joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400c63f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140110040]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, rdx
mov rsi, rcx
mov qword [rbp - 0x18], rdx
xor edi, edi
mov dword [rbp - 0x50], 0x2a2b3235
mov dword [rbp - 0x4c], 0x3f382f
mov byte [rbp - 0x48], 1
mov ecx, edi
nop dword [rax]
lea eax, [rcx + 0x46]
xor byte [rbp + rcx - 0x50], al
inc rcx
cmp rcx, 7
jb 0x1400c6430
mov byte [rbp - 0x48], 0
lea r9, [rbp - 0x40]
lea r8, [rbp - 0x49]
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x38]
call fcn.14004e260
nop
cmp byte [rbx], 0
jne 0x1400c646b
mov byte [rbx], 1
call fcn.1400bb310
mov qword [rbx + 8], rax
cmp byte [rbx], 1
jne 0x1400c6482
lea rdx, [rbp - 0x38]
mov rcx, qword [rbx + 8]
call fcn.1400c0020
mov rcx, rax
jmp 0x1400c6486
mov rcx, qword [rbp - 0x18]
lea rax, [rcx + 8]
cmp byte [rcx], 4
cmovne rax, rdi
movzx eax, byte [rax]
mov byte [rsi + 0x210], al
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x1400c64d8
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c64d3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400c64d3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400ccc18
mov dword [rbp - 0x50], 0x3a3b222b
mov dword [rbp - 0x4c], 0x292c2b
mov byte [rbp - 0x48], 1
mov rcx, rdi
nop dword [rax]
lea eax, [rcx + 0x46]
xor byte [rbp + rcx - 0x50], al
inc rcx
cmp rcx, 7
jb 0x1400c64f0
mov byte [rbp - 0x48], 0
lea r9, [rbp - 0x40]
lea r8, [rbp - 0x49]
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x38]
call fcn.14004e260
nop
cmp byte [rbx], 0
jne 0x1400c652b
mov byte [rbx], 1
call fcn.1400bb310
mov qword [rbx + 8], rax
cmp byte [rbx], 1
jne 0x1400c653f
lea rdx, [rbp - 0x38]
mov rcx, qword [rbx + 8]
call fcn.1400c0020
jmp 0x1400c6543
mov rax, qword [rbp - 0x18]
cmp byte [rax], 3
jne 0x1400c654c
mov rdi, qword [rax + 8]
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x1400c6559
mov rdx, qword [rdi]
lea rcx, [rsi + 0x218]
mov r8, qword [rdi + 0x10]
call fcn.14004f370
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x1400c65a9
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c65a3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400c65a3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400ccc18
nop
lea rcx, [rbx + 8]
movzx edx, byte [rbx]
call fcn.1400c1d40
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400cd260
mov rbx, qword [rsp + 0xa0]
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400cbd20
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov r8d, dword [rcx + 0x28]
mov rdi, rdx
mov rbx, rcx
cmp r8d, 0x40
jae 0x1400cbed8
lea ecx, [r8*8]
mov qword [rsp + 0x30], rsi
add qword [rbx], rcx
mov byte [r8 + rbx + 0x2c], 0x80
mov eax, dword [rbx + 0x28]
inc eax
mov dword [rbx + 0x28], eax
cmp eax, 0x38
jbe 0x1400cbd98
cmp eax, 0x40
jae 0x1400cbd82
nop word [rax + rax]
mov byte [rax + rbx + 0x2c], 0
mov eax, dword [rbx + 0x28]
inc eax
mov dword [rbx + 0x28], eax
cmp eax, 0x40
jb 0x1400cbd70
lea rsi, [rbx + 0x2c]
mov rcx, rbx
mov rdx, rsi
call fcn.1400cc000
xor eax, eax
mov dword [rbx + 0x28], eax
jmp 0x1400cbda0
lea rsi, [rbx + 0x2c]
jae 0x1400cbdb2
nop
mov byte [rax + rbx + 0x2c], 0
mov eax, dword [rbx + 0x28]
inc eax
mov dword [rbx + 0x28], eax
cmp eax, 0x38
jb 0x1400cbda0
movzx eax, byte [rbx + 7]
mov rdx, rsi
mov byte [rbx + 0x64], al
mov rcx, rbx
movzx eax, byte [rbx + 6]
mov byte [rbx + 0x65], al
movzx eax, byte [rbx + 5]
mov byte [rbx + 0x66], al
movzx eax, byte [rbx + 4]
mov byte [rbx + 0x67], al
movzx eax, byte [rbx + 3]
mov byte [rbx + 0x68], al
movzx eax, byte [rbx + 2]
mov byte [rbx + 0x69], al
movzx eax, byte [rbx + 1]
mov byte [rbx + 0x6a], al
movzx eax, byte [rbx]
mov byte [rbx + 0x6b], al
call fcn.1400cc000
movzx eax, byte [rbx + 0xb]
mov byte [rdi], al
movzx eax, byte [rbx + 0xa]
mov byte [rdi + 1], al
movzx eax, byte [rbx + 9]
mov byte [rdi + 2], al
movzx eax, byte [rbx + 8]
mov byte [rdi + 3], al
movzx eax, byte [rbx + 0xf]
mov byte [rdi + 4], al
movzx eax, byte [rbx + 0xe]
mov byte [rdi + 5], al
movzx eax, byte [rbx + 0xd]
mov byte [rdi + 6], al
movzx eax, byte [rbx + 0xc]
mov byte [rdi + 7], al
movzx eax, byte [rbx + 0x13]
mov byte [rdi + 8], al
movzx eax, byte [rbx + 0x12]
mov byte [rdi + 9], al
movzx eax, byte [rbx + 0x11]
mov byte [rdi + 0xa], al
movzx eax, byte [rbx + 0x10]
mov byte [rdi + 0xb], al
movzx eax, byte [rbx + 0x17]
mov byte [rdi + 0xc], al
movzx eax, byte [rbx + 0x16]
mov byte [rdi + 0xd], al
movzx eax, byte [rbx + 0x15]
mov byte [rdi + 0xe], al
movzx eax, byte [rbx + 0x14]
mov byte [rdi + 0xf], al
movzx eax, byte [rbx + 0x1b]
mov byte [rdi + 0x10], al
movzx eax, byte [rbx + 0x1a]
mov byte [rdi + 0x11], al
movzx eax, byte [rbx + 0x19]
mov byte [rdi + 0x12], al
movzx eax, byte [rbx + 0x18]
mov byte [rdi + 0x13], al
movzx eax, byte [rbx + 0x1f]
mov byte [rdi + 0x14], al
movzx eax, byte [rbx + 0x1e]
mov byte [rdi + 0x15], al
movzx eax, byte [rbx + 0x1d]
mov byte [rdi + 0x16], al
movzx eax, byte [rbx + 0x1c]
mov byte [rdi + 0x17], al
movzx eax, byte [rbx + 0x23]
mov byte [rdi + 0x18], al
movzx eax, byte [rbx + 0x22]
mov byte [rdi + 0x19], al
movzx eax, byte [rbx + 0x21]
mov byte [rdi + 0x1a], al
movzx eax, byte [rbx + 0x20]
mov byte [rdi + 0x1b], al
movzx eax, byte [rbx + 0x27]
mov byte [rdi + 0x1c], al
movzx eax, byte [rbx + 0x26]
mov byte [rdi + 0x1d], al
movzx eax, byte [rbx + 0x25]
mov byte [rdi + 0x1e], al
movzx eax, byte [rbx + 0x24]
mov rsi, qword [rsp + 0x30]
mov byte [rdi + 0x1f], al
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400cbef0
Capabilities:
Hash data using sha256

Disassembly:
xor eax, eax
mov qword [rcx + 0x24], 0x5be0cd19
mov qword [rcx], rax
mov dword [rcx + 8], 0x6a09e667
mov dword [rcx + 0xc], 0xbb67ae85
mov dword [rcx + 0x10], 0x3c6ef372
mov dword [rcx + 0x14], 0xa54ff53a
mov dword [rcx + 0x18], 0x510e527f
mov dword [rcx + 0x1c], 0x9b05688c
mov dword [rcx + 0x20], 0x1f83d9ab
ret
Function at 0x1400cd894
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400cd8de
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400cd8de
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400cd8de
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400cd8de
cmp dword [rcx + 0x84], 0xe
jbe 0x1400cd8de
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400cd8e0
xor al, al
add rsp, 0x28
ret
Function at 0x14004d394
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14004d1ff
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14004d1ff
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14004d1ff
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14004d1ff
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14004d1ff
cmp dword [rcx + 0x84], 0xe
jbe 0x14004d1ff
cmp dword [rcx + 0xf8], 0
je 0x14004d1ff
mov ecx, ebx
call fcn.14004d2b0
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14004d08c
nop
cmp dword [rbp + 0x20], 0
je 0x14004d24d
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14004d258
int3
xor r8d, r8d
xor edx, edx
jmp 0x14004d190
Function at 0x140057f64
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x140057f94
xor eax, eax
jmp 0x140058057
mov rbp, rbx
cmp word [rax], si
je 0x140057fb9
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x140057fa0
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x140057f9c
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.140056570
movsxd r14, eax
test eax, eax
jne 0x140057ff7
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x140057f8d
mov rcx, r14
call fcn.140052a2c
mov rdi, rax
test rax, rax
jne 0x140058010
xor ecx, ecx
call fcn.1400529f0
jmp 0x140057fec
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.140056570
test eax, eax
jne 0x140058041
mov rcx, rdi
call fcn.1400529f0
jmp 0x14005804b
xor ecx, ecx
call fcn.1400529f0
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x14005a510
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x14005a526
mov al, 1
jmp 0x14005a586
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x14005a537
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x14005a584
mov ecx, dword [rcx + 0x18]
nop
call fcn.1400584bc
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14005a584
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14005a584
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14005a584
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x14005a586
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x14005d660
Capabilities:
Accept command line arguments

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x70
xor ebx, ebx
mov dword [rsp + 0x90], ebx
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x90]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [rsp + 0xa8], rax
mov rdi, rax
test rax, rax
jne 0x14005d4f6
lea rax, [rbx - 1]
add rsp, 0x70
pop r15
pop rdi
pop rbx
ret
mov eax, dword [rsp + 0x90]
mov r15, 0xffffffffffffffff
inc eax
mov qword [rsp + 0x60], rsi
movsxd rcx, eax
mov eax, 8
mul rcx
mov qword [rsp + 0x48], r14
cmovo rax, r15
mov rcx, rax
call fcn.14005dc78
mov r14, rax
mov qword [rsp + 0xa0], rax
mov eax, dword [rsp + 0x90]
test eax, eax
je 0x14005d5ef
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x58], r12
mov r12, r14
mov qword [rsp + 0x50], r13
mov r13, rdi
sub r13, r14
mov r14d, ebx
nop dword [rax]
mov rbp, qword [r12 + r13]
mov r9d, r15d
mov qword [rsp + 0x38], rbx
mov r8, rbp
mov qword [rsp + 0x30], rbx
xor edx, edx
mov dword [rsp + 0x28], ebx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rdi, eax
mov rcx, rdi
call fcn.14005dc78
mov qword [rsp + 0x38], rbx
mov r9d, r15d
mov qword [rsp + 0x30], rbx
mov r8, rbp
mov dword [rsp + 0x28], edi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov qword [r12], rsi
lea r12, [r12 + 8]
mov eax, dword [rsp + 0x90]
inc r14d
cmp r14d, eax
jne 0x14005d560
mov r14, qword [rsp + 0xa0]
mov rdi, qword [rsp + 0xa8]
mov r13, qword [rsp + 0x50]
mov r12, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x68]
cdqe
mov rcx, rdi
mov qword [r14 + rax*8], rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [rsp + 0x90]
mov rdx, r14
call fcn.14001a4d0
mov esi, eax
cmp dword [rsp + 0x90], ebx
je 0x14005d63c
mov rdi, r14
nop dword [rax + rax]
mov rcx, qword [rdi]
test rcx, rcx
je 0x14005d63c
call fcn.14003a264
inc ebx
add rdi, 8
cmp ebx, dword [rsp + 0x90]
jne 0x14005d620
mov rcx, r14
call fcn.14003a264
mov r14, qword [rsp + 0x48]
mov eax, esi
