joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140042240
Capabilities:
Resolve dns

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov qword [r9], 0
mov r12, r9
lea r9, [rsp + 0x38]
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov r14d, eax
test eax, eax
jne 0x1400423db
mov rbx, qword [rsp + 0x38]
mov r13, qword [0x14011e810]
xor r15d, r15d
xor ebp, ebp
test rbx, rbx
je 0x140042448
mov dword [rsp + 0x2c], eax
mov qword [rsp + 0xa8], r12
nop word cs:[rax + rax]
mov rcx, qword [rbx + 0x18]
xor esi, esi
test rcx, rcx
je 0x1400422b4
call sym.strlen
lea rsi, [rax + 1]
mov eax, dword [rbx + 4]
cmp eax, 2
je 0x1400423f0
cmp eax, 0x17
jne 0x1400423a8
mov r12d, 0x1c
mov r14d, 0x1c
cmp qword [rbx + 0x20], 0
je 0x1400423a8
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x1400423a8
cmp rax, r14
jb 0x1400423a8
lea rcx, [r14 + rsi + 0x30]
call qword [r13]
mov rdi, rax
test rax, rax
je 0x140042408
movdqu xmm0, xmmword [rbx]
mov r9, qword [rbx + 0x20]
lea rcx, [rax + 0x30]
mov dword [rax + 0x10], r12d
mov qword [rax + 0x18], 0
lea r11, [rdi + 0x38]
mov qword [rax + 0x28], 0
and r11, 0xfffffffffffffff8
mov qword [rax + 0x20], rcx
movups xmmword [rax], xmm0
mov rax, qword [r9]
mov qword [rdi + 0x30], rax
mov rax, qword [r9 + r14 - 8]
mov qword [rcx + r14 - 8], rax
mov rax, rcx
sub rax, r11
sub r9, rax
add eax, r14d
and eax, 0xfffffff8
cmp eax, 8
jb 0x140042376
and eax, 0xfffffff8
xor edx, edx
mov r8d, edx
add edx, 8
mov r10, qword [r9 + r8]
mov qword [r11 + r8], r10
cmp edx, eax
jb 0x140042364
test rsi, rsi
je 0x14004238e
add rcx, r14
mov rdx, qword [rbx + 0x18]
mov r8, rsi
mov qword [rdi + 0x18], rcx
call sym.memcpy
test rbp, rbp
cmove rbp, rdi
test r15, r15
je 0x14004239e
mov qword [r15 + 0x28], rdi
mov r15, rdi
nop dword [rax]
mov rbx, qword [rbx + 0x28]
test rbx, rbx
jne 0x1400422a0
mov rcx, qword [rsp + 0x38]
mov r14d, dword [rsp + 0x2c]
mov r12, qword [rsp + 0xa8]
test rcx, rcx
je 0x1400423d2
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
test rbp, rbp
je 0x140042448
mov qword [r12], rbp
mov eax, r14d
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov r12d, 0x10
mov r14d, 0x10
jmp 0x1400422d5
mov rcx, qword [rsp + 0x38]
mov r12, qword [rsp + 0xa8]
test rcx, rcx
je 0x140042420
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
mov rbx, qword [0x14011e7f0]
test rbp, rbp
je 0x14004243e
nop dword [rax]
mov rcx, rbp
mov rbp, qword [rbp + 0x28]
call qword [rbx]
test rbp, rbp
jne 0x140042430
xor ebp, ebp
mov r14d, 8
jmp 0x1400423d7
mov ecx, 0x2af9
mov r14d, 0x2af9
xor ebp, ebp
call qword [sym.imp.WS2_32.dll_WSASetLastError]
jmp 0x1400423d7
Function at 0x1400426d0
Capabilities:
Convert ip address from string

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rdi, qword [sym.imp.WS2_32.dll_inet_pton]
lea rbp, [rsp + 0x2c]
mov rbx, rcx
mov esi, edx
mov rdx, rcx
mov r8, rbp
mov ecx, 2
call rdi
test eax, eax
jg 0x140042740
lea rbp, [rsp + 0x30]
mov rdx, rbx
mov ecx, 0x17
mov r8, rbp
call rdi
mov edx, eax
xor eax, eax
test edx, edx
jg 0x140042720
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov r9d, esi
mov r8, rbx
mov rdx, rbp
mov ecx, 0x17
call sym.Curl_ip2addr
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov r9d, esi
mov r8, rbx
mov rdx, rbp
mov ecx, 2
call sym.Curl_ip2addr
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x140043160
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
mov r8, rcx
mov r9, rdx
xor ecx, ecx
xor edx, edx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.msvcrt.dll__beginthreadex]
lea rdx, [rax - 1]
cmp rdx, 0xfffffffffffffffe
mov edx, 0
cmovae rax, rdx
add rsp, 0x38
ret

Function at 0x140043200
Capabilities:
Write file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x840
mov rsi, rcx
mov rbp, r8
lea rdi, [rsp + 0x30]
mov r12, r9
test rdx, rdx
je 0x140043318
mov r9, qword [rdx]
mov rcx, rdi
mov edx, 0x800
lea r8, [0x1400fa6a0]
call sym.curl_msnprintf
mov edx, 0x800
movsxd rcx, eax
sub edx, ecx
mov rbx, rcx
add rcx, rdi
movsxd rdx, edx
mov r9, r12
mov r8, rbp
call sym.curl_mvsnprintf
mov edx, 0xa
add ebx, eax
movsxd rax, ebx
mov word [rsp + rax + 0x30], dx
test byte [rsi + 0xa37], 0x10
je 0x1400432c2
add ebx, 1
cmp qword [rsi + 0x260], 0
movsxd rbx, ebx
je 0x1400432d0
mov rcx, rsi
call sym.Curl_is_in_callback
mov edx, 1
mov rcx, rsi
mov ebp, eax
call sym.Curl_set_in_callback
xor edx, edx
mov rcx, rsi
mov r9, rbx
mov rax, qword [rsi + 0x1d8]
mov r8, rdi
mov qword [rsp + 0x20], rax
call qword [rsi + 0x260]
movzx edx, bpl
mov rcx, rsi
call sym.Curl_set_in_callback
nop
add rsp, 0x840
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov r9, qword [rsi + 0x1d0]
mov r8d, 1
mov edx, 2
lea rcx, [0x1400fa6c0]
call sym.fwrite
mov r9, qword [rsi + 0x1d0]
mov rdx, rbx
mov rcx, rdi
mov r8d, 1
call sym.fwrite
nop
add rsp, 0x840
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rcx, rdi
mov edx, 0x800
xor ebx, ebx
jmp 0x14004324e
Function at 0x140043330
Capabilities:
Write file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rbx, rcx
mov esi, edx
mov rbp, r8
mov rdi, r9
test byte [rcx + 0xa37], 0x10
je 0x1400433a5
cmp qword [rcx + 0x260], 0
je 0x1400433a0
call sym.Curl_is_in_callback
mov rcx, rbx
mov edx, 1
mov r12d, eax
call sym.Curl_set_in_callback
mov edx, esi
mov rcx, rbx
mov r9, rdi
mov rax, qword [rbx + 0x1d8]
mov r8, rbp
mov qword [rsp + 0x20], rax
call qword [rbx + 0x260]
movzx edx, r12b
mov rcx, rbx
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp sym.Curl_set_in_callback
cmp esi, 2
jbe 0x1400433b0
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov r9, qword [rbx + 0x1d0]
lea rcx, [rsi + rsi*2]
mov edx, 2
lea rax, [0x1400fa6c0]
add rcx, rax
mov r8d, 1
call sym.fwrite
mov r9, qword [rbx + 0x1d0]
mov rdx, rdi
mov rcx, rbp
mov r8d, 1
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp sym.fwrite

Function at 0x140043400
Capabilities:
Write file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x158
mov qword [rsp + 0x190], r8
mov rbx, rcx
mov qword [rsp + 0x198], r9
test byte [rcx + 0xa37], 0x10
jne 0x140043435
cmp qword [rcx + 0x1e0], 0
je 0x1400434d5
lea rdi, [rsp + 0x40]
lea r9, [rsp + 0x190]
mov r8, rdx
mov edx, 0x100
mov rcx, rdi
mov qword [rsp + 0x38], r9
call sym.curl_mvsnprintf
mov rcx, qword [rbx + 0x1e0]
mov esi, eax
test rcx, rcx
je 0x14004346e
test byte [rbx + 0x1264], 8
je 0x1400434e8
movsxd rax, esi
mov edx, 0xa
mov word [rsp + rax + 0x40], dx
test byte [rbx + 0xa37], 0x10
je 0x1400434d5
add esi, 1
cmp qword [rbx + 0x260], 0
movsxd rsi, esi
je 0x140043500
mov rcx, rbx
call sym.Curl_is_in_callback
mov edx, 1
mov rcx, rbx
mov ebp, eax
call sym.Curl_set_in_callback
xor edx, edx
mov rcx, rbx
mov r9, rsi
mov rax, qword [rbx + 0x1d8]
mov r8, rdi
mov qword [rsp + 0x20], rax
call qword [rbx + 0x260]
movzx edx, bpl
mov rcx, rbx
call sym.Curl_set_in_callback
nop
add rsp, 0x158
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov rdx, rdi
call sym.strcpy
or byte [rbx + 0x1264], 8
jmp 0x14004346e
mov r9, qword [rbx + 0x1d0]
mov r8d, 1
mov edx, 2
lea rcx, [0x1400fa6c0]
call sym.fwrite
mov r9, qword [rbx + 0x1d0]
mov rdx, rsi
mov rcx, rdi
mov r8d, 1
call sym.fwrite
nop
add rsp, 0x158
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x140048600
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xb0
mov rsi, qword [rcx + 0x20]
mov rdi, qword [rsi + 0x228]
lea r12, [rsp + 0x24]
lea rbp, [rsp + 0x30]
mov rbx, rcx
mov qword [rsp + 0x28], 0xffffffffffffffff
mov dword [rsp + 0x24], pe_nt_image_headers64
mov r8, r12
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x140048710
mov rcx, qword [rsp + 0x28]
cmp rcx, 0xffffffffffffffff
je 0x140048758
test byte [rbx + 0xa37], 0x10
je 0x14004868e
mov rax, qword [rbx + 0x11e8]
test rax, rax
je 0x14004867a
mov r8d, dword [rax + 8]
test r8d, r8d
jle 0x14004868e
mov rcx, rbx
lea rdx, str.Connection_accepted_from_server
call sym.Curl_infof
mov rcx, qword [rsp + 0x28]
and byte [rsi + 0x3a1], 0xdf
mov edx, 1
call sym.curlx_nonblock
mov rdx, rsi
lea r9, [rsp + 0x28]
mov rcx, rbx
mov r8d, 1
call sym.Curl_conn_tcp_accepted_set
mov esi, eax
test eax, eax
jne 0x140048738
cmp qword [rbx + 0x270], 0
je 0x1400486fa
mov edx, 1
mov rcx, rbx
call sym.Curl_set_in_callback
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rbx + 0x278]
mov r8d, 1
call qword [rbx + 0x270]
xor edx, edx
mov rcx, rbx
mov edi, eax
call sym.Curl_set_in_callback
test edi, edi
jne 0x140048770
mov eax, esi
add rsp, 0xb0
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rcx, rdi
mov dword [rsp + 0x24], pe_nt_image_headers64
mov r8, r12
mov rdx, rbp
call qword [sym.imp.WS2_32.dll_accept]
mov qword [rsp + 0x28], rax
mov rcx, rax
jmp 0x140048652
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.WS2_32.dll_closesocket]
mov eax, esi
add rsp, 0xb0
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
lea rdx, str.Error_accept__ing_server_connect
mov rcx, rbx
mov esi, 0x1e
call sym.Curl_failf
jmp 0x1400486fa
test byte [rbx + 0xa37], 0x10
je 0x1400487cb
mov rax, qword [rbx + 0x11e8]
test rax, rax
je 0x14004878c
mov edx, dword [rax + 8]
test edx, edx
jle 0x1400487cb
mov rax, qword [0x14011e920]
mov eax, dword [rax + 8]
test eax, eax
jle 0x1400487cb
mov rax, qword [rbx + 0x20]
lea r8, [0x1400faf4d]
test rax, rax
je 0x1400487bc
movzx edx, byte [rax + 0x76e]
lea rax, str.STOP
mov r8, qword [rax + rdx*8]
lea rdx, str.__s__closing_DATA_connection
mov rcx, rbx
call sym.Curl_trc_ftp
mov edx, 1
mov rcx, rbx
mov esi, 0x2a
call sym.Curl_conn_close
mov rdx, qword [rbx + 0x20]
mov r8d, 1
mov rcx, rbx
call sym.Curl_conn_cf_discard_all
jmp 0x1400486fa
Function at 0x14004ace0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
mov rdi, qword [rcx + 0x20]
movzx eax, byte [rdi + 0x76e]
mov rbp, rdi
mov rsi, rcx
mov ebx, edx
cmp dl, al
je 0x14004ad0a
test byte [rcx + 0xa37], 0x10
jne 0x14004ad40
mov byte [rdi + 0x76e], bl
cmp bl, 0x13
je 0x14004adb8
cmp bl, 0x14
je 0x14004add0
mov r8d, 0xd
cmp bl, 0x15
je 0x14004ad9e
cmp bl, 0x16
je 0x14004ad98
xor eax, eax
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rdx, qword [rcx + 0x11e8]
test rdx, rdx
je 0x14004ad55
mov r9d, dword [rdx + 8]
test r9d, r9d
jle 0x14004ad0a
mov rdx, qword [0x14011e920]
mov rbp, rdi
mov r8d, dword [rdx + 8]
test r8d, r8d
jle 0x14004ad0a
lea rcx, str.STOP
movzx edx, bl
mov r9, qword [rcx + rdx*8]
mov r8, qword [rcx + rax*8]
lea rdx, str.__s_______s_
mov rcx, rsi
call sym.Curl_trc_ftp
mov rbp, qword [rsi + 0x20]
jmp 0x14004ad0a
mov r8d, 0xe
mov edx, 1
mov rcx, rsi
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp sym.ftp_state_quote
mov rdx, rbp
mov rcx, rsi
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp sym.ftp_state_size
cmp byte [rsi + 0x6e0], 2
mov rax, qword [rsi + 0x1b8]
mov rdi, qword [0x14011e7f0]
je 0x14004aec0
lea r9, [0x1400faf6b]
xor r12d, r12d
mov r8, r9
mov rdx, qword [rsi + 0x7e8]
test rdx, rdx
je 0x14004af30
lea rcx, [0x1400fb50c]
call sym.curl_maprintf
mov rcx, r12
mov rbx, rax
call qword [rdi]
test rbx, rbx
je 0x14004af50
lea rdx, [rbp + 0x660]
mov r9, rbx
lea r8, [0x1400fb0d9]
mov rcx, rsi
call sym.Curl_pp_sendf
mov rcx, rbx
mov dword [rsp + 0x3c], eax
call qword [rdi]
mov eax, dword [rsp + 0x3c]
test eax, eax
jne 0x14004ad34
mov rbx, qword [rsi + 0x20]
movzx eax, byte [rbx + 0x76e]
cmp al, 0x1f
je 0x14004aeb0
test byte [rsi + 0xa37], 0x10
je 0x14004aeb0
mov rdx, qword [rsi + 0x11e8]
test rdx, rdx
je 0x14004ae7e
mov ecx, dword [rdx + 8]
test ecx, ecx
jle 0x14004aeb0
mov rdx, qword [0x14011e920]
mov edx, dword [rdx + 8]
test edx, edx
jle 0x14004aeb0
lea rdx, str.STOP
lea r9, [0x1400fb49b]
mov rcx, rsi
mov r8, qword [rdx + rax*8]
lea rdx, str.__s_______s_
call sym.Curl_trc_ftp
nop dword [rax]
mov byte [rbx + 0x76e], 0x1f
jmp 0x14004ad32
mov rcx, qword [rax]
test rcx, rcx
je 0x14004adeb
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor edx, edx
lea r8, [rsp + 0x48]
mov qword [rsp + 0x48], 0
call sym.Curl_urldecode
test eax, eax
jne 0x14004ad34
mov r12, qword [rsp + 0x48]
mov edx, 0x2f
mov rcx, r12
call sym.strrchr
test rax, rax
je 0x14004af5a
sub rax, r12
mov edx, 1
mov r9, r12
cmove rax, rdx
lea r8, [0x1400fb50a]
mov byte [r12 + rax], 0
jmp 0x14004adf8
test byte [rsi + 0x1265], 0x20
lea rdx, [0x1400fb49b]
lea rax, str.NLST
cmovne rdx, rax
jmp 0x14004ae08
mov eax, 0x1b
jmp 0x14004ad34
mov rcx, r12
call qword [rdi]
jmp 0x14004adeb
Function at 0x140051310
Capabilities:
Query environment variable

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbp, qword [0x14011e820]
mov esi, 1
xor ebx, ebx
mov r12, qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov rdi, rcx
jmp 0x140051361
mov rdx, rax
mov r8d, esi
mov rcx, rdi
call r12
lea edx, [rax - 1]
cmp edx, 0x7fff
ja 0x140051398
cmp esi, eax
je 0x140051398
cmp eax, esi
jb 0x140051382
mov esi, eax
mov rcx, rbx
mov edx, esi
mov r13, rbx
call qword [rbp]
mov rbx, rax
test rax, rax
jne 0x140051340
mov rax, qword [0x14011e7f0]
mov rcx, r13
xor ebx, ebx
call qword [rax]
mov rax, rbx
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov rax, qword [0x14011e7f0]
mov rcx, rbx
xor ebx, ebx
call qword [rax]
jmp 0x140051382

Function at 0x140051710
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
mov eax, 0x1505
add rdx, rcx
cmp rcx, rdx
jae 0x14005173b
nop dword [rax]
mov r9, rax
add rcx, 1
shl r9, 5
add rax, r9
movsx r9, byte [rcx - 1]
xor rax, r9
cmp rdx, rcx
jne 0x140051720
xor edx, edx
div r8
mov rax, rdx
ret
Function at 0x140052970
Capabilities:
Convert ip address from string

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x98
mov rdi, rcx
mov rsi, rdx
test byte [rcx + 0xa37], 0x10
je 0x140052998
cmp byte [rdx + 0x18], 0
jne 0x1400529b0
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea r13, [rdx + 0x18]
lea rbp, [rsp + 0x20]
mov ecx, 2
mov rbx, qword [sym.imp.WS2_32.dll_inet_pton]
mov r8, rbp
mov rdx, r13
call rbx
test eax, eax
jg 0x140052998
lea r12, [rsp + 0x50]
mov rdx, r13
mov ecx, 0x17
mov r8, r12
call rbx
test eax, eax
jg 0x140052998
mov rbx, qword [rsi]
test byte [rdi + 0xa37], 0x10
je 0x140052a2a
mov rax, qword [rdi + 0x11e8]
test rax, rax
je 0x140052a08
mov r8d, dword [rax + 8]
test r8d, r8d
jle 0x140052a2a
cmp byte [rsi + 0x18], 0
mov r9d, dword [rsi + 0x14]
mov rcx, rdi
lea r8, str._none_
cmovne r8, r13
lea rdx, str.Host__s:_d_was_resolved.
call sym.Curl_infof
mov edx, 0x400
mov rcx, r12
lea r14, [rsp + 0x70]
call sym.Curl_dyn_init
mov edx, 0x400
mov rcx, r14
lea r15, [0x1400fc74a]
call sym.Curl_dyn_init
mov r13, qword [sym.imp.WS2_32.dll_inet_ntop]
test rbx, rbx
jne 0x140052a75
jmp 0x140052b60
mov rbx, qword [rbx + 0x28]
test rbx, rbx
je 0x140052b60
mov eax, dword [rbx + 4]
cmp eax, 0x17
je 0x140052a82
cmp eax, 2
jne 0x140052a68
xor esi, esi
cmp eax, 2
mov byte [rsp + 0x20], 0
setne sil
shl rsi, 5
add rsi, r12
cmp eax, 2
mov rax, qword [rbx + 0x20]
je 0x140052b18
mov ecx, 0x17
lea rdx, [rax + 8]
mov r9d, 0x2e
mov r8, rbp
call r13
mov rcx, rsi
call sym.Curl_dyn_len
test rax, rax
jne 0x140052b3a
mov rdx, rbp
mov rcx, rsi
call sym.Curl_dyn_add
test eax, eax
je 0x140052a68
test byte [rdi + 0xa37], 0x10
je 0x140052b00
mov rax, qword [rdi + 0x11e8]
test rax, rax
je 0x140052aed
mov ecx, dword [rax + 8]
test ecx, ecx
jle 0x140052b00
lea rdx, str.too_many_IP__cannot_show
mov rcx, rdi
call sym.Curl_infof
nop dword [rax]
mov rcx, r12
call sym.Curl_dyn_free
mov rcx, r14
call sym.Curl_dyn_free
jmp 0x140052998
mov ecx, 2
lea rdx, [rax + 4]
mov r9d, 0x2e
mov r8, rbp
call r13
mov rcx, rsi
call sym.Curl_dyn_len
test rax, rax
je 0x140052ac2
mov r8d, 2
mov rdx, r15
mov rcx, rsi
call sym.Curl_dyn_addn
test eax, eax
je 0x140052ac2
jmp 0x140052ad1
test byte [rdi + 0xa37], 0x10
je 0x140052b00
mov rax, qword [rdi + 0x11e8]
test rax, rax
je 0x140052b7c
mov edx, dword [rax + 8]
test edx, edx
jle 0x140052b00
mov rcx, r14
call sym.Curl_dyn_len
lea r8, str._none_
test rax, rax
jne 0x140052beb
lea rdx, str.IPv6:__s
mov rcx, rdi
call sym.Curl_infof
test byte [rdi + 0xa37], 0x10
je 0x140052b00
mov rax, qword [rdi + 0x11e8]
test rax, rax
je 0x140052bc3
mov eax, dword [rax + 8]
test eax, eax
jle 0x140052b00
mov rcx, r12
call sym.Curl_dyn_len
lea r8, str._none_
test rax, rax
jne 0x140052bf8
lea rdx, str.IPv4:__s
mov rcx, rdi
call sym.Curl_infof
jmp 0x140052b00
mov rcx, r14
call sym.Curl_dyn_ptr
mov r8, rax
jmp 0x140052b90
mov rcx, r12
call sym.Curl_dyn_ptr
mov r8, rax
jmp 0x140052bd7
Function at 0x1400531d0
Capabilities:
Convert ip address from string

Disassembly:
push rsi
push rbx
sub rsp, 0x48
mov rsi, qword [sym.imp.WS2_32.dll_inet_pton]
mov rdx, rcx
mov rbx, rcx
lea r8, [rsp + 0x2c]
mov ecx, 2
call rsi
mov edx, eax
mov eax, 1
test edx, edx
jg 0x14005320e
lea r8, [rsp + 0x30]
mov rdx, rbx
mov ecx, 0x17
call rsi
test eax, eax
setg al
add rsp, 0x48
pop rbx
pop rsi
ret

Function at 0x140053820
Capabilities:
Convert ip address from string

Disassembly:
cmp qword [rsp + 0x28], 0
mov qword [r9], 0
js 0x140053840
mov qword [rsp + 0x28], r9
mov r9d, 1
jmp sym.Curl_resolv
mov eax, 0xfffffffe
ret
Function at 0x140063560
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x38
xor eax, eax
test edx, edx
lea r8, [rsp + 0x2c]
mov edx, 0x8004667e
setne al
mov dword [rsp + 0x2c], eax
call qword [sym.imp.WS2_32.dll_ioctlsocket]
add rsp, 0x38
ret
Function at 0x140067610
Capabilities:
Create new key via cryptacquirecontext
Initialize hashing via wincrypt

Disassembly:
push rbx
sub rsp, 0x30
xor edx, edx
mov r9d, 0x18
xor r8d, r8d
mov dword [rsp + 0x20], 0xf0000040
mov rbx, rcx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
mov edx, eax
mov eax, 0x1b
test edx, edx
je 0x140067661
lea rax, [rbx + 8]
mov rcx, qword [rbx]
mov edx, 0x800c
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
mov edx, eax
xor eax, eax
test edx, edx
je 0x140067670
add rsp, 0x30
pop rbx
ret
mov rcx, qword [rbx]
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov qword [rbx], 0
mov eax, 2
jmp 0x140067661

Function at 0x140067690
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
mov r9d, 0x18
mov dword [rsp + 0x20], 0xf0000040
mov rdi, rcx
mov rsi, rdx
mov rbx, r8
xor edx, edx
lea rcx, [rsp + 0x40]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
mov edx, eax
mov eax, 0x1b
test edx, edx
je 0x14006775c
lea rax, [rsp + 0x48]
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov edx, 0x800c
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x1400677a0
mov rcx, rbx
call sym.curlx_uztoui
mov rdx, rsi
lea rsi, [rsp + 0x3c]
xor r9d, r9d
mov rcx, qword [rsp + 0x48]
mov r8d, eax
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
xor r8d, r8d
mov rcx, qword [rsp + 0x48]
mov r9, rsi
mov dword [rsp + 0x3c], 0
mov rbx, qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov edx, 2
mov dword [rsp + 0x20], 0
call rbx
cmp dword [rsp + 0x3c], 0x20
je 0x140067768
mov rcx, qword [rsp + 0x48]
test rcx, rcx
jne 0x140067798
mov rcx, qword [rsp + 0x40]
test rcx, rcx
jne 0x140067788
xor eax, eax
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
mov rcx, qword [rsp + 0x48]
mov r9, rsi
mov r8, rdi
mov edx, 2
mov dword [rsp + 0x20], 0
call rbx
jmp 0x140067746
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
jmp 0x14006775c
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
jmp 0x140067750
mov rcx, qword [rsp + 0x40]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, 2
jmp 0x14006775c
Function at 0x14006f0e0
Capabilities:
Send data
Send data on socket
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbx, qword [rcx + 0x1b8]
mov r12, qword [rcx + 0x20]
mov rsi, rcx
cmp edx, 0x1f
je 0x14006f118
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea rbp, [rbx + 0x1cd8]
lea rdi, [rbx + 0x1ed8]
cmp rbp, rdi
jb 0x14006f2b8
mov qword [rbx + 0x1ed8], rbp
lea r13, [rbx + 0x1cdb]
movzx ecx, word [rbx + 0x1ca8]
mov r15, qword [sym.imp.WS2_32.dll_htons]
call r15
movzx ecx, word [rbx + 0x1caa]
mov r14d, eax
call r15
mov rdx, qword [rbx + 0x1ed8]
cmp rdx, rdi
jae 0x14006f202
lea rcx, [rdx + 1]
mov qword [rbx + 0x1ed8], rcx
mov byte [rdx], r14b
mov rdx, qword [rbx + 0x1ed8]
cmp rdx, rdi
jae 0x14006f202
lea rcx, [rdx + 1]
mov qword [rbx + 0x1ed8], rcx
mov ecx, r14d
mov byte [rdx], ch
mov rdx, qword [rbx + 0x1ed8]
cmp rdx, rdi
jae 0x14006f202
lea rcx, [rdx + 1]
mov qword [rbx + 0x1ed8], rcx
mov byte [rdx], al
mov rdx, qword [rbx + 0x1ed8]
cmp rdx, rdi
jae 0x14006f202
lea rcx, [rdx + 1]
mov qword [rbx + 0x1ed8], rcx
mov byte [rdx], ah
mov rdx, qword [rbx + 0x1ed8]
cmp rdx, rdi
jae 0x14006f202
lea rax, [rdx + 1]
mov qword [rbx + 0x1ed8], rax
mov byte [rdx], 0xff
mov rdx, qword [rbx + 0x1ed8]
cmp rdx, rdi
jae 0x14006f202
lea rax, [rdx + 1]
mov qword [rbx + 0x1ed8], rax
mov byte [rdx], 0xf0
mov rdx, qword [rbx + 0x1ed8]
mov qword [rbx + 0x1ee0], rdx
mov qword [rbx + 0x1ed8], rbp
test byte [rsi + 0xa37], 0x10
je 0x14006f234
sub rdx, rbp
lea r8, [rbx + 0x1cda]
mov rcx, rsi
lea r9, [rdx - 2]
mov edx, 0x3e
call sym.printsub.part.0
xor r9d, r9d
mov rdi, qword [sym.imp.WS2_32.dll_send]
mov r8d, 3
mov rdx, rbp
mov rcx, qword [r12 + 0x220]
call rdi
test eax, eax
js 0x14006f2e0
mov r8d, 4
mov rdx, r13
mov rcx, rsi
call sym.send_telnet_data
xor r9d, r9d
mov rcx, qword [r12 + 0x220]
lea rdx, [rbx + 0x1cdf]
mov r8d, 2
call rdi
test eax, eax
jns 0x14006f103
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rsi
mov r8d, eax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp sym.Curl_failf
lea r13, [rbx + 0x1cdb]
mov eax, 0xfffffaff
mov byte [rbx + 0x1cda], 0x1f
mov qword [rbx + 0x1ed8], r13
mov word [rbx + 0x1cd8], ax
jmp 0x14006f13d
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rsi
mov r8d, eax
call sym.Curl_failf
jmp 0x14006f259
Function at 0x14006f300
Capabilities:
Send data
Send data on socket

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x40
xor r9d, r9d
mov rax, qword [rcx + 0x20]
mov byte [rsp + 0x3e], dl
mov rbx, rcx
mov esi, edx
mov edi, r8d
mov byte [rsp + 0x3f], r8b
lea rdx, [rsp + 0x3d]
mov rcx, qword [rax + 0x220]
mov r8d, 3
mov byte [rsp + 0x3d], 0xff
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
js 0x14006f3d8
test byte [rbx + 0xa37], 0x10
je 0x14006f3ca
lea r9, [0x140100c70]
cmp esi, 0xfd
je 0x14006f383
lea r9, str.DONT
cmp esi, 0xfe
je 0x14006f383
cmp esi, 0xfc
lea r9, str.WONT
lea rax, str.WILL
cmovne r9, rax
cmp edi, 0x27
jg 0x14006f3f8
movsxd rdx, edi
lea rax, str.BINARY
mov rax, qword [rax + rdx*8]
test rax, rax
je 0x14006f400
mov rdx, qword [rbx + 0x11e8]
test rdx, rdx
je 0x14006f3ae
mov edx, dword [rdx + 8]
test edx, edx
jle 0x14006f3ca
mov qword [rsp + 0x20], rax
lea r8, str.SENT
lea rdx, [0x140100c7e]
mov rcx, rbx
call sym.Curl_infof
nop
add rsp, 0x40
pop rbx
pop rsi
pop rdi
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rbx
mov r8d, eax
call sym.Curl_failf
jmp 0x14006f344
cmp edi, 0xff
je 0x14006f440
mov rax, qword [rbx + 0x11e8]
test rax, rax
je 0x14006f413
mov eax, dword [rax + 8]
test eax, eax
jle 0x14006f3ca
mov dword [rsp + 0x20], edi
lea r8, str.SENT
lea rdx, str._s__s__d
mov rcx, rbx
call sym.Curl_infof
nop
add rsp, 0x40
pop rbx
pop rsi
pop rdi
ret
lea rax, str.EXOPL
jmp 0x14006f39b