joyce8/EMBER2024-capa huggingface dataset:
Function at 0x594da4
Capabilities:
Copy file

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x1c0
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov rdi, rdx
mov rsi, rcx
mov rcx, rdx
call fcn.00595338
mov rdx, rdi
lea rcx, [rsp + 0x78]
call fcn.00401f00
mov rbx, rax
mov rdx, rsi
lea rcx, [rsp + 0x28]
call fcn.00401f00
xor r8d, r8d
mov rdx, qword [rbx + 0x48]
mov rcx, qword [rax + 0x48]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
sete bl
lea rax, [rsp + 0x28]
mov rcx, qword [rsp + 0x70]
cmp rcx, rax
je 0x594e3a
test rcx, rcx
je 0x594e3a
mov rax, qword [rsp + 0x28]
sub rax, rcx
sar rax, 1
lea rdx, [rax + rax]
cmp rdx, 0x100
jbe 0x594e34
call fcn.006a4944
jmp 0x594e3a
call fcn.006a3610
nop
lea rax, [rsp + 0x78]
mov rcx, qword [rsp + 0xc0]
cmp rcx, rax
je 0x594e75
test rcx, rcx
je 0x594e75
mov rax, qword [rsp + 0x78]
sub rax, rcx
sar rax, 1
lea rdx, [rax + rax]
cmp rdx, 0x100
jbe 0x594e70
call fcn.006a4944
jmp 0x594e75
call fcn.006a3610
test bl, bl
je 0x594f43
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rsp + 0x188]
call fcn.0058defc
nop
lea r8, str._when_copying__
mov rdx, rax
lea rcx, [rsp + 0x128]
call fcn.00402658
nop
mov r8, rsi
mov rdx, rax
lea rcx, [rsp + 0xc8]
call fcn.00402448
nop
lea r8, str.__to__
mov rdx, rax
lea rcx, [rsp + 0x158]
call fcn.00402658
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rsp + 0xf8]
call fcn.00402448
nop
lea r8, [0x007b44f4]
mov rdx, rax
lea rcx, [rsp + 0x78]
call fcn.00402658
mov rbx, rax
lea rcx, [rsp + 0x28]
call fcn.006a49e8
lea r11, [0x00798b08]
mov qword [rsp + 0x28], r11
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.004029b4
lea r11, [0x00798b08]
mov qword [rsp + 0x28], r11
lea rdx, [0x00850da0]
lea rcx, [rsp + 0x28]
call fcn.006ab82c
nop
lea r11, [rsp + 0x1c0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x594f58
Capabilities:
Delete file

Disassembly:
sub rsp, 0x78
mov rdx, rcx
lea rcx, [rsp + 0x20]
call fcn.00401f00
mov rcx, qword [rax + 0x48]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [rsp + 0x68]
lea r11, [rsp + 0x20]
cmp rcx, r11
je 0x594faa
test rcx, rcx
je 0x594faa
mov rdx, qword [rsp + 0x20]
sub rdx, rcx
sar rdx, 1
add rdx, rdx
cmp rdx, 0x100
jbe 0x594fa5
call fcn.006a4944
jmp 0x594faa
call fcn.006a3610
add rsp, 0x78
ret
Function at 0x594fb0
Capabilities:
Copy file