mov rsi, qword [rsp + 0x60]
add rsp, 0x70
pop r15
pop rdi
pop rbx
ret
jmp 0x14005d4b0
Function at 0x140001cb8
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x280
xor edx, edx
mov dword [rsp + 0x40], 0x238
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rsp + 0x40]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140001d49
lea rdi, [0x14008bd10]
and qword [rsp + 0x38], 0
lea r8, [rsp + 0x6c]
and qword [rsp + 0x30], 0
or r9d, 0xffffffff
mov dword [rsp + 0x28], pe_nt_image_headers64
xor edx, edx
mov ecx, 0xfde9
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea rdx, [0x140062ae8]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
mov rcx, rbx
test eax, eax
je 0x140001d65
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140001cf4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rbx, qword [rsp + 0x290]
add rsp, 0x280
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x48]
jmp 0x140001d54
Function at 0x140008260
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
xor ebp, ebp
mov rsi, r9
mov r14, rdx
mov rdi, rcx
mov ebx, ebp
cmp rcx, 0xffffffffffffffff
je 0x140008358
test r8b, r8b
je 0x1400082c9
mov al, byte [rdx]
test al, 8
je 0x1400082c9
or al, 8
mov dword [rsp + 0x70], ebp
mov byte [rdx], al
lea r9, [rsp + 0x70]
mov edx, 0xffff
mov dword [rsp + 0x20], 4
mov r8d, 0x80
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
lea rcx, [rsp + 0x30]
setne dl
call fcn.1400081b4
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
test eax, eax
mov rcx, rsi
mov ebx, eax
setne dl
call fcn.1400081b4
test ebx, ebx
je 0x140008358
mov edx, 0x2733
lea rcx, [rsp + 0x30]
call fcn.1400239b0
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.140007340
test al, al
jne 0x140008325
mov edx, 0x4d5
lea rcx, [rsp + 0x30]
call fcn.1400239b0
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.140007340
test al, al
je 0x140008358
lea r8, [rsp + 0x70]
mov dword [rsp + 0x70], ebp
mov edx, 0x8004667e
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_ioctlsocket]
and byte [r14], 0xfc
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
test eax, eax
mov rcx, rsi
mov ebx, eax
setne dl
call fcn.1400081b4
lea r11, [rsp + 0x50]
mov eax, ebx
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret

Function at 0x140008370
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
cmp qword [rdx + 0x10], 1
mov rbx, rdx
mov rdi, rcx
je 0x14000838c
mov r8d, dword [rdx]
jmp 0x1400083c1
mov rcx, qword [rdx + 8]
movabs rax, 0x4800144005b3
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 0x14
imul rax, rax, 0x1ffff7
sub rcx, rax
imul r8d, ecx, 0x3e8
add r8d, dword [rbx]
sub r8d, 0x79
je 0x1400083f1
sub r8d, 0x450
je 0x1400083ea
sub r8d, 6
je 0x1400083e3
cmp r8d, 1
jne 0x1400083fe
mov edx, 0x2751
jmp 0x1400083f6
mov edx, 0x2743
jmp 0x1400083f6
mov edx, 0x274d
jmp 0x1400083f6
mov edx, 0x274c
mov rcx, rbx
call fcn.140023924
test byte [rbx + 0x10], 1
je 0x140008410
cmp qword [rbx + 0x10], 1
jne 0x14000844e
cmp dword [rbx], 0
jne 0x14000844e
cmp rdi, 0xffffffffffffffff
jne 0x140008425
mov edx, 0x2719
mov rcx, rbx
call fcn.140023924
jmp 0x14000844e
and dword [rsp + 0x20], 0
xor r9d, r9d
mov edx, 0xffff
mov r8d, 0x7010
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
mov rcx, rbx
setne dl
call fcn.1400081b4
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x14000884c
Capabilities:
Resolve dns

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x50
mov r14, r9
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
test rdx, rdx
je 0x14000887d
cmp byte [rdx], 0
jne 0x14000887f
xor edi, edi
test rbx, rbx
je 0x14000888a
cmp byte [r8], 0
jne 0x14000888c
xor ebx, ebx
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov r9, qword [rbp + 0x30]
mov r8, r14
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
je 0x1400089f4
sub eax, 8
je 0x1400089ed
sub eax, 0x271e
je 0x1400089dd
sub eax, 0x16
je 0x1400089d6
sub eax, 3
je 0x1400089cf
sub eax, 0x3e
je 0x140008970
sub eax, 0x37c
je 0x140008969
sub eax, 1
je 0x140008956
cmp eax, 1
je 0x14000894f
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
and dword [rbp - 0x2c], 0
lea rbx, [0x1400840e0]
movabs rdx, 0x4d54ee85da812030
mov edi, eax
add rdx, qword [0x1400840e8]
mov eax, 1
cmp rdx, rax
jbe 0x140008933
mov r8, qword [0x1400840e0]
mov edx, edi
mov rcx, rbx
call qword [r8 + 0x30]
jmp 0x140008938
test edi, edi
setne al
movzx eax, al
add rax, 2
mov dword [rbp - 0x30], edi
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x28], rbx
jmp 0x140008a00
mov edx, 0x2afb
jmp 0x14000895b
mov edx, 0x2afa
lea rcx, [rbp - 0x30]
call fcn.1400239b0
jmp 0x140008a00
mov edx, 0x2af9
jmp 0x14000895b
mov edi, 0x277d
mov rcx, qword [0x1400840e8]
lea rbx, [0x1400840e0]
and dword [rbp - 0x14], 0
movabs rdx, 0x4d54ee85da812030
add rcx, rdx
mov eax, 1
cmp rcx, rax
jbe 0x1400089ad
mov rax, qword [0x1400840e0]
mov edx, edi
mov rcx, rbx
call qword [rax + 0x30]
movzx eax, al
add rax, 2
mov dword [rbp - 0x18], edi
mov qword [rbp - 8], rax
movsd xmm1, qword [rbp - 8]
mov qword [rbp - 0x10], rbx
movups xmm0, xmmword [rbp - 0x18]
movsd qword [rbp - 0x20], xmm1
jmp 0x1400089fc
mov edx, 0x273f
jmp 0x1400089e2
mov edi, 0x273c
jmp 0x140008975
mov edx, 0x2726
lea rcx, [rbp - 0x30]
call fcn.1400239b0
jmp 0x140008a00
mov edx, reloc.WS2_32.dll_ntohl
jmp 0x1400089e2
and qword [rbp - 0x20], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
mov rax, qword [rbp + 0x38]
movups xmm1, xmmword [rbp - 0x30]
mov rbx, qword [rsp + 0x60]
movsd xmm0, qword [rbp - 0x20]
mov rdi, qword [rsp + 0x70]
mov r14, qword [rsp + 0x78]
movups xmmword [rax], xmm1
movups xmmword [rsi], xmm1
movsd qword [rax + 0x10], xmm0
mov rax, rsi
movsd qword [rsi + 0x10], xmm0
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret
Function at 0x140008ab0
Capabilities:
Terminate thread

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [rcx + 0x10]
lea rdx, [rsp + 0x20]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rax, qword [rcx + 8]
mov rbx, rcx
or r9d, 0xffffffff
mov qword [rsp + 0x28], rax
lea ecx, [r8 + 2]
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
lock xadd dword [0x14008bab0], eax
test eax, eax
je 0x140008b07
mov rcx, qword [rbx + 8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
jmp 0x140008b28
mov rdx, qword [rbx + 8]
lea rcx, [fcn.140008100]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_QueueUserAPC]
mov rcx, qword [rbx + 8]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
add rsp, 0x30
pop rbx
ret
Function at 0x14000a8d8
Capabilities:
Send data
Send data on socket

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rcx, qword [rcx + 8]
lea rax, [rbp + 0x10]
xor edx, edx
mov qword [rbp - 0x28], rax
mov qword [rsp + 0x30], rdx
lea r9, [rbp + 0x18]
mov qword [rsp + 0x28], rdx
xorps xmm0, xmm0
mov byte [rbp + 0x10], dl
lea r8d, [rdx + 1]
mov qword [rbp - 0x10], rdx
mov dword [rbp + 0x18], edx
mov dword [rsp + 0x20], edx
lea rdx, [rbp - 0x30]
mov dword [rbp - 0x30], 1
movups xmmword [rbp - 0x20], xmm0
call qword [sym.imp.WS2_32.dll_WSASend]
mov dl, 1
lea rcx, [rbp - 0x20]
call fcn.1400081b4
cmp qword [rbp - 0x10], 1
movabs r9, 0x4800144005b3
mov r8, qword [rbp - 0x18]
je 0x14000a94e
mov ecx, dword [rbp - 0x20]
mov eax, ecx
jmp 0x14000a97c
mov rax, r9
mov rcx, r8
mul r8
mov rax, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 0x14
imul rax, rax, 0x1ffff7
sub rcx, rax
imul eax, ecx, 0x3e8
mov ecx, dword [rbp - 0x20]
add eax, ecx
cmp eax, 0x40
jne 0x14000a988
mov edx, 0x2746
jmp 0x14000a9c5
cmp qword [rbp - 0x10], 1
jne 0x14000a9b8
mov rax, r9
mul r8
mov rax, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 0x14
imul rax, rax, 0x1ffff7
sub r8, rax
imul eax, r8d, 0x3e8
add ecx, eax
cmp ecx, 0x4d2
jne 0x14000a9ce
mov edx, 0x274d
lea rcx, [rbp - 0x20]
call fcn.140023924
add rsp, 0x70
pop rbp
ret
Function at 0x14000a9d4
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r15
lea rbp, [rsp - 0x380]
sub rsp, 0x480
and qword [rsp + 0x50], 0
lea rax, [rbp - 0x80]
xorps xmm0, xmm0
mov qword [rsp + 0x78], rax
movups xmmword [rsp + 0x40], xmm0
mov rdi, rcx
mov dword [rsp + 0x70], 0x400
movabs r15, 0x4800144005b3
and qword [rsp + 0x30], 0
lea rax, [rbp + 0x3a8]
and qword [rsp + 0x28], 0
lea r9, [rbp + 0x3a0]
mov rcx, qword [rdi]
lea rdx, [rsp + 0x70]
and dword [rbp + 0x3a0], 0
mov r8d, 1
and dword [rbp + 0x3a8], 0
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_WSARecv]
mov dl, 1
lea rcx, [rsp + 0x40]
mov ebx, eax
call fcn.1400081b4
mov r10, qword [rsp + 0x50]
mov r9, qword [rsp + 0x48]
mov r8d, dword [rsp + 0x40]
cmp r10, 1
je 0x14000aa81
mov eax, r8d
jmp 0x14000aaab
mov rax, r15
mov ecx, r9d
mul r9
mov rax, r9
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 0x14
imul eax, eax, 0x1ffff7
sub ecx, eax
imul eax, ecx, 0x3e8
add eax, r8d
cmp eax, 0x40
jne 0x14000aab7
mov edx, 0x2746
jmp 0x14000aaf8
cmp r10, 1
je 0x14000aac2
mov eax, r8d
jmp 0x14000aaec
mov rax, r15
mov ecx, r9d
mul r9
mov rax, r9
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 0x14
imul eax, eax, 0x1ffff7
sub ecx, eax
imul eax, ecx, 0x3e8
add eax, r8d
cmp eax, 0x4d2
jne 0x14000ab04
mov edx, 0x274d
lea rcx, [rsp + 0x40]
call fcn.140023924
jmp 0x14000ab78
cmp r10, 1
je 0x14000ab0f
mov eax, r8d
jmp 0x14000ab39
mov rax, r15
mov ecx, r9d
mul r9
mov rax, r9
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 0x14
imul eax, eax, 0x1ffff7
sub ecx, eax
imul eax, ecx, 0x3e8
add eax, r8d
cmp eax, 0x2738
je 0x14000ab7c
cmp r10, 1
jne 0x14000ab6f
mov rax, r15
mul r9
mov rax, r9
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 0x14
imul eax, eax, 0x1ffff7
sub r9d, eax
imul eax, r9d, 0x3e8
add r8d, eax
cmp r8d, 0xea
je 0x14000ab7c
test ebx, ebx
jne 0x14000abad
and qword [rsp + 0x68], 0
xorps xmm0, xmm0
mov eax, dword [rbp + 0x3a0]
movups xmmword [rsp + 0x40], xmm0
movsd xmm0, qword [rsp + 0x68]
movsd qword [rsp + 0x50], xmm0
cmp eax, 0x400
je 0x14000aa18
test eax, eax
jg 0x14000abf8
je 0x14000abf4
mov edx, 0x2733
lea rcx, [rsp + 0x58]
call fcn.1400239b0
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x40]
call fcn.140007340
test al, al
jne 0x14000abf8
mov edx, 0x4d5
lea rcx, [rsp + 0x58]
call fcn.1400239b0
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x40]
call fcn.140007340
test al, al
setne al
jmp 0x14000abfa
xor al, al
jmp 0x14000abfa
mov al, 1
mov rbx, qword [rsp + 0x4b0]
add rsp, 0x480
pop r15
pop rdi
pop rbp
ret