joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14021c980
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x498
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xbe
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x4b8]
mov rax, qword [0x140812ac0]
xor rax, rbp
mov qword [rbp + 0x468], rax
lea rcx, reloc.WS2_32.dll_accept
call fcn.1401dd605
nop
lea rcx, [rbp + 0x10]
call fcn.1401d9afa
nop
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x490]
call fcn.1401d5c2a
movzx eax, al
test eax, eax
jne 0x14021ca07
mov byte [rbp + 0x354], 0
lea rcx, [rbp + 0x10]
call fcn.1401d62f1
movzx eax, byte [rbp + 0x354]
jmp 0x14021cbe9
lea rax, [rbp + 0x374]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0x394]
lea rcx, [rbp + 0x374]
call fcn.14021c260
mov rcx, rax
call fcn.1401d412c
mov rdx, rax
lea rcx, [rbp + 0x10]
call fcn.1401dc2c8
mov qword [rbp + 0xe8], rax
lea rax, [rbp + 0x3b4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0x3d4]
lea rcx, [rbp + 0x3b4]
call fcn.14021c340
mov rcx, rax
call fcn.1401de1d6
mov rdx, rax
lea rcx, [rbp + 0x10]
call fcn.1401dc2c8
mov qword [rbp + 0x108], rax
lea rax, [rbp + 0x3f4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0x414]
lea rcx, [rbp + 0x3f4]
call fcn.14021c4c0
mov rcx, rax
call fcn.1401d412c
mov rdx, rax
lea rcx, [rbp + 0x10]
call fcn.1401dc2c8
mov qword [rbp + 0x128], rax
cmp qword [rbp + 0xe8], 0
je 0x14021caf4
mov rax, qword [rbp + 0x108]
cmp qword [rbp + 0xe8], rax
jae 0x14021caf4
mov rax, qword [rbp + 0x128]
cmp qword [rbp + 0x108], rax
jb 0x14021cb10
mov byte [rbp + 0x434], 0
lea rcx, [rbp + 0x10]
call fcn.1401d62f1
movzx eax, byte [rbp + 0x434]
jmp 0x14021cbe9
lea rdx, [rbp + 0x490]
lea rcx, [rbp + 0x148]
call fcn.14021c130
nop
mov rdx, qword [rbp + 0xe8]
lea rcx, [rbp + 0x148]
call fcn.14021c530
nop
mov rdx, qword [rbp + 0x108]
lea rcx, [rbp + 0x148]
call fcn.14021c530
nop
mov rdx, qword [rbp + 0x128]
lea rcx, [rbp + 0x148]
call fcn.14021c530
nop
lea rcx, [rbp + 0x168]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
nop
lea rdx, [rbp + 0x168]
lea rcx, [rbp + 0x1b8]
call fcn.14021c190
nop
mov rdx, qword [rbp + 0x108]
lea rcx, [rbp + 0x1b8]
call fcn.14021c570
movzx eax, al
test eax, eax
je 0x14021cbc2
mov rdx, qword [rbp + 0x128]
lea rcx, [rbp + 0x1b8]
call fcn.14021c570
movzx eax, al
test eax, eax
je 0x14021cbc2
mov dword [rbp + 0x464], 1
jmp 0x14021cbcc
mov dword [rbp + 0x464], 0
movzx eax, byte [rbp + 0x464]
mov byte [rbp + 0x454], al
lea rcx, [rbp + 0x10]
call fcn.1401d62f1
movzx eax, byte [rbp + 0x454]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, reloc.WS2_32.dll_connect
call fcn.1401dbb48
mov rax, rdi
mov rcx, qword [rbp + 0x468]
xor rcx, rbp
call fcn.1401d8740
lea rsp, [rbp + 0x478]
pop rdi
pop rbp
ret
Function at 0x1403c3600
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
push rbp
push rdi
sub rsp, 0x148
lea rbp, [rsp + 0x20]
lea rcx, reloc.WS2_32.dll_accept
call fcn.1401dd605
nop
call fcn.1403c1990
mov qword [rbp + 8], rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x28]
shr rax, 0x10
and rax, 0xffff
movzx eax, ax
mov dword [rbp + 0x44], eax
mov rax, qword [rbp + 8]
add rax, 0x2c
mov r9d, 4
mov r8, rax
mov edx, 0x20001004
mov ecx, dword [rbp + 0x44]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x1403c3673
mov rax, qword [rbp + 8]
mov dword [rax + 0x2c], 0
lea rsp, [rbp + 0x128]
pop rdi
pop rbp
ret

Function at 0x140439200
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x148
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, socket
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x168]
mov rax, qword [0x140812ac0]
xor rax, rbp
mov qword [rbp + 0x100], rax
lea rcx, [0x14084f83c]
call fcn.1401dd605
nop
mov edx, 8
lea rcx, [rbp + 8]
call fcn.140447640
mov rdx, qword [rbp + 0x138]
lea rcx, [rbp + 8]
call fcn.14043ca30
nop
lea rax, [0x1404387d0]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x130]
add rax, 8
mov qword [rbp + 0xf8], rax
lea rcx, [rbp + 8]
call fcn.14044eab0
mov rcx, qword [rbp + 0xf8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rbp + 0x28]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov rcx, qword [rbp + 0x130]
mov qword [rcx], rax
mov rax, qword [rbp + 0x130]
cmp qword [rax], 0
je 0x1404392dc
lea rcx, [rbp + 8]
call fcn.1404514d0
nop
jmp 0x1404392f5
mov rax, qword [rbp + 0x130]
mov dword [rax + 8], 0
mov ecx, 6
call fcn.1401d6021
nop
lea rcx, [rbp + 8]
call fcn.14043ed80
nop
lea rcx, [rbp - 0x30]
lea rdx, reloc.WS2_32.dll_accept
call fcn.1401dbb48
mov rcx, qword [rbp + 0x100]
xor rcx, rbp
call fcn.1401d8740
lea rsp, [rbp + 0x118]
pop rdi
pop rbp
ret
Function at 0x140439380
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x148
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, socket
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x168]
mov rax, qword [0x140812ac0]
xor rax, rbp
mov qword [rbp + 0x100], rax
lea rcx, [0x14084f83c]
call fcn.1401dd605
nop
mov edx, 8
lea rcx, [rbp + 8]
call fcn.140447680
mov rdx, qword [rbp + 0x138]
lea rcx, [rbp + 8]
call fcn.14043cb00
nop
lea rax, [0x1404388e0]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x130]
add rax, 8
mov qword [rbp + 0xf8], rax
lea rcx, [rbp + 8]
call fcn.14044eb00
mov rcx, qword [rbp + 0xf8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rbp + 0x28]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov rcx, qword [rbp + 0x130]
mov qword [rcx], rax
mov rax, qword [rbp + 0x130]
cmp qword [rax], 0
je 0x14043945c
lea rcx, [rbp + 8]
call fcn.140451530
nop
jmp 0x140439475
mov rax, qword [rbp + 0x130]
mov dword [rax + 8], 0
mov ecx, 6
call fcn.1401d6021
nop
lea rcx, [rbp + 8]
call fcn.14043ee10
nop
lea rcx, [rbp - 0x30]
lea rdx, reloc.WS2_32.dll_accept
call fcn.1401dbb48
mov rcx, qword [rbp + 0x100]
xor rcx, rbp
call fcn.1401d8740
lea rsp, [rbp + 0x118]
pop rdi
pop rbp
ret

Function at 0x140439500
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x148
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, socket
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x168]
mov rax, qword [0x140812ac0]
xor rax, rbp
mov qword [rbp + 0x100], rax
lea rcx, [0x14084f83c]
call fcn.1401dd605
nop
mov edx, 8
lea rcx, [rbp + 8]
call fcn.1404476c0
mov rdx, qword [rbp + 0x138]
lea rcx, [rbp + 8]
call fcn.14043cbd0
nop
lea rax, [0x1404389f0]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x130]
add rax, 8
mov qword [rbp + 0xf8], rax
lea rcx, [rbp + 8]
call fcn.14044eb50
mov rcx, qword [rbp + 0xf8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rbp + 0x28]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov rcx, qword [rbp + 0x130]
mov qword [rcx], rax
mov rax, qword [rbp + 0x130]
cmp qword [rax], 0
je 0x1404395dc
lea rcx, [rbp + 8]
call fcn.140451590
nop
jmp 0x1404395f5
mov rax, qword [rbp + 0x130]
mov dword [rax + 8], 0
mov ecx, 6
call fcn.1401d6021
nop
lea rcx, [rbp + 8]
call fcn.14043eea0
nop
lea rcx, [rbp - 0x30]
lea rdx, reloc.WS2_32.dll_accept
call fcn.1401dbb48
mov rcx, qword [rbp + 0x100]
xor rcx, rbp
call fcn.1401d8740
lea rsp, [rbp + 0x118]
pop rdi
pop rbp
ret
Function at 0x140439680
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x148
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, socket
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x168]
mov rax, qword [0x140812ac0]
xor rax, rbp
mov qword [rbp + 0x100], rax
lea rcx, [0x14084f83c]
call fcn.1401dd605
nop
mov edx, 8
lea rcx, [rbp + 8]
call fcn.140447700
mov rdx, qword [rbp + 0x138]
lea rcx, [rbp + 8]
call fcn.14043cca0
nop
lea rax, [0x140438b00]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x130]
add rax, 8
mov qword [rbp + 0xf8], rax
lea rcx, [rbp + 8]
call fcn.14044eba0
mov rcx, qword [rbp + 0xf8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rbp + 0x28]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov rcx, qword [rbp + 0x130]
mov qword [rcx], rax
mov rax, qword [rbp + 0x130]
cmp qword [rax], 0
je 0x14043975c
lea rcx, [rbp + 8]
call fcn.1404515f0
nop
jmp 0x140439775
mov rax, qword [rbp + 0x130]
mov dword [rax + 8], 0
mov ecx, 6
call fcn.1401d6021
nop
lea rcx, [rbp + 8]
call fcn.14043ef30
nop
lea rcx, [rbp - 0x30]
lea rdx, reloc.WS2_32.dll_accept
call fcn.1401dbb48
mov rcx, qword [rbp + 0x100]
xor rcx, rbp
call fcn.1401d8740
lea rsp, [rbp + 0x118]
pop rdi
pop rbp
ret

Function at 0x140439800
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x148
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, socket
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x168]
mov rax, qword [0x140812ac0]
xor rax, rbp
mov qword [rbp + 0x100], rax
lea rcx, [0x14084f83c]
call fcn.1401dd605
nop
mov edx, 8
lea rcx, [rbp + 8]
call fcn.140447740
mov rdx, qword [rbp + 0x138]
lea rcx, [rbp + 8]
call fcn.14043cd70
nop
lea rax, [0x140438c10]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x130]
add rax, 8
mov qword [rbp + 0xf8], rax
lea rcx, [rbp + 8]
call fcn.14044ebf0
mov rcx, qword [rbp + 0xf8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rbp + 0x28]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov rcx, qword [rbp + 0x130]
mov qword [rcx], rax
mov rax, qword [rbp + 0x130]
cmp qword [rax], 0
je 0x1404398dc
lea rcx, [rbp + 8]
call fcn.140451650
nop
jmp 0x1404398f5
mov rax, qword [rbp + 0x130]
mov dword [rax + 8], 0
mov ecx, 6
call fcn.1401d6021
nop
lea rcx, [rbp + 8]
call fcn.14043efc0
nop
lea rcx, [rbp - 0x30]
lea rdx, reloc.WS2_32.dll_accept
call fcn.1401dbb48
mov rcx, qword [rbp + 0x100]
xor rcx, rbp
call fcn.1401d8740
lea rsp, [rbp + 0x118]
pop rdi
pop rbp
ret
Function at 0x140439980
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x148
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, socket
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x168]
mov rax, qword [0x140812ac0]
xor rax, rbp
mov qword [rbp + 0x100], rax
lea rcx, [0x14084f83c]
call fcn.1401dd605
nop
mov edx, 8
lea rcx, [rbp + 8]
call fcn.140447780
mov rdx, qword [rbp + 0x138]
lea rcx, [rbp + 8]
call fcn.14043ce40
nop
lea rax, [0x140438d20]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x130]
add rax, 8
mov qword [rbp + 0xf8], rax
lea rcx, [rbp + 8]
call fcn.14044ec40
mov rcx, qword [rbp + 0xf8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rbp + 0x28]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov rcx, qword [rbp + 0x130]
mov qword [rcx], rax
mov rax, qword [rbp + 0x130]
cmp qword [rax], 0
je 0x140439a5c
lea rcx, [rbp + 8]
call fcn.1404516b0
nop
jmp 0x140439a75
mov rax, qword [rbp + 0x130]
mov dword [rax + 8], 0
mov ecx, 6
call fcn.1401d6021
nop
lea rcx, [rbp + 8]
call fcn.14043f050
nop
lea rcx, [rbp - 0x30]
lea rdx, reloc.WS2_32.dll_accept
call fcn.1401dbb48
mov rcx, qword [rbp + 0x100]
xor rcx, rbp
call fcn.1401d8740
lea rsp, [rbp + 0x118]
pop rdi
pop rbp
ret
Function at 0x14045c5e0
Capabilities:
Query environment variable

Disassembly:
mov byte [rsp + 0x10], dl
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x30
mov eax, dword [0x14081d9c0]
mov dword [rsp + 0x20], eax
mov eax, dword [0x14081d9c0]
inc eax
mov dword [0x14081d9c0], eax
cmp dword [rsp + 0x20], 0
je 0x14045c613
xor eax, eax
jmp 0x14045c7cc
movzx eax, byte [rsp + 0x48]
test eax, eax
je 0x14045c670
lea rax, [fcn.1401d987f]
mov qword [fcn.1401d987f], rax
lea rax, [fcn.1401d73f9]
mov qword [fcn.1401d73f9], rax
lea rax, [0x1401d5fe5]
mov qword [0x1407bfd30], rax
lea rax, [0x1401dd1e1]
mov qword [0x1407bfd38], rax
lea rax, [0x1401d9555]
mov qword [0x1407bfd40], rax
lea rax, [0x1401d74a3]
mov qword [0x1407bfd48], rax
call fcn.1401d677e
test eax, eax
je 0x14045c698
mov ecx, 2
call fcn.1401de168
lea rdx, str.Error:_Curl_trc_init_failed_n
mov rcx, rax
call fcn.1401d5432
nop
jmp 0x14045c7b9
call fcn.1401dcbc9
test eax, eax
jne 0x14045c6c0
mov ecx, 2
call fcn.1401de168
lea rdx, str.Error:_Curl_ssl_init_failed_n
mov rcx, rax
call fcn.1401d5432
nop
jmp 0x14045c7b9
mov ecx, dword [rsp + 0x40]
call fcn.1401d9b40
test eax, eax
je 0x14045c6ec
mov ecx, 2
call fcn.1401de168
lea rdx, str.Error:_win32_init_failed_n
mov rcx, rax
call fcn.1401d5432
nop
jmp 0x14045c7b9
xor eax, eax
test eax, eax
je 0x14045c711
mov ecx, 2
call fcn.1401de168
lea rdx, str.Error:_Curl_amiga_init_failed_n
mov rcx, rax
call fcn.1401d5432
nop
jmp 0x14045c7b9
xor eax, eax
test eax, eax
je 0x14045c736
mov ecx, 2
call fcn.1401de168
lea rdx, str.Error:_Curl_macos_init_failed_n
mov rcx, rax
call fcn.1401d5432
nop
jmp 0x14045c7b9
call fcn.1401d6724
test eax, eax
je 0x14045c75b
mov ecx, 2
call fcn.1401de168
lea rdx, str.Error:_resolver_global_init_failed_n
mov rcx, rax
call fcn.1401d5432
nop
jmp 0x14045c7b9
xor eax, eax
test eax, eax
je 0x14045c77d
mov ecx, 2
call fcn.1401de168
lea rdx, str.Error:_Curl_ssh_init_failed_n
mov rcx, rax
call fcn.1401d5432
nop
jmp 0x14045c7b9
mov eax, dword [rsp + 0x40]
mov dword [0x14081d9c4], eax
lea rcx, str.CURL_GLOBAL_INIT
call fcn.1401d7075
test rax, rax
je 0x14045c7b5
lea r8, [0x1407bfe50]
mov edx, 0xc9
mov ecx, 1
call fcn.1401dc502
mov qword [0x14081d9d0], rax
xor eax, eax
jmp 0x14045c7cc
mov eax, dword [0x14081d9c0]
dec eax
mov dword [0x14081d9c0], eax
mov eax, 2
add rsp, 0x30
pop rdi
ret
Function at 0x140473c40
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0xb8
lea rdi, [rsp + 0x20]
mov ecx, 0x26
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0xd0]
mov rax, qword [0x140812ac0]
xor rax, rsp
mov qword [rsp + 0xa8], rax
mov dword [rsp + 0x20], 0
lea rcx, str.CURL_ENTROPY
call fcn.1401d7075
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x140473d59
movzx eax, byte [0x14081d9e8]
test eax, eax
jne 0x140473d34
mov dword [rsp + 0x34], 0
mov rcx, qword [rsp + 0x28]
call fcn.1401d81eb
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], 4
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rax
jae 0x140473ced
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0xa0], rax
jmp 0x140473cfa
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0xa0], rax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x58], rax
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x28]
lea rcx, [rsp + 0x34]
call fcn.1401d8781
mov ecx, dword [rsp + 0x34]
call qword [sym.imp.WS2_32.dll_ntohl]
mov dword [0x14081d9e4], eax
mov byte [0x14081d9e8], 1
jmp 0x140473d42
mov eax, dword [0x14081d9e4]
inc eax
mov dword [0x14081d9e4], eax
mov rax, qword [rsp + 0xd8]
mov ecx, dword [0x14081d9e4]
mov dword [rax], ecx
xor eax, eax
jmp 0x140473ea7
mov r8d, 4
mov rdx, qword [rsp + 0xd8]
mov rcx, qword [rsp + 0xd0]
call fcn.1401d7e5d
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 4
je 0x140473d88
mov eax, dword [rsp + 0x20]
jmp 0x140473ea7
movzx eax, byte [0x14081d9e8]
test eax, eax
jne 0x140473db9
mov edx, 4
mov rcx, qword [rsp + 0xd8]
call fcn.1401dd902
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 4
je 0x140473db9
mov eax, dword [rsp + 0x20]
jmp 0x140473ea7
movzx eax, byte [0x14081d9e8]
test eax, eax
jne 0x140473e5d
lea rcx, [rsp + 0x90]
call fcn.1401dc714
lea rcx, [rsp + 0x68]
mov rdi, rcx
mov rsi, rax
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
lea rdx, str.WARNING:_using_weak_random_seed
mov rcx, qword [rsp + 0xd0]
call fcn.1401dc87c
mov eax, dword [rsp + 0x68]
mov ecx, dword [rsp + 0x70]
add ecx, eax
mov eax, ecx
mov ecx, dword [0x14081d9e4]
add ecx, eax
mov eax, ecx
mov dword [0x14081d9e4], eax
imul eax, dword [0x14081d9e4], 0x41c64e6d
add eax, 0x3039
mov dword [0x14081d9e4], eax
imul eax, dword [0x14081d9e4], 0x41c64e6d
add eax, 0x3039
mov dword [0x14081d9e4], eax
imul eax, dword [0x14081d9e4], 0x41c64e6d
add eax, 0x3039
mov dword [0x14081d9e4], eax
mov byte [0x14081d9e8], 1
imul eax, dword [0x14081d9e4], 0x41c64e6d
add eax, 0x3039
mov dword [0x14081d9e4], eax
mov eax, dword [0x14081d9e4]
mov dword [rsp + 0x84], eax
mov eax, dword [rsp + 0x84]
shl eax, 0x10
mov ecx, dword [rsp + 0x84]
shr ecx, 0x10
and ecx, 0xffff
or eax, ecx
mov rcx, qword [rsp + 0xd8]
mov dword [rcx], eax
xor eax, eax
mov rdi, rax
mov rcx, rsp
lea rdx, reloc.WS2_32.dll_bind
call fcn.1401dbb48
mov rax, rdi
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.1401d8740
add rsp, 0xb8
pop rdi
pop rsi
ret
Function at 0x140483150
Capabilities:
Hash data using djb2

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0x1505
mov rax, qword [rsp + 0x20]
cmp qword [rsp + 0x50], rax
jae 0x1404831e5
mov rax, qword [rsp + 0x50]
movzx eax, byte [rax]
mov byte [rsp + 0x38], al
mov rax, qword [rsp + 0x50]
inc rax
mov qword [rsp + 0x50], rax
movzx ecx, byte [rsp + 0x38]
call fcn.1401dde57
movsx rax, al
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x28]
shl rax, 5
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
jmp 0x14048317d
xor edx, edx
mov rax, qword [rsp + 0x28]
mov ecx, 0x3f
div rcx
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x140488210
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
mov dword [rsp + 0x20], 0
mov rax, qword [rsp + 0x80]
mov qword [rax], 0
lea rcx, str.CURL_SMALLREQSEND
call fcn.1401d7075
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x140488290
mov r8d, 0xa
xor edx, edx
mov rcx, qword [rsp + 0x28]
call fcn.1401d5d97
mov eax, eax
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x140488290
mov rax, qword [rsp + 0x70]
cmp qword [rsp + 0x30], rax
jae 0x140488290
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x60]
cmp qword [rax + 0x328], 0
je 0x1404882e3
mov rax, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x60]
mov rax, qword [rax + 0x328]
cmp qword [rsp + 0x38], rax
jle 0x1404882e3
mov rax, qword [rsp + 0x60]
mov rax, qword [rax + 0x328]
mov rcx, qword [rsp + 0x78]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x70], rax
mov r9, qword [rsp + 0x80]
mov r8, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
call fcn.1401d48f7
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jne 0x1404883f5
mov rax, qword [rsp + 0x80]
cmp qword [rax], 0
je 0x1404883f5
cmp qword [rsp + 0x78], 0
je 0x140488370
mov rax, qword [rsp + 0x80]
mov rax, qword [rax]
cmp qword [rsp + 0x78], rax
jae 0x140488346
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x48], rax
jmp 0x140488356
mov rax, qword [rsp + 0x80]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov r9, qword [rsp + 0x48]
mov r8, qword [rsp + 0x68]
mov edx, 2
mov rcx, qword [rsp + 0x60]
call fcn.1401dc44e
nop
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x78]
cmp qword [rax], rcx
jbe 0x1404883f5
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x78]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x68]
add rcx, rax
mov rax, rcx
mov r9, qword [rsp + 0x40]
mov r8, rax
mov edx, 4
mov rcx, qword [rsp + 0x60]
call fcn.1401dc44e
mov rax, qword [rsp + 0x60]
mov rax, qword [rax + 0x108]
add rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x60]
mov qword [rcx + 0x108], rax
mov rax, qword [rsp + 0x60]
mov rdx, qword [rax + 0x108]
mov rcx, qword [rsp + 0x60]
call fcn.1401d6d7d
nop
mov eax, dword [rsp + 0x20]
add rsp, 0x50
pop rdi
ret
Function at 0x14048b900
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x60
lea rdi, [rsp + 0x20]
mov ecx, reloc.WS2_32.dll_recv
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x70]
mov rax, qword [rsp + 0x70]
mov rax, qword [rax + 0x80]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x40], 0
cmp qword [rsp + 0x28], 0
jne 0x14048b946
jmp 0x14048ba65
xor eax, eax
test eax, eax
jne 0x14048b946
mov rcx, qword [rsp + 0x70]
call fcn.14048b750
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x14048b9d7
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x70]
call fcn.14048b6b0
nop
xor eax, eax
test eax, eax
jne 0x14048b973
lea r8, str.kill_all
mov edx, 1
mov rcx, qword [rsp + 0x38]
call fcn.1401d876d
mov r8b, 1
mov rdx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax + 0x80]
call fcn.1401dc6d8
xor r9d, r9d
mov r8, qword [rsp + 0x38]
mov rax, qword [rsp + 0x70]
mov rdx, qword [rax + 0x80]
mov rcx, qword [rsp + 0x70]
call fcn.14048a460
mov rcx, qword [rsp + 0x70]
call fcn.14048b750
mov qword [rsp + 0x38], rax
jmp 0x14048b95b
lea rcx, str.CURL_GRACEFUL_SHUTDOWN
call fcn.1401d7075
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x14048ba1f
mov r8d, 0xa
xor edx, edx
mov rcx, qword [rsp + 0x48]
call fcn.1401d9b3b
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jle 0x14048ba1f
cmp dword [rsp + 0x50], 0x7fffffff
jge 0x14048ba1f
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x40], eax
mov edx, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x70]
call fcn.14048afb0
mov rcx, qword [rsp + 0x70]
call fcn.14048b800
nop
xor eax, eax
test eax, eax
jne 0x14048ba38
mov rax, qword [rsp + 0x28]
mov rdx, qword [rax + 0xc8]
mov rcx, qword [rsp + 0x28]
call fcn.1401d954b
lea rcx, [rsp + 0x28]
call fcn.1401dde8e
nop
xor eax, eax
test eax, eax
jne 0x14048ba5f
mov rcx, rsp
lea rdx, reloc.WS2_32.dll_accept
call fcn.1401dbb48
add rsp, 0x60
pop rdi
ret

Function at 0x1404912e0
Capabilities:
Convert ip address from string

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x60
lea rdi, [rsp + 0x20]
mov ecx, reloc.WS2_32.dll_recv
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x70]
mov rax, qword [0x140812ac0]
xor rax, rsp
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x70], 0
je 0x14049136f
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 0x70]
movsx eax, byte [rcx + rax]
test eax, eax
je 0x14049136f
lea r8, [rsp + 0x28]
mov rdx, qword [rsp + 0x70]
mov ecx, 2
call qword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
je 0x14049134f
mov eax, 1
jmp 0x140491371
lea r8, [rsp + 0x28]
mov rdx, qword [rsp + 0x70]
mov ecx, reloc.WS2_32.dll_socket
call qword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
je 0x14049136f
mov eax, 2
jmp 0x140491371
xor eax, eax
mov rdi, rax
mov rcx, rsp
lea rdx, reloc.WS2_32.dll_accept
call fcn.1401dbb48
mov rax, rdi
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1401d8740
add rsp, 0x60
pop rdi
ret