joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140077d1b
Capabilities:
Initialize winsock library

Disassembly:
jmp 0x1400bf180
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x220
lea rdi, [rsp + 0x30]
mov ecx, 0x7c
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x230]
mov rax, qword [0x1401a2d00]
xor rax, rsp
mov qword [rsp + 0x210], rax
mov eax, dword [rsp + 0x230]
and eax, 2
test eax, eax
je 0x1400bf257
mov eax, 0x202
mov word [rsp + 0x38], ax
lea rdx, [rsp + 0x50]
movzx ecx, word [rsp + 0x38]
call qword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [rsp + 0x1f4], eax
cmp dword [rsp + 0x1f4], 0
je 0x1400bf1fd
mov eax, 2
jmp 0x1400bf3ab
movzx eax, word [rsp + 0x50]
and rax, 0xff
movzx eax, al
movzx ecx, word [rsp + 0x38]
and rcx, 0xff
movzx ecx, cl
cmp eax, ecx
jne 0x1400bf247
movzx eax, word [rsp + 0x50]
shr rax, 8
and rax, 0xff
movzx eax, al
movzx ecx, word [rsp + 0x38]
shr rcx, 8
and rcx, 0xff
movzx ecx, cl
cmp eax, ecx
je 0x1400bf257
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 2
jmp 0x1400bf3ab
call fcn.1400785ea
mov dword [rsp + 0x1f8], eax
cmp dword [rsp + 0x1f8], 0
je 0x1400bf279
mov eax, dword [rsp + 0x1f8]
jmp 0x1400bf3ab
lea rcx, str.iphlpapi.dll
call fcn.140078333
mov qword [0x1401a33a0], rax
cmp qword [0x1401a33a0], 0
je 0x1400bf2cc
lea rdx, str.if_nametoindex
mov rcx, qword [0x1401a33a0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x200], rax
cmp qword [rsp + 0x200], 0
je 0x1400bf2cc
mov rax, qword [rsp + 0x200]
mov qword [0x1401a3380], rax
lea rcx, str.ws2_32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x1400bf331
lea rdx, str.FreeAddrInfoExW
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401a3388], rax
lea rdx, str.GetAddrInfoExCancel
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401a3390], rax
lea rdx, str.GetAddrInfoExW
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401a3398], rax
mov dword [rsp + 0x20], 3
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov ecx, 6
call fcn.140078202
movzx eax, al
test eax, eax
je 0x1400bf35e
mov byte [0x1401a3c04], 1
jmp 0x1400bf365
mov byte [0x1401a3c04], 0
mov dword [rsp + 0x20], 3
mov r9d, 2
xor r8d, r8d
mov edx, 2
mov ecx, 6
call fcn.140078202
movzx eax, al
test eax, eax
je 0x1400bf395
mov byte [0x1401a3bf9], 1
jmp 0x1400bf39c
mov byte [0x1401a3bf9], 0
lea rcx, [0x1401a3c08]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xor eax, eax
mov rdi, rax
mov rcx, rsp
lea rdx, reloc.WS2_32.dll_accept
call fcn.1400781c6
mov rax, rdi
mov rcx, qword [rsp + 0x210]
xor rcx, rsp
call fcn.140077a55
add rsp, 0x220
pop rdi
ret
Function at 0x140077e9c
Capabilities:
Parse pe header

Disassembly:
jmp 0x140162970
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140162990
xor al, al
jmp 0x140162a11
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1401629a3
xor al, al
jmp 0x140162a11
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x1401629cd
xor al, al
jmp 0x140162a11
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x1401629e1
xor al, al
jmp 0x140162a11
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x1401629f3
xor al, al
jmp 0x140162a11
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140162a0f
xor al, al
jmp 0x140162a11
mov al, 1
add rsp, 0x38
ret

Function at 0x140077f3c
Capabilities:
Create thread

Disassembly:
jmp 0x1400e9fa0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9, qword [rsp + 0x58]
mov r8, qword [rsp + 0x50]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll__beginthreadex]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x1400e9ffc
mov ecx, 0xffffffff
call fcn.140077bb8
cmp qword [rsp + 0x30], rax
jne 0x1400ea000
xor eax, eax
jmp 0x1400ea005
mov rax, qword [rsp + 0x30]
add rsp, 0x40
pop rdi
ret
Function at 0x140077f7d
Capabilities:
Create thread

