joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140020ed0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [rcx]
mov ebx, r9d
mov edi, r8d
mov rbp, rcx
call qword [rax + reloc.WS2_32.dll_htonl]
mov edx, dword [rsp + 0x90]
mov word [rsp + 0x32], bx
mov eax, reloc.WS2_32.dll_recv
mov dword [rsp + 0x34], edx
mov word [rsp + 0x3e], ax
shl ebx, 4
xor esi, esi
shr ebx, 3
lea r8, [rsp + 0x30]
mov r13d, 1
movzx ecx, bx
xor r9d, r9d
mov dword [rsp + 0x28], esi
mov eax, ecx
mov dword [rbp + 8], edi
mov word [rsp + 0x30], r13w
mov word [rsp + 0x3c], bx
mov word [rsp + 0x40], si
mov qword [rsp + 0x20], rbp
imul eax, edx
mov dword [rsp + 0x38], eax
mov eax, 0x51eb851f
mul edx
mov r12d, edx
mov edx, edi
shr r12d, 5
imul r12d, ecx
lea rcx, [rbp + 0xb8]
call qword [sym.imp.WINMM.dll_waveOutOpen]
mov ebx, eax
test eax, eax
je 0x140020fac
cmp dword [reloc.WS2_32.dll_accept], r13d
jg 0x140020fa5
lea r9, str.Failed_to_open_playback_channel._err_d
lea rdx, str.....media_tavAudioChannel.cpp
mov r8d, 0x1dc
mov ecx, r13d
mov dword [rsp + 0x20], eax
call fcn.1400045f0
mov eax, ebx
jmp 0x140021095
mov edi, esi
lea rbx, [rbp + 0x10]
lea rcx, [r12 + 0x30]
call fcn.1401e6440
xor ecx, ecx
mov r8d, gethostbyaddr
mov qword [rbx], rax
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], rcx
mov qword [rax + 0x20], rcx
mov qword [rax + 0x28], rcx
mov rax, qword [rbx]
mov dword [rax + 8], r12d
mov rcx, qword [rbx]
lea rax, [rcx + 0x30]
mov qword [rcx], rax
mov rax, qword [rbx]
movsxd rcx, edi
mov dword [rax + 0x18], esi
mov rax, qword [rbx]
mov dword [rax + 0x1c], esi
mov rax, qword [rbx]
mov qword [rax + 0x10], rcx
mov rdx, qword [rbx]
mov rcx, qword [rbp + 0xb8]
call qword [sym.imp.WINMM.dll_waveOutPrepareHeader]
test eax, eax
jne 0x140021090
inc edi
add rbx, 8
cmp edi, 0x10
jb 0x140020fb2
mov dword [rbp + 0xc], esi
cmp qword [rbp + 0xa0], rsi
jne 0x140021089
mov r9, qword [rbp + 0xb0]
lea rax, [rbp + 0xa8]
lea r8, [0x140001050]
mov qword [rsp + 0x28], rax
mov edx, 0x8000
xor ecx, ecx
mov dword [rsp + 0x20], 0x10000
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0xa0], rax
test rax, rax
je 0x140021076
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
cmp qword [rbp + 0xa0], rsi
setne sil
test esi, esi
je 0x140021089
xor eax, eax
jmp 0x140021095
mov eax, 0xfffffffb
jmp 0x140021095
mov eax, 2
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop r12
ret
Function at 0x140021ec0
Capabilities:
Encode data using xor

Disassembly:
mov dword [rsp + 0x10], edx
push rbx
push rbp
push rsi
push rdi
push r12
push r15
sub rsp, 0x18
movsxd rbx, edx
xor edx, edx
mov r11d, r8d
mov r10, rcx
mov edi, 2
movzx r12d, r9b
test r9d, 0xff0000
je 0x140021ef4
mov edi, edx
mov edx, 2
mov r8, qword [rsp + 0x70]
mov ecx, ebx
imul ecx, r11d
mov eax, ecx
movsxd r15, ecx
sar eax, 2
add r15, r8
add eax, ecx
movsxd rcx, eax
add rcx, r8
mov qword [rsp + 0x70], rcx
mov ecx, r12d
imul ecx, ebx
test r9d, 0xff00
je 0x140021f39
lea eax, [r11 - 2]
imul eax, ecx
cdqe
add r10, rax
mov eax, ecx
imul eax, eax, 0xfffffffd
jmp 0x140021f3b
mov eax, ecx
sar r11d, 1
movsxd rbp, edi
movsxd rsi, edx
sub r11d, 1
movsxd rdi, ecx
mov qword [rsp], r12
mov dword [rsp + 0x60], r11d
js 0x1400220e6
cdqe
mov qword [rsp + 0x50], r13
mov r9, rbx
mov qword [rsp + 0x10], r14
lea rdx, [0x140000000]
mov qword [rsp + 8], rax
test ebx, ebx
jle 0x1400220c7
mov r11, qword [rsp]
lea r14d, [rbx - 1]
mov rbx, qword [rsp + 0x70]
shr r14d, 1
lea r12, [rdi + rsi]
lea r13, [rdi + rbp]
inc r14d
nop dword [rax + rax]
movzx ecx, byte [r10 + rbp]
movzx eax, byte [rsi + r10]
add r8, 2
mov edx, dword [rdx + rcx*4 + 0x2e6320]
lea rcx, [0x140000000]
inc r15
add edx, dword [rcx + rax*4 + 0x2e5b20]
movzx eax, byte [r10 + 1]
inc rbx
add edx, dword [rcx + rax*4 + 0x2e5f20]
mov byte [r8 - 2], dl
shr edx, 0x14
xor dl, 0x80
mov byte [r15 - 1], dl
movzx ecx, byte [rdi + r10 + 1]
movzx eax, byte [r13 + r10]
lea rdx, [0x140000000]
mov edx, dword [rdx + rcx*4 + 0x2e5f20]
lea rcx, [0x140000000]
add edx, dword [rcx + rax*4 + 0x2e6320]
movzx eax, byte [r12 + r10]
add r10, r11
add edx, dword [rcx + rax*4 + 0x2e5b20]
mov byte [r9 + r8 - 2], dl
shr edx, 0xa
xor dl, 0x80
mov byte [rbx - 1], dl
movzx ecx, byte [r10 + rbp]
movzx eax, byte [rsi + r10]
lea rdx, [0x140000000]
movzx edx, byte [rdx + rcx*4 + 0x2e6320]
lea rcx, [0x140000000]
add dl, byte [rcx + rax*4 + 0x2e5b20]
movzx eax, byte [r10 + 1]
add dl, byte [rcx + rax*4 + 0x2e5f20]
mov byte [r8 - 1], dl
movzx ecx, byte [rdi + r10 + 1]
movzx eax, byte [r13 + r10]
lea rdx, [0x140000000]
movzx edx, byte [rdx + rcx*4 + 0x2e5f20]
lea rcx, [0x140000000]
add dl, byte [rcx + rax*4 + 0x2e6320]
movzx eax, byte [r12 + r10]
add r10, r11
add dl, byte [rcx + rax*4 + 0x2e5b20]
sub r14, 1
mov byte [r9 + r8 - 1], dl
lea rdx, [0x140000000]
jne 0x140021fa0
mov r11d, dword [rsp + 0x60]
mov rax, qword [rsp + 8]
mov qword [rsp + 0x70], rbx
mov ebx, dword [rsp + 0x58]
lea rdx, [0x140000000]
add r8, r9
add r10, rax
sub r11d, 1
mov dword [rsp + 0x60], r11d
jns 0x140021f75
mov r14, qword [rsp + 0x10]
mov r13, qword [rsp + 0x50]
add rsp, 0x18
pop r15
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14002cad0
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x50
mov rsi, rcx
lea rcx, [rsp + 0x78]
xor r12d, r12d
mov rbx, r9
mov rbp, r8
mov rdi, rdx
mov dword [rsp + 0x78], r12d
call fcn.140037a80
mov r10, qword [rsp + 0x90]
bt eax, 0x1f
mov dword [r10], eax
jae 0x14002cb19
mov dword [rbx], 0x80
jmp 0x14002cb41
bt eax, 0x1e
jae 0x14002cb27
mov dword [rbx], 0x40
jmp 0x14002cb41
bt eax, 0x1d
jae 0x14002cb35
mov dword [rbx], 0x20
jmp 0x14002cb41
bt eax, 0x1c
jae 0x14002cb41
mov dword [rbx], reloc.WS2_32.dll_recv
mov r9d, dword [rbx]
mov ebx, dword [rsp + 0x78]
mov edx, eax
mov r8d, ebx
mov rcx, rsi
call fcn.14002c8d0
cmp r12w, word [rdi + 0x37c]
jne 0x14002cb8e
test ebx, ebx
jne 0x14002cb72
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ebx, dword [rsp + 0x40]
cmp r12w, word [rdi + 0x37c]
jne 0x14002cb8e
mov eax, 1
test ebx, ebx
cmovg ax, bx
mov word [rdi + 0x37c], ax
movzx eax, word [rdi + 0x37c]
cmp ax, 1
jae 0x14002cba2
mov eax, 1
jmp 0x14002cbb2
cmp ax, 4
jbe 0x14002cbaf
mov eax, 4
jmp 0x14002cbb2
movzx eax, ax
movzx r8d, ax
mov r9, rbp
mov rdx, rdi
mov rcx, rsi
mov word [rdi + 0x37c], ax
call fcn.14002c7e0
test eax, eax
je 0x14002cbea
lea r8, str.GetMultipleThreadIdc____InitSliceSettings_failed.
mov edx, 1
mov rcx, rsi
call fcn.1400279c0
mov eax, 1
jmp 0x14002cbec
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x80]
add rsp, 0x50
pop r12
pop rdi
pop rsi
ret
Function at 0x140052260
Capabilities:
Encode data using base64
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
xor edx, edx
test r8b, r8b
jne 0x1400522a7
movzx eax, byte [rcx - 0x54]
movzx r8d, byte [rcx + 0x44]
sub r8d, eax
mov dword [rcx + 0x4c], r8d
mov eax, dword [rcx - 0x98]
bt eax, 8
jb 0x1400522a7
cmp eax, 2
je 0x14005229d
cmp byte [rcx - 0x87], dl
je 0x1400522a7
cmp dword [rcx - 0x4c], edx
je 0x1400522a7
mov edx, 1
mov ebx, dword [rcx + 0x4c]
test ebx, ebx
je 0x14005236d
test ebx, ebx
jns 0x1400522bc
neg ebx
add ebx, ebx
jmp 0x1400522c0
lea ebx, [rbx + rbx - 1]
add edx, 0x3c
mov r8d, 1
mov rcx, rdi
call fcn.140051970
cmp ebx, 1
jne 0x1400522de
lea edx, [rbx + 0x3d]
jmp 0x140052370
mov edx, 0x3e
mov rcx, rdi
lea r8d, [rdx - 0x3d]
call fcn.140051970
sub ebx, 2
test ebx, ebx
jle 0x140052366
mov qword [rsp + 0x30], rsi
lea rsi, [0x140000000]
movzx eax, byte [rdi + 0x53]
test al, 1
je 0x14005234e
mov edx, dword [rdi + 0x10]
movzx r8d, al
mov eax, edx
shr r8d, 1
shr rax, 6
and eax, 3
lea rax, [rax + r8*4]
movzx eax, byte [rax + rsi + 0x296670]
sub edx, eax
mov ecx, edx
btc ecx, 8
shr ecx, 8
add dword [rdi + 0xc], ecx
shl edx, cl
mov dword [rdi + 0x10], edx
movzx eax, byte [rsi + r8*2 + 0x296771]
add al, al
inc al
mov byte [rdi + 0x53], al
jmp 0x14005235b
mov edx, 0x3f
mov rcx, rdi
call fcn.14004ea60
dec ebx
test ebx, ebx
jg 0x140052302
mov rsi, qword [rsp + 0x30]
mov edx, 0x3f
jmp 0x140052370
add edx, 0x3c
xor r8d, r8d
mov rcx, rdi
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.140051970

Function at 0x140052390
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
movsx rax, r9w
xor ebx, ebx
mov rsi, rcx
cmp byte [rax + r8 + 0x7a], bl
movsx ecx, byte [rax + r8 + 0x75]
movsx edi, byte [rax + r8 + 0x7b]
jle 0x1400523c9
cmp byte [r8 + 0x1bb], bl
jne 0x1400523c9
mov ebx, 1
test cx, cx
jle 0x1400523dc
cmp byte [r8 + 0x1b9], 0
jne 0x1400523dc
add bx, 2
test di, di
jle 0x140052467
mov qword [rsp + 0x30], rbp
lea rbp, [0x140000000]
movsx edx, bx
add edx, 0x36
movsxd r9, edx
movzx eax, byte [r9 + rsi + 0x14]
test al, 1
je 0x14005244a
mov edx, dword [rsi + 0x10]
movzx r8d, al
mov eax, edx
shr r8d, 1
shr rax, 6
and eax, 3
lea rax, [rax + r8*4]
movzx eax, byte [rax + rbp + 0x296670]
sub edx, eax
mov ecx, edx
btc ecx, 8
shr ecx, 8
add dword [rsi + 0xc], ecx
shl edx, cl
mov dword [rsi + 0x10], edx
movzx eax, byte [rbp + r8*2 + 0x296771]
add al, al
inc al
mov byte [r9 + rsi + 0x14], al
jmp 0x140052452
mov rcx, rsi
call fcn.14004ea60
sar bx, 2
dec di
add bx, 4
test di, di
jg 0x1400523f1
mov rbp, qword [rsp + 0x30]
movsx edx, bx
xor r8d, r8d
mov rcx, rsi
add edx, 0x36
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp fcn.140051970
Function at 0x140052490
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov ebp, r8d
mov r14d, edx
mov rbx, rcx
test edx, edx
jle 0x1400524b4
mov r12d, edx
jmp 0x1400524ba
mov r12d, edx
neg r12d
mov r13d, 9
mov r15d, 1
cmp r12d, r13d
cmovl r13d, r12d
cmp r9d, 0x20
jle 0x1400524d9
lea eax, [r15 + 1]
jmp 0x1400524e3
xor eax, eax
cmp r9d, 2
cmovg eax, r15d
test r13d, r13d
je 0x140052608
cmp r13d, 9
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rdi
jge 0x14005256e
lea edx, [rax + r8]
mov r8d, r15d
call fcn.140051970
xor edi, edi
dec r13d
mov esi, 3
test r13d, r13d
jle 0x14005253c
nop word [rax + rax]
lea edx, [rsi + rbp]
mov r8d, r15d
mov rcx, rbx
call fcn.140051970
cmp edi, 3
jge 0x140052535
inc esi
inc edi
cmp edi, r13d
jl 0x140052520
lea edx, [rsi + rbp]
xor r8d, r8d
mov rcx, rbx
call fcn.140051970
mov eax, dword [rbx + 8]
xor edi, edi
test r14d, r14d
sets dil
inc dword [rbx + 0xc]
mov ecx, dword [rbx + 0xc]
lea edx, [rcx + rax]
neg edi
cmp edx, 0x40
jge 0x1400525d1
shl qword [rbx], cl
mov dword [rbx + 8], edx
jmp 0x1400525d9
lea edx, [rax + r8]
mov r8d, r15d
call fcn.140051970
xor edi, edi
lea esi, [rbp + 3]
nop
mov r8d, r15d
mov edx, esi
mov rcx, rbx
call fcn.140051970
cmp edi, 3
jge 0x140052594
inc esi
inc edi
cmp edi, 8
jl 0x140052580
lea r8d, [r12 - 9]
mov edx, 3
mov rcx, rbx
call fcn.14004eb20
mov eax, dword [rbx + 8]
xor edi, edi
test r14d, r14d
sets dil
inc dword [rbx + 0xc]
mov ecx, dword [rbx + 0xc]
lea edx, [rcx + rax]
neg edi
cmp edx, 0x40
jge 0x1400525d1
shl qword [rbx], cl
mov dword [rbx + 8], edx
jmp 0x1400525d9
mov rcx, rbx
call fcn.14004e970
mov ecx, dword [rbx + 0x10]
mov rsi, qword [rsp + 0x50]
mov eax, edi
mov rdi, qword [rsp + 0x58]
and rcx, rax
mov dword [rbx + 0xc], 0
add qword [rbx], rcx
mov rbx, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
lea edx, [rax + r8]
xor r8d, r8d
mov rbx, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rbp
jmp fcn.140051970

Function at 0x140066c20
Capabilities:
Create thread

Disassembly:
push rdi
sub rsp, 0x30
cmp qword [rcx + 0x38], 0
mov rdi, rcx
je 0x140066ca9
cmp byte [rcx + 0x70], 0
jne 0x140066ca1
add rcx, 0x48
mov qword [rsp + 0x40], rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [rdi + 0x48]
mov byte [rdi + 0x71], 0
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor r11d, r11d
lea r8, [0x140066d30]
mov qword [rsp + 0x28], r11
mov r9, rdi
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], r11d
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, qword [rsp + 0x40]
test rax, rax
je 0x140066ca9
cmp byte [rdi + 0x70], 0
mov qword [rdi + 0x30], rax
jne 0x140066ca1
nop dword [rax + rax]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [rdi + 0x70], 0
je 0x140066c90
xor eax, eax
add rsp, 0x30
pop rdi
ret
or eax, 0xffffffff
add rsp, 0x30
pop rdi
ret
Function at 0x14006c450
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rsi, rcx
mov rcx, qword [rcx + 0x58]
mov rbp, rdx
lea rdx, [rsp + 0x40]
call fcn.14006afa0
xor edi, edi
mov rcx, qword [rax]
test rcx, rcx
je 0x14006c48a
mov rcx, qword [rcx]
test rcx, rcx
jne 0x14006c48d
mov rcx, rdi
cmp qword [rbp + 0x10], rdi
jne 0x14006c4a1
test rcx, rcx
je 0x14006c4a1
call fcn.1401eea68
mov qword [rbp + 0x10], rax
mov rbx, qword [rsp + 0x40]
test rbx, rbx
je 0x14006c4c8
dec dword [rbx + 0x10]
cmp dword [rbx + 0x10], edi
jg 0x14006c4c8
mov rcx, qword [rbx]
test rcx, rcx
je 0x14006c4c0
call fcn.1401e64f8
mov rcx, rbx
call fcn.1401e60f0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbp
call fcn.140071810
cmp dword [rbp + 0x18], edi
jne 0x14006c576
mov ecx, reloc.WS2_32.dll_getservbyport
call fcn.1401e65ec
mov rbx, rax
test rax, rax
je 0x14006c50a
mov qword [rax + 8], rdi
mov dword [rax + 0x10], edi
mov qword [rax + 0x18], rax
lea rax, vtable.._AVResolveThread__4__ResolveAddRemoteCandidate_PeerConnection_webrtc__AEAAXPEAVCandidate_3__Z_.0
mov qword [rbx], rax
jmp 0x14006c50d
mov rbx, rdi
mov qword [rbx + 0x20], rbp
mov rax, qword [rsi + 0xa0]
mov qword [rbx + 0x30], rsi
mov qword [rbx + 0x28], rax
cmp qword [rbx + 8], rdi
jne 0x14006c58a
mov r9, qword [rbx + 0x18]
lea rax, [rbx + 0x10]
lea r8, [0x140001050]
mov qword [rsp + 0x28], rax
mov edx, 0x10000
xor ecx, ecx
mov dword [rsp + 0x20], 0x10000
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 8], rax
test rax, rax
je 0x14006c563
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
cmp qword [rbx + 8], rdi
setne dil
test edi, edi
je 0x14006c58a
lock add dword [rsi + 0x48], 1
jmp 0x14006c58a
mov rcx, qword [rsi + 0xa0]
mov rdx, qword [rbp + 0x20]
mov rcx, qword [rcx + 0x60]
call fcn.140078b60
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x140070670
Capabilities:
Resolve dns

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x20
mov rdi, qword [rsp + 0x68]
mov r14, qword [rsp + 0x60]
movzx ebp, r9w
mov qword [rdi], 0
mov r12d, r8d
mov r13d, edx
mov byte [r14], 0
call sub.WS2_32.dll_gethostbyname
mov rsi, rax
test rax, rax
je 0x140070748
cmp word [rax + 0x10], 2
mov qword [rsp + 0x40], rbx
jne 0x14007070b
cmp word [rax + 0x12], 4
jne 0x14007070b
mov rbx, qword [rax + 0x18]
mov rcx, qword [rbx]
test rcx, rcx
je 0x14007070b
nop dword [rax + rax]
mov r9d, dword [rcx]
movzx r8d, bp
mov edx, r12d
mov ecx, r13d
call fcn.1400705d0
mov qword [rdi], rax
test rax, rax
je 0x140070741
mov rcx, qword [rbx + 8]
add rbx, 8
lea rdi, [rax + 0x28]
test rcx, rcx
jne 0x1400706e0
mov r8, qword [rsi]
mov r9d, 0x400
mov rcx, r14
lea edx, [r9 + 1]
call fcn.1401ee7c0
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r13
pop r12
ret
mov eax, 8
jmp 0x140070722
call sub.WS2_32.dll_WSAGetLastError
sub eax, 0x2af9
je 0x14007075e
sub eax, 1
je 0x14007076c
sub eax, 1
je 0x140070765
mov eax, 0x2af9
jmp 0x140070727
mov eax, 0x2afb
jmp 0x140070727
mov eax, 0x2afa
jmp 0x140070727
Function at 0x140071000
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
sub rsp, 0x280
mov rax, qword [0x1402e0068]
xor rax, rsp
mov qword [rsp + 0x270], rax
cmp dword [0x1402e6ce8], 0
lea rax, [0x140070a50]
lea rbx, str.getaddrinfo
mov qword [rsp + 0x28], rax
lea rax, str.getnameinfo
movzx ebp, cx
mov qword [rsp + 0x30], rax
lea rax, [0x140070d60]
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x38], rax
lea rax, str.freeaddrinfo
mov qword [rsp + 0x40], rax
lea rax, [fcn.1400709f0]
mov qword [rsp + 0x48], rax
jne 0x1400711ce
lea rcx, [rsp + 0x160]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x1400711c4
lea r8, [rsp + 0x160]
lea rcx, [rsp + 0x50]
mov edx, 0x10c
mov qword [rsp + 0x290], rsi
call fcn.1401ee968
lea r8, str.ws2_32
lea rcx, [rsp + 0x50]
mov edx, 0x10c
call fcn.1401ee9dc
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x1400710f4
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140071154
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea r8, [rsp + 0x160]
lea rcx, [rsp + 0x50]
mov edx, 0x10c
call fcn.1401ee968
lea r8, str.wship6
lea rcx, [rsp + 0x50]
mov edx, 0x10c
call fcn.1401ee9dc
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x1400711bc
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140071154
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x1400711bc
mov qword [rsp + 0x298], rdi
lea rbx, [rsp + 0x28]
xor edi, edi
mov rdx, qword [rbx - 8]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx], rax
test rax, rax
je 0x1400711ab
inc rdi
add rbx, 0x10
cmp rdi, 3
jl 0x140071163
mov rax, qword [rsp + 0x28]
mov qword [str.P_n_a_], rax
mov rax, qword [rsp + 0x38]
mov qword [str.__r_a_], rax
mov rax, qword [rsp + 0x48]
mov qword [fcn.1400709f0], rax
jmp 0x1400711b4
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rdi, qword [rsp + 0x298]
mov rsi, qword [rsp + 0x290]
mov dword [0x1402e6ce8], 1
movzx eax, bp
lea rcx, str.getaddrinfo
add rax, rax
mov rax, qword [rcx + rax*8 + 8]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1401e6720
mov rbx, qword [rsp + 0x2a0]
add rsp, 0x280
pop rbp
ret
Function at 0x140072dd0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
cmp edx, 0xc
jne 0x140072e5b
mov rcx, qword [rcx + 0x60]
mov qword [rsp + 0x30], rsi
call fcn.140075fa0
mov esi, eax
test eax, eax
je 0x140072e4b
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [rdi + 0x58]
lea ebx, [rsi + rax]
test ecx, ecx
je 0x140072e29
cmp ecx, ebx
jb 0x140072e0e
sub ecx, ebx
jmp 0x140072e12
sub ecx, ebx
dec ecx
cmp ecx, 0x8ca0
ja 0x140072e4b
mov rcx, qword [rdi + 0x68]
mov edx, reloc.WS2_32.dll_inet_addr
mov rax, qword [rcx]
call qword [rax + 0x30]
mov rcx, qword [rdi + 0x68]
xor r9d, r9d
mov r8d, esi
mov rax, qword [rcx]
lea edx, [r9 + 0xb]
call qword [rax + 0x28]
mov dword [rdi + 0x58], ebx
test ebx, ebx
jne 0x140072e4b
mov dword [rdi + 0x58], 0xffffffff
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
cmp edx, 0xb
jne 0x140072eac
mov rcx, qword [rcx + 0x60]
call fcn.140075fa0
mov rcx, qword [rdi + 0x68]
mov r10, qword [rcx]
mov ebx, eax
mov eax, 0x1388
test ebx, ebx
cmove ebx, eax
xor r9d, r9d
lea edx, [r9 + 0xb]
mov r8d, ebx
call qword [r10 + 0x28]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea ecx, [rax + rbx]
mov dword [rdi + 0x58], ecx
test ecx, ecx
jne 0x140072e50
mov dword [rdi + 0x58], 0xffffffff
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x140072e50
mov rax, qword [rcx]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp qword [rax + 0x20]
Function at 0x140074c80
Capabilities:
Enumerate pe sections

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x108
mov rax, qword [0x1402e0068]
xor rax, rsp
mov qword [rsp + 0xf0], rax
mov rbx, r9
mov rdi, r8
mov rsi, rdx
mov rbp, rcx
test rdx, rdx
jne 0x140074cc3
call fcn.1401ee8e0
mov dword [rax], reloc.WS2_32.dll_ntohl
or rax, 0xffffffffffffffff
jmp 0x140074d65
lea rcx, [rsp + 0x70]
xor edx, edx
mov r8d, 0x80
call fcn.1401e6750
test rbx, rbx
je 0x140074dff
mov edx, dword [rbx]
mov qword [rsp + 0x100], r12
xor r12d, r12d
test dl, 1
je 0x140074d1c
movzx eax, word [rbx + 4]
mov cx, word [rbx + 6]
mov word [rsp + 0x70], ax
mov eax, dword [rbx + 8]
mov word [rsp + 0x74], cx
mov dword [rsp + 0x78], eax
mov eax, dword [rbx + 0xc]
mov dword [rsp + 0x7c], eax
mov eax, dword [rbx + 0x10]
mov dword [rsp + 0x8c], eax
jmp 0x140074d2a
mov ecx, r12d
mov word [rsp + 0x70], r12w
mov word [rsp + 0x74], cx
test dl, 2
je 0x140074d49
movzx eax, word [rbx + 0x14]
and ax, 0xf
or cx, ax
mov eax, dword [rbx + 0x18]
mov dword [rsp + 0x80], eax
mov word [rsp + 0x74], cx
test dl, 4
je 0x140074d81
call fcn.1401ee8e0
mov dword [rax], socket
or rax, 0xffffffffffffffff
mov r12, qword [rsp + 0x100]
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.1401e6720
add rsp, 0x108
pop rdi
pop rsi
pop rbp
pop rbx
ret
lea rax, [rsp + 0x60]
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x60], rdi
mov dword [rsp + 0x48], 1
mov dword [rsp + 0x58], r12d
mov dword [rsp + 0x5c], 1
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x4c], r12d
mov qword [rsp + 0x50], rdi
call fcn.1401ee8e0
lea r8, [rsp + 0x40]
xor r9d, r9d
mov rbx, rax
lea rax, [rsp + 0x70]
xor edx, edx
mov qword [rsp + 0x30], rax
mov rcx, rbp
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
call fcn.1400b96c0
mov dword [rbx], eax
call fcn.1401ee8e0
cmp dword [rax], r12d
jne 0x140074d59
sub rdi, qword [rsp + 0x50]
mov rax, rdi
jmp 0x140074d5d
call fcn.1401ee8e0
mov dword [rax], socket
or rax, 0xffffffffffffffff
jmp 0x140074d65
Function at 0x140077f80
Capabilities:
Send data
Send data on socket

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0xe0
mov rax, qword [0x1402e0068]
xor rax, rsp
mov qword [rsp + 0xd0], rax
cmp dword [rsp + 0x120], 0x17
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
jne 0x14007806f
cmp word [r9], 2
jne 0x14007806f
lea rcx, [rsp + 0x40]
mov rdx, r9
mov r8d, 0x88
call fcn.1401e75a0
cmp word [rsp + 0x40], 2
lea rcx, [rsp + 0x40]
mov rax, qword [rcx]
lea r11, [rsp + 0x30]
mov qword [r11], rax
mov rax, qword [rcx + 8]
mov qword [r11 + 8], rax
jne 0x14007804f
xor eax, eax
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x4c], eax
mov dword [rsp + 0x54], eax
mov dword [rsp + 0x44], eax
mov dword [rsp + 0x58], eax
mov eax, reloc.WS2_32.dll_socket
mov word [rsp + 0x40], ax
movzx eax, word [rsp + 0x32]
mov word [rsp + 0x42], ax
xor eax, eax
mov qword [rsp + 0x48], rax
mov word [rsp + 0x50], ax
or rax, 0xffffffffffffffff
mov word [rsp + 0x52], ax
mov eax, dword [rsp + 0x34]
mov dword [rsp + 0x54], eax
mov eax, 0x1c
mov dword [rsp + 0xc0], eax
jmp 0x140078056
mov eax, dword [rsp + 0xc0]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x40]
mov r8d, esi
mov rdx, rdi
mov rcx, rbx
mov qword [rsp + 0x20], rax
jmp 0x14007807f
mov eax, dword [r9 + 0x80]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r9
xor r9d, r9d
call sub.WS2_32.dll_sendto
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.1401e6720
add rsp, 0xe0
pop rdi
pop rsi
pop rbx
ret