joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400b9150
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x128
mov rdi, r9
mov rbx, r8
mov rsi, rcx
mov r12, qword [rsp + 0x190]
mov rax, qword [0x1402b7040]
xor rax, rsp
mov qword [rsp + 0x120], rax
movsxd rbp, edx
mov r14, qword [rcx + rbp*8 + 0x4c0]
mov rax, qword [rcx + 0x698]
test byte [rax + 0x7c], 3
je 0x1400b91b3
lea rax, [0x1400b9350]
cmp qword [rsi + rbp*8 + 0x4e8], rax
je 0x1400b9271
mov rcx, r14
mov rdx, rbx
mov r8d, edi
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_send]
mov dword [r12], 0
cmp eax, 0xffffffff
je 0x1400b9202
cdqe
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
cmp rcx, qword [0x1402b7040]
je 0x1400b91ee
call fcn.14019f290
int3
add rsp, 0x128
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x1400b921b
mov dword [r12], 0x51
xor eax, eax
jmp 0x1400b91d4
mov edi, eax
lea rbx, [rsp + 0x20]
mov r8d, 0x100
mov rcx, rbx
mov dl, 0xaa
call fcn.1401d8720
mov r8d, 0x100
mov ecx, edi
mov rdx, rbx
call fcn.1400d2920
mov rcx, qword [rsi]
lea rdx, str.Send_failure:__s
mov r8, rax
call fcn.1400b8d80
mov rax, qword [rsi]
mov dword [rax + 0x11b0], edi
mov dword [r12], 0x37
mov rax, 0xffffffffffffffff
jmp 0x1400b91d4
shl rbp, 5
lea r13, [rsi + rbp]
add r13, 0x508
mov r15, qword [r13 + 8]
sub r15, qword [r13 + 0x10]
cmp qword [r13], 0
sete al
test r15, r15
setne cl
or cl, al
cmp cl, 1
jne 0x1400b91b3
mov rcx, r14
mov rdx, 0xffffffffffffffff
mov r8, 0xffffffffffffffff
xor r9d, r9d
call fcn.1400d8a90
cmp eax, 0xffffffff
sete cl
test al, 1
sete al
or al, cl
jne 0x1400b91b3
add rbp, rsi
add rbp, 0x518
mov rax, qword [r13]
test rax, rax
je 0x1400b9309
mov rdx, qword [rbp]
add rdx, rax
mov rcx, r14
mov r8d, r15d
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x1400b91b3
mov eax, eax
add qword [rbp], rax
jmp 0x1400b91b3
mov rax, qword [rsi]
movsxd rcx, dword [rax + 0xb70]
add rcx, rcx
mov qword [r13 + 8], rcx
mov rax, qword [fcn.14009ead0]
call qword [0x1402a7b00]
mov qword [r13], rax
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
test rax, rax
je 0x1400b933f
mov r15, qword [r13 + 8]
xor edx, edx
jmp 0x1400b92e4
mov qword [r13 + 8], 0
jmp 0x1400b91b3
Function at 0x1400bedd0
Capabilities:
Set socket configuration

Disassembly:
push rsi
sub rsp, 0x40
mov rax, qword [0x1402b7040]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x34], 0x4020
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x2c], 4
mov eax, dword [0x1402cc650]
cmp eax, 2
je 0x1400bee96
mov rsi, rcx
test eax, eax
jne 0x1400bee44
mov ecx, 6
xor edx, edx
mov r8d, 2
mov r9d, 3
call fcn.1400b85f0
test al, al
je 0x1400bee3a
mov dword [0x1402cc650], 2
jmp 0x1400bee96
mov dword [0x1402cc650], 1
lea rax, [rsp + 0x2c]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
mov rcx, rsi
mov edx, 0xffff
mov r8d, 0x1001
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x1400bee75
cmp dword [rsp + 0x30], 0x4020
jg 0x1400bee96
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x34]
mov rcx, rsi
mov edx, 0xffff
mov r8d, 0x1001
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
cmp rcx, qword [0x1402b7040]
je 0x1400beead
call fcn.14019f290
int3
add rsp, 0x40
pop rsi
ret
Function at 0x1400bfc80
Capabilities:
Set socket configuration

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xc8
mov qword [rsp + 0x20], r9
mov rsi, r8
mov r12, rdx
mov rbx, rcx
mov rax, qword [0x1402b7040]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rdi, qword [rcx]
lea r15, [rsp + 0x30]
mov r8d, Ordinal_145
mov rcx, r15
mov dl, 0xaa
call fcn.1401d8720
test rsi, rsi
mov r14, rsi
cmove r14, r15
mov ebp, dword [r12 + 4]
mov dword [r14], ebp
xor r13d, r13d
cmp dword [rbx + 0x32c], 3
setne r13b
inc r13d
mov dword [r14 + 4], r13d
mov r15d, 0x11
cmp dword [rbx + 0x32c], 3
jne 0x1400bfd06
mov r15d, dword [r12 + 0xc]
test rsi, rsi
mov rcx, rsi
lea rax, [rsp + 0x30]
cmove rcx, rax
mov dword [rcx + 8], r15d
mov eax, dword [r12 + 0x10]
mov r8d, Ordinal_133
cmp eax, 0x80
cmovb r8d, eax
mov dword [rcx + 0xc], r8d
add rcx, 0x10
mov rdx, qword [r12 + 0x20]
call fcn.1401d8080
mov rax, qword [rdi + 0x738]
test rax, rax
je 0x1400bfdd1
test rdi, rdi
je 0x1400bfdbc
mov rcx, qword [rdi + 0xd8]
test rcx, rcx
je 0x1400bfda0
mov byte [rcx + 0x18a], 1
mov rax, qword [rdi + 0x738]
mov rcx, qword [rdi + 0x740]
xor edx, edx
mov r8, r14
call qword [0x1402a7b00]
mov rdx, qword [rsp + 0x20]
mov qword [rdx], rax
mov rcx, qword [rdi + 0xd8]
test rcx, rcx
je 0x1400bfdae
mov byte [rcx + 0x18a], 0
mov rax, qword [rdx]
jmp 0x1400bfde7
mov rcx, qword [rdi + 0xd0]
test rcx, rcx
jne 0x1400bfd60
jmp 0x1400bfd6e
mov rcx, qword [rdi + 0xd0]
test rcx, rcx
jne 0x1400bfd94
jmp 0x1400bfde7
mov rcx, qword [0x740]
xor edx, edx
mov r8, r14
call qword [0x1402a7b00]
jmp 0x1400bfddf
mov ecx, ebp
mov edx, r13d
mov r8d, r15d
call qword [sym.imp.WS2_32.dll_socket]
mov rcx, qword [rsp + 0x20]
mov qword [rcx], rax
cmp rax, 0xffffffffffffffff
je 0x1400bfe33
cmp dword [rbx + 0x32c], 5
jne 0x1400bfe10
lea r8, [rsp + 0x2c]
mov dword [r8], 1
mov rcx, rax
mov edx, 0x8004667e
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov ecx, dword [rbx + 0x328]
xor eax, eax
test ecx, ecx
je 0x1400bfe38
cmp dword [r14], 0x17
jne 0x1400bfe38
test rsi, rsi
lea rdx, [rsp + 0x30]
cmovne rdx, rsi
mov dword [rdx + 0x28], ecx
jmp 0x1400bfe38
mov eax, 7
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
cmp rcx, qword [0x1402b7040]
je 0x1400bfe52
call fcn.14019f290
int3
add rsp, 0xc8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400cab20
Capabilities:
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push rsi
sub rsp, 0x30
mov rsi, rcx
mov dword [rsp + 0x20], 0xf0000040
xor edx, edx
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x1400cab62
mov rcx, qword [rsi]
add rsi, 8
mov qword [rsp + 0x20], rsi
mov edx, 0x8003
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
nop
add rsp, 0x30
pop rsi
ret
Function at 0x1400ced80
Capabilities:
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov rdi, r9
mov rsi, r8
mov rbx, rdx
mov r14, rcx
mov ebp, dword [rsp + 0xb0]
mov rax, qword [0x1402b7040]
xor rax, rsp
mov qword [rsp + 0x50], rax
xor eax, eax
lea r15, [rsp + 0x48]
mov qword [r15], rax
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x3c], 0
mov dword [rsp + 0x38], 4
mov dword [rsp + 0x34], edi
mov rcx, r8
xor edx, edx
mov r8, r9
call fcn.1401d8720
mov dword [rsp + 0x20], 0xf0000040
mov rcx, r15
xor edx, edx
xor r8d, r8d
mov r9d, ebp
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x1400ceeae
mov edx, dword [rsp + 0xb8]
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x1400cee8c
mov rcx, qword [rsp + 0x40]
mov rdx, r14
mov r8d, ebx
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x1400cee8c
mov rcx, qword [rsp + 0x40]
mov dword [rsp + 0x20], 0
lea r8, [rsp + 0x3c]
lea r9, [rsp + 0x38]
mov edx, 4
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x1400cee8c
mov eax, dword [rsp + 0x3c]
cmp rdi, rax
jb 0x1400cee8c
mov rcx, qword [rsp + 0x40]
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x34]
mov edx, 2
mov r8, rsi
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1400cee9c
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1400ceeae
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
cmp rcx, qword [0x1402b7040]
je 0x1400ceec5
call fcn.14019f290
int3
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1400d03d0
Capabilities:
Check for time delay via gettickcount
Check for time delay via queryperformancecounter
Move file

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x1402b7040]
xor rax, rsp
mov qword [rsp + 0x30], rax
cmp byte [0x1402cc640], 1
je 0x1400d0422
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
imul rbx, rcx, 0x10624dd3
shr rbx, 0x26
imul ecx, ebx, 0x3e8
sub eax, ecx
imul r14d, eax, 0x3e8
jmp 0x1400d045e
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rbx, [rsp + 0x28]
mov qword [rbx], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rbx]
mov rcx, qword [0x1402cc648]
cqo
idiv rcx
mov rbx, rax
imul rax, rdx, 0xf4240
cqo
idiv rcx
mov r14, rax
mov rcx, rdi
mov rdx, rsi
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
je 0x1400d048d
xor eax, eax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
cmp rcx, qword [0x1402b7040]
je 0x1400d04b3
call fcn.14019f290
int3
movabs rbp, 0xffdf3b645a1cac09
movabs r12, 0xffbe76c8b4395813
mov r13d, 0x3e8
mov r15, qword [sym.imp.KERNEL32.dll_MoveFileExA]
jmp 0x1400d0549
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
imul rcx, rcx, 0x10624dd3
shr rcx, 0x26
imul edx, ecx, 0x3e8
sub eax, edx
imul edx, eax, 0x3e8
sub rcx, rbx
lea r8, [rcx + rbp]
mov eax, 1
cmp r8, r12
jb 0x1400d0476
imul rcx, rcx, 0x3e8
sub edx, r14d
movsxd rdx, edx
imul rdx, rdx, 0x10624dd3
mov r8, rdx
shr r8, 0x3f
sar rdx, 0x26
add edx, r8d
movsxd rdx, edx
add rdx, rcx
cmp rdx, r13
ja 0x1400d0476
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, rdi
mov rdx, rsi
mov r8d, 1
call r15
test eax, eax
jne 0x1400d0474
cmp byte [0x1402cc640], 1
jne 0x1400d04c4
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x28]
mov r8, qword [0x1402cc648]
cqo
idiv r8
mov rcx, rax
imul rax, rdx, 0xf4240
cqo
idiv r8
mov rdx, rax
jmp 0x1400d04e5
Function at 0x1400d8950
Capabilities:
Get socket status

Disassembly:
push rsi
sub rsp, 0x40
mov r10, qword [rsp + 0x70]
mov rax, qword [0x1402b7040]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov eax, 0x7fffffff
cmp r10, 0x7fffffff
cmovl rax, r10
test rdx, rdx
je 0x1400d8a41
cmp dword [rdx], 0
je 0x1400d8a41
movabs r11, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x30], r11
xor r11d, r11d
test r10, r10
js 0x1400d8a34
mov esi, 0
je 0x1400d89cb
mov r10d, eax
imul r11, r10, 0x10624dd3
shr r11, 0x26
imul r10d, r11d, 0x3e8
sub eax, r10d
imul esi, eax, 0x3e8
lea r10, [rsp + 0x30]
mov dword [r10], r11d
mov dword [r10 + 4], esi
xor eax, eax
test r9, r9
je 0x1400d89e6
cmp dword [r9], 0
cmovne rax, r9
xor r9d, r9d
test r8, r8
je 0x1400d89f6
cmp dword [r8], 0
cmovne r9, r8
xor r8d, r8d
test rdx, rdx
je 0x1400d8a05
cmp dword [rdx], 0
cmovne r8, rdx
inc ecx
mov qword [rsp + 0x20], r10
mov rdx, r8
mov r8, r9
mov r9, rax
call qword [sym.imp.WS2_32.dll_select]
mov esi, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
cmp rcx, qword [0x1402b7040]
je 0x1400d8a39
call fcn.14019f290
int3
xor r10d, r10d
jmp 0x1400d89d7
mov eax, esi
add rsp, 0x40
pop rsi
ret
test r8, r8
je 0x1400d8a50
cmp dword [r8], 0
jne 0x1400d898b
test r9, r9
je 0x1400d8a5f
cmp dword [r9], 0
jne 0x1400d898b
xor esi, esi
test eax, eax
je 0x1400d8a1d
js 0x1400d8a71
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400d8a1d
mov ecx, 0x2726
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov esi, 0xffffffff
jmp 0x1400d8a1d
Function at 0x1400d90c0
Capabilities:
Resolve dns

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x48
movaps xmmword [rsp + 0x30], xmm6
mov rsi, r9
mov rax, qword [0x1402b7040]
xor rax, rsp
mov qword [rsp + 0x28], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r9, [rsp + 0x20]
mov qword [r9], rax
mov qword [rsi], 0
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov ebx, eax
test eax, eax
je 0x1400d9120
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
cmp rcx, qword [0x1402b7040]
je 0x1400d9162
call fcn.14019f290
int3
mov r15, qword [rsp + 0x20]
test r15, r15
je 0x1400d914b
xor r12d, r12d
xorps xmm6, xmm6
xor edi, edi
jmp 0x1400d9186
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x1400d9144
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
xor ebx, ebx
test rdi, rdi
jne 0x1400d915d
mov ebx, 0x2af9
mov ecx, 0x2af9
call qword [sym.imp.WS2_32.dll_WSASetLastError]
xor edi, edi
mov qword [rsi], rdi
jmp 0x1400d9109
mov eax, ebx
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov rbx, r12
mov r15, qword [r15 + 0x28]
mov r12, rbx
test r15, r15
je 0x1400d9134
mov eax, dword [r15 + 4]
cmp eax, 2
je 0x1400d919c
cmp eax, 0x17
jne 0x1400d9177
mov r14d, 0x1c
jmp 0x1400d91a2
mov r14d, 0x10
cmp qword [r15 + 0x20], 0
je 0x1400d9177
cmp qword [r15 + 0x10], r14
jb 0x1400d9177
mov rax, qword [fcn.14009ead0]
mov ecx, 0x30
call qword [0x1402a7b00]
test rax, rax
je 0x1400d927c
mov rbx, rax
mov eax, dword [r15]
mov dword [rbx], eax
mov eax, dword [r15 + 4]
mov dword [rbx + 4], eax
mov eax, dword [r15 + 8]
mov dword [rbx + 8], eax
mov eax, dword [r15 + 0xc]
mov dword [rbx + 0xc], eax
mov dword [rbx + 0x10], r14d
movups xmmword [rbx + 0x18], xmm6
mov qword [rbx + 0x28], 0
mov rax, qword [fcn.14009ead0]
mov rcx, r14
call qword [0x1402a7b00]
mov qword [rbx + 0x20], rax
test rax, rax
je 0x1400d926c
mov rdx, qword [r15 + 0x20]
mov rcx, rax
mov r8, r14
call fcn.1401d8080
mov rcx, qword [r15 + 0x18]
test rcx, rcx
je 0x1400d9241
lea r14, [rbx + 0x18]
mov rax, qword [str._e_]
call qword [0x1402a7b00]
mov qword [r14], rax
test rax, rax
je 0x1400d925b
test rdi, rdi
cmove rdi, rbx
test r12, r12
je 0x1400d917a
mov qword [r12 + 0x28], rbx
jmp 0x1400d917a
mov rax, qword [fcn.1400581d0]
mov rcx, qword [rbx + 0x20]
call qword [0x1402a7b00]
mov rax, qword [fcn.1400581d0]
mov rcx, rbx
call qword [0x1402a7b00]
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x1400d928c
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
mov ebx, 8
test rdi, rdi
je 0x1400d915b
mov rax, qword [fcn.1400581d0]
mov rcx, qword [rdi + 0x20]
call qword [0x1402a7b00]
mov rax, qword [fcn.1400581d0]
mov rcx, qword [rdi + 0x18]
call qword [0x1402a7b00]
mov r14, qword [rdi + 0x28]
mov rax, qword [fcn.1400581d0]
mov rcx, rdi
call qword [0x1402a7b00]
mov rdi, r14
test r14, r14
jne 0x1400d929a
jmp 0x1400d915b
Function at 0x1400e36a0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov ebx, r8d
mov rsi, rcx
mov rax, qword [rcx]
lea ecx, [rbx - 0xd]
mov r9d, 0x9b0
cmp ecx, 2
ja 0x1400e36cb
mov ecx, ecx
lea r8, [0x14029b988]
mov r9, qword [r8 + rcx*8]
mov r8, qword [rax + 0x1e0]
lea rcx, [rsi + 0xa00]
mov r9, qword [rax + r9]
test dl, dl
jne 0x1400e3711
mov edx, dword [rsi + 0xaac]
lea r10d, [rdx + 1]
mov dword [rsi + 0xaac], r10d
test r9, r9
je 0x1400e3772
test edx, edx
js 0x1400e3720
xor r10d, r10d
mov r9, qword [r9 + 8]
cmp r10d, edx
jge 0x1400e371b
inc r10d
test r9, r9
jne 0x1400e36fe
jmp 0x1400e371b
mov dword [rsi + 0xaac], 0
test r9, r9
je 0x1400e3772
mov rax, qword [r9]
xor edx, edx
cmp byte [rax], 0x2a
sete dl
lea r8, [rdx + rax]
mov dword [rsi + 0xab0], edx
lea rdx, [0x14027ac3a]
call fcn.140100a10
test eax, eax
je 0x1400e3751
mov edi, eax
mov eax, edi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
mov dword [rsi + 0xab8], ebx
xor edi, edi
jmp 0x1400e3747
cmp dword [r8 + 0x10], 0
je 0x1400e3892
mov dword [rsi + 0xab8], 0
jmp 0x1400e3747
xor edi, edi
cmp ebx, 0xd
je 0x1400e375b
cmp ebx, 0xe
je 0x1400e3872
cmp ebx, 0xf
je 0x1400e3747
cmp byte [rsi + 0xa92], 1
jne 0x1400e37d9
cmp byte [rax + 0xf09], 0
jne 0x1400e37a6
cmp dword [rax + 0x9f8], 0
je 0x1400e3883
mov r8, qword [rsi + 0xa88]
test r8, r8
je 0x1400e3883
lea rdx, str.MDTM__s
call fcn.140100a10
test eax, eax
jne 0x1400e3745
mov dword [rsi + 0xab8], 0x12
jmp 0x1400e3747
mov dword [rsi + 0xab0], 0
xor edx, edx
cmp dword [rax + 0xbac], 2
sete dl
mov dword [rsi + 0xab4], edx
cmp byte [rsi + 0x655], 1
jne 0x1400e382e
mov r8, qword [rsi + 0xa70]
test r8, r8
je 0x1400e382e
cmp dword [rsi + 0xa80], 0
je 0x1400e3822
mov rdx, qword [rsi + 0xa78]
mov rdx, qword [rdx]
cmp byte [rdx], 0x2f
je 0x1400e382e
mov dword [rsi + 0xa94], 0
jmp 0x1400e384f
cmp dword [rsi + 0xa80], 0
je 0x1400e3790
mov dword [rsi + 0xa94], 1
mov rax, qword [rsi + 0xa78]
mov r8, qword [rax]
lea rdx, str.CWD__s
call fcn.140100a10
test eax, eax
jne 0x1400e3745
mov dword [rsi + 0xab8], 0x10
jmp 0x1400e3747
mov rcx, rsi
xor edx, edx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.1400e3dd0
mov rcx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.1400e4020
mov rdx, qword [rsi + 0xad0]
cmp rdx, 0xffffffffffffffff
je 0x1400e38e4
mov ecx, dword [rax + 0xfa4]
and ecx, 0xffffffbf
xor r8d, r8d
xor r9d, r9d
test rdx, rdx
cmovns r8, rdx
setns r9b
shl r9d, 6
or r9d, ecx
mov qword [rax + 0xf78], r8
mov dword [rax + 0xfa4], r9d
mov rdx, qword [rsi + 0xad0]
mov rcx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.1400e3c40
mov r8, qword [rsi + 0xa88]
cmp byte [rax + 0xf24], 1
jne 0x1400e3917
lea rdx, str.RETR__s
call fcn.140100a10
test eax, eax
jne 0x1400e3745
mov dword [rsi + 0xab8], 0x20
jmp 0x1400e3747
lea rdx, str.SIZE__s
call fcn.140100a10
test eax, eax
jne 0x1400e3745
mov dword [rsi + 0xab8], 0x18
jmp 0x1400e3747
Function at 0x1400e4020
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov rax, qword [rcx]
mov rcx, qword [rax + 0x1e0]
cmp byte [rax + 0xf1c], 1
jne 0x1400e40a0
cmp qword [rsi + 0xa88], 0
je 0x1400e40a0
movzx edx, byte [rax + 0xf0b]
movsx r8d, byte [rsi + 0xaa8]
xor edx, 1
lea edx, [rdx*8 + 0x41]
cmp edx, r8d
je 0x1400e40a0
mov dword [rcx + 0x10], 1
mov bl, byte [rax + 0xf0b]
xor bl, 1
shl bl, 3
or bl, 0x41
cmp byte [rsi + 0xaa8], bl
jne 0x1400e4123
mov dword [rsi + 0xab8], 0x13
mov rax, qword [rsi]
mov rax, qword [rax + 0x1e0]
mov eax, dword [rax + 0x10]
jmp 0x1400e40a3
mov eax, dword [rcx + 0x10]
test eax, eax
je 0x1400e40de
lea rcx, [rsi + 0xa00]
cmp eax, 1
je 0x1400e40ed
cmp qword [rsi + 0xa88], 0
je 0x1400e40de
lea rdx, str.REST__d
xor edi, edi
xor r8d, r8d
call fcn.140100a10
test eax, eax
jne 0x1400e4109
mov dword [rsi + 0xab8], 0x1a
jmp 0x1400e410b
mov rcx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.1400e4150
mov r8, qword [rsi + 0xa88]
test r8, r8
je 0x1400e40de
lea rdx, str.SIZE__s
call fcn.140100a10
test eax, eax
je 0x1400e4115
mov edi, eax
mov eax, edi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
mov dword [rsi + 0xab8], 0x17
xor edi, edi
jmp 0x1400e410b
movzx r8d, bl
lea rcx, [rsi + 0xa00]
lea rdx, str.TYPE__c
call fcn.140100a10
test eax, eax
jne 0x1400e4109
mov dword [rsi + 0xab8], 0x13
mov byte [rsi + 0xaa8], bl
jmp 0x1400e411f

Function at 0x1400e4150
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov rax, qword [rcx]
mov rcx, qword [rax + 0x1e0]
cmp dword [rcx + 0x10], 0
je 0x1400e4189
mov dword [rsi + 0xab8], 0xd
mov rcx, rsi
mov dl, 1
mov r8d, Ordinal_14
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.1400e36a0
cmp byte [rax + 0xf0e], 1
jne 0x1400e41a2
mov rcx, rsi
xor edx, edx
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.1400e4290
lea rcx, [rsi + 0xa00]
cmp byte [rax + 0xf11], 1
jne 0x1400e41d3
mov r8, qword [rsi + 0xa88]
test r8, r8
je 0x1400e423c
cmp byte [rax + 0xf1d], 1
jne 0x1400e4233
lea rdx, str.PRET_STOR__s
jmp 0x1400e4268
mov al, byte [rsi + 0x666]
test al, al
jne 0x1400e41ef
cmp byte [rsi + 0x65f], 1
jne 0x1400e41ef
mov byte [rsi + 0x666], 1
mov al, 1
xor al, 1
movzx edi, al
lea rax, [rdi + rdi*4]
lea r8, str.EPSV
add r8, rax
lea rdx, [0x14027ac3a]
call fcn.140100a10
test eax, eax
jne 0x1400e427d
mov dword [rsi + 0xaac], edi
mov dword [rsi + 0xab8], 0x1e
mov rcx, qword [rsi]
lea rdx, str.Connect_data_stream_passively_n
call fcn.1400b8a80
jmp 0x1400e427b
lea rdx, str.PRET_RETR__s
jmp 0x1400e4268
mov r8, qword [rax + 0xc08]
test r8, r8
jne 0x1400e4261
lea rdx, str.NLST
lea r8, str.LIST
cmp byte [rax + 0xf0d], 0
cmovne r8, rdx
lea rdx, str.PRET__s
call fcn.140100a10
test eax, eax
jne 0x1400e427d
mov dword [rsi + 0xab8], 0x1d
xor eax, eax
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x1400e5010
Capabilities:
Get local ipv4 addresses
Get socket information
Set socket configuration

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0xb8
mov rsi, rcx
mov rax, qword [0x1402b7040]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rdi, qword [rcx]
mov rbx, qword [rcx + 0x4c8]
movaps xmm0, xmmword [0x140275a70]
lea rdx, [rsp + 0x30]
movaps xmmword [rdx + 0x70], xmm0
movaps xmmword [rdx + 0x60], xmm0
movaps xmmword [rdx + 0x50], xmm0
movaps xmmword [rdx + 0x40], xmm0
movaps xmmword [rdx + 0x30], xmm0
movaps xmmword [rdx + 0x20], xmm0
movaps xmmword [rdx + 0x10], xmm0
movaps xmmword [rdx], xmm0
lea r8, [rsp + 0x28]
mov dword [r8], Ordinal_133
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x1400e50c7
mov rcx, rsi
mov rdx, rbx
call fcn.1400bed00
lea rdx, str.Error_accept__ing_server_connect
mov rcx, rdi
call fcn.1400b8d80
mov ebx, 0x1e
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
cmp rcx, qword [0x1402b7040]
je 0x1400e50b8
call fcn.14019f290
int3
mov eax, ebx
add rsp, 0xb8
pop rbx
pop rdi
pop rsi
pop r14
ret
lea r8, [rsp + 0x28]
mov dword [r8], Ordinal_133
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_accept]
mov r14, rax
mov rcx, rsi
mov rdx, rbx
call fcn.1400bed00
cmp r14, 0xffffffffffffffff
je 0x1400e508a
lea rdx, str.Connection_accepted_from_server_n
mov rcx, rdi
call fcn.1400b8a80
mov byte [rsi + 0x660], 0
mov qword [rsi + 0x4c8], r14
lea r8, [rsp + 0x2c]
mov dword [r8], 1
mov rcx, r14
mov edx, 0x8004667e
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov byte [rsi + 0xb2c], 1
mov rax, qword [rdi + 0x728]
xor ebx, ebx
test rax, rax
je 0x1400e509e
test rdi, rdi
je 0x1400e51ce
mov rcx, qword [rdi + 0xd8]
test rcx, rcx
je 0x1400e51f5
mov byte [rcx + 0x18a], 1
mov rax, qword [rdi + 0x728]
mov rcx, qword [rdi + 0x730]
mov rdx, r14
mov r8d, 1
call qword [0x1402a7b00]
mov rcx, qword [rdi + 0xd8]
test rcx, rcx
je 0x1400e51e7
mov byte [rcx + 0x18a], 0
test eax, eax
je 0x1400e509e
mov rdx, qword [rsi + 0x4c8]
cmp rdx, 0xffffffffffffffff
je 0x1400e51bd
mov rcx, rsi
call fcn.1400bed00
mov qword [rsi + 0x4c8], 0xffffffffffffffff
mov byte [rsi + 0x653], 0
mov ebx, Ordinal_46
jmp 0x1400e509e
mov rcx, qword [0x730]
mov rdx, r14
mov r8d, 1
call qword [0x1402a7b00]
jmp 0x1400e5195
mov rcx, qword [rdi + 0xd0]
test rcx, rcx
jne 0x1400e518e
jmp 0x1400e5195
mov rcx, qword [rdi + 0xd0]
test rcx, rcx
jne 0x1400e515e
jmp 0x1400e516c