joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400b03e0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
pshufd xmm0, xmmword [rdx], 0x55
lea rbp, [0x1400d1b40]
mov rdi, rcx
movd eax, xmm0
pshufd xmm0, xmmword [rdx], 0xff
mov rsi, rdx
movzx ebx, r8b
mov r10d, eax
movdqu xmm5, xmmword [rdi]
shr rax, 0x10
movzx r9d, al
mov eax, r10d
shr rax, 0x18
pslldq xmm5, 4
movdqa xmm4, xmm5
pslldq xmm5, 4
movzx r11d, byte [r9 + rbp]
movzx eax, byte [rax + rbp]
pxor xmm4, xmmword [rdi]
shl eax, 8
or r11d, eax
mov eax, r10d
shr rax, 8
movzx ecx, al
shl r11d, 8
movzx eax, byte [rcx + rbp]
or r11d, eax
movzx eax, r10b
shl r11d, 8
movzx ecx, byte [rax + rbp]
movd eax, xmm0
or r11d, ecx
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 0x18
movd xmm3, r11d
movzx r8d, byte [rcx + rbp]
movzx eax, byte [rax + rbp]
shl eax, 8
or r8d, eax
mov eax, edx
shr rax, 8
movzx ecx, al
shl r8d, 8
movzx eax, byte [rcx + rbp]
or r8d, eax
movzx eax, dl
shl r8d, 8
movzx ecx, byte [rax + rbp]
mov eax, r11d
ror eax, 8
or r8d, ecx
xor eax, ebx
mov edx, r8d
ror edx, 8
xor edx, ebx
movd xmm0, r8d
movd xmm2, eax
punpckldq xmm3, xmm0
movdqa xmm0, xmm5
movd xmm1, edx
pxor xmm0, xmm4
punpckldq xmm2, xmm1
punpckldq xmm3, xmm2
pslldq xmm5, 4
pxor xmm0, xmm5
pshufd xmm1, xmm3, 0xff
pxor xmm1, xmm0
pshufd xmm0, xmm1, 0x55
movd eax, xmm0
movdqu xmmword [rdi], xmm1
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 0x18
movzx r9d, byte [rcx + rbp]
movzx eax, byte [rax + rbp]
shl eax, 8
movdqu xmm5, xmmword [rsi]
or r9d, eax
mov rbx, qword [rsp + 8]
mov eax, edx
mov rdi, qword [rsp + 0x20]
shr rax, 8
movzx ecx, al
pshufd xmm0, xmm1, 0xff
shl r9d, 8
pslldq xmm5, 4
movzx eax, byte [rcx + rbp]
movdqa xmm4, xmm5
pxor xmm4, xmmword [rsi]
or r9d, eax
movzx eax, dl
shl r9d, 8
pslldq xmm5, 4
movzx ecx, byte [rax + rbp]
movd eax, xmm0
or r9d, ecx
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 0x18
movd xmm3, r9d
movzx r8d, byte [rcx + rbp]
movzx eax, byte [rax + rbp]
shl eax, 8
or r8d, eax
mov eax, edx
shr rax, 8
movzx ecx, al
shl r8d, 8
movzx eax, byte [rcx + rbp]
or r8d, eax
movzx eax, dl
shl r8d, 8
movzx ecx, byte [rax + rbp]
mov rbp, qword [rsp + 0x10]
or r8d, ecx
mov eax, r8d
mov ecx, r9d
ror eax, 8
ror ecx, 8
movd xmm0, r8d
punpckldq xmm3, xmm0
movdqa xmm0, xmm5
movd xmm1, eax
pxor xmm0, xmm4
movd xmm2, ecx
punpckldq xmm2, xmm1
punpckldq xmm3, xmm2
pslldq xmm5, 4
pshufd xmm1, xmm3, 0xaa
pxor xmm0, xmm5
pxor xmm1, xmm0
movdqu xmmword [rsi], xmm1
mov rsi, qword [rsp + 0x18]
ret
Function at 0x1400ba370
Capabilities:
Manipulate user privileges

Disassembly:
push rbp
push rbx
push rsi
push r14
lea rbp, [rsp - 0x3f]
sub rsp, 0xb8
xor esi, esi
mov r14d, esi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rbp - 0x41]
lea edx, [rsi + 8]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
cmp eax, 1
jne 0x1400ba585
mov rcx, qword [rbp - 0x41]
lea rax, [rbp + 0x7f]
lea r9d, [rsi + 4]
mov qword [rsp + 0x20], rax
lea r8, [rbp - 0x49]
mov dword [rbp + 0x7f], 4
lea edx, [rsi + 0x14]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov rcx, qword [rbp - 0x41]
lea edx, [rsi + 1]
test eax, eax
mov dword [rbp + 0x67], esi
lea rax, [rbp + 0x67]
mov ebx, esi
cmovne ebx, dword [rbp - 0x49]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov eax, dword [rbp + 0x67]
test eax, eax
je 0x1400ba428
test ebx, ebx
je 0x1400ba428
mov edx, eax
lea ecx, [rsi + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r9d, dword [rbp + 0x67]
lea edx, [rsi + 1]
mov rcx, qword [rbp - 0x41]
mov r14, rax
lea rax, [rbp + 0x67]
mov r8, r14
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov rcx, qword [rbp - 0x41]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r14, r14
je 0x1400ba585
xor eax, eax
lea r9, [rbp - 0x31]
mov r8d, 0xf0fff
mov qword [rbp - 0x19], rax
lea rdx, [rbp - 0x19]
mov qword [rbp - 0x11], rax
xor ecx, ecx
mov qword [rbp - 9], rax
mov qword [rbp - 1], rax
mov qword [rbp + 7], rax
mov qword [rbp + 0xf], rax
call sub.ADVAPI32.dll_LsaOpenPolicy
test eax, eax
jne 0x1400ba56d
mov rdx, qword [r14]
lea rax, [0x1400d6cd0]
mov rcx, qword [rbp - 0x31]
lea r9, [rbp + 0x6f]
lea r8, [rbp - 0x39]
mov qword [rbp - 0x21], rax
mov dword [rbp - 0x29], 0x2c002a
mov qword [rbp - 0x39], rsi
mov dword [rbp + 0x6f], esi
mov dword [rbp + 0x77], esi
call sub.ADVAPI32.dll_LsaEnumerateAccountRights
test eax, eax
jne 0x1400ba548
mov rax, qword [rbp - 0x39]
mov qword [rsp + 0xb0], rdi
mov rdi, rsi
mov qword [rsp + 0x98], r15
mov r15d, dword [rbp + 0x6f]
test r15, r15
je 0x1400ba52b
mov qword [rsp + 0xa8], r12
mov rbx, rax
movzx r12d, word [rbp - 0x29]
mov qword [rsp + 0xa0], r13
mov r13, qword [rbp - 0x21]
cmp word [rbx], r12w
jne 0x1400ba502
mov rcx, qword [rbx + 8]
mov r8d, 0x2a
mov rdx, r13
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400ba510
inc rdi
add rbx, 0x10
cmp rdi, r15
jb 0x1400ba4e6
jmp 0x1400ba517
mov dword [rbp + 0x77], 1
mov rax, qword [rbp - 0x39]
mov r12, qword [rsp + 0xa8]
mov r13, qword [rsp + 0xa0]
mov rcx, rax
call sub.ADVAPI32.dll_LsaFreeMemory
mov r15, qword [rsp + 0x98]
mov rdi, qword [rsp + 0xb0]
cmp dword [rbp + 0x77], esi
jne 0x1400ba564
mov rdx, qword [r14]
lea r8, [rbp - 0x29]
mov rcx, qword [rbp - 0x31]
mov r9d, 1
call sub.ADVAPI32.dll_LsaAddAccountRights
test eax, eax
sete sil
mov rcx, qword [rbp - 0x31]
call sub.ADVAPI32.dll_LsaClose
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, esi
add rsp, 0xb8
pop r14
pop rsi
pop rbx
pop rbp
ret
xor eax, eax
add rsp, 0xb8
pop r14
pop rsi
pop rbx
pop rbp
ret
Function at 0x1400bb7a0
Capabilities:
Connect socket

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor eax, eax
mov rdi, rcx
xchg byte [rcx + 8], al
mov rdx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x28]
mov r8d, dword [rdx + 0x10]
mov rdx, qword [rdx + 0x20]
call qword [sym.imp.WSOCK32.dll_connect]
mov rcx, qword [rdi + 0x20]
mov ebx, eax
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
mov qword [rdi + 0x20], 0
test ebx, ebx
je 0x1400bb7fa
mov rcx, qword [rdi + 0x10]
lea rdx, str.CONNECT_error:
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1400b6800
mov rbx, qword [rsp + 0x30]
mov al, 1
add rsp, 0x20
pop rdi
ret

Function at 0x1400bb810
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
sub rsp, 0x20
movzx eax, byte [rcx + 8]
mov rbx, rcx
test al, al
je 0x1400bb829
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov rcx, qword [rcx + 0x28]
xor r9d, r9d
mov qword [rsp + 0x30], rdi
call qword [sym.imp.WSOCK32.dll_recv]
mov edi, eax
test eax, eax
jne 0x1400bb85e
mov rcx, qword [rbx + 0x10]
lea rdx, str.RECEIVE_error:_socket_closed
call fcn.1400b67c0
mov eax, edi
mov rdi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret
cmp edi, 0xffffffff
jg 0x1400bb873
mov rcx, qword [rbx + 0x10]
lea rdx, str.RECEIVE_error:
call fcn.1400b6800
mov eax, edi
mov rdi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret

Function at 0x1400bb880
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
mov rbp, rcx
xor edi, edi
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rdx + rbx], dil
jne 0x1400bb8a3
test rbx, rbx
je 0x1400bb8d7
mov rcx, qword [rbp + 0x28]
lea rdx, [rdi + rsi]
mov r8d, ebx
xor r9d, r9d
sub r8d, edi
call qword [sym.imp.WSOCK32.dll_send]
cmp eax, 0xffffffff
je 0x1400bb8ee
cdqe
add rdi, rax
cmp rdi, rbx
jne 0x1400bb8b1
mov al, 1
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rcx, qword [rbp + 0x10]
lea rdx, str.SEND_error:
call fcn.1400b6800
xor al, al
jmp 0x1400bb8d9
Function at 0x1400be090
Capabilities:
Hash data using sha256

Disassembly:
push rbx
sub rsp, 0xb0
mov rax, qword [0x1400e71d8]
xor rax, rsp
mov qword [rsp + 0xa0], rax
xor eax, eax
mov dword [rsp + 0x20], 0x6a09e667
mov rbx, rcx
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x50], rax
lea r8d, [r8*8]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x44], eax
mov dword [rsp + 0x24], 0xbb67ae85
mov dword [rsp + 0x28], 0x3c6ef372
mov dword [rsp + 0x2c], 0xa54ff53a
mov dword [rsp + 0x30], 0x510e527f
mov dword [rsp + 0x34], 0x9b05688c
mov dword [rsp + 0x38], 0x1f83d9ab
mov qword [rsp + 0x3c], 0x5be0cd19
call fcn.1400be150
mov r9b, 1
lea rcx, [rsp + 0x20]
mov r8b, 0x81
mov rdx, rbx
call fcn.1400bde40
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1400bc560
add rsp, 0xb0
pop rbx
ret
Function at 0x1400beda0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xf0
mov rax, qword [0x1400e71d8]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov eax, dword [rcx]
lea rdi, [rcx + 0x3c]
mov dword [rbp - 0x79], eax
lea rdx, [rbp - 0x39]
mov eax, dword [rcx + 4]
mov rbx, rcx
mov dword [rbp - 0x75], eax
xor r8d, r8d
mov eax, dword [rcx + 8]
mov dword [rbp - 0x71], eax
mov eax, dword [rcx + 0xc]
mov dword [rbp - 0x6d], eax
mov eax, dword [rcx + 0x10]
mov dword [rbp - 0x69], eax
mov eax, dword [rcx + 0x14]
mov dword [rbp - 0x65], eax
mov eax, dword [rcx + 0x18]
mov dword [rbp - 0x61], eax
mov eax, dword [rcx + 0x1c]
mov dword [rbp - 0x5d], eax
mov eax, dword [rcx + 0x20]
mov dword [rbp - 0x59], eax
mov eax, dword [rcx + 0x24]
mov dword [rbp - 0x55], eax
mov eax, dword [rcx + 0x28]
mov dword [rbp - 0x51], eax
mov eax, dword [rcx + 0x2c]
mov dword [rbp - 0x4d], eax
mov eax, dword [rcx + 0x30]
mov dword [rbp - 0x49], eax
mov eax, dword [rcx + 0x34]
mov dword [rbp - 0x45], eax
mov eax, dword [rcx + 0x38]
lea rcx, [rbp - 0x79]
mov dword [rbp - 0x41], eax
mov eax, dword [rdi]
mov dword [rbp - 0x3d], eax
call fcn.1400befa0
mov r8d, 1
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x39]
call fcn.1400befa0
mov r8d, 2
lea rdx, [rbp - 0x39]
lea rcx, [rbp + 7]
call fcn.1400befa0
mov r8d, 3
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x39]
call fcn.1400befa0
mov r8d, 4
lea rdx, [rbp - 0x39]
lea rcx, [rbp + 7]
call fcn.1400befa0
mov r8d, 5
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x39]
call fcn.1400befa0
mov r8d, 6
lea rdx, [rbp - 0x39]
lea rcx, [rbp + 7]
call fcn.1400befa0
mov r8d, 7
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x39]
call fcn.1400befa0
mov r8d, 8
lea rdx, [rbp - 0x39]
lea rcx, [rbp + 7]
call fcn.1400befa0
mov r8d, 9
lea rdx, [rbp - 0x79]
lea rcx, [rbp - 0x39]
call fcn.1400befa0
lea rax, [rbp - 0x3d]
mov edx, reloc.WSOCK32.dll_recv
cmp rbx, rax
ja 0x1400beefe
xor ecx, ecx
lea rax, [rbp - 0x79]
cmp rdi, rax
jae 0x1400bef47
movdqu xmm0, xmmword [rbx]
movdqu xmm1, xmmword [rbp - 0x69]
pxor xmm0, xmmword [rbp - 0x79]
movdqu xmmword [rbx], xmm0
movdqu xmm0, xmmword [rbx + 0x10]
pxor xmm1, xmm0
movdqu xmmword [rbx + 0x10], xmm1
movdqu xmm0, xmmword [rbx + 0x20]
movdqu xmm1, xmmword [rbp - 0x59]
pxor xmm1, xmm0
movdqu xmmword [rbx + 0x20], xmm1
movdqu xmm0, xmmword [rbx + 0x30]
movdqu xmm1, xmmword [rbp - 0x49]
pxor xmm1, xmm0
movdqu xmmword [rbx + 0x30], xmm1
mov rcx, rdx
cmp rcx, rdx
jae 0x1400bef70
lea r8, [rbp - 0x79]
sub r8, rbx
lea rax, [rbx + rcx*4]
sub rdx, rcx
nop word [rax + rax]
mov ecx, dword [r8 + rax]
xor dword [rax], ecx
lea rax, [rax + 4]
sub rdx, 1
jne 0x1400bef60
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1400bc560
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x140033bfc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call fcn.1400497d8
xor esi, esi
test eax, eax
js 0x140033cbf
test rbx, rbx
jne 0x140033c27
or edi, 0xffffffff
jmp 0x140033c6c
mov edi, esi
mov ecx, esi
cmp word [rbx], si
je 0x140033c5f
cmp ecx, 0x7fffffff
jae 0x140033c22
mov eax, ecx
cmp word [rbx + rax*2], 0x5c
je 0x140033c54
cmp word [rbx + rax*2], 0x2f
je 0x140033c54
cmp word [rbx + rax*2], 0x3a
jne 0x140033c57
cmp ecx, 1
jne 0x140033c57
lea edi, [rcx + 1]
inc ecx
cmp word [rbx + rcx*2], si
jne 0x140033c30
mov eax, edi
cmp word [rbx + rax*2], si
je 0x140033c22
cmp edi, 7
jb 0x140033cba
lea eax, [rdi - 5]
mov r8d, 5
lea rcx, [rbx + rax*2]
lea rdx, str.x64_
call fcn.140212fd0
test eax, eax
jne 0x140033cba
mov eax, dword [0x14037c8a8]
lea ecx, [rdi - 4]
mov dword [rbx + rcx*2], eax
movzx eax, word [0x14037c8ac]
mov word [rbx + rcx*2 + 4], ax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140033cba
shr eax, 4
test al, 1
jne 0x140033cba
xor eax, eax
jmp 0x140033cbf
mov eax, 1
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140035a34
Capabilities:
Get hostname

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 8], rcx
push rdi
sub rsp, 0x20
mov rbx, rdx
and dword [rax + 8], 0
lea r8, [rax + 8]
xor edx, edx
lea ecx, [rdx + 5]
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
jne 0x140035af7
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x140035af7
and qword [rsp + 0x40], 0
mov edx, dword [rsp + 0x30]
mov eax, 2
mul rdx
mov rdx, 0xffffffffffffffff
cmovo rax, rdx
mov rcx, rax
call fcn.14005f8c4
mov rdi, rax
mov qword [rsp + 0x40], rax
lea r8, [rsp + 0x30]
mov rdx, rax
mov ecx, 5
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
jne 0x140035ad7
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov eax, 0x80004005
test ebx, ebx
cmovns ebx, eax
jmp 0x140035ae5
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
xor ebx, ebx
mov rcx, rdi
call fcn.14005f854
and qword [rsp + 0x40], 0
mov eax, ebx
jmp 0x140035b17
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovns ecx, eax
mov eax, ecx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x1400362b8
Capabilities:
Access the windows event log

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], r8
push rsi
push rdi
push r14
sub rsp, 0x60
mov ebp, edx
movzx r14d, cx
lea rdx, [0x14037cd10]
xor ecx, ecx
mov rsi, r9
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov rdi, rax
test rax, rax
jne 0x140036312
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov eax, 0x80004005
test ebx, ebx
cmovns ebx, eax
jmp 0x1400363a8
and qword [rsp + 0x50], 0
lea rcx, [rsp + 0x50]
xor ebx, ebx
call fcn.140213264
test eax, eax
js 0x140036330
mov rax, qword [rsp + 0x50]
mov rbx, qword [rax]
mov qword [rsp + 0x40], rsi
lea rax, [rsp + 0x90]
mov qword [rsp + 0x38], rax
mov ecx, 1
mov eax, dword [rsp + 0xa0]
xor r8d, r8d
mov dword [rsp + 0x30], eax
mov r9d, ebp
mov word [rsp + 0x28], cx
movzx edx, r14w
mov rcx, rdi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
test eax, eax
jne 0x140036393
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov eax, 0x80004005
test ebx, ebx
cmovns ebx, eax
jmp 0x140036395
xor ebx, ebx
mov rcx, qword [rsp + 0x50]
call fcn.14021325c
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
lea r11, [rsp + 0x60]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x1400363c0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x1403b9010]
xor rax, rsp
mov qword [rsp + 0x38], rax
xor esi, esi
mov rbx, rcx
mov word [rcx], si
xor r8d, r8d
lea ebp, [rsi + 2]
mov ecx, ebp
lea edx, [rsi + 1]
call qword [sym.imp.WS2_32.dll_socket]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x14003642a
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovns ecx, eax
mov eax, ecx
jmp 0x1400364ae
mov qword [rsp + 0x28], rbp
lea rdx, [rsp + 0x28]
mov ebp, reloc.OLEAUT32.dll_SafeArrayGetDim
mov qword [rsp + 0x30], rsi
mov r8d, ebp
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_bind]
test eax, eax
je 0x140036479
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
movzx ebx, ax
mov rcx, rdi
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov eax, 0x80004005
test ebx, ebx
cmovns ebx, eax
call qword [sym.imp.WS2_32.dll_closesocket]
mov eax, ebx
jmp 0x1400364ae
lea r8, [rsp + 0x20]
mov dword [rsp + 0x20], ebp
lea rdx, [rsp + 0x28]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
je 0x14003644e
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
movzx ecx, word [rsp + 0x2a]
call qword [sym.imp.WS2_32.dll_ntohs]
mov word [rbx], ax
xor eax, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14005f5e0
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x1400397cc
Capabilities:
Initialize winsock library

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x150]
sub rsp, 0x250
mov rax, qword [0x1403b9010]
xor rax, rsp
mov qword [rbp + 0x140], rax
mov rbx, rcx
mov al, byte [rcx + 0x49]
mov byte [0x1403e5a24], al
lea rcx, [0x1403e45b0]
call fcn.140210cbc
call fcn.14016cea0
call fcn.14021a654
movzx eax, byte [0x1403e51ba]
mov edi, 1
cmp byte [rbx + 0x48], 0
cmovne eax, edi
mov byte [0x1403e51ba], al
movups xmm0, xmmword [rbx]
movaps xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rbx + 0x10]
movaps xmmword [rsp + 0x40], xmm1
movups xmm0, xmmword [rbx + 0x20]
movaps xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rbx + 0x30]
movaps xmmword [rsp + 0x60], xmm1
movups xmm0, xmmword [rbx + 0x40]
movaps xmmword [rsp + 0x70], xmm0
mov rcx, qword [rbx + 0x30]
mov rax, qword [rbx + 0x38]
lea rdx, [rbp - 0x80]
mov qword [rsp + 0x20], rdx
and qword [rbp - 0x80], 0
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x70], rcx
xor r8d, r8d
mov edx, edi
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
mov rcx, qword [rbx + 0x28]
test rcx, rcx
je 0x14003989e
xor r8d, r8d
mov edx, edi
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
xor r8d, r8d
mov edx, edi
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
xor r8d, r8d
mov edx, edi
mov rcx, qword [rbx + 0x38]
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
nop
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov ebx, eax
test eax, eax
js 0x140039918
mov ecx, 0x202
lea rdx, [rbp - 0x60]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x140039900
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov eax, 0x80004005
test ebx, ebx
cmovns ebx, eax
jmp 0x140039911
lea rcx, [rsp + 0x30]
call fcn.140039948
mov ebx, eax
call fcn.14003be10
call qword [sym.imp.ole32.dll_CoUninitialize]
nop
lea rcx, [rsp + 0x30]
call fcn.140039784
mov eax, ebx
mov rcx, qword [rbp + 0x140]
xor rcx, rsp
call fcn.14005f5e0
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x140039948
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x1403b9010]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r14, rcx
and qword [rbp - 0x38], 0
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rdi, rax
mov qword [rbp - 0x38], rax
test rax, rax
je 0x1400399ca
mov rcx, rax
call fcn.14004c790
mov esi, eax
test eax, eax
js 0x140039af5
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf001f
mov rcx, qword [r14 + 0x60]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [r14 + 0x50], rax
test rax, rax
jne 0x1400399ed
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov eax, 0x80004005
test esi, esi
cmovns esi, eax
jmp 0x140039af5
and qword [rbp - 0x40], 0
lea r8, [r14 + 0x10]
lea rax, [rbp - 0x40]
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
mov qword [rsp + 0x28], r14
mov byte [rsp + 0x20], 0
mov r9d, dword [r14 + 0x20]
xor edx, edx
mov rcx, qword [r14 + 8]
call fcn.140041a78
mov esi, eax
mov rbx, qword [rbp - 0x40]
test eax, eax
js 0x140039ae6
mov rcx, qword [r14 + 0x28]
test rcx, rcx
je 0x140039a3b
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rax, qword [r14]
mov qword [rbp - 0x30], rax
mov rax, qword [rbx + 0x20]
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], rdi
mov rax, qword [r14 + 0x40]
mov qword [rbp - 0x18], rax
mov r14d, 4
mov esi, r14d
mov ecx, r14d
jmp 0x140039a6e
cmp byte [rbx + 0x3d], 0
je 0x140039aa6
dec esi
mov ecx, esi
and dword [rsp + 0x20], 0
or r9d, 0xffffffff
xor r8d, r8d
lea rdx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjectsEx]
cmp eax, 3
je 0x140039a64
cmp eax, r14d
jae 0x140039aaa
test eax, eax
jne 0x140039aa6
cmp byte [rbx + 0x3d], al
je 0x140039aa6
xor r8d, r8d
xor edx, edx
mov ecx, VarBoolFromI1
call fcn.140036248
xor esi, esi
jmp 0x140039aaf
mov esi, 0x805e1000
mov byte [rbx + 0x3d], 0
mov byte [0x1403e51ca], 1
mov rcx, qword [0x1403e59e8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
jne 0x140039adf
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0x805e1003
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
call qword [sym.imp.vsdebugeng.dll_DkmDllUninitialize]
nop
test rbx, rbx
je 0x140039af5
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx + reloc.OLEAUT32.dll_SafeArrayGetDim]
nop
test rdi, rdi
je 0x140039b08
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
and qword [rbp - 0x38], 0
mov eax, esi
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14005f5e0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret