joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002c3c0
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x130
mov rax, qword [0x14008c070]
xor rax, rsp
mov qword [rsp + 0x120], rax
mov rsi, qword [rsp + 0x190]
mov rbp, rcx
mov rcx, qword [rcx + 0x18]
mov r15, r8
movsxd r8, edx
mov r12, r9
mov rax, r8
shl rax, 5
lea rbx, [rcx + 0x218]
mov r14, qword [rcx + r8*8 + 0x1d0]
add rbx, rax
mov rax, qword [rcx + 0x3e8]
mov rdi, qword [rbx + 8]
sub rdi, qword [rbx + 0x10]
test byte [rax + 0x84], 3
je 0x14002c4ca
lea rax, [0x14002c270]
cmp qword [rcx + r8*8 + 0x1f8], rax
jne 0x14002c4ca
cmp qword [rbx], 0
je 0x14002c451
test rdi, rdi
je 0x14002c4ca
mov rdx, 0xffffffffffffffff
xor r9d, r9d
mov r8, rdx
mov rcx, r14
call fcn.14003d710
cmp eax, 0xffffffff
je 0x14002c4ca
test al, 1
je 0x14002c4ca
mov rcx, qword [rbx]
test rcx, rcx
jne 0x14002c4a9
mov eax, dword [rbp + 0x6ec]
lea ecx, [rax + rax]
mov qword [rbx + 8], rcx
call qword [section..data]
mov qword [rbx], rax
mov rcx, rax
test rax, rax
je 0x14002c504
mov rdi, qword [rbx + 8]
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0
mov rdx, qword [rbx + 0x10]
xor r9d, r9d
add rdx, rcx
mov r8d, edi
mov rcx, r14
call qword [sym.imp.WS2_32.dll_recv]
movsxd rcx, eax
test eax, eax
jle 0x14002c4ca
add qword [rbx + 0x10], rcx
xor r9d, r9d
mov r8d, r12d
mov rdx, r15
mov rcx, r14
call qword [sym.imp.WS2_32.dll_send]
movsxd rbx, eax
mov dword [rsi], 0
cmp rbx, 0xffffffffffffffff
jne 0x14002c543
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
cmp eax, 0x2733
jne 0x14002c513
xor ebx, ebx
mov dword [rsi], 0x51
jmp 0x14002c543
mov dword [rsi], reloc.WLDAP32.dll_Ordinal_27
mov rax, 0xffffffffffffffff
jmp 0x14002c546
mov r8d, 0x100
lea rdx, [rsp + 0x20]
mov ecx, edi
call fcn.140040ce0
mov r8, rax
lea rdx, str.Send_failure:__s
mov rcx, rbp
call fcn.14002bf50
mov dword [rbp + 0xd94], edi
mov dword [rsi], gethostname
mov rax, rbx
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.14006cd00
add rsp, 0x130
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x14002ca60
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub rsp, 0x28
cmp byte [rcx + 0x268], 0
je 0x14002ca7d
call fcn.140025d00
test eax, eax
jne 0x14002caa3
xor al, al
add rsp, 0x28
ret
mov rcx, qword [rcx + 0x1d0]
cmp rcx, 0xffffffffffffffff
je 0x14002ca76
mov r9d, 2
lea rdx, [rsp + 0x30]
lea r8d, [r9 - 1]
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
je 0x14002ca76
mov al, 1
add rsp, 0x28
ret
Function at 0x14002ccf0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x1c0
mov rax, qword [0x14008c070]
xor rax, rsp
mov qword [rsp + 0x1b0], rax
xorps xmm0, xmm0
mov dword [rsp + 0x20], 0x80
mov rax, rdx
mov rbx, r8
mov rsi, rcx
lea r8, [rsp + 0x20]
mov rcx, rax
lea rdx, [rsp + 0x30]
mov rdi, r9
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x90], xmm0
movups xmmword [rsp + 0xa0], xmm0
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x14002cda3
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r8d, 0x100
lea rdx, [rsp + 0xb0]
mov ecx, eax
mov ebx, eax
call fcn.140040ce0
mov r9, rax
lea rdx, str.getsockname___failed_with_errno__d:__s
mov r8d, ebx
mov rcx, rsi
call fcn.14002bf50
jmp 0x14002ce76
movzx ecx, word [rsp + 0x30]
sub ecx, 1
je 0x14002ce4b
sub ecx, 1
je 0x14002cded
cmp ecx, 0x15
jne 0x14002cdf9
lea rdx, [rsp + 0x38]
mov ecx, reloc.WS2_32.dll_socket
mov r8, rbx
mov r9d, reloc.WLDAP32.dll_Ordinal_46
call fcn.14005d770
test rax, rax
je 0x14002cdf9
movzx ecx, word [rsp + 0x32]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
