joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1404d9dba
Capabilities:
Check for software breakpoints
Query environment variable

Disassembly:
mov rax, rsp
test bh, 0x1b
jmp 0x1404d9dd3
mov qword [rax + 8], rbx
cmp r12b, 0xcc
cmp ax, cx
test rcx, r12
mov qword [rax + 0x10], rbp
stc
mov qword [rax + 0x18], rsi
clc
mov qword [rax + 0x20], rdi
test bx, 0x3e20
clc
push r14
test r15b, dl
cmp ah, 0xb7
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
sub r14d, r14d
ror bx, cl
xchg bx, bx
mov rbx, rax
test rax, rax
jmp 0x1404d9e1b
je 0x1404d9f99
mov rsi, rax
clc
cmp word [rax], r14w
jmp 0x1404d9e2e
je 0x1404d9e6e
or rax, 0xffffffffffffffff
jmp 0x1404d9e3d
inc rax
test bl, cl
cmp word [rsi + rax*2], r14w
jmp 0x1404d9e4c
jne 0x1404d9e3d
lea rsi, [rsi + rax*2]
add rsi, 2
stc
cmp r8w, di
cmp word [rsi], r14w
jmp 0x1404d9e68
jne 0x1404d9e34
mov qword [rsp + 0x38], r14
movzx r8w, r11b
sal r8w, 0xdd
rcr r9w, cl
sub rsi, rbx
or r8b, 0x40
and r9b, spl
mov qword [rsp + 0x30], r14
movsxd r9, eax
btr r9w, ax
add rsi, 2
bsr r9w, bx
xchg r8b, r9b
bts r8w, si
sar rsi, 1
sal r8b, cl
sal r8b, 0x93
shl r9b, cl
mov r8, rbx
mov r9d, esi
clc
cmp r8b, 0x2f
mov dword [rsp + 0x28], r14d
stc
sub edx, edx
jmp 0x1404d9ecf
mov qword [rsp + 0x20], r14
cmp esi, r14d
sub ecx, ecx
jmp 0x1404d9ede
call fcn.1404ca295
movsxd rbp, eax
jmp 0x1404d9ef1
test eax, eax
jmp 0x1404d9ef8
je 0x1404d9f99
mov rcx, rbp
jmp 0x1404d9f06
call fcn.1404ca1c3
mov rdi, rax
test rax, rax
je 0x1404d9f81
mov qword [rsp + 0x38], r14
ror r8w, cl
neg r8
not r9b
mov r9d, esi
movzx r8w, sil
bt r8w, 0xf3
mov qword [rsp + 0x30], r14
mov r8, rbx
cmc
mov dword [rsp + 0x28], ebp
sub edx, edx
stc
xor ecx, ecx
jmp 0x1404d9f4b
mov qword [rsp + 0x20], rax
jmp 0x1404d9f55
call fcn.1404ca295
test eax, eax
jmp 0x1404d9f61
je 0x1404d9f81
mov rsi, rdi
movzx di, r8b
jmp 0x1404d9f74
mov rdi, r14
jmp 0x1404d9f7c
jmp 0x1404d9f87
mov rsi, r14
movsx ecx, sp
mov rcx, rdi
jmp 0x1404d9f8f
call fcn.1404ca156
jmp 0x1404d9fa2
mov rsi, r14
jmp 0x1404d9fa2
test rbx, rbx
jmp 0x1404d9faa
je 0x1404d9fbe
mov rcx, rbx
jmp 0x1404d9fb8
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x50]
test r14, 0x48154de
cmp spl, sil
ror ah, 0x91
mov rax, rsi
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
bt di, 0xcd
btc r14w, r13w
mov rdi, qword [rsp + 0x68]
xadd r14b, r14b
add rsp, 0x40
jmp 0x1404d9ffc
pop r14
jmp 0x1404da003
ret
Function at 0x1404da004
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
jmp 0x1404da01e
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
cmp r11b, 0x71
push rdi
test spl, 0xc2
cmc
sub rsp, 0x20
jmp 0x1404da03b
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
jmp 0x1404da04d
test rax, rax
je 0x1404da124
mov rbp, rax
cmp word [rax], si
jmp 0x1404da061
je 0x1404da0a5
or rax, 0xffffffffffffffff
jmp 0x1404da070
inc rax
jmp 0x1404da078
cmp word [rbp + rax*2], si
jmp 0x1404da082
jne 0x1404da070
lea rbp, [rbp + rax*2]
add rbp, 2
jmp 0x1404da096
cmp word [rbp], si
jmp 0x1404da09f
jne 0x1404da067
sub rbp, rbx
add rbp, 2
sar rbp, 1
bts rcx, rbx
jmp 0x1404da0b8
add rbp, rbp
movsxd rcx, edx
bswap cx
mov rcx, rbp
jmp 0x1404da0c9
call fcn.1404ca1c3
mov rdi, rax
clc
test rax, rax
je 0x1404da10a
mov r8, rbp
not cl
movsx rdx, cx
mov rdx, rbx
bswap ecx
movzx rcx, r10w
movzx cx, ch
mov rcx, rax
jmp 0x1404da0f9
call fcn.1404a4302
mov rsi, rdi
cmc
jmp 0x1404da10a
sub ecx, ecx
jmp 0x1404da111
call fcn.1404ca156
mov rcx, rbx
jmp 0x1404da11e
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x30]
sal dil, cl
mov rax, rsi
stc
adc sil, r13b
bsr ebp, r13d
mov rsi, qword [rsp + 0x40]
btr rdi, rdi
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
mov dil, 0xba
pop rdi
jmp 0x1404da152
ret
Function at 0x1404dcfa0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
movzx eax, r15w
mov qword [rsp + 0x18], rbp
push rsi
push rdi
movzx eax, di
movsx ax, r13b
push r14
mov eax, 0x1450
jmp 0x1404dcfcd
call fcn.140448eb8
sub rsp, rax
ror rbp, cl
cmovs esi, esp
btr edi, 0x8d
mov rax, qword [0x1400b7288]
xor rax, rsp
mov qword [rsp + 0x1440], rax
movsxd r10, edx
cdqe
mov rdi, rcx
sal ch, 0x78
rcl rdx, cl
mov rax, r10
mov ebp, r9d
cmovbe edx, r13d
btc esi, 0xb9
inc ch
sar rax, 6
movzx r14, r9w
add ch, 0x97
test r10b, 0xd1
lea rcx, [0x1400ba940]
and r10d, 0x3f
lea rbp, [rbp + r8]
and r14, 0x7e1d6e7d
mov rsi, r8
adc dh, 0x95
mov rax, qword [rcx + rax*8]
lea rdx, [r10 + r10*8]
neg r14w
xadd r14w, r14w
mov r14, qword [rax + rdx*8 + 0x28]
test al, r15b
sub eax, eax
mov qword [rdi], rax
test dil, r15b
stc
mov dword [rdi + 8], eax
test r14w, 0x70c0
cmp bl, bpl
test esi, esp
cmp r8, rbp
jmp 0x1404dd073
jae 0x1404dd17e
lea rbx, [rsp + 0x40]
cmp rsi, rbp
jmp 0x1404dd086
jae 0x1404dd0d6
mov al, byte [rsi]
inc rsi
cmp r9b, al
cmp al, 0xa
jmp 0x1404dd09b
jne 0x1404dd0b4
inc dword [rdi + 8]
jmp 0x1404dd0a9
mov byte [rbx], 0xd
jmp 0x1404dd0b1
inc rbx
mov byte [rbx], al
bswap eax
cdqe
lahf
inc rbx
sbb al, r12b
rcr ah, 0x22
lea rax, [rsp + 0x143f]
cmc
cmp rbx, rax
jb 0x1404dd07e
and qword [rsp + 0x20], 0
movsxd r9, esi
xor r9, r15
rol ah, cl
lea rax, [rsp + 0x40]
xor r8b, 0x6d
movzx rdx, r8w
sub ebx, eax
movzx dx, bpl
setle dh
cmovnp cx, si
lea r9, [rsp + 0x30]
movzx rcx, r10w
setg r8b
mov r8d, ebx
jmp 0x1404dd114
lea rdx, [rsp + 0x40]
movzx cx, r10b
movsx cx, spl
cmovp ecx, r13d
mov rcx, r14
jmp 0x1404dd12f
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jmp 0x1404dd13c
je 0x1404dd173
mov eax, dword [rsp + 0x30]
jmp 0x1404dd14f
add dword [rdi + 4], eax
cmc
cmp eax, ebx
jmp 0x1404dd15a
jb 0x1404dd17e
cmp rsi, rbp
jmp 0x1404dd168
jb 0x1404dd079
jmp 0x1404dd17e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
rcr al, 0x96
mov rax, rdi
mov rcx, qword [rsp + 0x1440]
cmc
xor rcx, rsp
jmp 0x1404dd192
call fcn.1404a07bb
lea r11, [rsp + 0x1450]
mov rbx, qword [r11 + 0x20]
movsx esi, r13w
movsx rdi, ax
mov rbp, qword [r11 + 0x30]
movsx di, bpl
mov rsp, r11
movzx edi, cx
cmovae r14, rsp
movsx r14w, r10b
pop r14
not si
pop rdi
xchg si, si
pop rsi
jmp 0x1404dd1d2
ret
Function at 0x1404dd1d3
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
lahf
movzx rax, di
push rsi
cwde
lahf
movzx rax, dx
push rdi
movzx eax, r12w
lahf
movsxd rax, r13d
push r14
bswap eax
mov eax, 0x1450
call fcn.140448eb8
sub rsp, rax
add r10, 0x3c8e50f3
sub rbp, 0x6ea42e44
jmp 0x1404dd216
mov rax, qword [0x1400b7288]
shl r14w, cl
xor rax, rsp
bt di, r12w
mov qword [rsp + 0x1440], rax
movsxd r10, edx
mov rdi, rcx
mov rax, r10
cmovge rdx, r11
cmp rdi, 0x2bdd34b8
mov ebp, r9d
ror dl, cl
sar rax, 6
xor sil, 0xe9
lea rcx, [0x1400ba940]
or r14b, 0x11
and r10d, 0x3f
lea rbp, [rbp + r8]
mov rsi, r8
bswap rdx
xadd dh, dl
mov rax, qword [rcx + rax*8]
lea rdx, [r10 + r10*8]
rcr r14d, cl
shr r14b, cl
mov r14, qword [rax + rdx*8 + 0x28]
xor eax, eax
stc
cmc
mov qword [rdi], rax
mov dword [rdi + 8], eax
stc
cmp r8, rbp
jae 0x1404dd399
lea rbx, [rsp + 0x40]
cmc
cmp r14b, 0x4a
stc
cmp rsi, rbp
jae 0x1404dd30c
movzx eax, word [rsi]
cmc
add rsi, 2
cmc
cmp ax, 0xa
jmp 0x1404dd2bc
jne 0x1404dd2e0
add dword [rdi + 8], 2
sal cx, cl
sub cx, dx
mov ecx, 0xd
cmp sil, bpl
cmc
mov word [rbx], cx
add rbx, 2
cmp r13b, 0x71
mov word [rbx], ax
cmp si, 0x7114
cmp cl, r9b
add rbx, 2
sar eax, cl
cmovl ax, r11w
lea rax, [rsp + 0x143e]
cmp rbx, rax
jmp 0x1404dd306
jb 0x1404dd2a1
and qword [rsp + 0x20], 0
rol r8b, 0xca
sal r8w, 0x56
lea rax, [rsp + 0x40]
sub rbx, rax
cmc
sbb r9w, ax
lea r9, [rsp + 0x30]
sar rbx, 1
lea rdx, [rsp + 0x40]
ror r8w, cl
add ebx, ebx
setae r8b
movzx r8d, r9w
mov rcx, r14
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jmp 0x1404dd356
je 0x1404dd387
mov eax, dword [rsp + 0x30]
add dword [rdi + 4], eax
test bpl, 0xfd
cmp eax, ebx
jmp 0x1404dd36e
jb 0x1404dd399
cmp rsi, rbp
jmp 0x1404dd37c
jb 0x1404dd296
jmp 0x1404dd399
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
cmp rdx, 0x24f96a83
test r11b, dil
mov rax, rdi
sar rcx, 0x5e
mov rcx, qword [rsp + 0x1440]
cmp r11, 0x3a292fa8
xor rcx, rsp
call fcn.1404a07bb
lea r11, [rsp + 0x1450]
mov rbx, qword [r11 + 0x20]
movzx esi, r9w
mov esi, 0x6cd1502
jmp 0x1404dd3d1
mov rbp, qword [r11 + 0x30]
movzx r14w, r12b
mov si, 0x1e2d
mov rsp, r11
bswap esi
pop r14
mov dil, 0x9f
bswap di
pop rdi
jmp 0x1404dd3f1
pop rsi
jmp 0x1404dd3f7
ret
Function at 0x1404dd3f8
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
movsxd rax, r10d
not rax
mov qword [rsp + 0x18], rbp
jmp 0x1404dd42f
push rsi
cbw
movzx ax, ah
cwde
push rdi
cdqe
mov ax, sp
push r12
cmovp rax, rsi
setg al
mov rax, 0x51313f5
push r14
mov ah, cl
cwde
jmp 0x1404dd457
push r15
mov eax, 0x1470
call fcn.140448eb8
sub rsp, rax
mov rax, qword [0x1400b7288]
shrd r12w, r14w, 0xf0
bswap r10w
bt r15d, 0x2b
xor rax, rsp
mov qword [rsp + 0x1460], rax
movsxd r10, edx
or r14, r14
not edx
cwde
mov rbx, rcx
mov rax, r10
clc
rol rcx, cl
adc edx, r8d
mov r14d, r9d
sar rax, 6
stc
lea rcx, [0x1400ba940]
bt rdx, 0x12
and r10d, 0x3f
sbb di, r11w
rol rdi, cl
lea r14, [r14 + r8]
shl r15d, cl
mov r15, r8
movzx edi, r9w
cqo
mov rdi, r8
mov rax, qword [rcx + rax*8]
movzx rdx, r10w
bsr dx, cx
lea rdx, [r10 + r10*8]
mov r12, qword [rax + rdx*8 + 0x28]
sub eax, eax
test dh, 0xd8
jmp 0x1404dd4f2
mov qword [rbx], rax
test r12b, dl
cmp r8, r14
jmp 0x1404dd500
mov dword [rbx + 8], eax
jmp 0x1404dd508
jae 0x1404dd68b
lea rax, [rsp + 0x50]
stc
cmp rdi, r14
jmp 0x1404dd51c
jae 0x1404dd577
movzx ecx, word [rdi]
cmp dil, 0x1c
add rdi, 2
cmp dil, r9b
cmc
cmp cx, 0xa
jmp 0x1404dd53a
jne 0x1404dd552
mov edx, 0xd
mov word [rax], dx
clc
cmc
add rax, 2
clc
test rdi, r11
mov word [rax], cx
add rax, 2
lea rcx, [rsp + 0x6f8]
cmp r9, 0x73ea7d7d
cmc
cmp rax, rcx
jmp 0x1404dd571
jb 0x1404dd514
and qword [rsp + 0x38], 0
rcr r9b, cl
rol r8, 0x61
movsx r8w, r13b
lea rcx, [rsp + 0x50]
and qword [rsp + 0x30], 0
not r8b
movsx r8w, r11b
lea r8, [rsp + 0x50]
btr r9w, 0x6f
jmp 0x1404dd5ac
sub rax, rcx
mov dword [rsp + 0x28], 0xd55
lea rcx, [rsp + 0x700]
rcl r9d, 0x5a
sar rax, 1
mov qword [rsp + 0x20], rcx
mov r9d, eax
rcl ch, cl
mov ecx, 0xfde9
jmp 0x1404dd5de
xor edx, edx
jmp 0x1404dd5e5
call fcn.1404ca295
mov ebp, eax
test eax, eax
je 0x1404dd683
xor esi, esi
stc
jmp 0x1404dd5fc
test eax, eax
jmp 0x1404dd603
je 0x1404dd666
and qword [rsp + 0x20], 0
lea rdx, [rsp + 0x700]
cmovg r9w, di
mov r8w, 0x5222
mov ecx, esi
lea r9, [rsp + 0x40]
mov r8d, ebp
lea rdx, [rdx + rcx]
add cl, r8b
sar ch, cl
rcl ch, 0
mov rcx, r12
sub r8d, esi
jmp 0x1404dd642
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jmp 0x1404dd64f
je 0x1404dd683
add esi, dword [rsp + 0x40]
cmp esi, ebp
jmp 0x1404dd660
jb 0x1404dd609
mov eax, edi
test rbx, 0x322f4da8
sub eax, r15d
cmc
mov dword [rbx + 4], eax
jmp 0x1404dd67b
cmp rdi, r14
jmp 0x1404dd508
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx], eax
mov rax, rbx
btr cx, r9w
btc cx, cx
bts cx, sp
mov rcx, qword [rsp + 0x1460]
xor rcx, rsp
jmp 0x1404dd6ab
call fcn.1404a07bb
lea r11, [rsp + 0x1470]
bswap r15
mov rbx, qword [r11 + 0x30]
movzx rsi, ax
mov rbp, qword [r11 + 0x40]
mov rsp, r11
mov r12, rsi
xchg di, r12w
cmovno r14, rbp
pop r15
movsx r14d, r9w
jmp 0x1404dd6e5
pop r14
movsxd rsi, r14d
pop r12
bswap di
pop rdi
not sil
xchg esi, esi
pop rsi
jmp 0x1404dd6fb
ret
Function at 0x1404e0b94
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
and r9b, r9b
neg bl
rcl r8w, 0x7c
sub rsp, 0x20
shr bh, 0x2b
cwd
test dx, cx
mov rbx, rcx
lea r9, [0x1400c8e90]
adc rdx, rcx
sub ecx, ecx
lea r8, [0x1400c8e88]
lea rdx, [0x1400cfb70]
call fcn.1404e0e61
test rax, rax
jmp 0x1404e0bd6
je 0x1404e0bf0
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x1404e0be9
jmp qword [0x1400b8d90]
add rsp, 0x20
bswap bx
movzx ebx, r12w
not bx
pop rbx
jmp 0x1404e0c04
jmp qword [sym.imp.KERNEL32.dll_TlsAlloc]

Function at 0x1404e0d17
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
sbb bl, bpl
xor r8d, eax
push rdi
xchg r9w, bx
bsf bx, r11w
xor ebx, r8d
sub rsp, 0x20
sete bl
mov rbx, rdx
cwd
lea r9, [0x1400c8ea8]
bswap r8w
mov edi, ecx
jmp 0x1404e0d4d
lea rdx, [0x1400cf748]
mov ecx, 3
bswap r8d
movsx r8, r13w
lea r8, [0x1400c8ea0]
jmp 0x1404e0d6c
call fcn.1404e0e61
mov rdx, rbx
not cl
movsx ecx, dx
mov ecx, edi
cmp r15b, r13b
test rax, rax
jmp 0x1404e0d86
je 0x1404e0d97
call qword [0x1400b8d90]
jmp 0x1404e0d9d
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
rcr dil, cl
add rsp, 0x20
movzx edi, r14w
pop rdi
ret
Function at 0x1404e7a42
Capabilities:
Encode data using base64

Disassembly:
jmp fcn.1404e2349
push rbx
sub rsp, 0x20
ror bl, cl
inc r9b
btc bx, r14w
test r8, r8
lahf
xchg bx, bx
movzx r9d, dx
movsx dx, bpl
cdqe
movzx rbx, bp
lea rbx, [0x1400bae30]
cwd
mov edx, 0x2400
lahf
cwde
nop
cmovne rbx, r8
ror ax, cl
mov eax, 0x3ff
add edx, r9d
cmp rdi, rcx
clc
cmp dword [rbx], 0
jmp 0x1404e7a95
jne 0x1404e7b39
cmp dx, ax
jmp 0x1404e7aa3
ja 0x1404e7ace
and qword [rbx], 0
call fcn.1404b60e7
mov dword [rax], 0x2a
cmp dil, 0x50
cmp si, r12w
or rax, 0xffffffffffffffff
jmp 0x1404e7ac9
jmp 0x1404e7b7e
mov r8d, 0x2800
mov edx, r9d
test r15d, r13d
cmp ax, 0x63f0
add r9w, r8w
cmp bpl, 0x8c
cmp r9w, ax
ja 0x1404e7b1d
shl edx, 0xa
and edx, 0xfc9ffc00
jmp 0x1404e7b01
add edx, 0x10000
cmc
cmp cx, r9w
mov dword [rbx], edx
test bpl, sil
sub eax, eax
jmp 0x1404e7b18
jmp 0x1404e7b7e
mov r8, rbx
mov bh, 0xa5
xor bl, cl
btr rbx, 0x34
add rsp, 0x20
pop rbx
jmp 0x1404e7b34
jmp 0x140268719
cmp dx, ax
jmp 0x1404e7b41
ja 0x1404e7aa9
and qword [rsp + 0x40], 0
lea r8, [rsp + 0x40]
shr dh, cl
cmovl dx, si
mov edx, r9d
cmc
cmp al, r10b
and edx, 0xffff23ff
test r15b, 0x1d
stc
add edx, dword [rbx]
jmp 0x1404e7b71
call 0x140268719
and qword [rbx], 0
movzx bx, dh
add rsp, 0x20
movsx bx, r10b
xchg rbx, rbx
pop rbx
jmp 0x1404e7b90
ret
Function at 0x1400067d4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000681e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000681e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000681e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000681e
cmp dword [rcx + 0x84], 0xe
jbe 0x14000681e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140006820
xor al, al
add rsp, 0x28
ret
Function at 0x140009e60
Capabilities:
Hash data using crc32b

Disassembly:
xor r9d, r9d
lea r10, [0x140122090]
nop word [rax + rax]
xor eax, eax
test r9b, 1
je 0x140009e7c
bts eax, 7
mov ecx, r9d
shr ecx, 1
test cl, 1
je 0x140009e8a
bts eax, 6
shr ecx, 1
test cl, 1
je 0x140009e95
bts eax, 5
shr ecx, 1
test cl, 1
je 0x140009ea0
bts eax, 4
shr ecx, 1
test cl, 1
je 0x140009eab
bts eax, 3
shr ecx, 1
test cl, 1
je 0x140009eb6
bts eax, 2
shr ecx, 1
test cl, 1
je 0x140009ec1
bts eax, 1
test cl, 2
je 0x140009eca
bts eax, 0
shl eax, 0x18
lea ecx, [rax + rax]
mov edx, ecx
xor edx, 0x4c11db7
test eax, eax
cmovns edx, ecx
lea eax, [rdx + rdx]
mov ecx, eax
xor ecx, 0x4c11db7
test edx, edx
cmovns ecx, eax
lea eax, [rcx + rcx]
mov edx, eax
xor edx, 0x4c11db7
test ecx, ecx
cmovns edx, eax
lea eax, [rdx + rdx]
mov ecx, eax
xor ecx, 0x4c11db7
test edx, edx
cmovns ecx, eax
lea eax, [rcx + rcx]
mov edx, eax
xor edx, 0x4c11db7
test ecx, ecx
cmovns edx, eax
lea eax, [rdx + rdx]
mov ecx, eax
xor ecx, 0x4c11db7
test edx, edx
cmovns ecx, eax
lea eax, [rcx + rcx]
mov edx, eax
xor edx, 0x4c11db7
test ecx, ecx
cmovns edx, eax
lea eax, [rdx + rdx]
mov r8d, eax
xor r8d, 0x4c11db7
test edx, edx
cmovns r8d, eax
xor ecx, ecx
lea edx, [rcx + 0x1e]
test r8b, 1
je 0x140009f61
lea eax, [rdx + 1]
bts ecx, eax
sar r8d, 1
test r8b, 1
je 0x140009f6d
bts ecx, edx
sar r8d, 1
sub edx, 2
cmp edx, 0xfffffffe
jg 0x140009f55
mov dword [r10], ecx
inc r9d
add r10, 4
cmp r9d, 0x100
jl 0x140009e70
mov dword [0x140122080], 1
ret
Function at 0x14000cd90
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp dword [r8 + 0x38], 1
mov rdi, r9
mov rbx, r8
mov r14, rdx
mov rbp, rcx
je 0x14000cdbf
xor eax, eax
jmp 0x14000cf77
mov ecx, dword [r9 + 0x10]
mov qword [rsp + 0x30], rsi
call qword [sym.imp.WS2_32.dll_ntohl]
mov esi, eax
lea rax, [rsi - 1]
cmp rax, 0xfe
ja 0x14000cf38
mov ecx, dword [rdi + 0x1c]
call qword [sym.imp.WS2_32.dll_ntohl]
cmp eax, dword [rbx + 0xa4]
jne 0x14000cf38
mov ecx, dword [rdi + 0x20]
call qword [sym.imp.WS2_32.dll_ntohl]
cmp eax, dword [rbx + 0x9c]
jne 0x14000cf38
mov ecx, dword [rdi + 0x24]
call qword [sym.imp.WS2_32.dll_ntohl]
cmp eax, dword [rbx + 0xa0]
jne 0x14000cf38
mov eax, dword [rbx + 0x1c]
cmp dword [rdi + 0x28], eax
jne 0x14000cf38
mov edx, 1
mov r8b, 0xff
mov rcx, rbx
call fcn.14000cf90
cmp rsi, qword [rbx + 0x48]
jae 0x14000ce45
mov qword [rbx + 0x48], rsi
movzx ecx, word [rdi + 4]
call qword [sym.imp.WS2_32.dll_ntohs]
mov word [rbx + 0x18], ax
movzx eax, byte [rdi + 6]
mov byte [rbx + 0x21], al
movzx eax, byte [rdi + 7]
mov byte [rbx + 0x20], al
mov ecx, dword [rdi + 8]
call qword [sym.imp.WS2_32.dll_ntohl]
mov ecx, 0x240
mov esi, 0x1000
cmp eax, ecx
jb 0x14000ce7f
cmp eax, esi
mov ecx, eax
cmova ecx, esi
cmp ecx, dword [rbx + 0xd0]
jae 0x14000ce8d
mov dword [rbx + 0xd0], ecx
mov ecx, dword [rdi + 0xc]
call qword [sym.imp.WS2_32.dll_ntohl]
cmp eax, esi
jb 0x14000cea6
mov ecx, 0x10000
mov esi, eax
cmp eax, ecx
cmova esi, ecx
cmp esi, dword [rbx + 0xd4]
jae 0x14000ceb4
mov dword [rbx + 0xd4], esi
mov ecx, dword [rdi + 0x14]
call qword [sym.imp.WS2_32.dll_ntohl]
mov dword [rbx + 0x50], eax
mov ecx, dword [rdi + 0x18]
call qword [sym.imp.WS2_32.dll_ntohl]
mov dword [rbx + 0x54], eax
mov rcx, rbx
mov dword [rbp + 0x24], 1
test r14, r14
je 0x14000cf00
call fcn.14000a4d0
mov dword [rbx + 0x38], 5
mov dword [r14], 1
mov qword [r14 + 8], rbx
mov eax, dword [rbx + 0x1c8]
mov dword [r14 + 0x14], eax
xor eax, eax
jmp 0x14000cf72
xor edi, edi
cmp dword [rbx + 0x38], 1
sete dil
add edi, 3
call fcn.14000a500
cmp dword [rbx + 0x140], 0
mov dword [rbx + 0x38], edi
jne 0x14000cf34
lea rcx, [rbp + 0x48]
mov rdx, rbx
call fcn.140009c80
mov dword [rbx + 0x140], 1
xor eax, eax
jmp 0x14000cf72
xor edi, edi
mov rcx, rbx
mov dword [rbx + 0x1c8], edi
call fcn.14000a500
mov dword [rbx + 0x38], 9
cmp dword [rbx + 0x140], edi
jne 0x14000cf6d
lea rcx, [rbp + 0x48]
mov rdx, rbx
call fcn.140009c80
mov dword [rbx + 0x140], 1
mov eax, 0xffffffff
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x14000de70
Capabilities:
Resolve dns

Disassembly:
push rbx
push r14
sub rsp, 0x58
mov rax, qword [0x14011e640]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov r14, rcx
mov rbx, rdx
mov rcx, rdx
call qword [sym.imp.WS2_32.dll_gethostbyname]
test rax, rax
je 0x14000deb5
cmp word [rax + 0x10], 2
jne 0x14000deb5
mov rax, qword [rax + 0x18]
mov rcx, qword [rax]
mov eax, dword [rcx]
mov dword [r14], eax
xor eax, eax
jmp 0x14000df69
mov qword [rsp + 0x80], rbp
mov qword [rsp + 0x50], rsi
xor esi, esi
mov qword [rsp + 0x48], rdi
mov ebp, esi
mov qword [rsp + 0x40], r15
mov edi, esi
mov dword [rsp + 0x28], 0
lea r15d, [rsi + 0x2e]
nop
lea rdx, [rbx + 1]
mov qword [rsp + 0x20], rdx
cmp byte [rbx], 0x30
je 0x14000df23
mov r8d, 0xa
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtol]
cmp eax, 0xff
ja 0x14000df4b
mov rdx, qword [rsp + 0x20]
cmp rdx, rbx
je 0x14000df4b
mov rcx, rdx
sub rcx, rbx
cmp rcx, 3
jg 0x14000df4b
mov byte [rsp + rdi + 0x28], al
movsx eax, byte [rdx]
cmp ebp, 3
mov ecx, esi
cmovl ecx, r15d
cmp eax, ecx
jne 0x14000df4b
inc ebp
lea rbx, [rdx + 1]
inc rdi
cmp rdi, 4
jl 0x14000dee0
mov eax, dword [rsp + 0x28]
mov dword [r14], eax
jmp 0x14000df50
mov esi, 0xffffffff
mov r15, qword [rsp + 0x40]
mov eax, esi
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400d7e10
add rsp, 0x58
pop r14
pop rbx
ret

Function at 0x14000df90
Capabilities:
Initialize winsock library

Disassembly:
sub rsp, 0x1d8
mov rax, qword [0x14011e640]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov ecx, 0x101
lea rdx, [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x14000dff9
movzx eax, word [rsp + 0x20]
cmp al, 1
jne 0x14000dff3
shr ax, 8
cmp al, 1
jne 0x14000dff3
mov ecx, 1
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
xor eax, eax
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.1400d7e10
add rsp, 0x1d8
ret
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.1400d7e10
add rsp, 0x1d8
ret

Function at 0x14000e0f0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x14011e640]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rdx
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
lea rdx, [rsp + 0x28]
lea r8, [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
jne 0x14000e138
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400d7e10
add rsp, 0x40
pop rbx
ret
mov eax, dword [rsp + 0x2c]
movzx ecx, word [rsp + 0x2a]
mov dword [rbx], eax
call qword [sym.imp.WS2_32.dll_ntohs]
mov word [rbx + 4], ax
xor eax, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400d7e10
add rsp, 0x40
pop rbx
ret
Function at 0x14000e170
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
sub rsp, 0x80
mov rax, qword [0x14011e640]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov r11, r9
mov dword [rsp + 0x54], reloc.WS2_32.dll_recv
mov rbx, rdx
lea r9, [rsp + 0x54]
xor edx, edx
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rdx
mov r10, r8
mov qword [rsp + 0x38], rdx
test rbx, rbx
mov dword [rsp + 0x50], edx
mov r8d, r11d
cmove r9, rdx
cmove rax, rdx
mov qword [rsp + 0x30], r9
mov rdx, r10
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x58]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_WSARecvFrom]
cmp eax, 0xffffffff
jne 0x14000e1fe
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
sub eax, 0x2733
je 0x14000e1fa
cmp eax, 0x13
jne 0x14000e208
xor eax, eax
jmp 0x14000e22d
test dword [rsp + 0x50], 0x8000
je 0x14000e20f
mov eax, 0xffffffff
jmp 0x14000e22d
test rbx, rbx
je 0x14000e229
mov eax, dword [rsp + 0x64]
movzx ecx, word [rsp + 0x62]
mov dword [rbx], eax
call qword [sym.imp.WS2_32.dll_ntohs]
mov word [rbx + 4], ax
mov eax, dword [rsp + 0x58]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1400d7e10
add rsp, 0x80
pop rbx
ret

Function at 0x14000e250
Capabilities:
Send data
Send data on socket

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x70
mov rax, qword [0x14011e640]
xor rax, rsp
mov qword [rsp + 0x68], rax
xor r14d, r14d
mov rbp, r9
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
test rdx, rdx
je 0x14000e2a2
movzx ecx, word [rdx + 4]
mov eax, 2
mov word [rsp + 0x58], ax
mov qword [rsp + 0x60], r14
call qword [sym.imp.WS2_32.dll_htons]
mov word [rsp + 0x5a], ax
mov eax, dword [rbx]
mov dword [rsp + 0x5c], eax
mov qword [rsp + 0x40], r14
mov rax, rbx
neg rax
mov qword [rsp + 0x38], r14
lea rax, [rsp + 0x58]
mov r8d, ebp
sbb r9d, r9d
mov rdx, rsi
and r9d, 0x10
mov rcx, rdi
mov dword [rsp + 0x30], r9d
test rbx, rbx
lea r9, [rsp + 0x50]
cmove rax, r14
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r14d
call qword [sym.imp.WS2_32.dll_WSASendTo]
cmp eax, 0xffffffff
jne 0x14000e2fe
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
sub eax, 0x2733
neg eax
sbb eax, eax
jmp 0x14000e302
mov eax, dword [rsp + 0x50]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1400d7e10
add rsp, 0x70
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret