joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401c4eb9
Capabilities:
Get geographical location

Disassembly:
jmp 0x140502f60
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x58
call fcn.140501e90
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x140502fc7
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
movabs r10, 0xe375262d7cd44270
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x40]
call qword [0x140753030]
jmp 0x140502fe9
xor edx, edx
mov rcx, qword [rsp + 0x60]
call fcn.1401c2e2f
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
add rsp, 0x58
ret

Function at 0x1401c4eeb
Capabilities:
Terminate process

Disassembly:
jmp 0x14040f920
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x1401c57b0
Capabilities:
Print debug messages

Disassembly:
jmp 0x140527130
mov qword [rsp + 8], rcx
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x30]
mov rax, qword [0x140646600]
xor rax, rbp
mov qword [rbp + 0x18], rax
cmp qword [rbp + 0x30], 0
jne 0x140527156
jmp 0x1405271d3
mov rcx, qword [rbp + 0x30]
call fcn.1401c39ec
inc rax
mov qword [rbp], rax
cmp qword [rbp], 0
jne 0x14052716f
jmp 0x1405271d3
mov rax, qword [rbp]
shl rax, 1
mov rcx, rax
add rcx, 0xf
cmp rcx, rax
ja 0x14052718c
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1401c038c
sub rsp, rax
lea rax, [rsp + 0x30]
mov qword [rbp + 8], rax
mov rax, qword [rbp]
dec rax
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x30]
mov r8, qword [rbp]
mov rdx, qword [rbp + 8]
lea rcx, [rbp + 0x10]
call fcn.1401c1264
test eax, eax
jne 0x1405271d3
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rbp + 0x18]
xor rcx, rbp
call fcn.1401c40e5
lea rsp, [rbp + 0x20]
pop rbp
ret
Function at 0x1401c5c79
Capabilities:
Resolve dns

Disassembly:
jmp 0x1402edc10
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x6c8
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x112
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x6e8]
mov rax, qword [0x140646600]
xor rax, rbp
mov qword [rbp + 0x670], rax
lea rcx, reloc.WS2_32.dll_accept
call fcn.1401ca792
mov rax, qword [rbp + 0x6a0]
movzx eax, word [rax]
cmp eax, 2
jne 0x1402edc95
mov rax, qword [rbp + 0x6a0]
movzx ecx, word [rax + 2]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
mov rcx, qword [rbp + 0x6b8]
mov dword [rcx], eax
jmp 0x1402edcca
mov rax, qword [rbp + 0x6a0]
movzx eax, word [rax]
cmp eax, 0x17
jne 0x1402edcc3
mov rax, qword [rbp + 0x6a0]
movzx ecx, word [rax + 2]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
mov rcx, qword [rbp + 0x6b8]
mov dword [rcx], eax
jmp 0x1402edcca
xor al, al
jmp 0x1402edd4e
lea rax, [rbp + 0x10]
mov rdi, rax
xor eax, eax
mov ecx, 0x401
rep stosb byte [rdi], al
lea rcx, [rbp + 0x10]
call fcn.1401cac7e
mov qword [rbp + 0x668], rax
lea rcx, [rbp + 0x10]
call fcn.1401c3645
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov rcx, qword [rbp + 0x668]
mov r9d, ecx
mov r8, rax
mov edx, dword [rbp + 0x6a8]
mov rcx, qword [rbp + 0x6a0]
call qword [sym.imp.WS2_32.dll_getnameinfo]
test eax, eax
je 0x1402edd34
xor al, al
jmp 0x1402edd4e
lea rcx, [rbp + 0x10]
call fcn.1401c3645
mov rdx, rax
mov rcx, qword [rbp + 0x6b0]
call fcn.1401be758
mov al, 1
mov rdi, rax
lea rcx, [rbp - 0x40]
lea rdx, reloc.WS2_32.dll_accept
call fcn.1401c8505
mov rax, rdi
mov rcx, qword [rbp + 0x670]
xor rcx, rbp
call fcn.1401c40e5
lea rsp, [rbp + 0x688]
pop rdi
pop rbp
ret
Function at 0x1401c623c
Capabilities:
Set environment variable

Disassembly:
jmp 0x14051f7d0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x38]
mov rdx, qword [rax]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
add rsp, 0x28
ret
Function at 0x1401c696c
Capabilities:
Initialize winsock library

Disassembly:
jmp 0x1402a28d0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x2a8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, WSACleanup
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x2c8]
mov rax, qword [0x140646600]
xor rax, rbp
mov qword [rbp + 0x278], rax
lea rcx, reloc.WS2_32.dll_accept
call fcn.1401ca792
mov rax, qword [rbp + 0x2a0]
mov byte [rax], 0
lea rdx, [rbp + 0x10]
mov cx, 2
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x1402a293f
mov rax, qword [rbp + 0x2a0]
mov byte [rax], 1
mov rax, qword [rbp + 0x2a0]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, reloc.WS2_32.dll_accept
call fcn.1401c8505
mov rax, rdi
mov rcx, qword [rbp + 0x278]
xor rcx, rbp
call fcn.1401c40e5
lea rsp, [rbp + 0x288]
pop rdi
pop rbp
ret

Function at 0x1401c69e9
Capabilities:
Parse pe header

Disassembly:
jmp 0x1404129a0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1404129c0
xor al, al
jmp 0x140412a41
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1404129d3
xor al, al
jmp 0x140412a41
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x1404129fd
xor al, al
jmp 0x140412a41
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140412a11
xor al, al
jmp 0x140412a41
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140412a23
xor al, al
jmp 0x140412a41
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140412a3f
xor al, al
jmp 0x140412a41
mov al, 1
add rsp, 0x38
ret
Function at 0x1401c709c
Capabilities:
Initialize winsock library

Disassembly:
jmp 0x140347d70
push rbp
push rdi
sub rsp, 0x3d8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x8a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140646600]
xor rax, rbp
mov qword [rbp + 0x398], rax
lea rcx, reloc.WS2_32.dll_accept
call fcn.1401ca792
lea rax, str.conf_packet_athena.conf
mov qword [rbp + 8], rax
mov dword [rbp + 0x24], 0x1000
mov eax, 2
mov word [rbp + 0x204], ax
lea rdx, [rbp + 0x50]
movzx ecx, word [rbp + 0x204]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x140347df1
lea rcx, str.socket_init:_WinSock_not_available__n
call fcn.1401c3983
jmp 0x140347efb
movzx eax, word [rbp + 0x50]
and rax, 0xff
movzx eax, al
cmp eax, 2
jne 0x140347e18
movzx eax, word [rbp + 0x50]
shr rax, 8
and rax, 0xff
movzx eax, al
test eax, eax
je 0x140347e29
lea rcx, str.socket_init:_WinSock_version_mismatch__2.0_or_compatible_required___n
call fcn.1401c3983
jmp 0x140347efb
mov edx, reloc.WS2_32.dll_recv
lea rcx, [0x140663520]
call fcn.1401ca788
mov dword [0x140663514], eax
mov dword [0x140663560], 0
lea rcx, str.Server_uses_e_1_37mselecte_0m_as_event_dispatcher_n
call fcn.1401c860e
mov r8d, 0x200
xor edx, edx
lea rcx, [0x14066f570]
call fcn.1401c75c9
mov rcx, qword [rbp + 8]
call fcn.1401c481f
xor ecx, ecx
call fcn.140348050
mov qword [0x140663518], rax
lea r9, [0x1401c8eb5]
lea r8, [0x1401bf879]
lea rdx, [0x1401c652f]
xor ecx, ecx
call fcn.140344a20
mov r8d, 0x80000
xor edx, edx
lea rcx, [0x140677ba0]
call fcn.1401c75c9
lea rdx, str.connect_check_clear
lea rcx, [0x1403444e0]
call fcn.1401c1f4d
call fcn.1401c8a91
add rax, 0x3e8
mov dword [rsp + 0x20], 0x493e0
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x1403444e0]
mov rcx, rax
call fcn.1401cab4d
mov edx, dword [rbp + 0x24]
lea rcx, str.Server_supports_up_to_e_1_37m_ue_0m_concurrent_connections._n
call fcn.1401c860e
lea rcx, [rbp - 0x30]
lea rdx, reloc.WS2_32.dll_accept
call fcn.1401c8505
mov rcx, qword [rbp + 0x398]
xor rcx, rbp
call fcn.1401c40e5
lea rsp, [rbp + 0x3a8]
pop rdi
pop rbp
ret
Function at 0x1401c7d3f
Capabilities:
Terminate process

Disassembly:
jmp 0x140436610
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov ecx, reloc.WS2_32.dll_socket
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x14043663e
mov ecx, 5
int 0x29
mov r8d, 1
mov edx, 0xc0000417
mov ecx, 2
call fcn.1401c9941
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000417
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x1401c8faf
Capabilities:
Set current directory

Disassembly:
jmp 0x140527090
mov qword [rsp + 8], rcx
sub rsp, 0x68
lea rcx, [rsp + 0x30]
call fcn.1401c298e
call fcn.1401c4b12
mov r8d, eax
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x70]
call fcn.1401c21d2
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x1405270dd
mov dword [rsp + 0x24], 0
lea rcx, [rsp + 0x30]
call fcn.1401c36c7
mov eax, dword [rsp + 0x24]
jmp 0x140527102
lea rcx, [rsp + 0x30]
call fcn.1401c2709
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov dword [rsp + 0x28], eax
lea rcx, [rsp + 0x30]
call fcn.1401c36c7
mov eax, dword [rsp + 0x28]
add rsp, 0x68
ret
Function at 0x1401c9a4a
Capabilities:
Print debug messages

Disassembly:
jmp 0x1404f0250
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add rsp, 0x28
ret
Function at 0x1401c9d56
Capabilities:
Set thread local storage value

Disassembly:
jmp 0x140435390
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.140434ce0
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1404353d9
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x140753020]
jmp 0x1404353e8
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
add rsp, 0x48
ret

Function at 0x1401ca008
Capabilities:
Set environment variable

Disassembly:
jmp 0x140526f40
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xb8
lea rcx, [rsp + 0x78]
call fcn.1401c298e
lea rcx, [rsp + 0x48]
call fcn.1401c298e
call fcn.1401c4b12
mov r8d, eax
lea rdx, [rsp + 0x78]
mov rcx, qword [rsp + 0xc0]
call fcn.1401c21d2
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x140526faf
mov dword [rsp + 0x24], 0
lea rcx, [rsp + 0x48]
call fcn.1401c36c7
lea rcx, [rsp + 0x78]
call fcn.1401c36c7
mov eax, dword [rsp + 0x24]
jmp 0x140527040
call fcn.1401c4b12
mov r8d, eax
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0xc8]
call fcn.1401c21d2
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
je 0x140526ff6
mov dword [rsp + 0x2c], 0
lea rcx, [rsp + 0x48]
call fcn.1401c36c7
lea rcx, [rsp + 0x78]
call fcn.1401c36c7
mov eax, dword [rsp + 0x2c]
jmp 0x140527040
lea rcx, [rsp + 0x48]
call fcn.1401c2709
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x78]
call fcn.1401c2709
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0x48]
call fcn.1401c36c7
lea rcx, [rsp + 0x78]
call fcn.1401c36c7
mov eax, dword [rsp + 0x30]
add rsp, 0xb8
ret
Function at 0x1401ca607
Capabilities:
Create thread

Disassembly:
jmp 0x1404b8c90
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x78
cmp qword [rsp + 0x90], 0
je 0x1404b8cbc
mov dword [rsp + 0x30], 1
jmp 0x1404b8cc4
mov dword [rsp + 0x30], 0
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
jne 0x1404b8d0d
lea rax, str.procedure___nullptr
mov qword [rsp + 0x28], rax
lea rax, [0x1405be4d0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 0xc8
lea rdx, str.minkernelcrtsucrt_src_appcrt_startup_thread.cpp
mov ecx, 2
call fcn.1401bf5bd
cmp eax, 1
jne 0x1404b8d0d
int3
cmp dword [rsp + 0x34], 0
jne 0x1404b8d4f
call fcn.1401c27ef
mov dword [rax], reloc.WS2_32.dll_shutdown
mov qword [rsp + 0x20], 0
mov r9d, 0xc8
lea r8, str.minkernelcrtsucrt_src_appcrt_startup_thread.cpp
lea rdx, str._beginthreadex
lea rcx, str.procedure___nullptr
call fcn.1401c8b0e
xor eax, eax
jmp 0x1404b8e4f
mov rdx, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x90]
call fcn.1404b8780
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.1404b8580
lea rcx, [rsp + 0x40]
call fcn.1404b85f0
movzx eax, al
test eax, eax
jne 0x1404b8d9f
mov qword [rsp + 0x50], 0
lea rcx, [rsp + 0x40]
call fcn.1404b85d0
mov rax, qword [rsp + 0x50]
jmp 0x1404b8e4f
lea rcx, [rsp + 0x40]
call fcn.1404b8930
mov ecx, dword [rsp + 0x88]
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x28], rdx
mov edx, dword [rsp + 0xa0]
mov dword [rsp + 0x20], edx
mov r9, rax
lea r8, [0x1404b8330]
mov edx, ecx
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jne 0x1404b8e13
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1401c1a48
mov qword [rsp + 0x58], 0
lea rcx, [rsp + 0x40]
call fcn.1404b85d0
mov rax, qword [rsp + 0x58]
jmp 0x1404b8e4f
cmp qword [rsp + 0xa8], 0
je 0x1404b8e2c
mov rax, qword [rsp + 0xa8]
mov ecx, dword [rsp + 0x38]
mov dword [rax], ecx
lea rcx, [rsp + 0x40]
call fcn.1404b88f0
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x40]
call fcn.1404b85d0
mov rax, qword [rsp + 0x60]
add rsp, 0x78
ret
Function at 0x1401ca788
Capabilities:
Get hostname
Resolve dns

Disassembly:
jmp 0x140347b90
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x268
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x62
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x288]
mov rax, qword [0x140646600]
xor rax, rbp
mov qword [rbp + 0x238], rax
lea rcx, reloc.WS2_32.dll_accept
call fcn.1401ca792
mov dword [rbp + 4], 0
cmp qword [rbp + 0x260], 0
je 0x140347bf7
cmp dword [rbp + 0x268], 0
jg 0x140347bfe
xor eax, eax
jmp 0x140347cdb
mov edx, 0xff
lea rcx, [rbp + 0x30]
call qword [sym.imp.WS2_32.dll_gethostname]
cmp eax, 0xffffffff
jne 0x140347c2a
lea rcx, str.socket_getips:_No_hostname_defined__n
call fcn.1401c3983
xor eax, eax
jmp 0x140347cdb
lea rcx, [rbp + 0x30]
call qword [sym.imp.WS2_32.dll_gethostbyname]
mov qword [rbp + 0x168], rax
cmp qword [rbp + 0x168], 0
jne 0x140347c58
lea rcx, str.socket_getips:_Cannot_resolve_our_own_hostname_to_an_IP_address_n
call fcn.1401c3983
xor eax, eax
jmp 0x140347cdb
mov rax, qword [rbp + 0x168]
mov rax, qword [rax + 0x18]
mov qword [rbp + 0x148], rax
jmp 0x140347c74
mov eax, dword [rbp + 4]
inc eax
mov dword [rbp + 4], eax
mov eax, dword [rbp + 0x268]
cmp dword [rbp + 4], eax
jge 0x140347cb8
movsxd rax, dword [rbp + 4]
mov rcx, qword [rbp + 0x148]
cmp qword [rcx + rax*8], 0
je 0x140347cb8
movsxd rax, dword [rbp + 4]
mov rcx, qword [rbp + 0x148]
mov rax, qword [rcx + rax*8]
mov ecx, dword [rax]
call qword [sym.imp.WS2_32.dll_ntohl]
movsxd rcx, dword [rbp + 4]
mov rdx, qword [rbp + 0x260]
mov dword [rdx + rcx*4], eax
jmp 0x140347c6c
cmp dword [rbp + 4], 0
jne 0x140347cd8
movsxd rax, dword [rbp + 4]
mov rcx, qword [rbp + 0x260]
mov dword [rcx + rax*4], 0x7f000001
mov eax, dword [rbp + 4]
inc eax
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, reloc.WS2_32.dll_accept
call fcn.1401c8505
mov rax, rdi
mov rcx, qword [rbp + 0x238]
xor rcx, rbp
call fcn.1401c40e5
lea rsp, [rbp + 0x248]
pop rdi
pop rbp
ret
Function at 0x1401cb200
Capabilities:
Get system information on windows

Disassembly:
jmp 0x1403b41c0
sub rsp, 0x58
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov eax, dword [rsp + 0x40]
add rsp, 0x58
ret
Function at 0x1402ae9c0
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xf8
lea rbp, [rsp + 0x20]
lea rcx, reloc.WS2_32.dll_accept
call fcn.1401ca792
mov rax, qword [rbp + 0xf0]
mov rax, qword [rax + 0x18]
mov rcx, qword [rbp + 0xf0]
mov rcx, qword [rcx + 0x10]
mov rdx, qword [rbp + 0xf0]
mov rdx, qword [rdx + 8]
mov r8, qword [rbp + 0xf0]
mov r8, qword [r8]
mov qword [rbp + 0xc0], r8
mov r9d, dword [rax]
mov r8d, dword [rcx]
mov rdx, qword [rdx]
mov rax, qword [rbp + 0xc0]
mov rcx, qword [rax]
call qword [sym.imp.WS2_32.dll_send]
lea rsp, [rbp + 0xd8]
pop rdi
pop rbp
ret

Function at 0x1402aee10
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xf8
lea rbp, [rsp + 0x30]
lea rcx, reloc.WS2_32.dll_accept
call fcn.1401ca792
mov rax, qword [rbp + 0xe0]
mov rax, qword [rax]
mov rax, qword [rax]
inc rax
mov rcx, qword [rbp + 0xe0]
mov rcx, qword [rcx + 0x20]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rbp + 0xe0]
mov r9, qword [rcx + 0x18]
mov rcx, qword [rbp + 0xe0]
mov r8, qword [rcx + 0x10]
mov rcx, qword [rbp + 0xe0]
mov rdx, qword [rcx + 8]
mov ecx, eax
call qword [sym.imp.WS2_32.dll_select]
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret

Function at 0x1402af220
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xf8
lea rbp, [rsp + 0x20]
lea rcx, reloc.WS2_32.dll_accept
call fcn.1401ca792
mov rax, qword [rbp + 0xf0]
mov rax, qword [rax + 0x18]
mov rcx, qword [rbp + 0xf0]
mov rcx, qword [rcx + 0x10]
mov rdx, qword [rbp + 0xf0]
mov rdx, qword [rdx + 8]
mov r8, qword [rbp + 0xf0]
mov r8, qword [r8]
mov qword [rbp + 0xc0], r8
mov r9d, dword [rax]
mov r8d, dword [rcx]
mov rdx, qword [rdx]
mov rax, qword [rbp + 0xc0]
mov rcx, qword [rax]
call qword [sym.imp.WS2_32.dll_recv]
lea rsp, [rbp + 0xd8]
pop rdi
pop rbp
ret
Function at 0x1402b08b0
Capabilities:
Connect socket
Set socket configuration

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x158
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x1a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x178]
lea rcx, reloc.WS2_32.dll_accept
call fcn.1401ca792
mov rax, qword [rbp + 0x140]
mov rcx, qword [rax]
call fcn.1401c0cfb
movzx eax, al
mov dl, 1
mov rcx, qword [rbp + 0x148]
call fcn.1401c8794
mov rax, qword [rbp + 0x150]
mov r8d, dword [rax + 0x10]
mov rax, qword [rbp + 0x150]
mov rdx, qword [rax + 0x20]
mov rcx, qword [rbp + 0x148]
call qword [sym.imp.WS2_32.dll_connect]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jge 0x1402b09ae
call fcn.1401c43ec
movzx eax, al
test eax, eax
je 0x1402b0962
mov rax, qword [rbp + 0x140]
mov rax, qword [rax + 8]
mov dword [rax], 2
xor al, al
jmp 0x1402b0a99
mov rax, qword [rbp + 0x140]
mov rax, qword [rax + 0x18]
mov rcx, qword [rbp + 0x140]
mov rcx, qword [rcx + 0x10]
mov r8, qword [rax]
mov rdx, qword [rcx]
mov rcx, qword [rbp + 0x148]
call fcn.1401caa4e
mov rcx, qword [rbp + 0x140]
mov rcx, qword [rcx + 8]
mov dword [rcx], eax
mov rax, qword [rbp + 0x140]
mov rax, qword [rax + 8]
cmp dword [rax], 0
je 0x1402b09ae
xor al, al
jmp 0x1402b0a99
xor edx, edx
mov rcx, qword [rbp + 0x148]
call fcn.1401c8794
mov rax, qword [rbp + 0x140]
mov rax, qword [rax + 0x20]
imul rax, qword [rax], 0x3e8
mov qword [rbp + 0x118], rax
mov rcx, qword [rbp + 0x140]
mov rcx, qword [rcx + 0x28]
mov rax, qword [rcx]
cqo
mov ecx, 0x3e8
idiv rcx
mov rcx, qword [rbp + 0x118]
add rcx, rax
mov rax, rcx
mov dword [rbp + 0x24], eax
mov dword [rsp + 0x20], 4
lea r9, [rbp + 0x24]
mov r8d, 0x1006
mov edx, 0xffff
mov rcx, qword [rbp + 0x148]
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rax, qword [rbp + 0x140]
mov rax, qword [rax + 0x30]
imul rax, qword [rax], 0x3e8
mov qword [rbp + 0x118], rax
mov rcx, qword [rbp + 0x140]
mov rcx, qword [rcx + 0x38]
mov rax, qword [rcx]
cqo
mov ecx, 0x3e8
idiv rcx
mov rcx, qword [rbp + 0x118]
add rcx, rax
mov rax, rcx
mov dword [rbp + 0x44], eax
mov dword [rsp + 0x20], 4
lea r9, [rbp + 0x44]
mov r8d, 0x1005
mov edx, 0xffff
mov rcx, qword [rbp + 0x148]
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rax, qword [rbp + 0x140]
mov rax, qword [rax + 8]
mov dword [rax], 0
mov al, 1
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, reloc.WS2_32.dll_bind
call fcn.1401c8505
mov rax, rdi
lea rsp, [rbp + 0x128]
pop rdi
pop rbp
ret
Function at 0x140506740
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1498
call fcn.1401c038c
sub rsp, rax
mov rax, qword [0x140646600]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov eax, dword [rsp + 0x14b8]
sar eax, 6
cdqe
lea rcx, [0x140719850]
mov edx, dword [rsp + 0x14b8]
and edx, 0x3f
movsxd rdx, edx
imul rdx, rdx, 0x48
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + rdx + 0x28]
mov qword [rsp + 0x60], rax
mov eax, dword [rsp + 0x14c8]
mov rcx, qword [rsp + 0x14c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x68]
mov rdi, rax
xor eax, eax
mov ecx, reloc.WS2_32.dll_inet_ntoa
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x14c0]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rax
jae 0x140506932
lea rax, [rsp + 0x147f]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x38], rax
jae 0x140506886
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rax
jae 0x140506886
mov rax, qword [rsp + 0x48]
movzx eax, byte [rax]
mov byte [rsp + 0x31], al
mov rax, qword [rsp + 0x48]
inc rax
mov qword [rsp + 0x48], rax
movzx eax, byte [rsp + 0x31]
mov byte [rsp + 0x30], al
movsx eax, byte [rsp + 0x30]
cmp eax, 0xa
jne 0x14050686b
mov eax, dword [rsp + 0x70]
inc eax
mov dword [rsp + 0x70], eax
mov rax, qword [rsp + 0x38]
mov byte [rax], reloc.WS2_32.dll_listen
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx ecx, byte [rsp + 0x30]
mov byte [rax], cl
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
jmp 0x140506808
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
mov r8d, dword [rsp + 0x40]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1405068f2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x68], eax
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, reloc.WS2_32.dll_inet_ntoa
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x140506951
mov eax, dword [rsp + 0x44]
mov ecx, dword [rsp + 0x6c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6c], eax
mov eax, dword [rsp + 0x40]
cmp dword [rsp + 0x44], eax
jae 0x14050692d
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, reloc.WS2_32.dll_inet_ntoa
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x140506951
jmp 0x1405067de
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, reloc.WS2_32.dll_inet_ntoa
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.1401c40e5
add rsp, 0x1498
pop rdi
pop rsi
ret