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x1f0
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov rbx, rdx
mov rsi, rcx
mov rcx, rdx
call fcn.00595390
xor r8d, r8d
mov rdx, qword [rbx + 0x48]
mov rcx, qword [rsi + 0x48]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x5950df
mov rdx, rbx
lea rcx, [rsp + 0x190]
call fcn.00402190
mov rdi, rax
mov rdx, rsi
lea rcx, [rsp + 0x1c0]
call fcn.00402190
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rsp + 0xd0]
call fcn.0058defc
nop
lea r8, str._when_copying__
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.00402658
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x130]
call fcn.00402448
nop
lea r8, str.__to__
mov rdx, rax
lea rcx, [rsp + 0xa0]
call fcn.00402658
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rsp + 0x100]
call fcn.00402448
nop
lea r8, [0x007b44f4]
mov rdx, rax
lea rcx, [rsp + 0x160]
call fcn.00402658
mov rbx, rax
lea rcx, [rsp + 0x28]
call fcn.006a49e8
lea r11, [0x00798b08]
mov qword [rsp + 0x28], r11
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.004029b4
lea r11, [0x00798b08]
mov qword [rsp + 0x28], r11
lea rdx, [0x00850da0]
lea rcx, [rsp + 0x28]
call fcn.006ab82c
nop
lea r11, [rsp + 0x1f0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x5950f4
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x2e0
mov rdi, rcx
lea rcx, [rsp + 0x90]
xor edx, edx
mov r8d, 0x250
call fcn.006aba40
lea rcx, [rsp + 0x38]
mov rdx, rdi
call fcn.00401f00
lea rdx, [rsp + 0x90]
mov rcx, qword [rax + 0x48]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rcx, qword [rsp + 0x80]
mov rbx, rax
lea rax, [rsp + 0x38]
cmp rcx, rax
je 0x595175
test rcx, rcx
je 0x595175
mov rdx, qword [rsp + 0x38]
sub rdx, rcx
sar rdx, 1
add rdx, rdx
cmp rdx, 0x100
jbe 0x595170
call fcn.006a4944
jmp 0x595175
call fcn.006a3610
or rax, 0xffffffffffffffff
cmp rbx, rax
je 0x595248
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
mov r11d, dword [rsp + 0x90]
bt r11d, 0xa
jae 0x595233
cmp dword [rsp + 0xb4], 0xa000000c
jne 0x595233
shr r11d, 4
mov r9d, 1
test r9b, r11b
jne 0x595233
lea rcx, [rsp + 0x20]
mov r8d, 0x80000000
mov rdx, rdi
call fcn.005944d4
lea rdx, [rsp + 0x2f8]
mov rcx, qword [rax + 0x10]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
or edx, 0xffffffff
cmp eax, edx
jne 0x5951fc
lea rcx, [rsp + 0x2f8]
call fcn.00594950
mov rbx, rax
jmp 0x59520c
mov ebx, dword [rsp + 0x2f8]
mov eax, eax
shl rbx, 0x20
or rbx, rax
lea rax, [0x007955b8]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
lea rax, [0x007955c8]
mov qword [rsp + 0x28], rax
call fcn.0059492c
mov rax, rbx
jmp 0x595248
mov eax, dword [rsp + 0xac]
mov ecx, dword [rsp + 0xb0]
shl rax, 0x20
or rax, rcx
mov rbx, qword [rsp + 0x2f0]
add rsp, 0x2e0
pop rdi
ret
Function at 0x5952a0
Capabilities:
Get file attributes

Disassembly:
push rbx
sub rsp, 0x70
mov rdx, rcx
lea rcx, [rsp + 0x20]
call fcn.00401f00
mov rcx, qword [rax + 0x48]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov rcx, qword [rsp + 0x68]
mov ebx, eax
lea rax, [rsp + 0x20]
cmp rcx, rax
je 0x5952f6
test rcx, rcx
je 0x5952f6
mov rdx, qword [rsp + 0x20]
sub rdx, rcx
sar rdx, 1
add rdx, rdx
cmp rdx, 0x100
jbe 0x5952f1
call fcn.006a4944
jmp 0x5952f6
call fcn.006a3610
cmp ebx, 0xffffffff
jne 0x5952ff
xor eax, eax
jmp 0x59530a
and bl, 0x10
neg bl
sbb eax, eax
neg eax
inc eax
add rsp, 0x70
pop rbx
ret

Function at 0x595310
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx + 0x48]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x595327
xor eax, eax
jmp 0x595331
and al, 0x10
neg al
sbb eax, eax
neg eax
inc eax
add rsp, 0x28
ret

Function at 0x595390
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
lea rdx, [0x007b4510]
xor r8d, r8d
mov rbx, rcx
call fcn.0049c860
cmp rax, 0xffffffffffffffff
je 0x59542a
lea r8, [rax + 1]
jmp 0x595415
lea rdi, [rax + 1]
lea rdx, [rsp + 0x20]
xor r8d, r8d
mov r9, rdi
mov rcx, rbx
call fcn.00421328
xor edx, edx
mov rcx, qword [rax + 0x48]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov rcx, qword [rsp + 0x68]
lea r11, [rsp + 0x20]
cmp rcx, r11
je 0x595412
test rcx, rcx
je 0x595412
mov rdx, qword [rsp + 0x20]
sub rdx, rcx
sar rdx, 1
add rdx, rdx
cmp rdx, 0x100
jbe 0x59540d
call fcn.006a4944
jmp 0x595412
call fcn.006a3610
mov r8, rdi
lea rdx, [0x007b4510]
mov rcx, rbx
call fcn.0049c860
cmp rax, 0xffffffffffffffff
jne 0x5953b8
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret

Function at 0x5954d8
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
and dword [rsp + 0x30], 0
and dword [rsp + 0x30], 0
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
mov rbx, rdx
lea r8, [rsp + 0x30]
xor r9d, r9d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov rcx, qword [rdi + 0x10]
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
or edx, 0xffffffff
cmp eax, edx
jne 0x59552b
lea rcx, [rsp + 0x30]
call fcn.00594950
mov r11, rax
jmp 0x595539
mov r11d, dword [rsp + 0x30]
mov eax, eax
shl r11, 0x20
or r11, rax
cmp r11, 0xffffffffffffffff
jne 0x595550
lea rdx, [0x0085e820]
mov rcx, rbx
call fcn.004029b4
jmp 0x59555e
mov r8d, r11d
mov rdx, rbx
mov rcx, rdi
call fcn.00595438
mov rax, rbx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x59556c
Capabilities:
Enumerate files on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rsi
push rdi
push r12
sub rsp, 0x3b0
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov rsi, rdx
mov rdi, rcx
and dword [rsp + 0x20], 0
and qword [rcx], 0
and qword [rcx + 8], 0
and qword [rcx + 0x10], 0
mov dword [rsp + 0x20], 1
lea rcx, [rsp + 0x60]
call fcn.00402448
nop
mov rdx, rax
lea rcx, [rsp + 0x110]
call fcn.00401f00
lea rdx, [rsp + 0x160]
mov rcx, qword [rax + 0x48]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
lea rax, [rsp + 0x110]
mov r12d, 0x100
mov rcx, qword [rsp + 0x158]
cmp rcx, rax
je 0x59561f
test rcx, rcx
je 0x59561f
mov rdx, qword [rsp + 0x110]
sub rdx, rcx
sar rdx, 1
add rdx, rdx
cmp rdx, r12
jbe 0x595619
call fcn.006a4944
jmp 0x59561f
call fcn.006a3610
nop
lea rax, [rsp + 0x60]
mov rcx, qword [rsp + 0x88]
cmp rcx, rax
je 0x59564f
test rcx, rcx
je 0x59564f
mov rdx, qword [rsp + 0x60]
sub rdx, rcx
cmp rdx, r12
jbe 0x59564a
call fcn.006a4944
jmp 0x59564f
call fcn.006a3610
cmp rbx, 0xffffffffffffffff
je 0x59576e
lea r8, [rsp + 0x3e8]
lea rdx, [rsp + 0x18c]
lea rcx, [rsp + 0xc0]
call fcn.004023b4
nop
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x90]
call fcn.00402190
nop
mov r8, rax
mov rdx, rsi
lea rcx, [rsp + 0x30]
call fcn.00402448
nop
mov rdx, rax
mov rcx, rdi
call fcn.0040ce70
nop
lea rax, [rsp + 0x30]
mov rcx, qword [rsp + 0x58]
cmp rcx, rax
je 0x5956d8
test rcx, rcx
je 0x5956d8
mov rdx, qword [rsp + 0x30]
sub rdx, rcx
cmp rdx, r12
jbe 0x5956d2
call fcn.006a4944
jmp 0x5956d8
call fcn.006a3610
nop
lea rax, [rsp + 0x90]
mov rcx, qword [rsp + 0xb8]
cmp rcx, rax
je 0x59570f
test rcx, rcx
je 0x59570f
mov rdx, qword [rsp + 0x90]
sub rdx, rcx
cmp rdx, r12
jbe 0x595709
call fcn.006a4944
jmp 0x59570f
call fcn.006a3610
nop
lea rax, [rsp + 0xc0]
mov rcx, qword [rsp + 0x108]
cmp rcx, rax
je 0x59574c
test rcx, rcx
je 0x59574c
mov rax, qword [rsp + 0xc0]
sub rax, rcx
sar rax, 1
lea rdx, [rax + rax]
cmp rdx, r12
jbe 0x595747
call fcn.006a4944
jmp 0x59574c
call fcn.006a3610
lea rdx, [rsp + 0x160]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x595659
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rax, rdi
mov rbx, qword [rsp + 0x3d8]
add rsp, 0x3b0
pop r12
pop rdi
pop rsi
ret
Function at 0x5b99dc
Capabilities:
Set socket configuration

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rdi
sub rsp, 0x60
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 0x18], rsi
mov rdi, rcx
call fcn.005b9b34
nop
mov ecx, 0x50
call fcn.006a494c
mov rsi, rax
test rax, rax
je 0x5b9a38
lea rax, [0x007b3690]
mov qword [rsi], rax
lea rax, [rsi + 8]
mov qword [rax + 0x20], rax
mov qword [rax + 0x28], rax
mov rax, qword [rax + 0x20]
mov byte [rax], 0
or qword [rsi + 0x40], 0xffffffffffffffff
mov byte [rsi + 0x49], 0
jmp 0x5b9a3a
xor esi, esi
mov rcx, qword [rdi + 0x120]
cmp rsi, rcx
je 0x5b9a55
test rcx, rcx
je 0x5b9a55
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
mov qword [rdi + 0x120], rsi
mov rcx, rsi
mov rax, qword [rsi]
mov dl, 1
call qword [rax + 0x58]
mov rcx, qword [rdi + 0x120]
and dword [rsp + 0x78], 0
lea r8, [rsp + 0x78]
mov edx, 0x8004667e
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.WS2_32.dll_ioctlsocket]
lea r8, [rsp + 0x78]
lea rdx, str.0.0.0.0
lea rcx, [rsp + 0x28]
call fcn.004021a8
nop
mov rsi, qword [rdi + 0x120]
mov rax, qword [0x00862cb8]
cmp byte [rax + 0x2f50], 0
jne 0x5b9acf
mov rcx, qword [rax + 0xb8]
test rcx, rcx
je 0x5b9acf
mov edx, 0xd0
call fcn.0040a51c
mov edx, eax
jmp 0x5b9ad5
mov edx, dword [rax + 0x2764]
mov rax, qword [rsi]
lea r8, [rsp + 0x28]
mov rcx, rsi
call qword [rax + 0x60]
mov dword [rdi + 0x128], eax
lea rax, [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
cmp rcx, rax
je 0x5b9b1a
test rcx, rcx
je 0x5b9b1a
mov rdx, qword [rsp + 0x28]
sub rdx, rcx
cmp rdx, 0x100
jbe 0x5b9b15
call fcn.006a4944
jmp 0x5b9b1a
call fcn.006a3610
lea rcx, [rdi + 0x50]
call fcn.00593424
nop
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
Function at 0x5bf454
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x78], rbx
mov rbp, r8
mov r12, rdx
mov rbx, rcx
and dword [rsp + 0x24], 0
mov qword [rcx + 0x20], rcx
mov qword [rcx + 0x28], rcx
mov rax, qword [rcx + 0x20]
mov byte [rax], 0
mov dword [rsp + 0x24], 1
xor esi, esi
xor ecx, ecx
test r8, r8
je 0x5bf609
lea edi, [rsi + 3]
dec rbp
mov al, byte [r12]
mov byte [rsp + rcx + 0x88], al
inc esi
inc rcx
inc r12
mov r15b, byte [rsp + 0x8a]
mov r13b, byte [rsp + 0x89]
mov r14b, byte [rsp + 0x88]
cmp rcx, rdi
jne 0x5bf541
mov al, r14b
shr al, 2
mov byte [rsp + 0x20], al
mov cl, r14b
and cl, dil
shl cl, 4
mov al, r13b
shr al, 4
add cl, al
mov byte [rsp + 0x21], cl
mov cl, r13b
and cl, 0xf
shl cl, 2
mov al, r15b
shr al, 6
add cl, al
mov byte [rsp + 0x22], cl
mov al, r15b
and al, 0x3f
mov byte [rsp + 0x23], al
xor esi, esi
movzx ecx, byte [rsp + rsi + 0x20]
mov rax, qword [0x008ae008]
mov dl, byte [rcx + rax]
mov rcx, rbx
call fcn.00421144
inc rsi
cmp rsi, 4
jl 0x5bf51d
xor esi, esi
xor ecx, ecx
test rbp, rbp
jne 0x5bf4ab
test esi, esi
je 0x5bf609
movsxd rax, esi
cmp rax, rdi
jge 0x5bf587
lea rcx, [rsp + rax + 0x88]
mov r8, rdi
sub r8, rax
xor edx, edx
call fcn.006aba40
mov r15b, byte [rsp + 0x8a]
mov r13b, byte [rsp + 0x89]
mov r14b, byte [rsp + 0x88]
mov al, r14b
shr al, 2
mov byte [rsp + 0x20], al
and r14b, dil
shl r14b, 4
mov al, r13b
shr al, 4
add r14b, al
mov byte [rsp + 0x21], r14b
and r13b, 0xf
shl r13b, 2
mov al, r15b
shr al, 6
add r13b, al
mov byte [rsp + 0x22], r13b
and r15b, 0x3f
mov byte [rsp + 0x23], r15b
lea eax, [rsi + 1]
test eax, eax
jle 0x5bf5f3
lea rbp, [rsp + 0x20]
mov r12d, eax
movzx ecx, byte [rbp]
mov rax, qword [0x008ae008]
mov dl, byte [rcx + rax]
mov rcx, rbx
call fcn.00421144
inc rbp
sub r12, 1
jne 0x5bf5d4
cmp esi, edi
jge 0x5bf609
sub edi, esi
mov dl, 0x3d
mov rcx, rbx
call fcn.00421144
sub rdi, 1
jne 0x5bf5f9
mov rax, rbx
mov rbx, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x5f7c64
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
sub rsp, 0xa0
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov rsi, r8
mov edi, edx
mov r12, rcx
test edx, edx
jne 0x5f7c92
xor al, al
jmp 0x5f7d93
test edx, 0xc0000000
je 0x5f7cdd
mov eax, edx
shl eax, 8
xor eax, edx
and eax, 0x3fffffff
shl edi, 8
xor eax, edi
mov dword [r8], eax
mov r8d, 0x4593457
mov ecx, r8d
lea rdx, [rsi + 4]
mov eax, dword [rdx - 4]
xor eax, 0xa0934573
add eax, ecx
mov dword [rdx], eax
add ecx, r8d
add rdx, 4
cmp ecx, 0x1a173a0a
jb 0x5f7cbb
mov al, 1
jmp 0x5f7d93
lea rbx, [rcx + 0x20]
mov qword [rsp + 0x30], rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
mov edx, 6
mov rcx, r12
call fcn.005f6e8c
mov r12, rax
mov r8d, edi
mov edx, 1
mov rcx, rax
call fcn.0065ed68
lea rdx, [rsp + 0xd8]
mov rcx, r12
call fcn.0065eedc
nop
lea rcx, [rsp + 0xd8]
call fcn.0065ea68
test al, al
jne 0x5f7d4d
lea rcx, [rsp + 0xd8]
call fcn.0065ea38
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor al, al
jmp 0x5f7d93
xor edx, edx
mov rcx, qword [rsp + 0xd8]
mov rcx, qword [rcx + 8]
call fcn.00670c78
mov rcx, qword [rax]
mov qword [rsi], rcx
mov rcx, qword [rax + 8]
mov qword [rsi + 8], rcx
mov rax, qword [rax + 0x10]
mov qword [rsi + 0x10], rax
lea rcx, [rsp + 0xd8]
call fcn.0065ea38
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, 1
jmp 0x5f7d93
mov rbx, qword [rsp + 0xc0]
add rsp, 0xa0
pop r12
pop rdi
pop rsi
ret
Function at 0x609328
Capabilities:
Set socket configuration

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x80
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rdi, rdx
mov rbx, rcx
cmp qword [rcx + 0x40], 0xffffffffffffffff
je 0x60935d
mov rax, qword [rcx]
call qword [rax + 0x20]
mov r11, qword [rbx]
mov rcx, rbx
call qword [r11 + 0x28]
mov dword [rsp + 0x98], reloc.WS2_32.dll_recv
lea r8, [rsp + 0x98]
lea rdx, [rsp + 0x28]
mov rcx, qword [rdi + 0x40]
call qword [sym.imp.WS2_32.dll_accept]
mov qword [rbx + 0x40], rax
cmp rax, 0xffffffffffffffff
jne 0x609396
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2714
je 0x609368
mov rcx, qword [rbx + 0x40]
cmp rcx, 0xffffffffffffffff
jne 0x6093c4
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
lea rcx, [rsp + 0x38]
call fcn.0060901c
lea rdx, [0x00850ed8]
lea rcx, [rsp + 0x38]
call fcn.006ab82c
int3
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.WS2_32.dll_WSAAsyncSelect]
mov byte [rbx + 0x48], 0
mov ecx, dword [rsp + 0x2c]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
mov rdx, rax
lea r8, [rsp + 0x90]
lea rcx, [rsp + 0x38]
call fcn.004021a8
nop
lea rcx, [rbx + 8]
lea rax, [rsp + 0x38]
cmp rax, rcx
je 0x609414
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
call fcn.0040289c
nop
lea rax, [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
cmp rcx, rax
je 0x609445
test rcx, rcx
je 0x609445
mov rdx, qword [rsp + 0x38]
sub rdx, rcx
cmp rdx, 0x100
jbe 0x609440
call fcn.006a4944
jmp 0x609445
call fcn.006a3610
mov byte [rbx + 0x49], 1
mov dword [rsp + 0x90], 1
lea r8, [rsp + 0x90]
mov edx, 0x8004667e
mov rcx, qword [rbx + 0x40]
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov rbx, qword [rsp + 0xa0]
add rsp, 0x80
pop rdi
ret
Function at 0x6095ac
Capabilities:
Connect socket

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0xb0
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov esi, r8d
mov rdi, rdx
mov rbx, rcx
cmp qword [rcx + 0x40], 0xffffffffffffffff
jne 0x6095e0
mov rax, qword [rcx]
xor edx, edx
call qword [rax + 0x58]
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.0060b2a4
nop
xor edx, edx
lea r8d, [rdx + 0x10]
lea rcx, [rsp + 0x20]
call fcn.006aba40
mov r11d, 2
mov word [rsp + 0x20], r11w
movzx ecx, si
call qword [sym.imp.WS2_32.dll_htons]
mov word [rsp + 0x22], ax
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.WS2_32.dll_inet_addr]
mov dword [rsp + 0x24], eax
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rsp + 0x20]
mov rcx, qword [rbx + 0x40]
call qword [sym.imp.WS2_32.dll_connect]
mov edi, eax
test eax, eax
jns 0x60964f
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2714
je 0x609627
cmp edi, 0xffffffff
jne 0x60967f
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x60967f
mov edx, eax
lea rcx, [rsp + 0x68]
call fcn.0060901c
lea rdx, [0x00850ed8]
lea rcx, [rsp + 0x68]
call fcn.006ab82c
int3
cmp edi, 0xffffffff
je 0x609688
mov byte [rbx + 0x49], 1
lea rcx, [rbx + 8]
lea rax, [rsp + 0x30]
cmp rax, rcx
je 0x6096a5
mov r8, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x58]
call fcn.0040289c
mov dword [rbx + 0x38], esi
lea rax, [rsp + 0x30]
mov rcx, qword [rsp + 0x58]
cmp rcx, rax
je 0x6096d9
test rcx, rcx
je 0x6096d9
mov rdx, qword [rsp + 0x30]
sub rdx, rcx
cmp rdx, 0x100
jbe 0x6096d4
call fcn.006a4944
jmp 0x6096d9
call fcn.006a3610
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x60a584
Capabilities:
Set socket configuration

Disassembly:
mov rax, rsp
mov dword [rax + 0x18], r8d
sub rsp, 0x88
mov rcx, qword [rcx + 0x40]
mov r8d, edx
lea r9, [rax + 0x18]
mov edx, 0xffff
mov dword [rax - 0x68], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x60a5d8
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rcx, [rsp + 0x30]
mov edx, eax
call fcn.0060901c
lea rdx, [0x00850ed8]
lea rcx, [rsp + 0x30]
call fcn.006ab82c
int3
add rsp, 0x88
ret

Function at 0x60b2a4
Capabilities:
Resolve dns

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
and dword [rsp + 0x38], 0
mov rbx, rcx
mov rcx, qword [rdx + 0x28]
mov rdi, rdx
call qword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, 0xffffffff
jne 0x60b301
mov rcx, qword [rdi + 0x28]
call qword [sym.imp.WS2_32.dll_gethostbyname]
test rax, rax
jne 0x60b2e0
lea rdx, [0x0085e820]
jmp 0x60b304
mov rax, qword [rax + 0x18]
mov rcx, qword [rax]
mov ecx, dword [rcx]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
lea r8, [rsp + 0x38]
mov rcx, rbx
mov rdx, rax
call fcn.004021a8
jmp 0x60b30c
mov rdx, rdi
mov rcx, rbx
call fcn.004029b4
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x60b31c
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rbx
sub rsp, 0x30
mov rcx, qword [rcx + 0x40]
mov rbx, rdx
cmp rcx, 0xffffffffffffffff
je 0x60b367
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x50], reloc.WS2_32.dll_recv
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x60b367
mov ecx, dword [rsp + 0x24]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
lea r8, [rsp + 0x40]
mov rcx, rbx
mov rdx, rax
call fcn.004021a8
jmp 0x60b376
lea rdx, [0x0085e820]
mov rcx, rbx
call fcn.004029b4
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x637200
Capabilities:
Get file size

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x50
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov rsi, rcx
mov ebp, 1
mov r9d, ebp
mov r8d, 0x80000000
lea rcx, [rsp + 0x30]
call fcn.005944d4
nop
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
or edi, 0xffffffff
cmp eax, edi
jne 0x637260
mov edx, edi
lea rcx, [rsp + 0x80]
call fcn.00594950
mov r11, rax
jmp 0x637271
mov r11d, dword [rsp + 0x80]
shl r11, 0x20
mov eax, eax
or r11, rax
cmp r11, 0x438
je 0x63728a
cmp r11, 0x436
je 0x63728a
xor edi, edi
jmp 0x6373ab
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, edi
jne 0x6372b5
mov edx, edi
lea rcx, [rsp + 0x80]
call fcn.00594950
mov rcx, rax
jmp 0x6372c5
mov ecx, dword [rsp + 0x80]
shl rcx, 0x20
mov eax, eax
or rcx, rax
call fcn.006a43c4
mov rbx, rax
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x88]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, edi
jne 0x6372fd
mov edx, edi
lea rcx, [rsp + 0x88]
call fcn.00594950
mov r11, rax
jmp 0x63730e
mov r11d, dword [rsp + 0x88]
shl r11, 0x20
mov eax, eax
or r11, rax
mov qword [rsp + 0x88], r11
lea r8, [rsp + 0x88]
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.00594a94
mov rcx, qword [rsi + 0x80]
call fcn.006a5528
xor edi, edi
mov qword [rsi + 0x80], rdi
cmp rbx, rdi
je 0x637354
mov rdx, rbx
lea rcx, [rsi + 0x80]
call fcn.0060e51c
mov rax, qword [rsi + 0x80]
cmp rax, rdi
je 0x637365
mov eax, dword [rax + 0x12]
jmp 0x637367
mov eax, edi
cmp eax, 0x10
jne 0x63739c
mov rax, qword [rsi + 0x80]
cmp rax, rdi
je 0x63737d
mov eax, dword [rax + 0x16]
jmp 0x63737f
mov eax, edi
cmp eax, 0x10
jne 0x63739c
mov rax, qword [rsi + 0x80]
cmp rax, rdi
je 0x637395
mov eax, dword [rax + 0x1c]
jmp 0x637397
mov eax, edi
cmp eax, 0x20
je 0x63739f
mov bpl, dil
mov rcx, rbx
call fcn.006a5088
nop
mov dil, bpl
lea rax, [0x007955b8]
mov qword [rsp + 0x30], rax
lea rax, [0x007955c8]
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x30]
call fcn.0059492c
mov al, dil
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret