joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42acc0
Capabilities:
Write file on windows

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov r15, rdx
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
mov edx, 0xc0000000
xor r8d, r8d
xor r9d, r9d
call sub.KERNEL32_CreateFileA
mov rdi, rax
test rdi, rdi
je 0x42adaa
lea rcx, [rbp - 8]
call sub.KERNEL32_GetLocalTime
movzx r8d, word [rbp - 6]
movzx r9d, word [rbp - 2]
movzx eax, word [rbp - 8]
movzx ecx, word [rbp]
movzx edx, word [rbp + 2]
movzx ebx, word [rbp + 4]
movzx esi, word [rbp + 6]
mov dword [rsp + 0x40], esi
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], edx
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], eax
lea rbx, [0x004482a0]
lea rdx, [0x00435a00]
mov rcx, rbx
call sub.USER32_wsprintfA
mov rcx, rbx
call fcn.0041b6a0
mov qword [rsp + 0x20], 0
lea r14, [rbp - 8]
mov rcx, rdi
mov rdx, rbx
mov r8d, eax
mov r9, r14
call sub.KERNEL32_WriteFile
mov rcx, r15
call fcn.0041b6a0
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov rdx, r15
mov r8d, eax
mov r9, r14
call sub.KERNEL32_WriteFile
mov rcx, rdi
call sub.KERNEL32_CloseHandle
nop
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret

Function at 0x42ae00
Capabilities:
Write file on windows

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0xc0
lea rbp, [rsp + 0x80]
mov rsi, rcx
mov rcx, qword [0x004482c8]
test rcx, rcx
mov rax, qword [0x004482c0]
jne 0x42aed5
test rax, rax
jne 0x42aed5
cmp dword [0x00444800], 0
je 0x42af1f
lea rdi, [rbp - 0x50]
xor ecx, ecx
mov r8d, 0x80
mov rdx, rdi
call sub.KERNEL32_GetModuleFileNameA
mov edx, 0x5c
mov rcx, rdi
call fcn.0042ab00
test rax, rax
jne 0x42ae7d
mov edx, 0x3a
mov rcx, rdi
call fcn.0042ab00
test rax, rax
je 0x42ae83
inc rax
mov rdi, rax
mov dword [rbp + 0x3c], 0
call sub.KERNEL32_GetVersion
mov r9d, 0x12010
test eax, eax
jns 0x42aec3
call sub.KERNEL32_GetCurrentThreadId
lea rdx, [0x0042afe0]
lea r8, [rbp + 0x3c]
mov ecx, eax
call sub.USER32_EnumThreadWindows
cmp dword [rbp + 0x3c], 0
mov eax, 0x11010
mov r9d, 0x12010
cmove r9d, eax
xor ecx, ecx
mov rdx, rsi
mov r8, rdi
call fcn.004327a8
jmp 0x42af93
test rax, rax
je 0x42aeef
cmp eax, 0xffffffff
je 0x42af93
mov rcx, rsi
call rax
mov rcx, qword [0x004482c8]
test rcx, rcx
je 0x42af93
cmp ecx, 0xffffffff
je 0x42af93
cmp byte [rcx], 0
je 0x42af93
mov rdx, rsi
add rsp, 0xc0
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
jmp fcn.0042acc0
mov ecx, 0xfffffff4
call sub.KERNEL32_GetStdHandle
mov rdi, rax
mov qword [rsp + 0x20], 0
lea r14, [0x00435a30]
lea rbx, [rbp - 0x50]
mov r8d, 2
mov rcx, rdi
mov rdx, r14
mov r9, rbx
call sub.KERNEL32_WriteFile
mov rcx, rsi
call fcn.0041b6a0
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov rdx, rsi
mov r8d, eax
mov r9, rbx
call sub.KERNEL32_WriteFile
mov qword [rsp + 0x20], 0
mov r8d, 2
mov rcx, rdi
mov rdx, r14
mov r9, rbx
call sub.KERNEL32_WriteFile
nop
add rsp, 0xc0
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
Function at 0x42c620
Capabilities:
Query environment variable

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov rax, qword [0x00458338]
test rax, rax
je 0x42c669
mov rcx, qword [rax]
test rcx, rcx
je 0x42c6e0
add rax, 8
xor esi, esi
nop
cmp byte [rcx], 1
sbb esi, 0
inc esi
mov rcx, qword [rax]
add rax, 8
test rcx, rcx
jne 0x42c650
jmp 0x42c711
mov r14, qword [0x004583b0]
test r14, r14
jne 0x42c69c
call sub.KERNEL32_GetEnvironmentStrings
mov r14, rax
mov qword [0x004583b0], r14
test r14, r14
jne 0x42c69c
lea rcx, [0x00435ad0]
call fcn.0042afc0
mov r14, qword [0x004583b0]
mov rcx, r14
call fcn.0041b6a0
xor r15d, r15d
test eax, eax
je 0x42c6e4
xor edi, edi
xor esi, esi
mov rbx, r14
nop word cs:[rax + rax]
lea edi, [rax + rdi + 1]
inc esi
cdqe
lea rbx, [rbx + rax + 1]
mov rcx, rbx
call fcn.0041b6a0
test eax, eax
jne 0x42c6c0
inc edi
movsxd rbx, edi
jmp 0x42c6eb
xor esi, esi
jmp 0x42c711
mov ebx, 1
xor esi, esi
mov rcx, rbx
call fcn.004160d0
mov qword [0x00458330], rax
test rax, rax
je 0x42c7eb
mov rcx, rax
mov rdx, r14
mov r8, rbx
call fcn.0041ac90
lea eax, [rsi + 4]
mov dword [0x00458340], eax
add esi, 5
movsxd rcx, esi
mov edx, 8
call fcn.004160c0
mov rdi, rax
test rdi, rdi
je 0x42c782
mov r14, qword [0x00458338]
test r14, r14
je 0x42c787
mov rdx, qword [r14]
test rdx, rdx
je 0x42c7d6
lea rax, [r14 + 8]
xor ecx, ecx
cmp byte [rdx], 0
je 0x42c770
mov rdx, qword [rax - 8]
movsxd rbx, ecx
mov qword [rdi + rbx*8], rdx
jmp 0x42c772
dec ecx
inc ecx
mov rdx, qword [rax]
add rax, 8
test rdx, rdx
jne 0x42c750
jmp 0x42c7d1
xor r15d, r15d
jmp 0x42c7eb
mov rbx, qword [0x00458330]
mov rcx, rbx
call fcn.0041b6a0
test eax, eax
je 0x42c7de
movabs r15, 0x100000000
mov rsi, rdi
nop word [rax + rax]
mov qword [rsi], rbx
shl rax, 0x20
add rax, r15
sar rax, 0x20
add rbx, rax
mov rcx, rbx
call fcn.0041b6a0
add rsi, 8
test eax, eax
jne 0x42c7b0
test r14, r14
je 0x42c7de
mov rcx, r14
call fcn.004160e0
mov qword [0x00458338], rdi
mov r15d, 1
mov eax, r15d
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret

Function at 0x42d0e0
Capabilities:
Query environment variable

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov rbx, r9
mov edi, r8d
mov r14, rdx
mov rsi, rcx
mov dword [rbp - 0x10], 1
mov qword [rbp - 8], rsi
cmp edi, 1
jne 0x42d141
mov eax, dword [0x00458450]
lea ecx, [rax + 1]
mov dword [0x00458450], ecx
test eax, eax
jne 0x42d141
call sub.KERNEL32_GetEnvironmentStringsW
mov qword [0x004583b8], rax
mov rcx, qword [rsi + 0x88]
call fcn.0041cd40
lea rcx, [rbp - 0x10]
xor edx, edx
call fcn.0042cd70
mov rcx, qword [rsi + 0x30]
mov rdx, r14
mov r8d, edi
mov r9, rbx
call fcn.0042d000
mov esi, eax
test edi, edi
jne 0x42d193
dec dword [0x00458450]
jne 0x42d193
mov rcx, r14
call fcn.0042b6e0
lea rcx, [rbp - 0x10]
mov edx, 1
call fcn.0042cd70
mov rcx, qword [0x004583b8]
test rcx, rcx
je 0x42d193
call sub.KERNEL32_FreeEnvironmentStringsW
mov qword [0x004583b8], 0
mov eax, esi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
Function at 0x42d350
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rsi
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov ecx, dword [0x00458460]
call sub.KERNEL32_TlsGetValue
mov rsi, rax
test rsi, rsi
je 0x42d393
mov ecx, dword [0x00458460]
xor edx, edx
call sub.KERNEL32_TlsSetValue
call sub.KERNEL32_GetProcessHeap
xor edx, edx
mov rcx, rax
mov r8, rsi
add rsp, 0x28
pop rsi
pop rbp
jmp 0x432658
nop
add rsp, 0x28
pop rsi
pop rbp
ret
jmp qword [sym.imp.KERNEL32_HeapFree]

Function at 0x42d400
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov esi, ecx
cmp byte [0x004370a4], 0
je 0x42d462
mov ecx, dword [0x00458460]
call sub.KERNEL32_TlsGetValue
test rax, rax
jne 0x42d46e
call fcn.0042d250
mov edi, eax
test edi, edi
je 0x42d455
call sub.KERNEL32_GetProcessHeap
movsxd r8, edi
mov edx, 8
mov rcx, rax
call sub.KERNEL32_HeapAlloc
mov ecx, dword [0x00458460]
mov rdx, rax
call sub.KERNEL32_TlsSetValue
mov ecx, dword [0x00458460]
call sub.KERNEL32_TlsGetValue
jmp 0x42d46e
mov rax, qword gs:[0x58]
mov rax, qword [rax]
movsxd rcx, esi
add rcx, rax
mov rax, rcx
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
Function at 0x14008bcf0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14008bcfd
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14008bd0d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x14008bcf5
lea eax, [rcx + 1]
jmp 0x14008bd1b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x14008bd2e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x14008bd14
sub eax, 3
jb 0x14008bd4e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14008bd9d
sar eax, 1
movsxd rbp, eax
jb 0x14008bd84
jmp 0x14008bd5c
add ebx, ebx
jne 0x14008bd5a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x14008bd84
inc ecx
add ebx, ebx
jne 0x14008bd6a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x14008bd84
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14008bd7d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14008bd6c
add ecx, 2
jmp 0x14008bd89
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.14008bcb2
jmp 0x14008bcfd
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x28a00
mov dl, 0x11
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x14008bde9
cmp rsi, rcx
jae 0x14008bdf1
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x14008bdd0
cmp al, 0x8f
ja 0x14008bdd0
cmp byte [rsi - 2], 0xf
je 0x14008bdd6
sub al, 0xe8
cmp al, 1
ja 0x14008bdba
cmp rsi, rcx
jae 0x14008bdf1
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x14008bdc0
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x14008bdf1
lodsb al, byte [rsi]
jmp 0x14008bdd0
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x89000]
mov eax, dword [rdi]
or eax, eax
je 0x14008be4e
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0xc26cc]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x14008bdfe
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x14008be48
mov qword [rbx], rax
add rbx, 8
jmp 0x14008be1e
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x14008be88
cmp al, 0xef
ja 0x14008be7a
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x14008be5a
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x14008be69
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x237]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x14008bedc
sub rsp, 0xffffffffffffff80
jmp 0x14000a6a0
Function at 0x1400998e0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
cmp qword [rsp + 0x80], 0
jg 0x140099905
xor eax, eax
jmp 0x140099ac6
mov rax, qword [rsp + 0x70]
cmp qword [rax + 0x68], 0
je 0x14009992d
mov r8, qword [rsp + 0x80]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
call fcn.140099b00
jmp 0x140099ac6
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x70]
call fcn.1400933c0
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jbe 0x1400999ca
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x20]
call fcn.140088460
mov rax, qword [rax]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x70]
call fcn.140097280
mov r8, qword [rsp + 0x28]
mov rdx, rax
mov rcx, qword [rsp + 0x78]
call fcn.140089e80
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x78]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov edx, dword [rsp + 0x28]
mov rcx, qword [rsp + 0x70]
call fcn.1400971b0
nop
mov rax, qword [rsp + 0x70]
cmp qword [rax + 0x80], 0
je 0x140099ab6
mov rcx, qword [rsp + 0x70]
call fcn.140094240
mov qword [rsp + 0x58], 0xfff
cmp qword [rsp + 0x20], 0xfff
jbe 0x140099a6a
mov rax, qword [rsp + 0x70]
mov r9, qword [rax + 0x80]
mov r8d, 0xfff
mov edx, 1
mov rcx, qword [rsp + 0x78]
call fcn.140278710
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x78]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x30], 0xfff
je 0x140099a68
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
sub rcx, rax
mov rax, rcx
jmp 0x140099ac6
jmp 0x1400999f0
cmp qword [rsp + 0x20], 0
jbe 0x140099ab6
mov rax, qword [rsp + 0x70]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x20]
mov edx, 1
mov rcx, qword [rsp + 0x78]
call fcn.140278710
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
sub rcx, rax
mov rax, rcx
add rsp, 0x68
ret
Function at 0x1400a06e0
Capabilities:
Convert ip address from string

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x88
mov rax, qword [0x1404cfac0]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov r13, qword [rcx]
mov ebp, r8d
mov rsi, rcx
lea r8, [rsp + 0x20]
mov ebx, 2
xor r14d, r14d
mov ecx, ebx
mov r15, r9
mov r12, qword [r13 + 0x11b0]
mov rdi, rdx
mov dword [r9], r14d
call qword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
jle 0x1400a074c
mov r9d, ebp
lea rdx, [rsp + 0x20]
mov r8, rdi
mov ecx, ebx
call fcn.1400b67a0
jmp 0x1400a082a
mov ebx, reloc.WS2_32.dll_socket
lea r8, [rsp + 0x58]
mov ecx, ebx
mov rdx, rdi
call qword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
jle 0x1400a077c
mov r9d, ebp
lea rdx, [rsp + 0x58]
mov r8, rdi
mov ecx, ebx
call fcn.1400b67a0
jmp 0x1400a082a
mov ecx, dword [rsi + 0x440]
sub ecx, 1
je 0x1400a07a0
cmp ecx, 1
je 0x1400a078f
mov ebx, r14d
call fcn.1400a1210
test al, al
mov eax, 2
cmove ebx, eax
jmp 0x1400a07a5
mov ebx, 2
cmp dword [rsi + 0xbc], 3
lea r8, [0x1402ace38]
xorps xmm0, xmm0
lea rcx, [rsp + 0x68]
movups xmmword [rsp + 0x28], xmm0
setne r14b
mov dword [rsp + 0x2c], ebx
inc r14d
mov r9d, ebp
mov edx, ntohl
mov dword [rsp + 0x30], r14d
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
call fcn.1400b4640
lea rcx, [rsp + 0x58]
call fcn.1400a0570
lea r9, [rsp + 0x28]