mov dword [rdi], eax
jmp 0x14002ce76
lea rdx, [rsp + 0x34]
mov ecx, 2
jmp 0x14002cdc5
mov byte [rbx], 0
mov dword [rdi], 0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], 0x273f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ebx, dword [rax]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov r8d, 0x100
lea rdx, [rsp + 0xb0]
mov ecx, ebx
mov rdi, rax
call fcn.140040ce0
mov r8d, dword [rdi]
lea rdx, str.ssloc_inet_ntop___failed_with_errno__d:__s
mov r9, rax
mov rcx, rsi
call fcn.14002bf50
jmp 0x14002ce76
cmp dword [rsp + 0x20], 2
jle 0x14002ce6d
lea r9, [rsp + 0x32]
mov edx, reloc.WLDAP32.dll_Ordinal_46
lea r8, [0x140071e10]
mov rcx, rbx
call fcn.14003ef40
jmp 0x14002ce70
mov byte [rbx], 0
mov dword [rdi], 0
mov rcx, qword [rsp + 0x1b0]
xor rcx, rsp
call fcn.14006cd00
add rsp, 0x1c0
pop rdi
pop rsi
pop rbx
ret

Function at 0x14002d7c0
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x30
mov eax, dword [0x14008cb40]
mov rbx, rcx
mov dword [rsp + 0x50], 0x4020
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x58], 4
test eax, eax
jne 0x14002d824
lea r9d, [rax + 2]
mov dword [rsp + 0x20], 3
xor r8d, r8d
lea ecx, [rax + 6]
xor edx, edx
call fcn.14005de80
test al, al
je 0x14002d818
mov dword [0x14008cb40], 2
add rsp, 0x30
pop rbx
ret
mov dword [0x14008cb40], 1
jmp 0x14002d829
cmp eax, 2
je 0x14002d87b
lea rax, [rsp + 0x58]
mov edx, 0xffff
lea r9, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r8d, 0x1001
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x14002d85a
mov eax, dword [rsp + 0x50]
cmp dword [rsp + 0x48], eax
jg 0x14002d87b
lea r9, [rsp + 0x50]
mov dword [rsp + 0x20], 4
mov edx, 0xffff
mov r8d, 0x1001
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_setsockopt]
add rsp, 0x30
pop rbx
ret
Function at 0x14002ed30
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__read]
cdqe
add rsp, 0x28
ret

Function at 0x14002f050
Capabilities:
Get common file path

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x20
mov rbx, rcx
xor ebp, ebp
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdi, rax
test rax, rax
jne 0x14002f07a
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
lea rdx, [0x140073a08]
mov qword [rsp + 0x48], r14
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x140073a18]
mov rcx, rbx
mov r14, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strpbrk]
test rax, rax
je 0x14002f0de
mov rcx, rbx
test r14, r14
je 0x14002f0c8
xor edx, edx
lea r8d, [rdx + 8]
call r14
mov r14, qword [rsp + 0x48]
mov rbp, rax
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r14, qword [rsp + 0x48]
mov rbp, rax
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
test r14, r14
je 0x14002f116
lea rdx, str.AddDllDirectory
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14002f116
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call r14
mov r14, qword [rsp + 0x48]
mov rbp, rax
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
xor edx, edx
mov qword [rsp + 0x50], r15
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov r15d, eax
test eax, eax
je 0x14002f1d8
mov qword [rsp + 0x40], rsi
mov rsi, 0xffffffffffffffff
mov rdx, rsi
nop
inc rdx
cmp byte [rbx + rdx], bpl
jne 0x14002f140
lea ecx, [rax + 1]
add rcx, rdx
call qword [section..data]
mov rdi, rax
test rax, rax
je 0x14002f1ca
mov edx, r15d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x14002f1ca
mov rax, rsi
cmp byte [rdi + rax + 1], bpl
lea rax, [rax + 1]
jne 0x14002f170
mov ecx, 0x5c
mov word [rax + rdi], cx
inc rsi
cmp byte [rdi + rsi], bpl
jne 0x14002f184
mov rcx, rdi
sub rcx, rbx
add rcx, rsi
nop word [rax + rax]
movzx eax, byte [rbx]
mov byte [rcx + rbx], al
lea rbx, [rbx + 1]
test al, al
jne 0x14002f1a0
mov rcx, rdi
test r14, r14
je 0x14002f1c1
xor edx, edx
lea r8d, [rdx + 8]
call r14
jmp 0x14002f1c7
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbp, rax
mov rcx, rdi
call qword [0x14008c008]
mov rsi, qword [rsp + 0x40]
mov r15, qword [rsp + 0x50]
mov rax, rbp
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
Function at 0x14002f1f0
Capabilities:
Get common file path
Initialize winsock library

Disassembly:
sub rsp, 0x1e8
mov rax, qword [0x14008c070]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
test cl, 2
je 0x14002f256
mov ecx, 0x202
lea rdx, [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x14002f239
movzx eax, word [rsp + 0x30]
cmp al, 2
jne 0x14002f233
shr ax, 8
cmp al, 2
je 0x14002f256
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 2
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.14006cd00
add rsp, 0x1e8
ret
call fcn.14005efc0
test eax, eax
jne 0x14002f46e
mov qword [rsp + 0x200], rsi
lea rcx, str.kernel32
mov qword [rsp + 0x208], rdi
xor esi, esi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdi, rax
test rax, rax
jne 0x14002f296
mov qword [0x14008cb50], rsi
jmp 0x14002f42b
mov qword [rsp + 0x1f0], rbx
lea rdx, [0x140073a08]
mov rcx, rdi
mov qword [rsp + 0x1f8], rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rbx, str.iphlpapi.dll
mov rbp, rax
mov rcx, rbx
lea rdx, [0x140073a18]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strpbrk]
test rax, rax
je 0x14002f2fb
mov rcx, rbx
test rbp, rbp
je 0x14002f2ed
xor edx, edx
lea r8d, [rdx + 8]
call rbp
mov rsi, rax
jmp 0x14002f3ea
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
jmp 0x14002f3ea
test rbp, rbp
je 0x14002f32a
lea rdx, str.AddDllDirectory
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14002f32a
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call rbp
mov rsi, rax
jmp 0x14002f3ea
xor edx, edx
mov qword [rsp + 0x1e0], r14
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov r14d, eax
test eax, eax
je 0x14002f3e2
lea ecx, [rax + 1]
add rcx, 0xc
call qword [section..data]
mov rdi, rax
test rax, rax
je 0x14002f3d9
mov edx, r14d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x14002f3d9
mov rcx, 0xffffffffffffffff
mov rax, rcx
nop word [rax + rax]
cmp byte [rdi + rax + 1], sil
lea rax, [rax + 1]
jne 0x14002f380
mov edx, 0x5c
mov word [rax + rdi], dx
inc rcx
cmp byte [rdi + rcx], sil
jne 0x14002f394
mov rdx, rdi
sub rdx, rbx
add rdx, rcx
nop word [rax + rax]
movzx eax, byte [rbx]
mov byte [rdx + rbx], al
lea rbx, [rbx + 1]
test al, al
jne 0x14002f3b0
mov rcx, rdi
test rbp, rbp
je 0x14002f3d0
xor edx, edx
lea r8d, [rdx + 8]
call rbp
jmp 0x14002f3d6
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
mov rcx, rdi
call qword [0x14008c008]
mov r14, qword [rsp + 0x1e0]
mov rbp, qword [rsp + 0x1f8]
mov rbx, qword [rsp + 0x1f0]
mov qword [0x14008cb50], rsi
test rsi, rsi
je 0x14002f42b
lea rdx, str.if_nametoindex
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14008cb48]
test rax, rax
cmovne rcx, rax
mov qword [0x14008cb48], rcx
xor edx, edx
mov dword [rsp + 0x20], 3
mov r9d, 2
xor r8d, r8d
lea ecx, [rdx + 6]
call fcn.14005de80
test al, al
lea rcx, [0x14008d2f0]
setne byte [0x14008d2e8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov rdi, qword [rsp + 0x208]
xor eax, eax
mov rsi, qword [rsp + 0x200]
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.14006cd00
add rsp, 0x1e8
ret
Function at 0x140031240
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov r8, rdx
movzx edx, byte [rcx]
test dl, dl
je 0x140031275
lea r9, [0x140073ce0]
movzx eax, byte [r8]
test al, al
je 0x140031275
movzx eax, byte [rax + r9]
movzx edx, dl
cmp byte [rdx + r9], al
jne 0x140031287
movzx edx, byte [rcx + 1]
inc rcx
inc r8
test dl, dl
jne 0x140031251
xor edx, edx
mov eax, edx
cmp byte [rcx], al
sete al
cmp byte [r8], dl
setne dl
xor eax, edx
ret
xor eax, eax
ret
Function at 0x140042290
Capabilities:
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x60
mov rbx, rcx
movaps xmmword [rsp + 0x50], xmm6
lea rcx, [rsp + 0x30]
mov rdi, rdx
call fcn.140034d00
mov rcx, rbx
movups xmm6, xmmword [rax]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov rcx, rdi
mov rsi, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov r8d, 1
mov rcx, rsi
mov rdx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x140042340
nop word [rax + rax]
lea rcx, [rsp + 0x40]
movdqa xmmword [rsp + 0x20], xmm6
call fcn.140034d00
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x30], xmm0
call fcn.140034d90
cmp rax, 0x3e8
ja 0x140042373
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r8d, 1
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
je 0x1400422f0
test rsi, rsi
je 0x14004234e
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test rbx, rbx
je 0x14004235c
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
movaps xmm6, xmmword [rsp + 0x50]
add rsp, 0x60
pop rdi
ret
test rsi, rsi
je 0x140042381
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test rbx, rbx
je 0x14004238f
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov eax, 1
jmp 0x14004235e
Function at 0x1400424e0
Capabilities:
Connect socket
Get local ipv4 addresses
Get socket information
Set socket configuration

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x14008c070]
xor rax, rsp
mov qword [rbp - 8], rax
mov edx, 1
mov dword [rbp - 0x40], reloc.WS2_32.dll_recv
mov esi, 2
mov dword [rbp - 0x3c], 1
mov ecx, esi
mov rdi, r9
lea r8d, [rdx + 5]
call qword [sym.imp.WS2_32.dll_socket]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x140042532
jmp 0x1400426fb
mov qword [rsp + 0x90], r14
mov ecx, 0x7f000001
xor r14d, r14d
mov word [rbp - 0x38], si
mov qword [rbp - 0x30], r14
call qword [sym.imp.WS2_32.dll_htonl]
lea r9, [rbp - 0x3c]
mov word [rbp - 0x36], r14w
mov edx, 0xffff
mov dword [rbp - 0x34], eax
lea r8d, [r14 + 4]
mov qword [rdi + 8], 0xffffffffffffffff
mov rcx, rbx
mov qword [rdi], 0xffffffffffffffff
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x1400426d2
lea r8d, [r14 + 0x10]
mov rcx, rbx
lea rdx, [rbp - 0x38]
call qword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
je 0x1400426d2
lea r8, [rbp - 0x40]
mov rcx, rbx
lea rdx, [rbp - 0x38]
call qword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
je 0x1400426d2
cmp dword [rbp - 0x40], 0x10
jl 0x1400426d2
lea edx, [r14 + 1]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
je 0x1400426d2
xor r8d, r8d
lea edx, [r14 + 1]
mov ecx, esi
call qword [sym.imp.WS2_32.dll_socket]
mov qword [rdi], rax
cmp rax, 0xffffffffffffffff
je 0x1400426d2
lea r8d, [r14 + 0x10]
mov rcx, rax
lea rdx, [rbp - 0x38]
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x1400426d2
lea edx, [r14 + 1]
mov rcx, rbx
call fcn.14005d740
test eax, eax
js 0x1400426d2
lea edx, [r14 + 1]
mov qword [rbp - 0x18], rbx
mov r8d, 0x2710
mov dword [rbp - 0x10], 0x300
lea rcx, [rbp - 0x18]
call fcn.14003d320
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_accept]
mov qword [rdi + 8], rax
cmp rax, 0xffffffffffffffff
je 0x1400426d2
mov rcx, qword [rdi]
lea r8, [rbp - 0x40]
lea rdx, [rbp - 0x38]
mov dword [rbp - 0x40], reloc.WS2_32.dll_recv
call qword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
je 0x1400426d2
cmp dword [rbp - 0x40], 0x10
jl 0x1400426d2
mov rcx, qword [rdi + 8]
lea r8, [rbp - 0x40]
lea rdx, [rbp - 0x28]
mov dword [rbp - 0x40], reloc.WS2_32.dll_recv
call qword [sym.imp.WS2_32.dll_getpeername]
cmp eax, 0xffffffff
je 0x1400426d2
cmp dword [rbp - 0x40], 0x10
jl 0x1400426d2
movzx eax, word [rbp - 0x28]
cmp word [rbp - 0x38], ax
jne 0x1400426d2
mov eax, dword [rbp - 0x24]
cmp dword [rbp - 0x34], eax
jne 0x1400426d2
movzx eax, word [rbp - 0x26]
cmp word [rbp - 0x36], ax
jne 0x1400426d2
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
jmp 0x1400426f3
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_closesocket]
mov rcx, qword [rdi]
call qword [sym.imp.WS2_32.dll_closesocket]
mov rcx, qword [rdi + 8]
call qword [sym.imp.WS2_32.dll_closesocket]
mov eax, 0xffffffff
mov r14, qword [rsp + 0x90]
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14006cd00
mov rbx, qword [rsp + 0x98]
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret
Function at 0x140042750
Capabilities:
Resolve dns

Disassembly:
push rbp
push r12
push r13
push r15
sub rsp, 0x28
mov r13, r9
xor ebp, ebp
mov qword [r9], rbp
xor r15d, r15d
lea r9, [rsp + 0x68]
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov r12d, eax
test eax, eax
jne 0x1400428ee
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x60], rdi
mov rdi, qword [rsp + 0x68]
test rdi, rdi
je 0x1400428ce
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x20], r14
nop
mov rax, qword [rdi + 0x18]
test rax, rax
je 0x1400427be
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x1400427b0
inc rbx
jmp 0x1400427c0
xor ebx, ebx
mov eax, dword [rdi + 4]
cmp eax, 2
jne 0x1400427ce
lea r14d, [rax + 0xe]
jmp 0x1400427db
cmp eax, 0x17
jne 0x140042874
lea r14d, [rax + 5]
cmp qword [rdi + 0x20], 0
je 0x140042874
mov rax, qword [rdi + 0x10]
test rax, rax
je 0x140042874
cmp rax, r14
jb 0x140042874
lea rcx, [rbx + 0x30]
add rcx, r14
call qword [section..data]
mov rsi, rax
test rax, rax
je 0x140042883
mov ecx, dword [rdi]
mov r8, r14
mov dword [rax], ecx
mov ecx, dword [rdi + 4]
mov dword [rax + 4], ecx
mov ecx, dword [rdi + 8]
mov dword [rax + 8], ecx
mov ecx, dword [rdi + 0xc]
mov dword [rax + 0xc], ecx
lea rcx, [rsi + 0x30]
mov dword [rax + 0x10], r14d
xor eax, eax
mov qword [rsi + 0x18], rax
mov qword [rsi + 0x28], rax
mov qword [rsi + 0x20], rcx
mov rdx, qword [rdi + 0x20]
call sub.VCRUNTIME140.dll_memcpy
test rbx, rbx
je 0x140042861
mov rcx, qword [rsi + 0x20]
mov r8, rbx
add rcx, r14
mov qword [rsi + 0x18], rcx
mov rdx, qword [rdi + 0x18]
call sub.VCRUNTIME140.dll_memcpy
test rbp, rbp
cmove rbp, rsi
test r15, r15
je 0x140042871
mov qword [r15 + 0x28], rsi
mov r15, rsi
mov rdi, qword [rdi + 0x28]
test rdi, rdi
jne 0x1400427a0
jmp 0x140042889
mov r12d, 8
mov rcx, qword [rsp + 0x68]
mov r14, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x58]
test rcx, rcx
je 0x1400428a3
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
test r12d, r12d
je 0x1400428c9
test rbp, rbp
je 0x1400428c5
nop dword [rax]
mov rbx, qword [rbp + 0x28]
mov rcx, rbp
call qword [0x14008c008]
mov rbp, rbx
test rbx, rbx
jne 0x1400428b0
xor ebp, ebp
jmp 0x1400428dd
test rbp, rbp
jne 0x1400428dd
mov r12d, 0x2af9
mov ecx, r12d
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov rdi, qword [rsp + 0x60]
mov eax, r12d
mov rbx, qword [rsp + 0x50]
mov qword [r13], rbp
add rsp, 0x28
pop r15
pop r13
pop r12
pop rbp
ret

Function at 0x140042d40
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
mov r9, rdx
mov r8, rcx
mov qword [rsp + 0x28], rbx
xor edx, edx
mov dword [rsp + 0x20], ebx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
cmovbe rbx, rax
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x140042de0
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rbx, rdx
mov edx, Ordinal_46
mov rsi, r8
mov rbp, rcx
test r8, r8
je 0x140042eab
xor r14d, r14d
nop dword [rax]
mov edi, 4
lea rdx, [rsp + 0x50]
cmp rsi, rdi
mov r8d, 4
mov rcx, rbp
cmovb rdi, rsi
call fcn.140026880
cmp eax, 4
jne 0x140042e5c
cmp byte [0x14008cb5c], r14b
jne 0x140042e68
lea r9d, [rax - 2]
mov dword [rsp + 0x50], r14d
mov r8d, eax
lea rdx, [rsp + 0x50]
xor ecx, ecx
call sub.bcrypt.dll_BCryptGenRandom
neg eax
sbb eax, eax
and eax, 2
mov edx, eax
test eax, eax
jne 0x140042ead
mov eax, dword [rsp + 0x50]
jmp 0x140042e87
imul eax, dword [0x14008cb58], 0x41c64e6d
mov edx, r14d
add eax, 0x3039
mov dword [0x14008cb58], eax
rol eax, 0x10
mov dword [rsp + 0x50], eax
test rdi, rdi
je 0x140042ea2
sub rsi, rdi
nop
mov byte [rbx], al
inc rbx
shr eax, 8
sub rdi, 1
jne 0x140042e90
mov dword [rsp + 0x50], eax
test rsi, rsi
jne 0x140042e10
mov eax, edx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret

Function at 0x140042ec0
Capabilities:
Generate random numbers via winapi

Disassembly:
mov r11, rsp
push rsi
push r12
push r14
push r15
sub rsp, 0xd8
mov rax, qword [0x14008c070]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rax, r8
lea r15, [rsp + 0x30]
and rax, 0xfffffffffffffffe
mov r14, r8
mov rsi, rdx
mov r12, rcx
cmp rax, 0x100
jae 0x14004306c
test r14b, 1
je 0x14004306c
mov qword [r11 + 0x18], rbx
dec r14
mov qword [r11 - 0x28], rbp
mov ecx, Ordinal_46
mov qword [r11 - 0x30], rdi
mov rbp, r14
shr rbp, 1
lea rdi, [rsp + 0x30]
mov qword [r11 - 0x38], r13
je 0x140042feb
xor r13d, r13d
nop word [rax + rax]
mov ebx, 4
lea rdx, [rsp + 0x20]
cmp rbp, rbx
mov r8d, 4
mov rcx, r12
cmovb rbx, rbp
call fcn.140026880
cmp eax, 4
jne 0x140042f8c
cmp byte [0x14008cb5c], r13b
jne 0x140042f9c
lea r9d, [rax - 2]
mov dword [rsp + 0x20], r13d
mov r8d, eax
lea rdx, [rsp + 0x20]
xor ecx, ecx
call sub.bcrypt.dll_BCryptGenRandom
neg eax
sbb eax, eax
and eax, 2
mov ecx, eax
test eax, eax
jne 0x14004302d
mov eax, dword [rsp + 0x20]
jmp 0x140042fbb
imul eax, dword [0x14008cb58], 0x41c64e6d
mov ecx, r13d
add eax, 0x3039
mov dword [0x14008cb58], eax
rol eax, 0x10
mov dword [rsp + 0x20], eax
test rbx, rbx
je 0x140042fe2
sub rbp, rbx
nop dword [rax]
nop word [rax + rax]
mov byte [rdi], al
inc rdi
shr eax, 8
sub rbx, 1
jne 0x140042fd0
mov dword [rsp + 0x20], eax
test rbp, rbp
jne 0x140042f40
mov eax, ecx
test ecx, ecx
jne 0x14004302d
test r14, r14
je 0x140043028
lea rdx, [0x140078c08]
nop dword [rax]
movzx ecx, byte [r15]
lea r15, [r15 + 1]
mov eax, ecx
and ecx, 0xf
shr rax, 4
movzx eax, byte [rax + rdx]
mov byte [rsi], al
movzx eax, byte [rcx + rdx]
mov byte [rsi + 1], al
add rsi, 2
sub r14, 2
jne 0x140043000
mov byte [rsi], 0
xor eax, eax
mov rdi, qword [rsp + 0xc8]
mov rbp, qword [rsp + 0xd0]
mov rbx, qword [rsp + 0x110]
mov r13, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.14006cd00
add rsp, 0xd8
pop r15
pop r14
pop r12
pop rsi
ret
mov eax, Ordinal_46
jmp 0x14004304d