joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400e0ff0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0x100
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
mov rcx, qword [rcx]
call fcn.1400df9a0
test al, al
jne 0x1400e11a8
mov dword [rbp - 0x61], edi
mov qword [rbp - 0x59], rsi
xor esi, esi
mov dword [rbp + 0x67], esi
mov qword [rbp + 7], rsi
mov qword [rsp + 0x30], rsi
lea rax, [rbp - 0x11]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x67]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8d, [rsi + 1]
lea rdx, [rbp - 0x61]
mov rcx, qword [rbx + 8]
call qword [sym.imp.WS2_32.dll_WSARecv]
test eax, eax
je 0x1400e106e
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
jne 0x1400e11cf
mov rcx, qword [rbx]
call fcn.1400df780
mov qword [rbp + 0xf], rax
mov byte [rbp + 0x17], sil
lea rax, [rbp - 0x11]
mov qword [rbx + 0x10], rax
mov rcx, qword [rbx]
call fcn.1400df780
lea rdx, [rax + 0x70]
lea rcx, vtable.std::_Func_impl_no_alloc_class__lambda_ba592e99b77cc87b7eb140194ef6b88a___void___.0
mov qword [rbp - 0x51], rcx
mov qword [rbp - 0x49], rbx
lea rcx, [rbp - 0x51]
mov qword [rbp - 0x19], rcx
lea rcx, [rbp - 0x51]
call fcn.1400954f0
mov rcx, qword [rbp - 0x19]
test rcx, rcx
je 0x1400e10cb
mov rax, qword [rcx]
lea rdx, [rbp - 0x51]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
mov rcx, qword [rbx]
call fcn.1400df480
mov rcx, qword [rbx]
call fcn.1400df780
lea rdi, [rax + 0x70]
mov rcx, qword [rdi + 0x38]
test rcx, rcx
je 0x1400e10f8
mov rax, qword [rcx]
cmp rcx, rdi
setne dl
call qword [rax + 0x20]
mov qword [rdi + 0x38], rsi
mov qword [rbx + 0x10], rsi
lea rax, [rbp + 0x67]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rbp + 0x7f]
lea rdx, [rbp - 0x11]
mov rcx, qword [rbx + 8]
call qword [sym.imp.WS2_32.dll_WSAGetOverlappedResult]
cmp eax, 1
je 0x1400e112e
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e3
jne 0x1400e116b
jmp 0x1400e1144
mov eax, dword [rbp + 0x7f]
mov rbx, qword [rsp + 0x128]
add rsp, 0x100
pop rdi
pop rsi
pop rbp
ret
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x79], xmm0
mov qword [rbp - 0x69], rax
lea rcx, [rbp - 0x79]
call fcn.14008b8a0
lea rdx, [0x140166ac0]
lea rcx, [rbp - 0x79]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
mov edx, eax
lea rcx, [rbp - 0x51]
call fcn.1400e3470
nop
mov r8, rax
lea rdx, str.TcpConnection::read__WSAGetOverlappedResult_failed_
lea rcx, [rbp + 0x1f]
call fcn.14007caf0
nop
mov rdx, rax
lea rcx, [rbp - 0x79]
call fcn.140009c30
lea rdx, [0x1401662d0]
lea rcx, [rbp - 0x79]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x79], xmm0
mov qword [rbp - 0x69], rax
lea rcx, [rbp - 0x79]
call fcn.14008b8a0
lea rdx, [0x140166ac0]
lea rcx, [rbp - 0x79]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
mov edx, eax
lea rcx, [rbp + 0x1f]
call fcn.1400e3470
nop
mov r8, rax
lea rdx, str.TcpConnection::read__WSARecv_failed_
lea rcx, [rbp - 0x51]
call fcn.14007caf0
nop
mov rdx, rax
lea rcx, [rbp - 0x79]
call fcn.140009c30
lea rdx, [0x1401662d0]
lea rcx, [rbp - 0x79]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x1400e2360
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
mov r15, rdx
lea r14, [rdx - 1]
mov rdi, rcx
xor r12d, r12d
nop word [rax + rax]
mov rsi, r12
mov rbp, r12
test r14, r14
je 0x1400e2576
mov rdx, qword [rdi + 8]
nop dword [rax]
nop word [rax + rax]
lea ecx, [rdx + 0xff]
shl rsi, cl
add rsi, rsi
nop dword [rax]
mov r10, qword [rdi]
mov ecx, dword [r10]
cmp ecx, 0x270
jne 0x1400e2424
lea rax, [r10 + 8]
mov r9d, ecx
nop word [rax + rax]
mov r8d, dword [rax - 4]
xor r8d, dword [rax]
lea rax, [rax + 4]
btr r8d, 0x1f
xor r8d, dword [rax - 8]
mov ecx, r8d
and cl, 1
neg cl
sbb edx, edx
shr r8d, 1
and edx, 0x9908b0df
xor edx, dword [rax + 0x62c]
xor edx, r8d
mov dword [rax + 0x9b8], edx
sub r9, 1
jne 0x1400e23e0
mov ecx, dword [r10]
jmp 0x1400e2507
cmp ecx, 0x4e0
jb 0x1400e2507
lea r11, [r10 + 0x9c4]
mov ebx, 0xe3
mov eax, dword [r11]
nop
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, edx
xor ecx, dword [r11 + 0x634]
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x1400e2440
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop word [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x1400e2490
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
mov ecx, r12d
mov dword [r10], r12d
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
mov r8, qword [rdi + 0x10]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and edx, 0xffffdf8c
shl edx, 0xf
mov ecx, edx
xor rcx, rax
mov rax, rcx
shr rax, 0x12
xor rax, rcx
cmp rax, r8
ja 0x1400e23c0
mov rdx, qword [rdi + 8]
or rsi, rax
lea ecx, [rdx + 0xff]
shl rbp, cl
add rbp, rbp
or rbp, r8
cmp rbp, r14
jb 0x1400e23b0
xor edx, edx
mov rax, rbp
div r15
mov rcx, rax
mov r8, rdx
xor edx, edx
mov rax, rsi
div r15
cmp rax, rcx
jb 0x1400e259a
cmp r8, r14
jne 0x1400e2390
mov rbx, qword [rsp + 0x20]
mov rax, rsi
mov rbp, qword [rsp + 0x28]
xor edx, edx
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
div r15
mov rax, rdx
pop r15
pop r14
pop r12
ret
Function at 0x1400e25c0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
mov rax, qword [rcx + 8]
xor r14d, r14d
mov edi, r14d
mov ebp, r14d
mov rsi, rcx
nop word [rax + rax]
lea ecx, [rax + 0xff]
shl rdi, cl
add rdi, rdi
nop dword [rax]
mov r10, qword [rsi]
mov ecx, dword [r10]
cmp ecx, 0x270
jne 0x1400e2664
lea rax, [r10 + 8]
mov r9d, ecx
nop word [rax + rax]
mov r8d, dword [rax - 4]
xor r8d, dword [rax]
lea rax, [rax + 4]
btr r8d, 0x1f
xor r8d, dword [rax - 8]
mov ecx, r8d
and cl, 1
neg cl
sbb edx, edx
shr r8d, 1
and edx, 0x9908b0df
xor edx, dword [rax + 0x62c]
xor edx, r8d
mov dword [rax + 0x9b8], edx
sub r9, 1
jne 0x1400e2620
mov ecx, dword [r10]
jmp 0x1400e2747
cmp ecx, 0x4e0
jb 0x1400e2747
lea r11, [r10 + 0x9c4]
mov ebx, 0xe3
mov eax, dword [r11]
nop
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x1400e2680
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x1400e26d0
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
mov ecx, r14d
mov dword [r10], r14d
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov ecx, edx
mov dword [r10], eax
mov eax, dword [r10 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and edx, 0xffffdf8c
shl edx, 0xf
mov ecx, edx
xor rcx, rax
mov rdx, rcx
shr rdx, 0x12
xor rdx, rcx
cmp rdx, qword [rsi + 0x10]
ja 0x1400e2600
mov rax, qword [rsi + 8]
or rdi, rdx
add rbp, rax
cmp rbp, 0x40
jb 0x1400e25f0
mov rbx, qword [rsp + 0x10]
mov rax, rdi
mov rdi, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
pop r14
ret
Function at 0x1400e27d0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister
Resolve dns

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x1340]
mov eax, 0x1440
call fcn.140116750
sub rsp, rax
mov rdi, r8
mov rsi, rdx
mov rcx, qword [rcx]
call fcn.1400df9a0
test al, al
jne 0x1400e2996
movdqa xmm0, xmmword [0x140136650]
movdqu xmmword [rsp + 0x38], xmm0
xor ebx, ebx
mov qword [rsp + 0x48], rbx
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rbx
cmp qword [rdi + 0x18], 0x10
jb 0x1400e2838
mov rdi, qword [rdi]
lea r9, [rbp + 0x1350]
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
jne 0x1400e2956
mov rax, qword [rbp + 0x1350]
test rax, rax
je 0x1400e286f
inc rbx
mov rax, qword [rax + 0x28]
test rax, rax
jne 0x1400e2863
call sub.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_
mov r8d, 0xffffffff
mov dword [rbp + 0x1334], r8d
mov dword [rbp - 0x4c], eax
mov edx, 1
nop dword [rax]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [rbp + rdx*4 - 0x4c], eax
inc rdx
cmp rdx, 0x270
jb 0x1400e2890
mov dword [rbp - 0x50], 0x270
lea rax, [rbp - 0x50]
mov qword [rsp + 0x20], rax
mov ecx, 0x40
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
dec rcx
shr rax, 1
cmp rax, r8
ja 0x1400e28d0
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x20]
test rbx, rbx
jne 0x1400e28f6
call fcn.1400e25c0
jmp 0x1400e28fe
mov rdx, rbx
call fcn.1400e2360
mov rbx, qword [rbp + 0x1350]
test rax, rax
je 0x1400e291a
nop word [rax + rax]
mov rbx, qword [rbx + 0x28]
sub rax, 1
jne 0x1400e2910
mov rax, qword [rbx + 0x20]
mov ecx, dword [rax + 4]
call qword [sym.imp.WS2_32.dll_ntohl]
mov edx, eax
mov rcx, rsi
call fcn.1400e1cb0
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
mov rax, rsi
lea r11, [rsp + 0x1440]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
mov edx, eax
lea rcx, [rsp + 0x68]
call fcn.1400e3470
nop
mov r8, rax
lea rdx, str.Ipv4Resolver::resolve__getaddrinfo_failed_
lea rcx, [rbp - 0x78]
call fcn.14007caf0
nop
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.140009c30
lea rdx, [0x1401662d0]
lea rcx, [rsp + 0x20]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x20]
call fcn.14008b8a0
lea rdx, [0x140166ac0]
lea rcx, [rsp + 0x20]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x1400f0910
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, rcx
xor eax, eax
xchg byte [rcx], al
mov ecx, reloc.WS2_32.dll_recv
call fcn.140116214
test rax, rax
je 0x1400f093a
lea rcx, [0x1400ef7f0]
mov qword [rax], rcx
mov qword [rax + 8], rbx
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x1400ef250]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1400f098b
cmp dword [rbx + 0x10], 0
jne 0x1400f0984
movaps xmm0, xmmword [rsp + 0x30]
movups xmmword [rbx + 8], xmm0
add rsp, 0x40
pop rbx
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
nop
mov dword [rsp + 0x38], 0
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
Function at 0x1400fa770
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movdqu xmm3, xmmword [rcx + 0x10]
movdqu xmm0, xmmword [rcx]
movdqu xmmword [rdx + 0x10], xmm3
movdqa xmm2, xmm0
movdqu xmmword [rdx], xmm0
pslldq xmm2, 4
movdqa xmm1, xmm2
pslldq xmm2, 4
pxor xmm1, xmm0
movdqa xmm4, xmm2
pxor xmm4, xmm1
pslldq xmm2, 4
pxor xmm4, xmm2
aeskeygenassist xmm0, xmm3, 1
pshufd xmm1, xmm0, 0xff
pxor xmm4, xmm1
movdqa xmm1, xmm3
pslldq xmm1, 4
movdqa xmm0, xmm1
movdqu xmmword [rdx + 0x20], xmm4
pslldq xmm1, 4
pxor xmm0, xmm3
movdqa xmm2, xmm1
pslldq xmm1, 4
pxor xmm2, xmm0
pxor xmm2, xmm1
aeskeygenassist xmm0, xmm4, 0
pshufd xmm1, xmm0, 0xaa
pxor xmm2, xmm1
movdqa xmm1, xmm4
pslldq xmm1, 4
movdqa xmm0, xmm1
movdqu xmmword [rdx + 0x30], xmm2
pslldq xmm1, 4
pxor xmm0, xmm4
movdqa xmm3, xmm1
pslldq xmm1, 4
pxor xmm3, xmm0
pxor xmm3, xmm1
aeskeygenassist xmm0, xmm2, 2
pshufd xmm1, xmm0, 0xff
pxor xmm3, xmm1
movdqa xmm1, xmm2
pslldq xmm1, 4
movdqa xmm0, xmm1
movdqu xmmword [rdx + 0x40], xmm3
pxor xmm0, xmm2
pslldq xmm1, 4
movdqa xmm2, xmm1
pslldq xmm1, 4
pxor xmm2, xmm0
pxor xmm2, xmm1
aeskeygenassist xmm0, xmm3, 0
pshufd xmm1, xmm0, 0xaa
pxor xmm2, xmm1
movdqa xmm1, xmm3
pslldq xmm1, 4
movdqa xmm0, xmm1
movdqu xmmword [rdx + 0x50], xmm2
pslldq xmm1, 4
pxor xmm0, xmm3
movdqa xmm3, xmm1
pslldq xmm1, 4
pxor xmm3, xmm0
pxor xmm3, xmm1
aeskeygenassist xmm0, xmm2, 4
pshufd xmm1, xmm0, 0xff
pxor xmm3, xmm1
movdqa xmm1, xmm2
pslldq xmm1, 4
movdqa xmm0, xmm1
movdqu xmmword [rdx + 0x60], xmm3
pxor xmm0, xmm2
pslldq xmm1, 4
movdqa xmm2, xmm1
pslldq xmm1, 4
pxor xmm2, xmm0
pxor xmm2, xmm1
aeskeygenassist xmm0, xmm3, 0
pshufd xmm1, xmm0, 0xaa
pxor xmm2, xmm1
movdqa xmm1, xmm3
movdqu xmmword [rdx + 0x70], xmm2
pslldq xmm1, 4
movdqa xmm0, xmm1
pslldq xmm1, 4
movdqa xmm4, xmm1
pxor xmm0, xmm3
pslldq xmm1, 4
pxor xmm4, xmm0
pxor xmm4, xmm1
aeskeygenassist xmm0, xmm2, 8
pshufd xmm1, xmm0, 0xff
pxor xmm4, xmm1
movdqa xmm1, xmm2
pslldq xmm1, 4
movdqa xmm0, xmm1
movdqu xmmword [rdx + 0x80], xmm4
pxor xmm0, xmm2
pslldq xmm1, 4
movdqa xmm3, xmm1
pslldq xmm1, 4
pxor xmm3, xmm0
pxor xmm3, xmm1
aeskeygenassist xmm0, xmm4, 0
pshufd xmm1, xmm0, 0xaa
pxor xmm3, xmm1
movdqa xmm1, xmm4
pslldq xmm1, 4
movdqa xmm0, xmm1
movdqu xmmword [rdx + 0x90], xmm3
pslldq xmm1, 4
pxor xmm0, xmm4
movdqa xmm2, xmm1
pslldq xmm1, 4
pxor xmm2, xmm0
pxor xmm2, xmm1
aeskeygenassist xmm0, xmm3, 0x10
pshufd xmm1, xmm0, 0xff
pxor xmm2, xmm1
movdqu xmmword [rdx + 0xa0], xmm2
ret
Function at 0x140114db0
Capabilities:
Get local ipv4 addresses
Get socket information
Resolve dns
Send data
Send data on socket
Send http request
Send http request with host header

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x8c0
movzx edi, dx
mov r14, r8
mov r8d, dword [rsp + 0x910]
movzx edx, di
mov r15, r9
mov dword [r9], 0
mov rbp, rcx
call fcn.140115980
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x140114df9
xor eax, eax
jmp 0x140114f44
mov qword [rsp + 0x8e0], rbx
mov rbx, qword [rsp + 0x900]
test rbx, rbx
je 0x140114e9f
lea r8, [rsp + 0x8f8]
mov dword [rsp + 0x8f8], 0x80
lea rdx, [rsp + 0x40]
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jns 0x140114e46
lea rcx, str.getsockname
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_perror]
jmp 0x140114e9f
mov r9d, dword [rsp + 0x908]
lea rcx, [rsp + 0x40]
mov edx, dword [rsp + 0x8f8]
mov r8, rbx
mov dword [rsp + 0x30], 0xa
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.WS2_32.dll_getnameinfo]
mov ebx, eax
test eax, eax
je 0x140114e9f
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8d, ebx
lea rdx, str.getnameinfo___failed_:__d_n
mov rcx, rax
call fcn.140077b30
mov dword [rsp + 0x30], edi
lea rax, [0x14014256c]
mov qword [rsp + 0x28], rbp
lea r8, str.GET__s_HTTP__s_r_nHost:__s:_d_r_nConnection:_Close_r_nUser_Agent:_Windows__UPnP_1.1__MiniUPnPc_2.2.2_r_n_r_n
mov r9, r14
mov qword [rsp + 0x20], rax
mov edx, 0x800
lea rcx, [rsp + 0xc0]
call fcn.1400f5e20
mov edi, eax
cmp eax, 0x800
jae 0x140114f6a
xor ebx, ebx
test eax, eax
jle 0x140114f1a
nop dword [rax]
nop word [rax + rax]
mov r8d, edi
movsxd rax, ebx
lea rdx, [rsp + 0xc0]
sub r8d, ebx
add rdx, rax
xor r9d, r9d
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
js 0x140114f5d
add ebx, eax
cmp ebx, edi
jl 0x140114ef0
mov r8, qword [rsp + 0x918]
mov rdx, r15
mov rcx, rsi
call fcn.1401146d0
mov rcx, rsi
mov rbx, rax
call qword [sym.imp.WS2_32.dll_closesocket]
mov rax, rbx
mov rbx, qword [rsp + 0x8e0]
lea r11, [rsp + 0x8c0]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
lea rcx, str.send
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_perror]
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
jmp 0x140114f3c
Function at 0x140115320
Capabilities:
Send data
Send data on socket
Send http request
Send http request with host header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r14
sub rsp, 0x260
mov rsi, qword [rsp + 0x2a8]
mov rbx, 0xffffffffffffffff
mov rdi, rbx
mov rbp, r8
mov r14, rdx
mov r12, rcx
inc rdi
cmp byte [rsi + rdi], 0
jne 0x140115356
mov byte [rsp + 0x50], 0
cmp r9w, 0x50
je 0x140115385
movzx r9d, r9w
lea r8, str.:_hu
mov edx, 8
lea rcx, [rsp + 0x50]
call fcn.1400f5e20
mov rax, qword [rsp + 0x2a0]
lea r8, str.POST__s_HTTP__s_r_nHost:__s_s_r_nUser_Agent:_Windows__UPnP_1.1__MiniUPnPc_2.2.2_r_nContent_Length:__d_r_nContent_Type:_text_xml_r_nSOAPAction:___s__r_nConnection:_Close_r_nCache_Control:_no_cache_r_nPragma:_no_cache_r_n_r_n
mov rcx, qword [rsp + 0x2b0]
mov r9, r14
mov qword [rsp + 0x40], rax
mov edx, 0x200
mov dword [rsp + 0x38], edi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x60]
call fcn.1400f5e20
movsxd r14, eax
cmp r14d, 0x200
jae 0x14011546e
mov qword [rsp + 0x280], r15
lea r15d, [r14 + rdi]
movsxd rcx, r15d
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbp, rax
test rax, rax
je 0x140115466
mov r8, r14
lea rdx, [rsp + 0x60]
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
movsxd r8, edi
lea rcx, [r14 + rbp]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
xor r9d, r9d
mov r8d, r15d
mov rdx, rbp
mov rcx, r12
call qword [sym.imp.WS2_32.dll_send]
mov edi, eax
test eax, eax
jns 0x14011545b
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, 2
mov ebx, eax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r9d, ebx
lea r8, str.send
mov rcx, rax
lea rdx, str.Socket_error:__s___d_n
call fcn.140077b30
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ebx, edi
mov r15, qword [rsp + 0x280]
lea r11, [rsp + 0x260]
mov eax, ebx
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r12
pop rdi
ret
Function at 0x140115f20
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x250
mov rsi, rdx
mov qword [rsp + 0x48], rcx
mov eax, 0x10624dd3
mov dword [rsp + 0x40], 1
imul r9d
mov edi, r8d
mov rbx, rcx
sar edx, 6
xor r8d, r8d
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x3e8
mov dword [rsp + 0x30], edx
lea rdx, [rsp + 0x40]
sub r9d, eax
imul eax, r9d, 0x3e8
xor r9d, r9d
lea ecx, [r9 + 0x40]
mov dword [rsp + 0x34], eax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_select]
test eax, eax
jns 0x140115fc8
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, 2
mov ebx, eax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r9d, ebx
lea r8, str.select
mov rcx, rax
lea rdx, str.Socket_error:__s___d_n
call fcn.140077b30
mov eax, 0xffffffff
jmp 0x140116027
jne 0x140115fce
xor eax, eax
jmp 0x140116027
xor r9d, r9d
mov r8d, edi
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_recv]
mov edi, eax
test eax, eax
jns 0x140116012
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, 2
mov ebx, eax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r9d, ebx
lea r8, str.recv
mov rcx, rax
lea rdx, str.Socket_error:__s___d_n
call fcn.140077b30
mov rax, qword [rsp + 0x280]
test rax, rax
je 0x140116025
mov dword [rax], 0
mov eax, edi
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x140013870
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1400eb9a0]
test rax, rax
je 0x140013892
call rax
mov al, 1
jmp 0x1400139ee
xor r9d, r9d
mov dword [rbp - 0x30], 0xe9030a0a
mov cl, 0xa
mov dword [rbp - 0x2c], 0xd8f0d8c6
mov dword [rbp - 0x28], 0xd9fa8f
movabs rbx, 0x8080808080808081
lea r10d, [r9 + 0xa]
movsx eax, cl
inc eax
movsxd r8, eax
lea rax, [r9 + 0xa]
imul r8, rax
mov rax, rbx
mul r8
shr rdx, 7
imul rax, rdx, 0xff
movsx rdx, cl
sub r8, rax
mov al, r9b
and al, 7
shl al, 3
mov cl, al
mov rax, rbx
sar rdx, cl
mov rcx, r10
xor r8b, dl
mul r10
add r10, 0xa
shr rdx, 7
imul rax, rdx, 0xff
sub rcx, rax
xor r8b, cl
xor byte [rbp + r9 - 0x2f], r8b
inc r9
cmp r10, 0x6e
jae 0x140013923
mov cl, byte [rbp - 0x30]
jmp 0x1400138ba
lea rcx, [rbp - 0x2f]
mov byte [rbp - 0x25], 0
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r9, rax
test rax, rax
je 0x1400139ec
movdqa xmm0, xmmword [0x1400dc690]
xor eax, eax
movdqu xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x10], 0xd9fafa6d
xor r10d, r10d
mov word [rbp - 0xc], 0x63be
lea r11d, [rax + 0x15]
mov byte [rbp - 0xa], al
movsx eax, byte [rbp - 0x20]
mov cl, r10b
inc eax
and cl, 7
movsxd r8, eax
lea rax, [r10 + 0x15]
imul r8, rax
shl cl, 3
mov rax, rbx
mul r8
shr rdx, 7
imul rax, rdx, 0xff
movsx rdx, byte [rbp - 0x20]
sub r8, rax
sar rdx, cl
xor r8b, dl
mov rcx, r11
mov rax, rbx
mul r11
add r11, 0x15
shr rdx, 7
imul rax, rdx, 0xff
sub rcx, rax
xor r8b, cl
xor byte [rbp + r10 - 0x1f], r8b
inc r10
cmp r11, 0x1ce
jb 0x140013963
lea rdx, [rbp - 0x1f]
mov byte [rbp - 0xa], 0
mov rcx, r9
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400eb9a0], rax
test rax, rax
jne 0x140013889
xor al, al
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret

Function at 0x1400139fc
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x160
mov rax, qword [0x1400e6700]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov esi, ecx
xor ebx, ebx
xor edx, edx
lea ecx, [rbx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140013a77
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
jmp 0x140013a64
cmp dword [rsp + 0x28], esi
je 0x140013a6a
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140013a50
jmp 0x140013a6e
mov ebx, dword [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140093c50
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret