joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401578a0
Capabilities:
Resolve dns

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov byte [rsp + 0x20], 0
mov dword [rsp + 0x24], 0
mov rcx, qword [rsp + 0x68]
call fcn.14006ea80
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x28]
cmp dword [rsp + 0x24], eax
jge 0x140157951
movsxd rax, dword [rsp + 0x24]
mov rdx, rax
mov rcx, qword [rsp + 0x68]
call fcn.1400c3820
movsx eax, byte [rax]
cmp eax, 0x61
jge 0x140157907
movsxd rax, dword [rsp + 0x24]
mov rdx, rax
mov rcx, qword [rsp + 0x68]
call fcn.1400c3820
movsx eax, byte [rax]
cmp eax, 0x41
jl 0x140157942
movsxd rax, dword [rsp + 0x24]
mov rdx, rax
mov rcx, qword [rsp + 0x68]
call fcn.1400c3820
movsx eax, byte [rax]
cmp eax, 0x7a
jle 0x14015793b
movsxd rax, dword [rsp + 0x24]
mov rdx, rax
mov rcx, qword [rsp + 0x68]
call fcn.1400c3820
movsx eax, byte [rax]
cmp eax, 0x5a
jg 0x140157942
mov byte [rsp + 0x20], 1
jmp 0x140157951
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
jmp 0x1401578c9
movzx eax, byte [rsp + 0x20]
test eax, eax
je 0x1401579d1
mov rcx, qword [rsp + 0x68]
call fcn.1400d8190
mov rcx, rax
call sub.WS2_32.dll_gethostbyname
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x1401579b9
mov rax, qword [rsp + 0x38]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x40], rax
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx + rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov eax, dword [rax]
mov dword [rsp + 0x2c], eax
mov rcx, qword [rsp + 0x68]
call fcn.140072130
mov eax, dword [rsp + 0x2c]
jmp 0x1401579f5
mov dword [rsp + 0x30], 0
mov rcx, qword [rsp + 0x68]
call fcn.140072130
mov eax, dword [rsp + 0x30]
jmp 0x1401579f5
mov rcx, qword [rsp + 0x68]
call fcn.1400d8190
mov rcx, rax
call sub.WS2_32.dll_inet_addr
mov dword [rsp + 0x34], eax
mov rcx, qword [rsp + 0x68]
call fcn.140072130
mov eax, dword [rsp + 0x34]
add rsp, 0x58
ret

Function at 0x140158b80
Capabilities:
Connect socket

Disassembly:
mov word [rsp + 0x18], r8w
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rcx, qword [rsp + 0x40]
call fcn.140158c00
movzx eax, al
test eax, eax
jne 0x140158ba6
jmp 0x140158beb
mov eax, 2
mov word [rsp + 0x20], ax
mov eax, dword [rsp + 0x48]
mov dword [rsp + 0x24], eax
movzx eax, word [rsp + 0x50]
mov word [rsp + 0x22], ax
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rsp + 0x20]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
call sub.WS2_32.dll_connect
cmp eax, 0xffffffff
jne 0x140158be1
jmp 0x140158beb
mov al, 1
jmp 0x140158bed
xor al, al
add rsp, 0x38
ret

Function at 0x140158c60
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor r9d, r9d
mov r8d, dword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call sub.WS2_32.dll_recv
add rsp, 0x28
ret
Function at 0x140158e70
Capabilities:
Send data
Send data on socket

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor r9d, r9d
mov r8d, dword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call sub.WS2_32.dll_send
add rsp, 0x28
ret
Function at 0x1401619b0
Capabilities:
Hash data using djb2

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], 0x1505
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x50], rax
jae 0x140161a3a
mov rax, qword [rsp + 0x28]
shl rax, 5
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x50]
movzx eax, byte [rax]
mov byte [rsp + 0x20], al
movzx ecx, byte [rsp + 0x20]
call fcn.140173e50
movsx rax, al
mov rcx, qword [rsp + 0x28]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x50]
inc rax
mov qword [rsp + 0x50], rax
jmp 0x1401619dc
xor edx, edx
mov rax, qword [rsp + 0x28]
mov ecx, 0x3f
div rcx
mov rax, rdx
add rsp, 0x48
ret
push rdi
sub rsp, 0x20
mov rdi, rcx
test rcx, rcx
je 0x140161e8d
call fcn.140178470
test al, al
jne 0x140161e8d
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rsi
xor esi, esi
or rbx, 0xffffffffffffffff
inc rbx
cmp byte [rdi + rbx], sil
jne 0x140161e27
mov r8, rbx
mov edx, reloc.WLDAP32.dll_Ordinal_46
mov rcx, rdi
call fcn.140182f10
test rax, rax
je 0x140161e6c
sub rax, rdi
mov edx, reloc.WLDAP32.dll_Ordinal_46
mov r8, rax
mov rcx, rdi
call fcn.140182f10
mov rsi, rax
test rax, rax
je 0x140161e6c
inc rsi
mov rcx, rdi
sub rcx, rsi
add rbx, rcx
test rsi, rsi
mov rdx, rbx
cmovne rdi, rsi
mov rcx, rdi
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x1401619b0
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x140161e00
Capabilities:
Hash data using djb2

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], 0x1505
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x50], rax
jae 0x140161a3a
mov rax, qword [rsp + 0x28]
shl rax, 5
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x50]
movzx eax, byte [rax]
mov byte [rsp + 0x20], al
movzx ecx, byte [rsp + 0x20]
call fcn.140173e50
movsx rax, al
mov rcx, qword [rsp + 0x28]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x50]
inc rax
mov qword [rsp + 0x50], rax
jmp 0x1401619dc
xor edx, edx
mov rax, qword [rsp + 0x28]
mov ecx, 0x3f
div rcx
mov rax, rdx
add rsp, 0x48
ret
push rdi
sub rsp, 0x20
mov rdi, rcx
test rcx, rcx
je 0x140161e8d
call fcn.140178470
test al, al
jne 0x140161e8d
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rsi
xor esi, esi
or rbx, 0xffffffffffffffff
inc rbx
cmp byte [rdi + rbx], sil
jne 0x140161e27
mov r8, rbx
mov edx, reloc.WLDAP32.dll_Ordinal_46
mov rcx, rdi
call fcn.140182f10
test rax, rax
je 0x140161e6c
sub rax, rdi
mov edx, reloc.WLDAP32.dll_Ordinal_46
mov r8, rax
mov rcx, rdi
call fcn.140182f10
mov rsi, rax
test rax, rax
je 0x140161e6c
inc rsi
mov rcx, rdi
sub rcx, rsi
add rbx, rcx
test rsi, rsi
mov rdx, rbx
cmovne rdi, rsi
mov rcx, rdi
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x1401619b0
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x14016ee00
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
cmp byte [rcx + 0xa97], 0
mov rbp, r9
mov r14, r8
movsxd rsi, edx
mov rdi, rcx
je 0x14016eebe
cmp qword [rcx + 0x260], 0
je 0x14016ee7e
mov qword [rsp + 0x40], rbx
call fcn.14015cb20
mov dl, 1
mov rcx, rdi
movzx ebx, al
call fcn.14015ce80
mov rcx, qword [rdi + 0x1d8]
mov r9, rbp
mov qword [rsp + 0x20], rcx
mov r8, r14
mov rcx, rdi
mov edx, esi
call qword [rdi + 0x260]
movzx edx, bl
mov rcx, rdi
call fcn.14015ce80
mov rbx, qword [rsp + 0x40]
jmp 0x14016eebe
cmp esi, 2
ja 0x14016eebe
mov r9, qword [rdi + 0x1d0]
lea rax, [0x14022c480]
mov edx, 2
lea rcx, [rsi + rsi*2]
add rcx, rax
lea r8d, [rdx - 1]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov r9, qword [rdi + 0x1d0]
mov r8d, 1
mov rdx, rbp
mov rcx, r14
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x14016eee0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rdi
sub rsp, 0x160
mov rax, qword [0x140256ad8]
xor rax, rsp
mov qword [rsp + 0x140], rax
cmp byte [rcx + 0xa97], 0
mov rdi, rcx
jne 0x14016ef23
cmp qword [rcx + 0x1e0], 0
je 0x14016f011
mov r8, rdx
mov qword [rsp + 0x150], rsi
mov edx, 0x100
lea r9, [rsp + 0x180]
lea rcx, [rsp + 0x30]
call fcn.1401766f0
mov rdx, qword [rdi + 0x1e0]
movsxd r9, eax
test rdx, rdx
je 0x14016ef89
cmp byte [rdi + 0x132f], 0
jne 0x14016ef89
lea r8, [rsp + 0x30]
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [r8]
lea r8, [r8 + 1]
mov byte [rdx], cl
lea rdx, [rdx + 1]
test cl, cl
jne 0x14016ef70
mov byte [rdi + 0x132f], 1
mov byte [rsp + r9 + 0x30], 0xa
inc r9d
movsxd rsi, r9d
cmp rsi, 0x102
jae 0x14016f062
cmp byte [rdi + 0xa97], 0
mov byte [rsp + rsi + 0x30], 0
je 0x14016f009
cmp qword [rdi + 0x260], 0
je 0x14016f02a
mov rcx, rdi
mov qword [rsp + 0x158], rbx
call fcn.14015cb20
mov dl, 1
mov rcx, rdi
movzx ebx, al
call fcn.14015ce80
mov rdx, qword [rdi + 0x1d8]
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rdx
mov r9, rsi
xor edx, edx
mov rcx, rdi
call qword [rdi + 0x260]
movzx edx, bl
mov rcx, rdi
call fcn.14015ce80
mov rbx, qword [rsp + 0x158]
mov rsi, qword [rsp + 0x150]
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1401b4da0
add rsp, 0x160
pop rdi
ret
mov r9, qword [rdi + 0x1d0]
lea rcx, [0x14022c480]
mov edx, 2
lea r8d, [rdx - 1]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov r9, qword [rdi + 0x1d0]
lea rcx, [rsp + 0x30]
mov r8d, 1
mov rdx, rsi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
jmp 0x14016f009
call fcn.1401b4ec8
int3

Function at 0x140171a80
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
call sub.api_ms_win_crt_stdio_l1_1_0.dll__read
cdqe
add rsp, 0x28
ret
Function at 0x140171d70
Capabilities:
Get common file path

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x20
mov rbx, rcx
xor ebp, ebp
lea rcx, [0x14022c950]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdi, rax
test rax, rax
jne 0x140171d9a
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
lea rdx, [0x14022c960]
mov qword [rsp + 0x48], r14
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x14022c970]
mov rcx, rbx
mov r14, rax
call sub.api_ms_win_crt_string_l1_1_0.dll_strpbrk
test eax, eax
je 0x140171dfc
mov rcx, rbx
test r14, r14
je 0x140171de6
xor edx, edx
lea r8d, [rdx + 8]
call r14
mov r14, qword [rsp + 0x48]
mov rbp, rax
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r14, qword [rsp + 0x48]
mov rbp, rax
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
test r14, r14
je 0x140171e34
lea rdx, str.AddDllDirectory
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140171e34
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call r14
mov r14, qword [rsp + 0x48]
mov rbp, rax
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
xor edx, edx
mov qword [rsp + 0x50], r15
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov r15d, eax
test eax, eax
je 0x140171ef8
mov qword [rsp + 0x40], rsi
or rsi, 0xffffffffffffffff
mov rdx, rsi
nop word [rax + rax]
inc rdx
cmp byte [rbx + rdx], bpl
jne 0x140171e60
lea ecx, [rax + 1]
add rcx, rdx
call qword [sub.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
je 0x140171eea
mov edx, r15d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x140171eea
mov rax, rsi
cmp byte [rdi + rax + 1], bpl
lea rax, [rax + 1]
jne 0x140171e90
mov ecx, 0x5c
mov word [rax + rdi], cx
cmp byte [rdi + rsi + 1], bpl
lea rsi, [rsi + 1]
jne 0x140171ea4
lea rcx, [rsi + rdi]
sub rcx, rbx
nop word [rax + rax]
movzx eax, byte [rbx]
mov byte [rcx + rbx], al
lea rbx, [rbx + 1]
test al, al
jne 0x140171ec0
mov rcx, rdi
test r14, r14
je 0x140171ee1
xor edx, edx
lea r8d, [rdx + 8]
call r14
jmp 0x140171ee7
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbp, rax
mov rcx, rdi
call qword [fcn.1401b66f5]
mov rsi, qword [rsp + 0x40]
mov r15, qword [rsp + 0x50]
mov rax, rbp
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
Function at 0x140171f10
Capabilities:
Initialize winsock library

Disassembly:
sub rsp, 0x1e8
mov rax, qword [0x140256ad8]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
test cl, 2
je 0x140171f76
mov ecx, 0x202
lea rdx, [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x140171f59
movzx eax, word [rsp + 0x30]
cmp al, 2
jne 0x140171f53
shr ax, 8
cmp al, 2
je 0x140171f76
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 2
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.1401b4da0
add rsp, 0x1e8
ret
call fcn.1401a7470
test eax, eax
jne 0x140171fef
lea rcx, str.iphlpapi.dll
call fcn.140171d70
mov qword [0x1404bd578], rax
test rax, rax
je 0x140171fbc
lea rdx, str.if_nametoindex
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1404bd570]
test rax, rax
cmovne rcx, rax
mov qword [0x1404bd570], rcx
xor edx, edx
mov dword [rsp + 0x20], 3
mov r9d, 2
xor r8d, r8d
lea ecx, [rdx + 6]
call fcn.1401a7010
test al, al
lea rcx, [0x1404bdc28]
setne byte [0x1404bdc20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xor eax, eax
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.1401b4da0
add rsp, 0x1e8
ret
Function at 0x140183770
Capabilities:
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x60
mov rbx, rcx
movaps xmmword [rsp + 0x50], xmm6
lea rcx, [rsp + 0x30]
mov rdi, rdx
call fcn.140162410
mov rcx, rbx
movups xmm6, xmmword [rax]
call case.0x14016accf.1
mov rcx, rdi
mov rsi, rax
call case.0x14016accf.1
mov r8d, 1
mov rdx, rax
mov rcx, rsi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x140183820
nop dword [rax]
nop word [rax + rax]
lea rcx, [rsp + 0x40]
movdqa xmmword [rsp + 0x20], xmm6
call fcn.140162410
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x30], xmm0
call fcn.140162490
cmp rax, 0x3e8
ja 0x140183851
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r8d, 1
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
je 0x1401837d0
test rsi, rsi
je 0x14018382d
mov rcx, rsi
call fcn.1401b66f5
test rbx, rbx
je 0x14018383a
mov rcx, rbx
call fcn.1401b66f5
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
movaps xmm6, xmmword [rsp + 0x50]
add rsp, 0x60
pop rdi
ret
test rsi, rsi
je 0x14018385e
mov rcx, rsi
call fcn.1401b66f5
test rbx, rbx
je 0x14018386b
mov rcx, rbx
call fcn.1401b66f5
mov eax, 1
jmp 0x14018383c
Function at 0x140183de0
Capabilities:
Resolve dns

Disassembly:
push rbp
push r12
push r13
push r15
sub rsp, 0x28
mov r13, r9
xor ebp, ebp
mov qword [r9], rbp
xor r15d, r15d
lea r9, [rsp + 0x68]
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov r12d, eax
test eax, eax
jne 0x140183f7e
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x60], rdi
mov rdi, qword [rsp + 0x68]
test rdi, rdi
je 0x140183f5e
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x20], r14
nop
mov rax, qword [rdi + 0x18]
test rax, rax
je 0x140183e4e
or rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140183e40
inc rbx
jmp 0x140183e50
xor ebx, ebx
mov eax, dword [rdi + 4]
cmp eax, 2
jne 0x140183e5e
lea r14d, [rax + 0xe]
jmp 0x140183e6b
cmp eax, 0x17
jne 0x140183f04
lea r14d, [rax + 5]
cmp qword [rdi + 0x20], 0
je 0x140183f04
mov rax, qword [rdi + 0x10]
test rax, rax
je 0x140183f04
cmp rax, r14
jb 0x140183f04
lea rcx, [rbx + 0x30]
add rcx, r14
call qword [sub.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x140183f13
mov ecx, dword [rdi]
mov r8, r14
mov dword [rax], ecx
mov ecx, dword [rdi + 4]
mov dword [rax + 4], ecx
mov ecx, dword [rdi + 8]
mov dword [rax + 8], ecx
mov ecx, dword [rdi + 0xc]
mov dword [rax + 0xc], ecx
lea rcx, [rsi + 0x30]
mov dword [rax + 0x10], r14d
xor eax, eax
mov qword [rsi + 0x18], rax
mov qword [rsi + 0x28], rax
mov qword [rsi + 0x20], rcx
mov rdx, qword [rdi + 0x20]
call sub.VCRUNTIME140.dll_memcpy
test rbx, rbx
je 0x140183ef1
mov rcx, qword [rsi + 0x20]
mov r8, rbx
add rcx, r14
mov qword [rsi + 0x18], rcx
mov rdx, qword [rdi + 0x18]
call sub.VCRUNTIME140.dll_memcpy
test rbp, rbp
cmove rbp, rsi
test r15, r15
je 0x140183f01
mov qword [r15 + 0x28], rsi
mov r15, rsi
mov rdi, qword [rdi + 0x28]
test rdi, rdi
jne 0x140183e30
jmp 0x140183f19
mov r12d, 8
mov rcx, qword [rsp + 0x68]
mov r14, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x58]
test rcx, rcx
je 0x140183f33
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
test r12d, r12d
je 0x140183f59
test rbp, rbp
je 0x140183f55
nop dword [rax]
mov rbx, qword [rbp + 0x28]
mov rcx, rbp
call qword [fcn.1401b66f5]
mov rbp, rbx
test rbx, rbx
jne 0x140183f40
xor ebp, ebp
jmp 0x140183f6d
test rbp, rbp
jne 0x140183f6d
mov r12d, 0x2af9
mov ecx, r12d
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov rdi, qword [rsp + 0x60]
mov eax, r12d
mov rbx, qword [rsp + 0x50]
mov qword [r13], rbp
add rsp, 0x28
pop r15
pop r13
pop r12
pop rbp
ret
Function at 0x140184580
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rdi, rdx
mov edx, Ordinal_46
mov rsi, r8
mov rbp, rcx
test r8, r8
je 0x14018464b
nop dword [rax + rax]
mov ebx, 4
lea rdx, [rsp + 0x40]
cmp rsi, rbx
mov r8d, 4
mov rcx, rbp
cmovb rbx, rsi
call fcn.140168620
cmp eax, 4
jne 0x1401845fe
cmp byte [0x1404bd580], 0
jne 0x14018460a
xor eax, eax
lea rdx, [rsp + 0x40]
xor ecx, ecx
mov dword [rsp + 0x40], eax
lea r9d, [rax + 2]
lea r8d, [rax + 4]
call sub.bcrypt.dll_BCryptGenRandom
neg eax
sbb eax, eax
and eax, 2
mov edx, eax
test eax, eax
jne 0x14018464d
mov eax, dword [rsp + 0x40]
jmp 0x140184628
imul eax, dword [0x1404bd584], 0x41c64e6d
add eax, 0x3039
mov dword [0x1404bd584], eax
rol eax, 0x10
mov dword [rsp + 0x40], eax
xor edx, edx
test rbx, rbx
je 0x140184642
sub rsi, rbx
mov byte [rdi], al
inc rdi
shr eax, 8
sub rbx, 1
jne 0x140184630
mov dword [rsp + 0x40], eax
test rsi, rsi
jne 0x1401845b0
mov eax, edx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x140184670
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
sub rdi, 1
je 0x14018473b
lea rbp, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789
nop
mov r8d, 4
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.140168620
cmp eax, 4
jne 0x140184704
cmp byte [0x1404bd580], 0
jne 0x1401846e6
xor eax, eax
lea rdx, [rsp + 0x40]
xor ecx, ecx
mov dword [rsp + 0x40], eax
lea r9d, [rax + 2]
lea r8d, [rax + 4]
call sub.bcrypt.dll_BCryptGenRandom
test eax, eax
je 0x140184708
mov eax, 2
jmp 0x140184740
imul eax, dword [0x1404bd584], 0x41c64e6d
add eax, 0x3039
mov dword [0x1404bd584], eax
rol eax, 0x10
mov dword [rsp + 0x40], eax
jmp 0x140184708
test eax, eax
jne 0x140184740
mov ecx, dword [rsp + 0x40]
cmp ecx, 0xfffffffc
jae 0x1401846a0
mov eax, 0x8421085
mul ecx
mov eax, ecx
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
imul eax, eax, 0x3e
sub ecx, eax
movzx eax, byte [rcx + rbp]
mov byte [rsi], al
inc rsi
sub rdi, 1
jne 0x1401846a0
mov byte [rsi], 0
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x1401879d0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov r14, rcx
mov ebx, 1
mov edx, ebx
xor ecx, ecx
xor ebp, ebp
call qword [str._ge_]
mov rdi, rax
test rax, rax
je 0x140187a4d
nop word [rax + rax]
mov r8d, ebx
mov rdx, rdi
mov rcx, r14
mov rbp, rdi
mov esi, ebx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov ebx, eax
test eax, eax
je 0x140187a78
cmp ebx, esi
je 0x140187a78
cmp ebx, 0x8000
ja 0x140187a78
cmp ebx, esi
jb 0x140187a73
mov edx, ebx
mov rcx, rdi
call qword [str._ge_]
mov rdi, rax
test rax, rax
jne 0x140187a10
mov rcx, rbp
call qword [fcn.1401b66f5]
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov rax, rdi
jmp 0x140187a58
mov rcx, rdi
jmp 0x140187a50
jmp 0x1401879d0

Function at 0x140187a80
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov r14, rcx
mov ebx, 1
mov edx, ebx
xor ecx, ecx
xor ebp, ebp
call qword [str._ge_]
mov rdi, rax
test rax, rax
je 0x140187a4d
nop word [rax + rax]
mov r8d, ebx
mov rdx, rdi
mov rcx, r14
mov rbp, rdi
mov esi, ebx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov ebx, eax
test eax, eax
je 0x140187a78
cmp ebx, esi
je 0x140187a78
cmp ebx, 0x8000
ja 0x140187a78
cmp ebx, esi
jb 0x140187a73
mov edx, ebx
mov rcx, rdi
call qword [str._ge_]
mov rdi, rax
test rax, rax
jne 0x140187a10
mov rcx, rbp
call qword [fcn.1401b66f5]
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov rax, rdi
jmp 0x140187a58
mov rcx, rdi
jmp 0x140187a50
jmp 0x1401879d0
Function at 0x140192280
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xc0
mov rax, qword [0x140256ad8]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rsi, qword [rcx + 0x20]
lea r8, [rsp + 0x20]
mov rdi, rcx
lea rdx, [rsp + 0x30]
mov rbx, qword [rsi + 0x1e0]
mov rcx, rbx
mov qword [rsp + 0x28], 0xffffffffffffffff
mov dword [rsp + 0x20], 0x80
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x1401922fc
lea r8, [rsp + 0x20]
mov dword [rsp + 0x20], 0x80
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_accept]
mov qword [rsp + 0x28], rax
jmp 0x140192301
mov rax, qword [rsp + 0x28]
mov rcx, rdi
cmp rax, 0xffffffffffffffff
jne 0x140192320
lea rdx, str.Error_accept__ing_server_connect
call fcn.14016eee0
mov eax, reloc.WLDAP32.dll_Ordinal_30
jmp 0x1401923ac
lea rdx, str.Connection_accepted_from_server
call fcn.14016f070
mov byte [rsi + 0x305], 0
mov edx, 1
mov rcx, qword [rsp + 0x28]
call fcn.1401ac530
lea r9, [rsp + 0x28]
mov r8d, 1
mov rdx, rsi
mov rcx, rdi
call fcn.1401a4830
test eax, eax
jne 0x1401923ac
cmp qword [rdi + 0x270], 0
je 0x1401923aa
mov dl, 1
mov rcx, rdi
call fcn.14015ce80
mov rdx, qword [rsp + 0x28]
mov r8d, 1
mov rcx, qword [rdi + 0x278]
call qword [rdi + 0x270]
xor edx, edx
mov rcx, rdi
mov ebx, eax
call fcn.14015ce80
test ebx, ebx
je 0x1401923aa
mov rdx, rsi
mov rcx, rdi
call fcn.1401928c0
mov eax, Ordinal_46
jmp 0x1401923ac
xor eax, eax
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1401b4da0
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x140194210
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rsi, qword [rcx + 0x20]
lea eax, [rdx - 0xc8]
mov rbx, rcx
mov edi, dword [rsi + 0x6e8]
cmp eax, 0x64
jb 0x14019428d
test edi, edi
jne 0x14019424e
lea rdx, str.disabling_EPRT_usage
call fcn.14016f070
mov byte [rsi + 0x30a], dil
inc edi
mov rcx, rbx
cmp edi, 2
jne 0x140194277
lea rdx, str.Failed_to_do_PORT
call fcn.14016eee0
lea eax, [rdi + 0x1c]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov edx, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp 0x140195050
lea rdx, str.Connect_data_stream_actively
call fcn.14016f070
mov rax, qword [rbx + 0x20]
mov byte [rax + 0x6f6], 0
mov rax, qword [rbx + 0x198]
mov rdi, qword [rbx + 0x20]
cmp dword [rax + 0x10], 0
je 0x1401942d1
or r8, 0xffffffffffffffff
mov dword [rsp + 0x20], 0xffffffff
or edx, r8d
xor r9d, r9d
mov rcx, rbx
call fcn.140175780
jmp 0x1401942d8
mov byte [rdi + 0x305], 1
mov rbx, qword [rsp + 0x40]
xor eax, eax
mov rsi, qword [rsp + 0x48]
mov byte [rdi + 0x6fc], 1
add rsp, 0x30
pop rdi
ret