joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400d39b0
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
cmp dword [rax + 0x57e90], 0
jne 0x1400d39d1
mov eax, 1
jmp 0x1400d3ad3
mov rax, qword [rsp + 0x40]
mov dword [rax + 0x57e90], 0
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x20], 0
jmp 0x1400d39fd
mov eax, dword [rsp + 0x20]
add eax, 1
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0x3a98
jge 0x1400d3a22
movsxd rcx, dword [rsp + 0x20]
imul rcx, rcx, 0x30
mov rax, qword [rsp + 0x40]
mov dword [rax + rcx + 0x57e98], 0
jmp 0x1400d39f2
mov dword [rsp + 0x20], 0
jmp 0x1400d3a37
mov eax, dword [rsp + 0x20]
add eax, 1
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 0x57e94]
cmp dword [rsp + 0x20], eax
jge 0x1400d3aaa
movsxd rax, dword [rsp + 0x20]
mov edx, 0x7d0
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx + rax*8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0
je 0x1400d3a82
movsxd rax, dword [rsp + 0x20]
xor edx, edx
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx + rax*8]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx + rax*8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movsxd r11, dword [rsp + 0x20]
mov rax, qword [rsp + 0x40]
mov qword [rax + r11*8], 0
jmp 0x1400d3a2c
mov rcx, qword [rsp + 0x40]
add rcx, 0x1d4c0
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov rcx, qword [rsp + 0x40]
add rcx, 0x1d4e8
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov eax, 1
add rsp, 0x38
ret
Function at 0x1400d4030
Capabilities:
Create thread
Initialize winsock library

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x1f8
mov rax, qword [0x1402a25c0]
xor rax, rsp
mov qword [rsp + 0x1e8], rax
mov dword [rsp + 0x1e0], 0
lea rdx, [rsp + 0x40]
mov cx, 0x101
call qword [sym.imp.WS2_32.dll_WSAStartup]
mov rax, qword [rsp + 0x200]
cmp dword [rax + 0x57e90], 0
je 0x1400d4083
mov eax, 1
jmp 0x1400d420b
mov rax, qword [rsp + 0x200]
mov dword [rax + 0x57e90], 1
mov dword [rsp + 0x1e0], 0
jmp 0x1400d40b3
mov eax, dword [rsp + 0x1e0]
add eax, 1
mov dword [rsp + 0x1e0], eax
cmp dword [rsp + 0x1e0], 0x3a98
jge 0x1400d40e1
movsxd rcx, dword [rsp + 0x1e0]
imul rcx, rcx, 0x30
mov rax, qword [rsp + 0x200]
mov dword [rax + rcx + 0x57e98], 0
jmp 0x1400d40a2
mov rcx, qword [rsp + 0x200]
add rcx, 0x1d4c0
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov rcx, qword [rsp + 0x200]
add rcx, 0x1d4e8
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov r11, qword [rsp + 0x200]
mov dword [r11 + 0x57e94], 0xa
mov dword [rsp + 0x1e0], 0
jmp 0x1400d413c
mov eax, dword [rsp + 0x1e0]
add eax, 1
mov dword [rsp + 0x1e0], eax
mov rax, qword [rsp + 0x200]
mov eax, dword [rax + 0x57e94]
cmp dword [rsp + 0x1e0], eax
jge 0x1400d4206
mov dword [rsp + 0x1e4], 0
movsxd rdx, dword [rsp + 0x1e0]
imul rdx, rdx, 0x10
mov rcx, qword [rsp + 0x200]
mov rax, qword [rsp + 0x200]
mov qword [rcx + rdx + 0x1d510], rax
movsxd rdx, dword [rsp + 0x1e0]
imul rdx, rdx, 0x10
mov rcx, qword [rsp + 0x200]
mov eax, dword [rsp + 0x1e0]
mov dword [rcx + rdx + 0x1d518], eax
movsxd rcx, dword [rsp + 0x1e0]
imul rcx, rcx, 0x10
mov rax, qword [rsp + 0x200]
lea r9, [rax + rcx + 0x1d510]
lea rax, [rsp + 0x1e4]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
lea r8, [0x1400d3cc0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r11, rax
movsxd rcx, dword [rsp + 0x1e0]
mov rax, qword [rsp + 0x200]
mov qword [rax + rcx*8], r11
jmp 0x1400d412b
mov eax, 1
mov rcx, qword [rsp + 0x1e8]
xor rcx, rsp
call fcn.1400a8040
add rsp, 0x1f8
ret
Function at 0x1400d56b0
Capabilities:
Query service status
Start service

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov r8d, 0xf003f
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1400d56dd
xor al, al
jmp 0x1400d5793
mov r8d, reloc.OLEAUT32.dll_SafeArrayLock
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x1400d5732
mov r8d, 4
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x1400d5732
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor al, al
jmp 0x1400d5793
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x1400d576e
cmp dword [rsp + 0x34], 2
jne 0x1400d576a
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400d576c
jmp 0x1400d576e
jmp 0x1400d5742
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp dword [rsp + 0x34], 4
jne 0x1400d5791
mov al, 1
jmp 0x1400d5793
xor al, al
add rsp, 0x58
ret
Function at 0x1400d73b0
Capabilities:
Resolve dns

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_gethostbyname]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
cmp qword [rsp + 0x28], 0
je 0x1400d7418
movsxd rcx, dword [rsp + 0x20]
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 0x18]
cmp qword [rax + rcx*8], 0
je 0x1400d7418
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + rax*8]
mov eax, dword [rsp + 0x40]
cmp dword [rcx], eax
jne 0x1400d740b
mov eax, 1
jmp 0x1400d741a
mov eax, dword [rsp + 0x20]
add eax, 1
mov dword [rsp + 0x20], eax
jmp 0x1400d73cd
xor eax, eax
add rsp, 0x38
ret

Function at 0x1400d7430
Capabilities:
Acquire debug privileges

Disassembly:
push rdi
sub rsp, 0x50
mov dword [rsp + 0x40], 0
lea rdi, [rsp + 0x44]
xor eax, eax
mov ecx, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
rep stosb byte [rdi], al
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x30]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x1400d7470
xor eax, eax
jmp 0x1400d74fe
lea r8, [rsp + 0x38]
lea rdx, [0x140213c98]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x1400d7497
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1400d74fe
mov dword [rsp + 0x40], 1
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x44], rax
mov dword [rsp + 0x4c], 2
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, reloc.OLEAUT32.dll_SafeArrayGetDim
lea r8, [rsp + 0x40]
xor edx, edx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x1400d74ee
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1400d74fe
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
add rsp, 0x50
pop rdi
ret
Function at 0x1400d7510
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x478
mov eax, dword [rsp + 0x488]
mov dword [rsp + 0x240], eax
mov dword [rsp + 0x244], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x460], 0
jmp 0x1400d7560
mov eax, dword [rsp + 0x460]
add eax, 1
mov dword [rsp + 0x460], eax
mov eax, dword [rsp + 0x30]
cmp dword [rsp + 0x460], eax
jae 0x1400d7587
mov ecx, dword [rsp + 0x460]
mov rax, qword [rsp + 0x480]
cmp qword [rsp + rcx*8 + 0x38], rax
jne 0x1400d7585
jmp 0x1400d7587
jmp 0x1400d754f
mov eax, dword [rsp + 0x30]
cmp dword [rsp + 0x460], eax
jne 0x1400d75ba
cmp dword [rsp + 0x30], 0x40
jae 0x1400d75ba
mov ecx, dword [rsp + 0x460]
mov rax, qword [rsp + 0x480]
mov qword [rsp + rcx*8 + 0x38], rax
mov eax, dword [rsp + 0x30]
add eax, 1
mov dword [rsp + 0x30], eax
xor eax, eax
test eax, eax
jne 0x1400d7542
mov dword [rsp + 0x250], 0
mov dword [rsp + 0x464], 0
jmp 0x1400d75e9
mov eax, dword [rsp + 0x464]
add eax, 1
mov dword [rsp + 0x464], eax
mov eax, dword [rsp + 0x250]
cmp dword [rsp + 0x464], eax
jae 0x1400d7616
mov ecx, dword [rsp + 0x464]
mov rax, qword [rsp + 0x480]
cmp qword [rsp + rcx*8 + 0x258], rax
jne 0x1400d7614
jmp 0x1400d7616
jmp 0x1400d75d8
mov eax, dword [rsp + 0x250]
cmp dword [rsp + 0x464], eax
jne 0x1400d7658
cmp dword [rsp + 0x250], 0x40
jae 0x1400d7658
mov ecx, dword [rsp + 0x464]
mov rax, qword [rsp + 0x480]
mov qword [rsp + rcx*8 + 0x258], rax
mov eax, dword [rsp + 0x250]
add eax, 1
mov dword [rsp + 0x250], eax
xor eax, eax
test eax, eax
jne 0x1400d75cb
lea rax, [rsp + 0x240]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x250]
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov ecx, 0x40
call qword [sym.imp.WS2_32.dll_select]
test eax, eax
jne 0x1400d7694
xor eax, eax
jmp 0x1400d76d6
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x480]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x1400d76b1
mov eax, 1
jmp 0x1400d76d6
lea rdx, [rsp + 0x250]
mov rcx, qword [rsp + 0x480]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x1400d76d1
mov eax, 0xffffffff
jmp 0x1400d76d6
mov eax, 0xffffffff
add rsp, 0x478
ret
Function at 0x1400d7d20
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
cmp dword [rax + 0x220], 0
jne 0x1400d7d41
mov eax, 1
jmp 0x1400d7e63
mov rax, qword [rsp + 0x40]
mov dword [rax + 0x220], 0
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x208], 0xffffffffffffffff
je 0x1400d7d98
mov edx, 2
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx + 0x208]
call qword [sym.imp.WS2_32.dll_shutdown]
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx + 0x208]
call qword [sym.imp.WS2_32.dll_closesocket]
mov r11, qword [rsp + 0x40]
mov qword [r11 + 0x208], 0xffffffffffffffff
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x218], 0
je 0x1400d7e10
mov edx, 0x7d0
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx + 0x218]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x1400d7ddd
xor edx, edx
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx + 0x218]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x218], 0
je 0x1400d7e0e
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx + 0x218]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r11, qword [rsp + 0x40]
mov qword [r11 + 0x218], 0
jmp 0x1400d7e5e
mov dword [rsp + 0x24], 0
cmp dword [rsp + 0x24], 0x96
jge 0x1400d7e5e
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x40]
lea rcx, [0x1403ade90]
call fcn.14001de00
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
jne 0x1400d7e46
jmp 0x1400d7e5e
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [rsp + 0x24]
add eax, 1
mov dword [rsp + 0x24], eax
jmp 0x1400d7e18
mov eax, 1
add rsp, 0x38
ret
Function at 0x1400d80b0
Capabilities:
Check for time delay via gettickcount
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
cmp dword [rsp + 0x70], 8
jne 0x1400d81f3
mov rax, qword [rsp + 0x68]
mov eax, dword [rax]
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0
jg 0x1400d80ec
xor eax, eax
jmp 0x1400d82d0
mov dword [rsp + 0x2c], 0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x50]
cmp dword [rax + 0x220], 0
je 0x1400d81e9
cmp dword [0x1403ab4f8], 0
jle 0x1400d8148
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
sub ecx, dword [rsp + 0x28]
mov eax, dword [0x1403ab4f8]
imul eax, eax, 0x3e8
cmp ecx, eax
jle 0x1400d8148
mov rax, qword [rsp + 0x68]
mov qword [rax], 0xffffffffffffffff
xor eax, eax
jmp 0x1400d82d0
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
call fcn.1400d7e70
test eax, eax
jne 0x1400d815d
jmp 0x1400d80fe
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x68]
mov rax, qword [rax]
mov rdx, qword [rsp + 0x60]
add rdx, rax
movsxd rax, dword [rsp + 0x24]
sub rdx, rax
xor r9d, r9d
mov r8d, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.WS2_32.dll_recv]
mov dword [rsp + 0x2c], eax
mov eax, dword [rsp + 0x24]
cmp dword [rsp + 0x2c], eax
jne 0x1400d81a2
jmp 0x1400d81e9
cmp dword [rsp + 0x2c], 0
jne 0x1400d81bc
mov rax, qword [rsp + 0x68]
mov qword [rax], 0
xor eax, eax
jmp 0x1400d82d0
cmp dword [rsp + 0x2c], 0
jge 0x1400d81d6
mov rax, qword [rsp + 0x68]
mov qword [rax], 0xffffffffffffffff
xor eax, eax
jmp 0x1400d82d0
mov ecx, dword [rsp + 0x2c]
mov eax, dword [rsp + 0x24]
sub eax, ecx
mov dword [rsp + 0x24], eax
jmp 0x1400d80fe
mov eax, 1
jmp 0x1400d82d0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x50]
cmp dword [rax + 0x220], 0
je 0x1400d82ce
cmp dword [0x1403ab4f8], 0
jle 0x1400d8247
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
sub ecx, dword [rsp + 0x20]
mov eax, dword [0x1403ab4f8]
imul eax, eax, 0x3e8
cmp ecx, eax
jle 0x1400d8247
mov rax, qword [rsp + 0x68]
mov qword [rax], 0xffffffffffffffff
xor eax, eax
jmp 0x1400d82d0
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
call fcn.1400d7e70
test eax, eax
jne 0x1400d825c
jmp 0x1400d81fd
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0x70]
mov rax, qword [rsp + 0x68]
mov r8d, dword [rax]
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.WS2_32.dll_recv]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jne 0x1400d829e
mov rax, qword [rsp + 0x68]
mov qword [rax], 0
xor eax, eax
jmp 0x1400d82d0
cmp dword [rsp + 0x30], 0
jge 0x1400d82b5
mov rax, qword [rsp + 0x68]
mov qword [rax], 0xffffffffffffffff
xor eax, eax
jmp 0x1400d82d0
movsxd rcx, dword [rsp + 0x30]
mov rax, qword [rsp + 0x68]
mov qword [rax], rcx
mov eax, 1
jmp 0x1400d82d0
xor eax, eax
add rsp, 0x48
ret
Function at 0x1400d8990
Capabilities:
Get local ipv4 addresses
Get socket information
Send data
Send data on socket
Write file on windows

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
mov eax, 0x1080
call fcn.1401d5c30
sub rsp, rax
mov qword [rsp + 0x1068], 0xfffffffffffffffe
mov rax, qword [0x1402a25c0]
xor rax, rsp
mov qword [rsp + 0x1078], rax
xor r9d, r9d
mov r8d, dword [rsp + 0x10a8]
mov rdx, qword [rsp + 0x10a0]
mov rcx, qword [rsp + 0x1098]
call qword [sym.imp.WS2_32.dll_send]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jge 0x1400d8a03
xor eax, eax
jmp 0x1400d8be0
movsxd rax, dword [rsp + 0x20]
cmp rax, qword [rsp + 0x10a8]
je 0x1400d8a19
xor eax, eax
jmp 0x1400d8be0
cmp dword [0x1403ab4fc], 0
je 0x1400d8bdb
cmp qword [rsp + 0x10a8], 0
jbe 0x1400d8bdb
mov dword [rsp + 0x30], reloc.OLEAUT32.dll_SafeArrayGetDim
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x1098]
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x1400d8a63
mov eax, 1
jmp 0x1400d8be0
movzx eax, byte [rsp + 0x44]
cmp eax, 0x7f
jne 0x1400d8a77
mov eax, 1
jmp 0x1400d8be0
movzx eax, byte [0x14020f88e]
mov byte [rsp + 0x50], al
lea rdi, [rsp + 0x51]
xor eax, eax
mov ecx, 0x1000
rep stosb byte [rdi], al
lea rcx, [0x1403ad898]
call fcn.1400012c0
mov rdx, rax
lea rcx, [rsp + 0x1060]
call fcn.1400d8910
mov qword [rsp + 0x1070], rax
mov r8, qword [rsp + 0x1070]
mov r8, qword [r8]
lea rdx, str._slog.dat
lea rcx, [rsp + 0x50]
call fcn.1400acc54
lea rcx, [rsp + 0x1060]
call fcn.140001470
mov eax, dword [0x1404b5a38]
and eax, 1
test eax, eax
jne 0x1400d8b12
mov eax, dword [0x1404b5a38]
or eax, 1
mov dword [0x1404b5a38], eax
lea rcx, [0x1404b5a00]
call fcn.1400109a0
lea rcx, [0x1401fd0b0]
call fcn.1400a8c9c
nop
lea rcx, [0x1404b5a00]
call fcn.140010ae0
lea rdx, [0x1402139a4]
lea rcx, [rsp + 0x50]
call fcn.1400af95c
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x1400d8b52
lea rdx, [0x1402139a8]
lea rcx, [rsp + 0x50]
call fcn.1400af95c
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1400d8bcf
mov r8d, 2
xor edx, edx
mov rcx, qword [rsp + 0x28]
call fcn.1400ade50
mov rcx, qword [rsp + 0x28]
call fcn.1400ae0c4
cmp eax, 0x40000
jle 0x1400d8b9d
mov rcx, qword [rsp + 0x28]
call fcn.1400a9ff0
lea rdx, [0x1402139ac]
lea rcx, [rsp + 0x50]
call fcn.1400af95c
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1400d8bcf
mov r9, qword [rsp + 0x28]
mov r8d, 1
mov rdx, qword [rsp + 0x10a8]
mov rcx, qword [rsp + 0x10a0]
call fcn.1400ac434
mov rcx, qword [rsp + 0x28]
call fcn.1400a9ff0
lea rcx, [0x1404b5a00]
call fcn.140010ab0
mov eax, 1
mov rcx, qword [rsp + 0x1078]
xor rcx, rsp
call fcn.1400a8040
add rsp, 0x1080
pop rdi
ret
Function at 0x1400db3e0
Capabilities:
Resolve dns

Disassembly:
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x80
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov dword [rsp + 0x50], 0
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_gethostbyname]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
cmp qword [rsp + 0x28], 0
je 0x1400db52d
movsxd rcx, dword [rsp + 0x20]
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 0x18]
cmp qword [rax + rcx*8], 0
je 0x1400db52d
movsxd rcx, dword [rsp + 0x20]
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + rcx*8]
mov ecx, dword [rax]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x1400db51d
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_inet_addr]
mov ecx, eax
call qword [sym.imp.WS2_32.dll_ntohl]
mov ebx, eax
lea rcx, str.192.0.0.0
call qword [sym.imp.WS2_32.dll_inet_addr]
mov ecx, eax
call qword [sym.imp.WS2_32.dll_ntohl]
cmp ebx, eax
jb 0x1400db51d
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_inet_addr]
mov ecx, eax
call qword [sym.imp.WS2_32.dll_ntohl]
mov ebx, eax
lea rcx, str.223.255.255.255
call qword [sym.imp.WS2_32.dll_inet_addr]
mov ecx, eax
call qword [sym.imp.WS2_32.dll_ntohl]
cmp ebx, eax
ja 0x1400db51d
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.140010e20
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x68], rax
mov rcx, qword [rsp + 0x68]
call fcn.140010eb0
mov rdx, rax
mov rcx, qword [rsp + 0x90]
call fcn.140002090
mov eax, dword [rsp + 0x50]
or eax, 1
mov dword [rsp + 0x50], eax
lea rcx, [rsp + 0x40]
call fcn.140002e10
mov rax, qword [rsp + 0x90]
jmp 0x1400db5d4
mov eax, dword [rsp + 0x20]
add eax, 1
mov dword [rsp + 0x20], eax
jmp 0x1400db413
cmp qword [rsp + 0x28], 0
je 0x1400db5ad
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 0x18]
mov rax, qword [rax]
mov ecx, dword [rax]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x1400db5ad
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x48]
call fcn.140010e20
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x78], rax
mov rcx, qword [rsp + 0x78]
call fcn.140010eb0
mov rdx, rax
mov rcx, qword [rsp + 0x90]
call fcn.140002090
mov eax, dword [rsp + 0x50]
or eax, 1
mov dword [rsp + 0x50], eax
lea rcx, [rsp + 0x48]
call fcn.140002e10
mov rax, qword [rsp + 0x90]
jmp 0x1400db5d4
lea rdx, [0x140214d54]
mov rcx, qword [rsp + 0x90]
call fcn.140002090
mov eax, dword [rsp + 0x50]
or eax, 1
mov dword [rsp + 0x50], eax
mov rax, qword [rsp + 0x90]
add rsp, 0x80
pop rbx
ret
Function at 0x1400e3600
Capabilities:
Create tcp socket
Create thread
Create udp socket
Set socket configuration

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0xc8
mov qword [rsp + 0x98], 0xfffffffffffffffe
mov rax, qword [0x1402a25c0]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rax, qword [rsp + 0xd0]
cmp dword [rax + 0x220], 0
je 0x1400e3653
mov eax, 1
jmp 0x1400e38ac
cmp dword [rsp + 0xd8], 0
jne 0x1400e36e2
mov rax, qword [rsp + 0xd0]
mov dword [rax + 0x220], 1
lea rcx, [rsp + 0x50]
call fcn.14004f1a0
mov r11, qword [rsp + 0xd0]
mov qword [rsp + 0x70], r11
lea rdx, [rsp + 0x50]
lea rcx, [0x1403ade90]
call fcn.1400d3cf0
cmp eax, 0xffffffff
jne 0x1400e36c1
mov dword [rsp + 0x84], 0
lea rcx, [rsp + 0x50]
call fcn.14004f200
mov eax, dword [rsp + 0x84]
jmp 0x1400e38ac
mov dword [rsp + 0x88], 1
lea rcx, [rsp + 0x50]
call fcn.14004f200
mov eax, dword [rsp + 0x88]
jmp 0x1400e38ac
xor r8d, r8d
mov edx, 1
mov ecx, 2
call qword [sym.imp.WS2_32.dll_socket]
mov r11, rax
mov rax, qword [rsp + 0xd0]
mov qword [rax + 0x208], r11
cmp dword [rsp + 0xe8], 0
je 0x1400e374c
mov dword [rsp + 0x80], 1
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x80]
mov r8d, 4
mov edx, 0xffff
mov rcx, qword [rsp + 0xd0]
mov rcx, qword [rcx + 0x208]
call qword [sym.imp.WS2_32.dll_setsockopt]
mov eax, 2
mov word [rsp + 0x40], ax
mov rdx, qword [rsp + 0xe0]
lea rcx, [rsp + 0x90]
call fcn.140002d80
mov qword [rsp + 0xa0], rax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0xa8], rax
mov rcx, qword [rsp + 0xa8]
call fcn.140002e30
mov rcx, rax
call qword [sym.imp.WS2_32.dll_inet_addr]
mov dword [rsp + 0x44], eax
lea rcx, [rsp + 0x90]
call fcn.140002e10
movzx ecx, word [rsp + 0xd8]
call qword [sym.imp.WS2_32.dll_htons]
mov word [rsp + 0x42], ax
mov r8d, reloc.OLEAUT32.dll_SafeArrayGetDim
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0xd0]
mov rcx, qword [rcx + 0x208]
call qword [sym.imp.WS2_32.dll_bind]
test eax, eax
je 0x1400e382a
mov edx, 2
mov rcx, qword [rsp + 0xd0]
mov rcx, qword [rcx + 0x208]
call qword [sym.imp.WS2_32.dll_shutdown]
mov rcx, qword [rsp + 0xd0]
mov rcx, qword [rcx + 0x208]
call qword [sym.imp.WS2_32.dll_closesocket]
mov r11, qword [rsp + 0xd0]
mov qword [r11 + 0x208], 0xffffffffffffffff
xor eax, eax
jmp 0x1400e38ac
mov rax, qword [rsp + 0xd0]
mov dword [rax + 0x220], 1
mov rcx, qword [rsp + 0xd0]
mov eax, dword [rsp + 0xd8]
mov dword [rcx + 0x210], eax
mov rcx, qword [rsp + 0xd0]
add rcx, 8
mov rdx, qword [rsp + 0xe0]
call fcn.1400a9460
lea r11, [rsp + 0x30]
mov qword [rsp + 0x28], r11
mov dword [rsp + 0x20], 0
mov r9, qword [rsp + 0xd0]
lea r8, [0x14004f220]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r11, rax
mov rax, qword [rsp + 0xd0]
mov qword [rax + 0x218], r11
mov eax, 1
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1400a8040
add rsp, 0xc8
ret