joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400b2e2b
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x1402aa5c0]
jne 0x1400a87aa
rol rcx, 0x10
test cx, 0xffff
jne 0x1400a87a6
repz ret
ror rcx, 0x10
jmp 0x1400b2d84
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x1402b2210]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x1402b2308]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x1400b2e09
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x1402b2210]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x1400b2e2b
mov rax, qword [rsp + 0x88]
mov qword [0x1402b2308], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x1402b22a8], rax
mov rax, qword [0x1402b2308]
mov qword [0x1402b2180], rax
mov rax, qword [rsp + 0x90]
mov qword [0x1402b2290], rax
mov dword [0x1402b2170], 0xc0000409
mov dword [0x1402b2174], 1
mov rax, qword [0x1402aa5c0]
mov qword [rsp + 0x68], rax
mov rax, qword [0x1402aa5c8]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x1402b2208], eax
mov ecx, 1
call fcn.1400bc758
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x140211ae0]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x1402b2208], 0
jne 0x1400b2eb2
mov ecx, 1
call fcn.1400bc758
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x1400c41ac
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.1400b2930
xor ebx, ebx
mov rdi, rax
cmp qword [0x1402b2a90], rbx
jne 0x1400c42b2
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x1400c4387
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400c4387
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, [0x140211f80]
mov rcx, rsi
mov qword [0x1402b2a90], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, [0x140211f68]
mov rcx, rsi
mov qword [0x1402b2a98], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
mov qword [0x1402b2aa0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x1402b2ab0], rax
test rax, rax
je 0x1400c42a9
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x1402b2aa8], rax
jmp 0x1400c42b9
mov rax, qword [0x1402b2aa8]
jmp 0x1400c42c0
mov rax, qword [0x1402b2aa8]
mov r11, qword [0x1402b2ab0]
cmp rax, rdi
je 0x1400c4328
cmp r11, rdi
je 0x1400c4328
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x1402b2ab0]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x1400c4328
test rax, rax
je 0x1400c4328
call rsi
test rax, rax
je 0x1400c4322
lea rcx, [rsp + 0x88]
mov r9d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x1400c4322
test byte [rsp + 0x38], 1
jne 0x1400c4328
bts ebp, 0x15
jmp 0x1400c4366
mov rcx, qword [0x1402b2a98]
cmp rcx, rdi
je 0x1400c4366
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x1400c4366
call rax
mov rbx, rax
test rax, rax
je 0x1400c4366
mov rcx, qword [0x1402b2aa0]
cmp rcx, rdi
je 0x1400c4366
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x1400c4366
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x1402b2a90]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x1400c4387
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x1400c4389
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x1400d4d50
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
cmp dword [rax + 0x57e90], 0
jne 0x1400d4d71
mov eax, 1
jmp 0x1400d4e73
mov rax, qword [rsp + 0x40]
mov dword [rax + 0x57e90], 0
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x20], 0
jmp 0x1400d4d9d
mov eax, dword [rsp + 0x20]
add eax, 1
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0x3a98
jge 0x1400d4dc2
movsxd rcx, dword [rsp + 0x20]
imul rcx, rcx, 0x30
mov rax, qword [rsp + 0x40]
mov dword [rax + rcx + 0x57e98], 0
jmp 0x1400d4d92
mov dword [rsp + 0x20], 0
jmp 0x1400d4dd7
mov eax, dword [rsp + 0x20]
add eax, 1
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 0x57e94]
cmp dword [rsp + 0x20], eax
jge 0x1400d4e4a
movsxd rax, dword [rsp + 0x20]
mov edx, 0x7d0
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx + rax*8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0
je 0x1400d4e22
movsxd rax, dword [rsp + 0x20]
xor edx, edx
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx + rax*8]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx + rax*8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movsxd r11, dword [rsp + 0x20]
mov rax, qword [rsp + 0x40]
mov qword [rax + r11*8], 0
jmp 0x1400d4dcc
mov rcx, qword [rsp + 0x40]
add rcx, 0x1d4c0
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov rcx, qword [rsp + 0x40]
add rcx, 0x1d4e8
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov eax, 1
add rsp, 0x38
ret
Function at 0x1400d53d0
Capabilities:
Create thread
Initialize winsock library

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x1f8
mov rax, qword [0x1402aa5c0]
xor rax, rsp
mov qword [rsp + 0x1e8], rax
mov dword [rsp + 0x1e0], 0
lea rdx, [rsp + 0x40]
mov cx, 0x101
call qword [sym.imp.WSOCK32.dll_WSAStartup]
mov rax, qword [rsp + 0x200]
cmp dword [rax + 0x57e90], 0
je 0x1400d5423
mov eax, 1
jmp 0x1400d55ab
mov rax, qword [rsp + 0x200]
mov dword [rax + 0x57e90], 1
mov dword [rsp + 0x1e0], 0
jmp 0x1400d5453
mov eax, dword [rsp + 0x1e0]
add eax, 1
mov dword [rsp + 0x1e0], eax
cmp dword [rsp + 0x1e0], 0x3a98
jge 0x1400d5481
movsxd rcx, dword [rsp + 0x1e0]
imul rcx, rcx, 0x30
mov rax, qword [rsp + 0x200]
mov dword [rax + rcx + 0x57e98], 0
jmp 0x1400d5442
mov rcx, qword [rsp + 0x200]
add rcx, 0x1d4c0
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov rcx, qword [rsp + 0x200]
add rcx, 0x1d4e8
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov r11, qword [rsp + 0x200]
mov dword [r11 + 0x57e94], 0xa
mov dword [rsp + 0x1e0], 0
jmp 0x1400d54dc
mov eax, dword [rsp + 0x1e0]
add eax, 1
mov dword [rsp + 0x1e0], eax
mov rax, qword [rsp + 0x200]
mov eax, dword [rax + 0x57e94]
cmp dword [rsp + 0x1e0], eax
jge 0x1400d55a6
mov dword [rsp + 0x1e4], 0
movsxd rdx, dword [rsp + 0x1e0]
imul rdx, rdx, 0x10
mov rcx, qword [rsp + 0x200]
mov rax, qword [rsp + 0x200]
mov qword [rcx + rdx + 0x1d510], rax
movsxd rdx, dword [rsp + 0x1e0]
imul rdx, rdx, 0x10
mov rcx, qword [rsp + 0x200]
mov eax, dword [rsp + 0x1e0]
mov dword [rcx + rdx + 0x1d518], eax
movsxd rcx, dword [rsp + 0x1e0]
imul rcx, rcx, 0x10
mov rax, qword [rsp + 0x200]
lea r9, [rax + rcx + 0x1d510]
lea rax, [rsp + 0x1e4]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
lea r8, [0x1400d5060]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r11, rax
movsxd rcx, dword [rsp + 0x1e0]
mov rax, qword [rsp + 0x200]
mov qword [rax + rcx*8], r11
jmp 0x1400d54cb
mov eax, 1
mov rcx, qword [rsp + 0x1e8]
xor rcx, rsp
call fcn.1400a8790
add rsp, 0x1f8
ret
Function at 0x1400d6a50
Capabilities:
Query service status
Start service

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov r8d, 0xf003f
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1400d6a7d
xor al, al
jmp 0x1400d6b33
mov r8d, reloc.OLEAUT32.dll_SafeArrayLock
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x1400d6ad2
mov r8d, 4
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x1400d6ad2
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor al, al
jmp 0x1400d6b33
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x1400d6b0e
cmp dword [rsp + 0x34], 2
jne 0x1400d6b0a
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400d6b0c
jmp 0x1400d6b0e
jmp 0x1400d6ae2
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp dword [rsp + 0x34], 4
jne 0x1400d6b31
mov al, 1
jmp 0x1400d6b33
xor al, al
add rsp, 0x58
ret
Function at 0x1400d8760
Capabilities:
Resolve dns

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.WSOCK32.dll_gethostbyname]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
cmp qword [rsp + 0x28], 0
je 0x1400d87c8
movsxd rcx, dword [rsp + 0x20]
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 0x18]
cmp qword [rax + rcx*8], 0
je 0x1400d87c8
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + rax*8]
mov eax, dword [rsp + 0x40]
cmp dword [rcx], eax
jne 0x1400d87bb
mov eax, 1
jmp 0x1400d87ca
mov eax, dword [rsp + 0x20]
add eax, 1
mov dword [rsp + 0x20], eax
jmp 0x1400d877d
xor eax, eax
add rsp, 0x38
ret

Function at 0x1400d87e0
Capabilities:
Acquire debug privileges

Disassembly:
push rdi
sub rsp, 0x50
mov dword [rsp + 0x40], 0
lea rdi, [rsp + 0x44]
xor eax, eax
mov ecx, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
rep stosb byte [rdi], al
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x30]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x1400d8820
xor eax, eax
jmp 0x1400d88ae
lea r8, [rsp + 0x38]
lea rdx, [0x140219c48]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x1400d8847
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1400d88ae
mov dword [rsp + 0x40], 1
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x44], rax
mov dword [rsp + 0x4c], 2
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, reloc.OLEAUT32.dll_SafeArrayGetDim
lea r8, [rsp + 0x40]
xor edx, edx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x1400d889e
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1400d88ae
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
add rsp, 0x50
pop rdi
ret
Function at 0x1400d88c0
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x478
mov eax, dword [rsp + 0x488]
mov dword [rsp + 0x240], eax
mov dword [rsp + 0x244], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x460], 0
jmp 0x1400d8910
mov eax, dword [rsp + 0x460]
add eax, 1
mov dword [rsp + 0x460], eax
mov eax, dword [rsp + 0x30]
cmp dword [rsp + 0x460], eax
jae 0x1400d8937
mov ecx, dword [rsp + 0x460]
mov rax, qword [rsp + 0x480]
cmp qword [rsp + rcx*8 + 0x38], rax
jne 0x1400d8935
jmp 0x1400d8937
jmp 0x1400d88ff
mov eax, dword [rsp + 0x30]
cmp dword [rsp + 0x460], eax
jne 0x1400d896a
cmp dword [rsp + 0x30], 0x40
jae 0x1400d896a
mov ecx, dword [rsp + 0x460]
mov rax, qword [rsp + 0x480]
mov qword [rsp + rcx*8 + 0x38], rax
mov eax, dword [rsp + 0x30]
add eax, 1
mov dword [rsp + 0x30], eax
xor eax, eax
test eax, eax
jne 0x1400d88f2
mov dword [rsp + 0x250], 0
mov dword [rsp + 0x464], 0
jmp 0x1400d8999
mov eax, dword [rsp + 0x464]
add eax, 1
mov dword [rsp + 0x464], eax
mov eax, dword [rsp + 0x250]
cmp dword [rsp + 0x464], eax
jae 0x1400d89c6
mov ecx, dword [rsp + 0x464]
mov rax, qword [rsp + 0x480]
cmp qword [rsp + rcx*8 + 0x258], rax
jne 0x1400d89c4
jmp 0x1400d89c6
jmp 0x1400d8988
mov eax, dword [rsp + 0x250]
cmp dword [rsp + 0x464], eax
jne 0x1400d8a08
cmp dword [rsp + 0x250], 0x40
jae 0x1400d8a08
mov ecx, dword [rsp + 0x464]
mov rax, qword [rsp + 0x480]
mov qword [rsp + rcx*8 + 0x258], rax
mov eax, dword [rsp + 0x250]
add eax, 1
mov dword [rsp + 0x250], eax
xor eax, eax
test eax, eax
jne 0x1400d897b
lea rax, [rsp + 0x240]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x250]
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov ecx, 0x40
call qword [sym.imp.WSOCK32.dll_select]
test eax, eax
jne 0x1400d8a44
xor eax, eax
jmp 0x1400d8a86
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x480]
call sub.WSOCK32.dll___WSAFDIsSet
test eax, eax
je 0x1400d8a61
mov eax, 1
jmp 0x1400d8a86
lea rdx, [rsp + 0x250]
mov rcx, qword [rsp + 0x480]
call sub.WSOCK32.dll___WSAFDIsSet
test eax, eax
je 0x1400d8a81
mov eax, 0xffffffff
jmp 0x1400d8a86
mov eax, 0xffffffff
add rsp, 0x478
ret
Function at 0x1400d90d0
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
cmp dword [rax + 0x220], 0
jne 0x1400d90f1
mov eax, 1
jmp 0x1400d9213
mov rax, qword [rsp + 0x40]
mov dword [rax + 0x220], 0
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x208], 0xffffffffffffffff
je 0x1400d9148
mov edx, 2
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx + 0x208]
call qword [sym.imp.WSOCK32.dll_shutdown]
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx + 0x208]
call qword [sym.imp.WSOCK32.dll_closesocket]
mov r11, qword [rsp + 0x40]
mov qword [r11 + 0x208], 0xffffffffffffffff
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x218], 0
je 0x1400d91c0
mov edx, 0x7d0
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx + 0x218]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x1400d918d
xor edx, edx
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx + 0x218]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x218], 0
je 0x1400d91be
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx + 0x218]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r11, qword [rsp + 0x40]
mov qword [r11 + 0x218], 0
jmp 0x1400d920e
mov dword [rsp + 0x24], 0
cmp dword [rsp + 0x24], 0x96
jge 0x1400d920e
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x40]
lea rcx, [0x1403b5ec0]
call fcn.14001b3a0
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
jne 0x1400d91f6
jmp 0x1400d920e
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [rsp + 0x24]
add eax, 1
mov dword [rsp + 0x24], eax
jmp 0x1400d91c8
mov eax, 1
add rsp, 0x38
ret
Function at 0x1400d9460
Capabilities:
Check for time delay via gettickcount
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
cmp dword [rsp + 0x70], 8
jne 0x1400d95a3
mov rax, qword [rsp + 0x68]
mov eax, dword [rax]
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0
jg 0x1400d949c
xor eax, eax
jmp 0x1400d9680
mov dword [rsp + 0x2c], 0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x50]
cmp dword [rax + 0x220], 0
je 0x1400d9599
cmp dword [0x1403b3558], 0
jle 0x1400d94f8
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
sub ecx, dword [rsp + 0x28]
mov eax, dword [0x1403b3558]
imul eax, eax, 0x3e8
cmp ecx, eax
jle 0x1400d94f8
mov rax, qword [rsp + 0x68]
mov qword [rax], 0xffffffffffffffff
xor eax, eax
jmp 0x1400d9680
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
call fcn.1400d9220
test eax, eax
jne 0x1400d950d
jmp 0x1400d94ae
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x68]
mov rax, qword [rax]
mov rdx, qword [rsp + 0x60]
add rdx, rax
movsxd rax, dword [rsp + 0x24]
sub rdx, rax
xor r9d, r9d
mov r8d, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.WSOCK32.dll_recv]
mov dword [rsp + 0x2c], eax
mov eax, dword [rsp + 0x24]
cmp dword [rsp + 0x2c], eax
jne 0x1400d9552
jmp 0x1400d9599
cmp dword [rsp + 0x2c], 0
jne 0x1400d956c
mov rax, qword [rsp + 0x68]
mov qword [rax], 0
xor eax, eax
jmp 0x1400d9680
cmp dword [rsp + 0x2c], 0
jge 0x1400d9586
mov rax, qword [rsp + 0x68]
mov qword [rax], 0xffffffffffffffff
xor eax, eax
jmp 0x1400d9680
mov ecx, dword [rsp + 0x2c]
mov eax, dword [rsp + 0x24]
sub eax, ecx
mov dword [rsp + 0x24], eax
jmp 0x1400d94ae
mov eax, 1
jmp 0x1400d9680
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x50]
cmp dword [rax + 0x220], 0
je 0x1400d967e
cmp dword [0x1403b3558], 0
jle 0x1400d95f7
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
sub ecx, dword [rsp + 0x20]
mov eax, dword [0x1403b3558]
imul eax, eax, 0x3e8
cmp ecx, eax
jle 0x1400d95f7
mov rax, qword [rsp + 0x68]
mov qword [rax], 0xffffffffffffffff
xor eax, eax
jmp 0x1400d9680
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
call fcn.1400d9220
test eax, eax
jne 0x1400d960c
jmp 0x1400d95ad
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0x70]
mov rax, qword [rsp + 0x68]
mov r8d, dword [rax]
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.WSOCK32.dll_recv]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jne 0x1400d964e
mov rax, qword [rsp + 0x68]
mov qword [rax], 0
xor eax, eax
jmp 0x1400d9680
cmp dword [rsp + 0x30], 0
jge 0x1400d9665
mov rax, qword [rsp + 0x68]
mov qword [rax], 0xffffffffffffffff
xor eax, eax
jmp 0x1400d9680
movsxd rcx, dword [rsp + 0x30]
mov rax, qword [rsp + 0x68]
mov qword [rax], rcx
mov eax, 1
jmp 0x1400d9680
xor eax, eax
add rsp, 0x48
ret
Function at 0x1400d9d40
Capabilities:
Get local ipv4 addresses
Get socket information
Send data
Send data on socket
Write file on windows

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
mov eax, 0x1080
call fcn.1401da720
sub rsp, rax
mov qword [rsp + 0x1068], 0xfffffffffffffffe
mov rax, qword [0x1402aa5c0]
xor rax, rsp
mov qword [rsp + 0x1078], rax
xor r9d, r9d
mov r8d, dword [rsp + 0x10a8]
mov rdx, qword [rsp + 0x10a0]
mov rcx, qword [rsp + 0x1098]
call qword [sym.imp.WSOCK32.dll_send]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jge 0x1400d9db3
xor eax, eax
jmp 0x1400d9f90
movsxd rax, dword [rsp + 0x20]
cmp rax, qword [rsp + 0x10a8]
je 0x1400d9dc9
xor eax, eax
jmp 0x1400d9f90
cmp dword [0x1403b355c], 0
je 0x1400d9f8b
cmp qword [rsp + 0x10a8], 0
jbe 0x1400d9f8b
mov dword [rsp + 0x30], reloc.OLEAUT32.dll_SafeArrayGetDim
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x1098]
call qword [sym.imp.WSOCK32.dll_getsockname]
test eax, eax
je 0x1400d9e13
mov eax, 1
jmp 0x1400d9f90
movzx eax, byte [rsp + 0x44]
cmp eax, 0x7f
jne 0x1400d9e27
mov eax, 1
jmp 0x1400d9f90
movzx eax, byte [0x14021553e]
mov byte [rsp + 0x50], al
lea rdi, [rsp + 0x51]
xor eax, eax
mov ecx, 0x1000
rep stosb byte [rdi], al
lea rcx, [0x1403b58c8]
call fcn.14000f8f0
mov rdx, rax
lea rcx, [rsp + 0x1060]
call fcn.1400d9cc0
mov qword [rsp + 0x1070], rax
mov r8, qword [rsp + 0x1070]
mov r8, qword [r8]
lea rdx, str._slog.dat
lea rcx, [rsp + 0x50]
call fcn.1400ad4a8
lea rcx, [rsp + 0x1060]
call fcn.140001490
mov eax, dword [0x1404bda78]
and eax, 1
test eax, eax
jne 0x1400d9ec2
mov eax, dword [0x1404bda78]
or eax, 1
mov dword [0x1404bda78], eax
lea rcx, [0x1404bda40]
call fcn.14000e0a0
lea rcx, [0x1402034e0]
call fcn.1400a93ec
nop
lea rcx, [0x1404bda40]
call fcn.14000e350
lea rdx, [0x140219894]
lea rcx, [rsp + 0x50]
call fcn.1400b000c
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x1400d9f02
lea rdx, [0x1402198ec]
lea rcx, [rsp + 0x50]
call fcn.1400b000c
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1400d9f7f
mov r8d, 2
xor edx, edx
mov rcx, qword [rsp + 0x28]
call fcn.1400ae580
mov rcx, qword [rsp + 0x28]
call fcn.1400ae7f4
cmp eax, 0x40000
jle 0x1400d9f4d
mov rcx, qword [rsp + 0x28]
call fcn.1400aa608
lea rdx, [0x1402198fc]
lea rcx, [rsp + 0x50]
call fcn.1400b000c
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1400d9f7f
mov r9, qword [rsp + 0x28]
mov r8d, 1
mov rdx, qword [rsp + 0x10a8]
mov rcx, qword [rsp + 0x10a0]
call fcn.1400acb98
mov rcx, qword [rsp + 0x28]
call fcn.1400aa608
lea rcx, [0x1404bda40]
call fcn.14000e320
mov eax, 1
mov rcx, qword [rsp + 0x1078]
xor rcx, rsp
call fcn.1400a8790
add rsp, 0x1080
pop rdi
ret
Function at 0x1400dc730
Capabilities:
Resolve dns
Set socket configuration

Disassembly:
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x80
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov dword [rsp + 0x50], 0
xor ecx, ecx
call qword [sym.imp.WSOCK32.dll_gethostbyname]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
cmp qword [rsp + 0x28], 0
je 0x1400dc87d
movsxd rcx, dword [rsp + 0x20]
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 0x18]
cmp qword [rax + rcx*8], 0
je 0x1400dc87d
movsxd rcx, dword [rsp + 0x20]
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + rcx*8]
mov ecx, dword [rax]
call qword [sym.imp.WSOCK32.dll_inet_ntoa]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x1400dc86d
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.WSOCK32.dll_inet_addr]
mov ecx, eax
call qword [sym.imp.WSOCK32.dll_ntohl]
mov ebx, eax
lea rcx, str.192.0.0.0
call qword [sym.imp.WSOCK32.dll_inet_addr]
mov ecx, eax
call qword [sym.imp.WSOCK32.dll_ntohl]
cmp ebx, eax
jb 0x1400dc86d
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.WSOCK32.dll_inet_addr]
mov ecx, eax
call qword [sym.imp.WSOCK32.dll_ntohl]
mov ebx, eax
lea rcx, str.223.255.255.255
call qword [sym.imp.WSOCK32.dll_inet_addr]
mov ecx, eax
call qword [sym.imp.WSOCK32.dll_ntohl]
cmp ebx, eax
ja 0x1400dc86d
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.14000e700
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x68], rax
mov rcx, qword [rsp + 0x68]
call fcn.1400118c0
mov rdx, rax
mov rcx, qword [rsp + 0x90]
call fcn.140002100
mov eax, dword [rsp + 0x50]
or eax, 1
mov dword [rsp + 0x50], eax
lea rcx, [rsp + 0x40]
call fcn.140002ea0
mov rax, qword [rsp + 0x90]
jmp 0x1400dc924
mov eax, dword [rsp + 0x20]
add eax, 1
mov dword [rsp + 0x20], eax
jmp 0x1400dc763
cmp qword [rsp + 0x28], 0
je 0x1400dc8fd
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 0x18]
mov rax, qword [rax]
mov ecx, dword [rax]
call qword [sym.imp.WSOCK32.dll_inet_ntoa]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x1400dc8fd
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x48]
call fcn.14000e700
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x78], rax
mov rcx, qword [rsp + 0x78]
call fcn.1400118c0
mov rdx, rax
mov rcx, qword [rsp + 0x90]
call fcn.140002100
mov eax, dword [rsp + 0x50]
or eax, 1
mov dword [rsp + 0x50], eax
lea rcx, [rsp + 0x48]
call fcn.140002ea0
mov rax, qword [rsp + 0x90]
jmp 0x1400dc924
lea rdx, [0x14021ac9c]
mov rcx, qword [rsp + 0x90]
call fcn.140002100
mov eax, dword [rsp + 0x50]
or eax, 1
mov dword [rsp + 0x50], eax
mov rax, qword [rsp + 0x90]
add rsp, 0x80
pop rbx
ret