joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400d70b0
Capabilities:
Resolve dns

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x48
movaps xmmword [rsp + 0x30], xmm6
mov rsi, r9
mov rax, qword [0x1402b3040]
xor rax, rsp
mov qword [rsp + 0x28], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r9, [rsp + 0x20]
mov qword [r9], rax
mov qword [rsi], 0
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov ebx, eax
test eax, eax
je 0x1400d7110
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
cmp rcx, qword [0x1402b3040]
je 0x1400d7152
call fcn.14019d280
int3
mov r15, qword [rsp + 0x20]
test r15, r15
je 0x1400d713b
xor r12d, r12d
xorps xmm6, xmm6
xor edi, edi
jmp 0x1400d7176
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x1400d7134
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
xor ebx, ebx
test rdi, rdi
jne 0x1400d714d
mov ebx, 0x2af9
mov ecx, 0x2af9
call qword [sym.imp.WS2_32.dll_WSASetLastError]
xor edi, edi
mov qword [rsi], rdi
jmp 0x1400d70f9
mov eax, ebx
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov rbx, r12
mov r15, qword [r15 + 0x28]
mov r12, rbx
test r15, r15
je 0x1400d7124
mov eax, dword [r15 + 4]
cmp eax, 2
je 0x1400d718c
cmp eax, 0x17
jne 0x1400d7167
mov r14d, 0x1c
jmp 0x1400d7192
mov r14d, 0x10
cmp qword [r15 + 0x20], 0
je 0x1400d7167
cmp qword [r15 + 0x10], r14
jb 0x1400d7167
mov rax, qword [fcn.14009cac0]
mov ecx, 0x30
call qword [0x1402a4958]
test rax, rax
je 0x1400d726c
mov rbx, rax
mov eax, dword [r15]
mov dword [rbx], eax
mov eax, dword [r15 + 4]
mov dword [rbx + 4], eax
mov eax, dword [r15 + 8]
mov dword [rbx + 8], eax
mov eax, dword [r15 + 0xc]
mov dword [rbx + 0xc], eax
mov dword [rbx + 0x10], r14d
movups xmmword [rbx + 0x18], xmm6
mov qword [rbx + 0x28], 0
mov rax, qword [fcn.14009cac0]
mov rcx, r14
call qword [0x1402a4958]
mov qword [rbx + 0x20], rax
test rax, rax
je 0x1400d725c
mov rdx, qword [r15 + 0x20]
mov rcx, rax
mov r8, r14
call fcn.1401d6070
mov rcx, qword [r15 + 0x18]
test rcx, rcx
je 0x1400d7231
lea r14, [rbx + 0x18]
mov rax, qword [fcn.1401b5b10]
call qword [0x1402a4958]
mov qword [r14], rax
test rax, rax
je 0x1400d724b
test rdi, rdi
cmove rdi, rbx
test r12, r12
je 0x1400d716a
mov qword [r12 + 0x28], rbx
jmp 0x1400d716a
mov rax, qword [fcn.1400581d0]
mov rcx, qword [rbx + 0x20]
call qword [0x1402a4958]
mov rax, qword [fcn.1400581d0]
mov rcx, rbx
call qword [0x1402a4958]
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x1400d727c
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
mov ebx, 8
test rdi, rdi
je 0x1400d714b
mov rax, qword [fcn.1400581d0]
mov rcx, qword [rdi + 0x20]
call qword [0x1402a4958]
mov rax, qword [fcn.1400581d0]
mov rcx, qword [rdi + 0x18]
call qword [0x1402a4958]
mov r14, qword [rdi + 0x28]
mov rax, qword [fcn.1400581d0]
mov rcx, rdi
call qword [0x1402a4958]
mov rdi, r14
test r14, r14
jne 0x1400d728a
jmp 0x1400d714b
Function at 0x1400e1690
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov ebx, r8d
mov rsi, rcx
mov rax, qword [rcx]
lea ecx, [rbx - 0xd]
mov r9d, 0x9b0
cmp ecx, 2
ja 0x1400e16bb
mov ecx, ecx
lea r8, [0x1402987e8]
mov r9, qword [r8 + rcx*8]
mov r8, qword [rax + 0x1e0]
lea rcx, [rsi + 0xa00]
mov r9, qword [rax + r9]
test dl, dl
jne 0x1400e1701
mov edx, dword [rsi + 0xaac]
lea r10d, [rdx + 1]
mov dword [rsi + 0xaac], r10d
test r9, r9
je 0x1400e1762
test edx, edx
js 0x1400e1710
xor r10d, r10d
mov r9, qword [r9 + 8]
cmp r10d, edx
jge 0x1400e170b
inc r10d
test r9, r9
jne 0x1400e16ee
jmp 0x1400e170b
mov dword [rsi + 0xaac], 0
test r9, r9
je 0x1400e1762
mov rax, qword [r9]
xor edx, edx
cmp byte [rax], 0x2a
sete dl
lea r8, [rdx + rax]
mov dword [rsi + 0xab0], edx
lea rdx, [0x140277c2a]
call fcn.1400fea00
test eax, eax
je 0x1400e1741
mov edi, eax
mov eax, edi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
mov dword [rsi + 0xab8], ebx
xor edi, edi
jmp 0x1400e1737
cmp dword [r8 + 0x10], 0
je 0x1400e1882
mov dword [rsi + 0xab8], 0
jmp 0x1400e1737
xor edi, edi
cmp ebx, 0xd
je 0x1400e174b
cmp ebx, 0xe
je 0x1400e1862
cmp ebx, 0xf
je 0x1400e1737
cmp byte [rsi + 0xa92], 1
jne 0x1400e17c9
cmp byte [rax + 0xf09], 0
jne 0x1400e1796
cmp dword [rax + 0x9f8], 0
je 0x1400e1873
mov r8, qword [rsi + 0xa88]
test r8, r8
je 0x1400e1873
lea rdx, str.MDTM__s
call fcn.1400fea00
test eax, eax
jne 0x1400e1735
mov dword [rsi + 0xab8], 0x12
jmp 0x1400e1737
mov dword [rsi + 0xab0], 0
xor edx, edx
cmp dword [rax + 0xbac], 2
sete dl
mov dword [rsi + 0xab4], edx
cmp byte [rsi + 0x655], 1
jne 0x1400e181e
mov r8, qword [rsi + 0xa70]
test r8, r8
je 0x1400e181e
cmp dword [rsi + 0xa80], 0
je 0x1400e1812
mov rdx, qword [rsi + 0xa78]
mov rdx, qword [rdx]
cmp byte [rdx], 0x2f
je 0x1400e181e
mov dword [rsi + 0xa94], 0
jmp 0x1400e183f
cmp dword [rsi + 0xa80], 0
je 0x1400e1780
mov dword [rsi + 0xa94], 1
mov rax, qword [rsi + 0xa78]
mov r8, qword [rax]
lea rdx, str.CWD__s
call fcn.1400fea00
test eax, eax
jne 0x1400e1735
mov dword [rsi + 0xab8], 0x10
jmp 0x1400e1737
mov rcx, rsi
xor edx, edx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.1400e1dc0
mov rcx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.1400e2010
mov rdx, qword [rsi + 0xad0]
cmp rdx, 0xffffffffffffffff
je 0x1400e18d4
mov ecx, dword [rax + 0xfa4]
and ecx, 0xffffffbf
xor r8d, r8d
xor r9d, r9d
test rdx, rdx
cmovns r8, rdx
setns r9b
shl r9d, 6
or r9d, ecx
mov qword [rax + 0xf78], r8
mov dword [rax + 0xfa4], r9d
mov rdx, qword [rsi + 0xad0]
mov rcx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.1400e1c30
mov r8, qword [rsi + 0xa88]
cmp byte [rax + 0xf24], 1
jne 0x1400e1907
lea rdx, str.RETR__s
call fcn.1400fea00
test eax, eax
jne 0x1400e1735
mov dword [rsi + 0xab8], 0x20
jmp 0x1400e1737
lea rdx, str.SIZE__s
call fcn.1400fea00
test eax, eax
jne 0x1400e1735
mov dword [rsi + 0xab8], 0x18
jmp 0x1400e1737
Function at 0x1400e2010
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov rax, qword [rcx]
mov rcx, qword [rax + 0x1e0]
cmp byte [rax + 0xf1c], 1
jne 0x1400e2090
cmp qword [rsi + 0xa88], 0
je 0x1400e2090
movzx edx, byte [rax + 0xf0b]
movsx r8d, byte [rsi + 0xaa8]
xor edx, 1
lea edx, [rdx*8 + 0x41]
cmp edx, r8d
je 0x1400e2090
mov dword [rcx + 0x10], 1
mov bl, byte [rax + 0xf0b]
xor bl, 1
shl bl, 3
or bl, 0x41
cmp byte [rsi + 0xaa8], bl
jne 0x1400e2113
mov dword [rsi + 0xab8], 0x13
mov rax, qword [rsi]
mov rax, qword [rax + 0x1e0]
mov eax, dword [rax + 0x10]
jmp 0x1400e2093
mov eax, dword [rcx + 0x10]
test eax, eax
je 0x1400e20ce
lea rcx, [rsi + 0xa00]
cmp eax, 1
je 0x1400e20dd
cmp qword [rsi + 0xa88], 0
je 0x1400e20ce
lea rdx, str.REST__d
xor edi, edi
xor r8d, r8d
call fcn.1400fea00
test eax, eax
jne 0x1400e20f9
mov dword [rsi + 0xab8], 0x1a
jmp 0x1400e20fb
mov rcx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.1400e2140
mov r8, qword [rsi + 0xa88]
test r8, r8
je 0x1400e20ce
lea rdx, str.SIZE__s
call fcn.1400fea00
test eax, eax
je 0x1400e2105
mov edi, eax
mov eax, edi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
mov dword [rsi + 0xab8], 0x17
xor edi, edi
jmp 0x1400e20fb
movzx r8d, bl
lea rcx, [rsi + 0xa00]
lea rdx, str.TYPE__c
call fcn.1400fea00
test eax, eax
jne 0x1400e20f9
mov dword [rsi + 0xab8], 0x13
mov byte [rsi + 0xaa8], bl
jmp 0x1400e210f

Function at 0x1400e2140
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov rax, qword [rcx]
mov rcx, qword [rax + 0x1e0]
cmp dword [rcx + 0x10], 0
je 0x1400e2179
mov dword [rsi + 0xab8], 0xd
mov rcx, rsi
mov dl, 1
mov r8d, Ordinal_14
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.1400e1690
cmp byte [rax + 0xf0e], 1
jne 0x1400e2192
mov rcx, rsi
xor edx, edx
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.1400e2280
lea rcx, [rsi + 0xa00]
cmp byte [rax + 0xf11], 1
jne 0x1400e21c3
mov r8, qword [rsi + 0xa88]
test r8, r8
je 0x1400e222c
cmp byte [rax + 0xf1d], 1
jne 0x1400e2223
lea rdx, str.PRET_STOR__s
jmp 0x1400e2258
mov al, byte [rsi + 0x666]
test al, al
jne 0x1400e21df
cmp byte [rsi + 0x65f], 1
jne 0x1400e21df
mov byte [rsi + 0x666], 1
mov al, 1
xor al, 1
movzx edi, al
lea rax, [rdi + rdi*4]
lea r8, str.EPSV
add r8, rax
lea rdx, [0x140277c2a]
call fcn.1400fea00
test eax, eax
jne 0x1400e226d
mov dword [rsi + 0xaac], edi
mov dword [rsi + 0xab8], 0x1e
mov rcx, qword [rsi]
lea rdx, str.Connect_data_stream_passively_n
call fcn.1400b6a70
jmp 0x1400e226b
lea rdx, str.PRET_RETR__s
jmp 0x1400e2258
mov r8, qword [rax + 0xc08]
test r8, r8
jne 0x1400e2251
lea rdx, str.NLST
lea r8, str.LIST
cmp byte [rax + 0xf0d], 0
cmovne r8, rdx
lea rdx, str.PRET__s
call fcn.1400fea00
test eax, eax
jne 0x1400e226d
mov dword [rsi + 0xab8], 0x1d
xor eax, eax
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x1400e3000
Capabilities:
Get local ipv4 addresses
Get socket information
Set socket configuration

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0xb8
mov rsi, rcx
mov rax, qword [0x1402b3040]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rdi, qword [rcx]
mov rbx, qword [rcx + 0x4c8]
movaps xmm0, xmmword [0x140272a70]
lea rdx, [rsp + 0x30]
movaps xmmword [rdx + 0x70], xmm0
movaps xmmword [rdx + 0x60], xmm0
movaps xmmword [rdx + 0x50], xmm0
movaps xmmword [rdx + 0x40], xmm0
movaps xmmword [rdx + 0x30], xmm0
movaps xmmword [rdx + 0x20], xmm0
movaps xmmword [rdx + 0x10], xmm0
movaps xmmword [rdx], xmm0
lea r8, [rsp + 0x28]
mov dword [r8], Ordinal_133
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x1400e30b7
mov rcx, rsi
mov rdx, rbx
call fcn.1400bccf0
lea rdx, str.Error_accept__ing_server_connect