Disassembly:
jmp 0x14007b060
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x178
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, Ordinal_35
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x198]
mov rax, qword [0x1401a2d00]
xor rax, rbp
mov qword [rbp + 0x138], rax
lea rcx, reloc.WS2_32.dll_accept
call fcn.14007856d
call qword [sym.imp.KERNEL32.dll_AllocConsole]
mov ecx, 1
call qword [sym.imp.ucrtbased.dll___acrt_iob_func]
mov r9, rax
lea r8, [0x14016b2c0]
lea rdx, str.CONOUT_
lea rcx, [rbp + 8]
call qword [sym.imp.ucrtbased.dll_freopen_s]
cmp qword [rbp + 8], 0
jne 0x14007b0f5
mov eax, 1
jmp 0x14007b1b0
call fcn.140077ef6
nop
mov ecx, 0x8003
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9, qword [rbp + 0x160]
lea r8, [0x140077311]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
je 0x14007b144
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x2710
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 8
lea rcx, [rbp + 0x160]
call fcn.140077efb
mov edx, 8
lea rcx, [rbp + 0x168]
call fcn.140077efb
mov edx, 4
lea rcx, [rbp + 0x178]
call fcn.140077efb
mov edx, 8
lea rcx, [rbp + 0x170]
call fcn.140077efb
nop
jmp 0x14007b19e
mov rcx, qword [rbp + 8]
call qword [sym.imp.ucrtbased.dll_fclose]
call qword [sym.imp.KERNEL32.dll_FreeConsole]
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, reloc.WS2_32.dll_bind
call fcn.1400781c6
mov rax, rdi
mov rcx, qword [rbp + 0x138]
xor rcx, rbp
call fcn.140077a55
lea rsp, [rbp + 0x148]
pop rdi
pop rbp
ret
Function at 0x140078310
Capabilities:
Write file on windows

Disassembly:
jmp 0x1400b57f0
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov rax, qword [rsp + 0x50]
movzx eax, byte [rax + 0xaaf]
test eax, eax
je 0x1400b58fc
mov rax, qword [rsp + 0x50]
cmp qword [rax + 0x278], 0
je 0x1400b5885
mov rcx, qword [rsp + 0x50]
call fcn.140077eba
mov byte [rsp + 0x30], al
mov dl, 1
mov rcx, qword [rsp + 0x50]
call fcn.140078199
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 0x1f0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x68]
mov r8, qword [rsp + 0x60]
mov edx, dword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x50]
call qword [rax + 0x278]
movzx edx, byte [rsp + 0x30]
mov rcx, qword [rsp + 0x50]
call fcn.140078199
jmp 0x1400b58fc
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
je 0x1400b58a4
cmp dword [rsp + 0x34], 1
je 0x1400b58a4
cmp dword [rsp + 0x34], 2
je 0x1400b58a4
jmp 0x1400b58fc
movsxd rax, dword [rsp + 0x58]
imul rax, rax, 3
lea rcx, [0x14016fa20]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x50]
mov r9, qword [rcx + 0x1e8]
mov r8d, 1
mov edx, 2
mov rcx, rax
call qword [sym.imp.ucrtbased.dll_fwrite]
mov rax, qword [rsp + 0x50]
mov r9, qword [rax + 0x1e8]
mov r8d, 1
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ucrtbased.dll_fwrite]
add rsp, 0x40
pop rdi
ret
Function at 0x140078333
Capabilities:
Get common file path

Disassembly:
jmp 0x1400bf460
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x60
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x1400bf49d
xor eax, eax
jmp 0x1400bf63a
lea rdx, str.LoadLibraryExA
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x28], rax
lea rdx, [0x140192a70]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ucrtbased.dll_strpbrk]
test rax, rax
je 0x1400bf50a
cmp qword [rsp + 0x28], 0
je 0x1400bf4eb
mov r8d, 8
xor edx, edx
mov rcx, qword [rsp + 0x70]
call qword [rsp + Ordinal_41]
mov qword [rsp + 0x50], rax
jmp 0x1400bf4fb
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
jmp 0x1400bf635
cmp qword [rsp + 0x28], 0
je 0x1400bf544
lea rdx, str.AddDllDirectory
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400bf544
mov r8d, 0x800
xor edx, edx
mov rcx, qword [rsp + 0x70]
call qword [rsp + Ordinal_41]
mov qword [rsp + 0x20], rax
jmp 0x1400bf635
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 0
je 0x1400bf635
mov rcx, qword [rsp + 0x70]
call fcn.140077988
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0x38]
inc eax
mov eax, eax
add rax, qword [rsp + 0x40]
mov rcx, rax
call qword [section..data]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x1400bf62a
mov edx, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x1400bf62a
mov rcx, qword [rsp + 0x48]
call fcn.140077988
mov rcx, qword [rsp + 0x48]
add rcx, rax
mov rax, rcx
lea rdx, [0x140192a88]
mov rcx, rax
call fcn.140077735
mov rcx, qword [rsp + 0x48]
call fcn.140077988
mov rcx, qword [rsp + 0x48]
add rcx, rax
mov rax, rcx
mov rdx, qword [rsp + 0x70]
mov rcx, rax
call fcn.140077735
cmp qword [rsp + 0x28], 0
je 0x1400bf610
mov r8d, 8
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [rsp + Ordinal_41]
mov qword [rsp + 0x58], rax
jmp 0x1400bf620
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x48]
call qword [0x140190008]
mov rax, qword [rsp + 0x20]
add rsp, 0x60
pop rdi
ret
Function at 0x1400783f1
Capabilities:
Set socket configuration

Disassembly:
jmp 0x14012f1e0
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x90
lea rdi, [rsp + 0x30]
mov ecx, Ordinal_27
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0xa0]
mov dword [rsp + 0x34], 0x4020
mov dword [rsp + 0x54], 0
mov dword [rsp + 0x74], 4
cmp dword [0x1401a3434], 0
jne 0x14012f261
mov dword [rsp + 0x20], 3
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov ecx, 6
call fcn.140078202
movzx eax, al
test eax, eax
je 0x14012f257
mov dword [0x1401a3434], 2
jmp 0x14012f261
mov dword [0x1401a3434], 1
cmp dword [0x1401a3434], 2
jne 0x14012f26c
jmp 0x14012f2ca
lea rax, [rsp + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x54]
mov r8d, 0x1001
mov edx, 0xffff
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x14012f2a4
mov eax, dword [rsp + 0x34]
cmp dword [rsp + 0x54], eax
jle 0x14012f2a4
jmp 0x14012f2ca
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x34]
mov r8d, 0x1001
mov edx, 0xffff
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rcx, rsp
lea rdx, reloc.WS2_32.dll_closesocket
call fcn.1400781c6
add rsp, 0x90
pop rdi
ret

Function at 0x140078441
Capabilities:
Read file on windows

Disassembly:
jmp 0x1400bea30
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x20
mov rcx, qword [rsp + 0x40]
call fcn.1400776c7
mov r8d, eax
mov rdx, qword [rsp + 0x38]
mov ecx, dword [rsp + 0x30]
call qword [sym.imp.ucrtbased.dll__read]
cdqe
add rsp, 0x20
pop rdi
ret
Function at 0x1400785e5
Capabilities:
Generate random numbers via winapi

Disassembly:
jmp 0x1400ec3f0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
mov r8, qword [rsp + 0x38]
xor edx, edx
mov rcx, qword [rsp + 0x30]
call fcn.14007802c
mov r9d, 2
mov r8d, dword [rsp + 0x38]
mov rdx, qword [rsp + 0x30]
xor ecx, ecx
call fcn.1400771ae
test eax, eax
je 0x1400ec432
mov eax, 2
jmp 0x1400ec434
xor eax, eax
add rsp, 0x20
pop rdi
ret

Function at 0x14008b850
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x70
lea rdi, [rsp + 0x30]
mov ecx, reloc.WS2_32.dll_recv
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x80]
mov dword [rsp + 0x54], 4
lea rax, [rsp + 0x54]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
mov r8d, 0x1008
mov edx, 0xffff
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x14008b8c4
cmp dword [rsp + 0x34], 1
jne 0x14008b8c4
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.WS2_32.dll_send]
mov rcx, rsp
lea rdx, reloc.WS2_32.dll_bind
call fcn.1400781c6
add rsp, 0x70
pop rdi
ret

Function at 0x140093740
Capabilities:
Hash data using djb2

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0x1505
mov rax, qword [rsp + 0x20]
cmp qword [rsp + 0x50], rax
jae 0x1400937cb
mov rax, qword [rsp + 0x28]
shl rax, 5
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x50]
movzx eax, byte [rax]
mov byte [rsp + 0x30], al
mov rax, qword [rsp + 0x50]
inc rax
mov qword [rsp + 0x50], rax
movzx ecx, byte [rsp + 0x30]
call fcn.1400786a3
movsx rax, al
mov rcx, qword [rsp + 0x28]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
jmp 0x14009376d
xor edx, edx
mov rax, qword [rsp + 0x28]
mov ecx, 0x3f
div rcx
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x1400c75c0
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xa0
lea rdi, [rsp + 0x50]
mov ecx, reloc.WS2_32.dll_sendto
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0xb0]
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x84]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x64]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x4004747b
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.WS2_32.dll_WSAIoctl]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jne 0x1400c7661
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x64]
mov r8d, 0x1001
mov edx, 0xffff
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rcx, rsp
lea rdx, reloc.WS2_32.dll_bind
call fcn.1400781c6
add rsp, 0xa0
pop rdi
ret

Function at 0x1400e3b20
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x70
lea rdi, [rsp + 0x30]
mov ecx, reloc.WS2_32.dll_recv
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x80]
cmp qword [rsp + 0x88], 0
je 0x1400e3b6a
mov rax, qword [rsp + 0x88]
cmp dword [rax], 0
jne 0x1400e3bac
cmp qword [rsp + 0x90], 0
je 0x1400e3b82
mov rax, qword [rsp + 0x90]
cmp dword [rax], 0
jne 0x1400e3bac
cmp qword [rsp + 0x98], 0
je 0x1400e3b9a
mov rax, qword [rsp + 0x98]
cmp dword [rax], 0
jne 0x1400e3bac
mov rcx, qword [rsp + 0xa0]
call fcn.140077c0d
jmp 0x1400e3c7d
mov rdx, qword [rsp + 0xa0]
lea rcx, [rsp + 0x38]
call fcn.1400780e5
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x98], 0
je 0x1400e3bea
mov rax, qword [rsp + 0x98]
cmp dword [rax], 0
je 0x1400e3bea
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x50], rax
jmp 0x1400e3bf3
mov qword [rsp + 0x50], 0
cmp qword [rsp + 0x90], 0
je 0x1400e3c1a
mov rax, qword [rsp + 0x90]
cmp dword [rax], 0
je 0x1400e3c1a
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x58], rax
jmp 0x1400e3c23
mov qword [rsp + 0x58], 0
cmp qword [rsp + 0x88], 0
je 0x1400e3c4a
mov rax, qword [rsp + 0x88]
cmp dword [rax], 0
je 0x1400e3c4a
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x60], rax
jmp 0x1400e3c53
mov qword [rsp + 0x60], 0
mov eax, dword [rsp + 0x80]
inc eax
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x20], rcx
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
mov ecx, eax
call qword [sym.imp.WS2_32.dll_select]
mov rdi, rax
mov rcx, rsp
lea rdx, reloc.WS2_32.dll_accept
call fcn.1400781c6
mov rax, rdi
add rsp, 0x70
pop rdi
ret
Function at 0x1400f2940
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xd0
lea rdi, [rsp + 0x30]
mov ecx, Ordinal_41
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0xe0]
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x58], 0
mov dword [rsp + 0x74], 0
mov dword [rsp + 0x94], 4
mov eax, dword [rsp + 0xf8]
mov dword [rsp + 0xb4], eax
mov r8, qword [rsp + 0xf8]
xor edx, edx
mov rcx, qword [rsp + 0xf0]
call fcn.14007802c
mov dword [rsp + 0x20], 0xf0000040
mov r9d, dword [rsp + 0x100]
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x1400f29e8
jmp 0x1400f2ad2
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, dword [rsp + 0x108]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x1400f2a13
jmp 0x1400f2aaa
xor r9d, r9d
mov r8d, dword [rsp + 0xe8]
mov rdx, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x1400f2a37
jmp 0x1400f2aaa
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x94]
lea r8, [rsp + 0x74]
mov edx, 4
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
jne 0x1400f2a62
jmp 0x1400f2aaa
mov eax, dword [rsp + 0x74]
cmp qword [rsp + 0xf8], rax
jae 0x1400f2a72
jmp 0x1400f2aaa
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0xb4]
mov r8, qword [rsp + 0xf0]
mov edx, 2
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x1400f2aa0
jmp 0x1400f2aaa
xor eax, eax
test eax, eax
jne 0x1400f29e8
cmp qword [rsp + 0x58], 0
je 0x1400f2abd
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
cmp qword [rsp + 0x38], 0
je 0x1400f2ad2
xor edx, edx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, rsp
lea rdx, reloc.WS2_32.dll_getpeername
call fcn.1400781c6
add rsp, 0xd0
pop rdi
ret
Function at 0x1400f4530
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x34], 1
mov dword [rsp + 0x38], 0x8000
mov eax, dword [rsp + 0x34]
mov edx, eax
mov rcx, qword [rsp + 0x20]
call qword [0x140190010]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x1400f4580
mov rcx, qword [rsp + 0x20]
call qword [0x140190008]
xor eax, eax
jmp 0x1400f45eb
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x20], rax
mov eax, dword [rsp + 0x34]
mov dword [rsp + 0x30], eax
mov r8d, dword [rsp + 0x30]
mov rdx, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
je 0x1400f45c6
mov eax, dword [rsp + 0x30]
cmp dword [rsp + 0x34], eax
je 0x1400f45c6
mov eax, dword [rsp + 0x38]
cmp dword [rsp + 0x34], eax
jbe 0x1400f45d5
mov rcx, qword [rsp + 0x20]
call qword [0x140190008]
xor eax, eax
jmp 0x1400f45eb
mov eax, dword [rsp + 0x30]
cmp dword [rsp + 0x34], eax
jae 0x1400f45e6
mov rax, qword [rsp + 0x20]
jmp 0x1400f45eb
jmp 0x1400f4553
add rsp, 0x40
pop rdi
ret
Function at 0x140106700
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x120
lea rdi, [rsp + 0x20]
mov ecx, 0x40
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x130]
mov rax, qword [0x1401a2d00]
xor rax, rsp
mov qword [rsp + 0x118], rax
mov rax, qword [rsp + 0x130]
mov rax, qword [rax + 0x20]
mov qword [rsp + 0x20], rax
mov eax, 8
imul rax, rax, 1
mov rcx, qword [rsp + 0x20]
mov rax, qword [rcx + rax + 0x220]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x38], 0xffffffffffffffff
mov dword [rsp + 0xf4], 0x80
lea r8, [rsp + 0xf4]
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x1401067bc
mov dword [rsp + 0xf4], 0x80
lea r8, [rsp + 0xf4]
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.WS2_32.dll_accept]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0xffffffffffffffff
jne 0x1401067e2
lea rdx, str.Error_accept__ing_server_connect
mov rcx, qword [rsp + 0x130]
call fcn.140078743
mov eax, reloc.WLDAP32.dll_Ordinal_30
jmp 0x1401068da
lea rdx, str.Connection_accepted_from_server
mov rcx, qword [rsp + 0x130]
call fcn.1400783a1
mov rax, qword [rsp + 0x20]
mov byte [rax + 0x34d], 0
mov edx, 1
mov rcx, qword [rsp + 0x38]
call fcn.1400773f7
lea r9, [rsp + 0x38]
mov r8d, 1
mov rdx, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x130]
call fcn.140078770
mov dword [rsp + 0x104], eax
cmp dword [rsp + 0x104], 0
je 0x14010684b
mov eax, dword [rsp + 0x104]
jmp 0x1401068da
mov rax, qword [rsp + 0x130]
cmp qword [rax + 0x288], 0
je 0x1401068d8
mov dword [rsp + 0x108], 0
mov dl, 1
mov rcx, qword [rsp + 0x130]
call fcn.140078199
mov r8d, 1
mov rdx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x130]
mov rcx, qword [rax + 0x290]
mov rax, qword [rsp + 0x130]
call qword [rax + 0x288]
mov dword [rsp + 0x108], eax
xor edx, edx
mov rcx, qword [rsp + 0x130]
call fcn.140078199
cmp dword [rsp + 0x108], 0
je 0x1401068d8
mov rdx, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x130]
call fcn.1401065b0
mov eax, Ordinal_46
jmp 0x1401068da
xor eax, eax
mov rdi, rax
mov rcx, rsp
lea rdx, reloc.WS2_32.dll_closesocket
call fcn.1400781c6
mov rax, rdi
mov rcx, qword [rsp + 0x118]
xor rcx, rsp
call fcn.140077a55
add rsp, 0x120
pop rdi
ret