mov r8d, ebp
mov rdx, rdi
mov rcx, rsi
movups xmm0, xmmword [rax]
movups xmmword [r12], xmm0
call fcn.1400a0e70
test al, al
je 0x1400a0819
mov dword [r15], 1
jmp 0x1400a0828
lea rdx, str.getaddrinfo___thread_failed_to_start_n
mov rcx, r13
call fcn.1400a7a40
xor eax, eax
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140270fb0
add rsp, 0x88
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
jmp 0x1400a06e0
Function at 0x1400aae10
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp byte [0x1404d1cc0], 0
mov esi, r8d
mov rdi, qword [rsp + 0x68]
je 0x1400aaebf
test rdi, rdi
je 0x1400aaebf
mov eax, dword [0x1404d1cc4]
test eax, eax
jne 0x1400aaeb7
mov r8d, dword [rsp + 0x60]
lea rsi, str.recv
mov r9, rsi
lea rcx, str.LIMIT__s:_d__s_reached_memlimit_n
mov rdx, rdi
call fcn.1400aab60
mov ecx, 2
call fcn.140277c94
mov r9d, dword [rsp + 0x60]
lea rdx, str.LIMIT__s:_d__s_reached_memlimit_n
mov rcx, rax
mov qword [rsp + 0x20], rsi
mov r8, rdi
call fcn.1400b4610
mov rcx, qword [0x1404d1cb8]
call fcn.140278448
call fcn.140287e70
mov dword [rax], ntohl
mov eax, 0xffffffff
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
dec eax
mov dword [0x1404d1cc4], eax
call qword [sym.imp.WS2_32.dll_recv]
mov ebx, eax
test rdi, rdi
je 0x1400aaee7
mov r8d, dword [rsp + 0x60]
lea rcx, str.RECV__s:_d_recv__lu____ld_n
mov r9d, esi
mov dword [rsp + 0x20], eax
mov rdx, rdi
call fcn.1400aab60
mov rsi, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x1400aaf60
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp byte [0x1404d1cc0], 0
mov esi, r8d
mov rdi, qword [rsp + 0x68]
je 0x1400ab00f
test rdi, rdi
je 0x1400ab00f
mov eax, dword [0x1404d1cc4]
test eax, eax
jne 0x1400ab007
mov r8d, dword [rsp + 0x60]
lea rsi, str.send
mov r9, rsi
lea rcx, str.LIMIT__s:_d__s_reached_memlimit_n
mov rdx, rdi
call fcn.1400aab60
mov ecx, 2
call fcn.140277c94
mov r9d, dword [rsp + 0x60]
lea rdx, str.LIMIT__s:_d__s_reached_memlimit_n
mov rcx, rax
mov qword [rsp + 0x20], rsi
mov r8, rdi
call fcn.1400b4610
mov rcx, qword [0x1404d1cb8]
call fcn.140278448
call fcn.140287e70
mov dword [rax], ntohl
mov eax, 0xffffffff
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
dec eax
mov dword [0x1404d1cc4], eax
call qword [sym.imp.WS2_32.dll_send]
mov ebx, eax
test rdi, rdi
je 0x1400ab037
mov r8d, dword [rsp + 0x60]
lea rcx, str.SEND__s:_d_send__lu____ld_n
mov r9d, esi
mov dword [rsp + 0x20], eax
mov rdx, rdi
call fcn.1400aab60
mov rsi, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x1400b69b0
Capabilities:
Convert ip address from string

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x88
mov rax, qword [0x1404cfac0]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov r13, qword [rcx]
mov ebp, r8d
mov rsi, rcx
lea r8, [rsp + 0x20]
mov ebx, 2
xor r14d, r14d
mov ecx, ebx
mov r15, r9
mov r12, qword [r13 + 0x11b0]
mov rdi, rdx
mov dword [r9], r14d
call qword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
jle 0x1400a074c
mov r9d, ebp
lea rdx, [rsp + 0x20]
mov r8, rdi
mov ecx, ebx
call fcn.1400b67a0
jmp 0x1400a082a
mov ebx, reloc.WS2_32.dll_socket
lea r8, [rsp + 0x58]
mov ecx, ebx
mov rdx, rdi
call qword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
jle 0x1400a077c
mov r9d, ebp
lea rdx, [rsp + 0x58]
mov r8, rdi
mov ecx, ebx
call fcn.1400b67a0
jmp 0x1400a082a
mov ecx, dword [rsi + 0x440]
sub ecx, 1
je 0x1400a07a0
cmp ecx, 1
je 0x1400a078f
mov ebx, r14d
call fcn.1400a1210
test al, al
mov eax, 2
cmove ebx, eax
jmp 0x1400a07a5
mov ebx, 2
cmp dword [rsi + 0xbc], 3
lea r8, [0x1402ace38]
xorps xmm0, xmm0
lea rcx, [rsp + 0x68]
movups xmmword [rsp + 0x28], xmm0
setne r14b
mov dword [rsp + 0x2c], ebx
inc r14d
mov r9d, ebp
mov edx, ntohl
mov dword [rsp + 0x30], r14d
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
call fcn.1400b4640
lea rcx, [rsp + 0x58]
call fcn.1400a0570
lea r9, [rsp + 0x28]
mov r8d, ebp
mov rdx, rdi
mov rcx, rsi
movups xmm0, xmmword [rax]
movups xmmword [r12], xmm0
call fcn.1400a0e70
test al, al
je 0x1400a0819
mov dword [r15], 1
jmp 0x1400a0828
lea rdx, str.getaddrinfo___thread_failed_to_start_n
mov rcx, r13
call fcn.1400a7a40
xor eax, eax
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140270fb0
add rsp, 0x88
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
jmp 0x1400a06e0
Function at 0x1400ba800
Capabilities:
Encode data using xor

Disassembly:
push r14
push r15
sub rsp, 0x1f8
mov rax, qword [0x1404cfac0]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
cmp byte [0x1404d1f80], 0
mov r14, rcx
jne 0x1400ba839
call fcn.1400f4070
test eax, eax
je 0x1400ba857
mov byte [0x1404d1f80], 1
xor eax, eax
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.140270fb0
add rsp, 0x1f8
pop r15
pop r14
ret
mov rcx, qword [r14 + 0xcf8]
test rcx, rcx
je 0x1400ba876
mov edx, 0x400
call fcn.1400f5110
call fcn.1400f4070
test eax, eax
jne 0x1400ba839
mov qword [rsp + 0x218], rbx
xor r15d, r15d
mov qword [rsp + 0x220], rbp
mov qword [rsp + 0x228], rsi
mov qword [rsp + 0x1f0], rdi
movaps xmmword [rsp + 0x1e0], xmm6
movaps xmmword [rsp + 0x1d0], xmm7
movsd xmm7, qword [0x1402b82b8]
nop dword [rax]
nop word [rax + rax]
mov rsi, r15
lea rbp, [rsp + 0x80]
nop dword [rax + rax]
lea rcx, [rsp + 0x30]
call fcn.1400a0570
mov ecx, 1
movups xmm6, xmmword [rax]
movups xmmword [rsp + 0x20], xmm6
call fcn.1400a7930
lea rcx, [rsp + 0x40]
lea rdi, [rsi + 3]
call fcn.1400a0570
lea rcx, [rsp + 0x50]
movsxd rbx, dword [rax + 8]
call fcn.1400a0570
mov rdx, rbx
lea rcx, [rdi - 2]
add rdx, qword [rax]
movq rax, xmm6
imul rdx, rdi
imul rcx, rax
shl rdx, 8
xor rdx, rcx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x20], rdx
call fcn.1400a0570
lea rcx, [rsp + 0x70]
mov rbx, rax
call fcn.1400a0570
mov ecx, dword [rbx + 8]
lea rbp, [rbp + 0x10]
add ecx, dword [rax]
lea eax, [rsi + 4]
imul ecx, eax
lea eax, [rsi + 2]
imul eax, dword [rsp + 0x28]
inc rsi
shl ecx, 0x10
xor ecx, eax
mov dword [rsp + 0x28], ecx
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rbp - 0x10], xmm0
cmp rsi, 4
jb 0x1400ba8d0
movaps xmm2, xmm7
lea rcx, [rsp + 0x80]
mov edx, 0x40
call fcn.1400f3da0
call fcn.1400f4070
test eax, eax
je 0x1400ba8c0
mov edx, 0x100
mov byte [rsp + 0xc0], r15b
lea rcx, [rsp + 0xc0]
call fcn.1400f4ea0
movaps xmm7, xmmword [rsp + 0x1d0]
movaps xmm6, xmmword [rsp + 0x1e0]
mov rdi, qword [rsp + 0x1f0]
mov rsi, qword [rsp + 0x228]
mov rbp, qword [rsp + 0x220]
mov rbx, qword [rsp + 0x218]
cmp byte [rsp + 0xc0], r15b
je 0x1400baa0d
mov edx, 0x400
lea rcx, [rsp + 0xc0]
call fcn.1400f5110
call fcn.1400f4070
test eax, eax
jne 0x1400ba839
lea rdx, str.libcurl_is_now_using_a_weak_random_seed__n
mov rcx, r14
call fcn.1400a7bc0
call fcn.1400f4070
test eax, eax
mov ecx, reloc.WLDAP32.dll_Ordinal_35
cmovne ecx, r15d
mov eax, ecx
jmp 0x1400ba83b
Function at 0x1400bf7e0
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x1038
call fcn.140270c50
sub rsp, rax
mov rax, qword [0x1404cfac0]
xor rax, rsp
mov qword [rsp + 0x1020], rax
call fcn.14028e0bc
mov byte [rsp + 0x20], 0
test rax, rax
je 0x1400bf857
mov r8d, 0x1000
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [rsp + 0x20], 0
je 0x1400bf857
lea r8, [0x1402b82c0]
mov edx, Ordinal_46
lea rcx, [rsp + 0x20]
call fcn.1400ab140
mov rcx, qword [rsp + 0x1020]
xor rcx, rsp
call fcn.140270fb0
add rsp, 0x1038
ret
xor eax, eax
mov rcx, qword [rsp + 0x1020]
xor rcx, rsp
call fcn.140270fb0
add rsp, 0x1038
ret

Function at 0x1400c5a40
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0xd0
mov rax, qword [0x1404cfac0]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rbp, qword [rcx + 0x260]
lea r8, [rsp + 0x30]
mov rsi, qword [rcx]
lea rdx, [rsp + 0x40]
mov rdi, rcx
mov dword [rsp + 0x30], 0x80
mov rcx, rbp
mov rbx, 0xffffffffffffffff
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x1400c5acb
lea rax, str.C:Users_riskuDownloads_vcpkg_master_buildtreescurl_srcurl_7_68_0_cd669cc759lib_ftp.c
mov dword [rsp + 0x30], 0x80
mov r9d, 0x123
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x30]
mov rcx, rbp
lea rdx, [rsp + 0x40]
call fcn.1400aa8f0
mov rbx, rax
mov rdx, rbp
mov rcx, rdi
call fcn.1400a8710
mov rcx, rsi
cmp rbx, 0xffffffffffffffff
jne 0x1400c5af0
lea rdx, str.Error_accept__ing_server_connect
call fcn.1400a7a40
lea eax, [rbx + 0x1f]
jmp 0x1400c5b69
lea rdx, str.Connection_accepted_from_server_n
call fcn.1400a7bc0
mov edx, 1
mov byte [rdi + 0x3f8], 0
mov rcx, rbx
mov qword [rdi + 0x260], rbx
call fcn.1400b3560
mov byte [rdi + 0x279], 1
cmp qword [rsi + 0x728], 0
je 0x1400c5b67
mov dl, 1
mov rcx, rsi
call fcn.14009ce10
mov rcx, qword [rsi + 0x730]
mov r8d, 1
mov rdx, rbx
call qword [rsi + 0x728]
xor edx, edx
mov rcx, rsi
mov ebx, eax
call fcn.14009ce10
test ebx, ebx
je 0x1400c5b67
mov rcx, rdi
call fcn.1400c6080
mov eax, Ordinal_46
jmp 0x1400c5b69
xor eax, eax
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.140270fb0
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x1400c6c40
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx]
mov rbx, rcx
add rcx, 0x798
cmp byte [rax + 0xe91], 0
jne 0x1400c6c65
cmp dword [rax + 0x9f0], 0
je 0x1400c6c91
mov r8, qword [rcx + 0x88]
test r8, r8
je 0x1400c6c91
lea rdx, str.MDTM__s
call fcn.1400de2e0
test eax, eax
jne 0x1400c6c9e
mov dword [rbx + 0x850], 0x12
add rsp, 0x20
pop rbx
ret
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.1400c7b10
add rsp, 0x20
pop rbx
ret