mov qword [0x14010abc0], rax
mov rcx, rax
test rax, rax
je 0x1400eb0cf
lea rdx, str.if_nametoindex
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
je 0x1400eb0cf
mov qword [0x14010aa20], rax
mov ecx, 6
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 3
call fcn.1400f6360
lea rcx, [0x14010aa10]
mov byte [0x14010aa30], al
call qword [sym.imp.kernel32.dll_QueryPerformanceFrequency]
mov eax, ebx
add rsp, 0x1d0
pop rbx
ret

Function at 0x1400eb110
Capabilities:
Generate random numbers via winapi

Disassembly:
push rdi
sub rsp, 0x20
xor eax, eax
mov r9d, 2
mov r10, rcx
mov rdi, rcx
mov rcx, rdx
mov r8, rdx
rep stosb byte [rdi], al
mov rdx, r10
call sub.bcrypt.dll_BCryptGenRandom
test eax, eax
setne al
movzx eax, al
add eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x1400f1100
Capabilities:
Hash data using djb2

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, rcx
test rcx, rcx
jne 0x1400f1116
xor edx, edx
jmp 0x1400f1198
call fcn.1400d85a0
test al, al
jne 0x1400f110f
mov rcx, rsi
call sub.msvcrt.dll_strlen
mov edx, 0x2e
mov rcx, rsi
mov r8, rax
mov rdi, rax
call fcn.1400def10
mov r8, rax
test rax, rax
jne 0x1400f1147
mov rbx, rsi
jmp 0x1400f1169
sub r8, rsi
mov edx, 0x2e
mov rcx, rsi
call fcn.1400def10
test rax, rax
je 0x1400f1142
lea rbx, [rax + 1]
mov rax, rbx
sub rax, rsi
sub rdi, rax
add rdi, rbx
mov eax, 0x1505
cmp rbx, rdi
jae 0x1400f118e
movsx ecx, byte [rbx]
imul rsi, rax, 0x21
inc rbx
call fcn.1400e36a0
movsx rax, al
xor rax, rsi
jmp 0x1400f1171
mov ecx, 0x3f
xor edx, edx
div rcx
mov rax, rdx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
Function at 0x1400f1520
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edx, 8
lea r8, [0x14013e1a0]
mov rax, rcx
mov rcx, rax
movzx eax, al
mov eax, dword [r8 + rax*4]
shr rcx, 8
xor rax, rcx
dec edx
jne 0x1400f152f
ret

Function at 0x1400f3120
Capabilities:
Query environment variable

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov esi, 1
xor ebx, ebx
mov rdi, rcx
mov rax, qword [0x14013aef0]
mov rcx, rbx
mov edx, esi
mov rbp, rbx
call qword [rax]
mov rbx, rax
test rax, rax
jne 0x1400f3150
mov rcx, rbp
jmp 0x1400f3171
mov rdx, rax
mov r8d, esi
mov rcx, rdi
call qword [sym.imp.kernel32.dll_GetEnvironmentVariableA]
lea edx, [rax - 1]
cmp edx, 0x7fff
ja 0x1400f316e
cmp esi, eax
jne 0x1400f317e
mov rcx, rbx
mov rax, qword [0x14013aeb0]
xor ebx, ebx
call qword [rax]
jmp 0x1400f3186
cmp eax, esi
jb 0x1400f3186
mov esi, eax
jmp 0x1400f3132
mov rax, rbx
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x1400f6150
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x38
xor eax, eax
test edx, edx
lea r8, [rsp + 0x2c]
mov edx, 0x8004667e
setne al
mov dword [rsp + 0x2c], eax
call qword [sym.imp.WS2_32.dll_ioctlsocket]
add rsp, 0x38
ret

Function at 0x1400f6180
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
call sub.msvcrt.dll__read
cdqe
add rsp, 0x28
ret

Function at 0x140100970
Capabilities:
Create new key via cryptacquirecontext
Initialize hashing via wincrypt

Disassembly:
push rbx
sub rsp, 0x30
xor edx, edx
mov r9d, 0x18
xor r8d, r8d
mov dword [rsp + 0x20], 0xf0000040
mov rbx, rcx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
mov edx, eax
mov eax, 0x1b
test edx, edx
je 0x1401009d4
lea rax, [rbx + 8]
mov edx, 0x800c
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, qword [rbx]
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
mov edx, eax
xor eax, eax
test edx, edx
jne 0x1401009d4
mov rcx, qword [rbx]
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
mov qword [rbx], rax
mov eax, 2
add rsp, 0x30
pop rbx
ret

Function at 0x140100a30
Capabilities:
Receive data
Receive data on socket

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x138
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
mov rbx, rcx
xor ecx, ecx
mov r12, r8
mov rsi, r9
mov dword [r9], ecx
mov rcx, qword [rax + 0x98]
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recv]
movsxd r13, eax
mov rdi, r13
cmp r13d, 0xffffffff
jne 0x140100abc
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebp, eax
cmp eax, 0x2733
jne 0x140100a87
mov dword [rsi], 0x51
jmp 0x140100abc
lea rdx, [rsp + 0x30]
mov r8d, 0x100
mov ecx, eax
call fcn.1400e77f0
mov rcx, qword [rbx + 8]
lea rdx, str.Recv_failure:__s
mov r8, rax
call fcn.1400d5c80
mov rax, qword [rbx + 8]
mov dword [rax + 0xccc], ebp
mov dword [rsi], 0x38
mov eax, dword [rsi]
mov rcx, qword [rbx + 8]
mov dword [rsp + 0x20], edi
mov r9, r12
lea r8, str.nw_in_read_len_zu______d__err_d
mov dword [rsp + 0x28], eax
mov rdx, qword [rbx]
call fcn.1400e8000
mov rax, r13
add rsp, 0x138
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
Function at 0x140103940
Capabilities:
Send data
Send data on socket

Disassembly:
sub rsp, 0x48
mov r8d, 0x1008
mov edx, 0xffff
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x50], rcx
lea r9, [rsp + 0x38]
mov dword [rsp + 0x3c], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x140103990
cmp dword [rsp + 0x38], 1
mov rcx, qword [rsp + 0x50]
jne 0x140103990
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.WS2_32.dll_send]
nop
add rsp, 0x48
ret
Function at 0x1401068e0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x1c8
mov rax, qword [rdx + 0x20]
mov rax, qword [rax + 0x2d0]
mov eax, dword [rax + 0x84]
mov rsi, rcx
mov rbx, rdx
and eax, 0x800
jne 0x1401069c4
lea rbp, [rsp + 0x40]
mov ecx, 0x20
lea r8, [rsp + 0x3c]
mov dword [rsp + 0x3c], pe_nt_image_headers64
mov rdi, rbp
mov rdx, rbp
rep stosd dword [rdi], eax
mov rcx, qword [rsi + 0x98]
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x140106969
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, [rsp + 0xc0]
mov r8d, 0x100
mov ecx, eax
mov esi, eax
call fcn.1400e77f0
mov r8d, esi
lea rdx, str.getsockname___failed_with_errno__d:__s
mov r9, rax
jmp 0x1401069bb
mov edx, dword [rsp + 0x3c]
lea r9, [rsi + 0x144]
lea r8, [rsi + 0x114]
mov rcx, rbp
call fcn.1400c8e00
test al, al
jne 0x1401069c4
mov rsi, qword [sym.imp.msvcrt.dll__errno]
call rsi
lea rdx, [rsp + 0xc0]
mov r8d, 0x100
mov ecx, dword [rax]
call fcn.1400e77f0
mov qword [rsp + 0x28], rax
call rsi
mov r9, qword [rsp + 0x28]
lea rdx, str.ssloc_inet_ntop___failed_with_errno__d:__s
mov r8d, dword [rax]
mov rcx, rbx
call fcn.1400d5c80
nop
add rsp, 0x1c8
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x140108d90
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x140
mov r8d, 1
mov rbx, rcx
mov dword [rsp + 0x3c], 1
mov rcx, rdx
lea r9, [rsp + 0x3c]
mov dword [rsp + 0x20], 4
mov edx, 6
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x140108df3
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, [rsp + 0x40]
mov r8d, 0x100
mov ecx, eax
call fcn.1400e77f0
lea rdx, str.Could_not_set_TCP_NODELAY:__s
mov rcx, rbx
mov r8, rax
call fcn.1400ddc00
nop
add rsp, 0x140
pop rbx
ret