mov rcx, rdi
call fcn.1400b6d70
mov ebx, 0x1e
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
cmp rcx, qword [0x1402b3040]
je 0x1400e30a8
call fcn.14019d280
int3
mov eax, ebx
add rsp, 0xb8
pop rbx
pop rdi
pop rsi
pop r14
ret
lea r8, [rsp + 0x28]
mov dword [r8], Ordinal_133
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_accept]
mov r14, rax
mov rcx, rsi
mov rdx, rbx
call fcn.1400bccf0
cmp r14, 0xffffffffffffffff
je 0x1400e307a
lea rdx, str.Connection_accepted_from_server_n
mov rcx, rdi
call fcn.1400b6a70
mov byte [rsi + 0x660], 0
mov qword [rsi + 0x4c8], r14
lea r8, [rsp + 0x2c]
mov dword [r8], 1
mov rcx, r14
mov edx, 0x8004667e
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov byte [rsi + 0xb2c], 1
mov rax, qword [rdi + 0x728]
xor ebx, ebx
test rax, rax
je 0x1400e308e
test rdi, rdi
je 0x1400e31be
mov rcx, qword [rdi + 0xd8]
test rcx, rcx
je 0x1400e31e5
mov byte [rcx + 0x18a], 1
mov rax, qword [rdi + 0x728]
mov rcx, qword [rdi + 0x730]
mov rdx, r14
mov r8d, 1
call qword [0x1402a4958]
mov rcx, qword [rdi + 0xd8]
test rcx, rcx
je 0x1400e31d7
mov byte [rcx + 0x18a], 0
test eax, eax
je 0x1400e308e
mov rdx, qword [rsi + 0x4c8]
cmp rdx, 0xffffffffffffffff
je 0x1400e31ad
mov rcx, rsi
call fcn.1400bccf0
mov qword [rsi + 0x4c8], 0xffffffffffffffff
mov byte [rsi + 0x653], 0
mov ebx, Ordinal_46
jmp 0x1400e308e
mov rcx, qword [0x730]
mov rdx, r14
mov r8d, 1
call qword [0x1402a4958]
jmp 0x1400e3185
mov rcx, qword [rdi + 0xd0]
test rcx, rcx
jne 0x1400e317e
jmp 0x1400e3185
mov rcx, qword [rdi + 0xd0]
test rcx, rcx
jne 0x1400e314e
jmp 0x1400e315c
Function at 0x1400e5a70
Capabilities:
Send data
Send data on socket

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
cmp edx, 0x1f
jne 0x1400e5c0f
mov rdi, rcx
mov rsi, qword [rcx]
mov rbx, qword [rsi + 0x1e0]
lea r12, [rbx + 0x1eb8]
mov word [rbx + 0x1cb8], 0xfaff
lea r14, [rbx + 0x1cbb]
mov qword [rbx + 0x1eb8], r14
mov byte [rbx + 0x1cba], 0x1f
movzx ecx, word [rbx + 0x1ca8]
mov r15, qword [sym.imp.WS2_32.dll_htons]
call r15
mov ebp, eax
movzx ecx, word [rbx + 0x1caa]
call r15
mov r9, qword [rbx + 0x1eb8]
cmp r9, r12
jae 0x1400e5af1
lea rcx, [r9 + 1]
mov qword [r12], rcx
mov byte [r9], bpl
mov r9, qword [r12]
cmp r9, r12
jae 0x1400e5b08
shr ebp, 8
lea rcx, [r9 + 1]
mov qword [r12], rcx
mov byte [r9], bpl
mov r9, qword [r12]
cmp r9, r12
jae 0x1400e5b1c
lea rcx, [r9 + 1]
mov qword [r12], rcx
mov byte [r9], al
mov r9, qword [r12]
cmp r9, r12
jae 0x1400e5b33
shr eax, 8
lea rcx, [r9 + 1]
mov qword [r12], rcx
mov byte [r9], al
mov r9, qword [r12]
cmp r9, r12
jae 0x1400e5b48
lea rax, [r9 + 1]
mov qword [r12], rax
mov byte [r9], 0xff
mov r9, qword [r12]
lea r15, [rbx + 0x1cb8]
lea r8, [rbx + 0x1cba]
cmp r9, r12
jae 0x1400e5b6b
lea rax, [r9 + 1]
mov qword [r12], rax
mov byte [r9], 0xf0
mov r9, qword [r12]
mov qword [rbx + 0x1ec0], r9
mov qword [rbx + 0x1eb8], r15
sub r9, r15
add r9, 0xfffffffffffffffe
mov rcx, rsi
mov edx, 0x3e
call fcn.1400e5c20
mov rcx, qword [rdi + 0x4c0]
mov rdx, r15
mov r8d, 3
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x1400e5bc2
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rsi
mov r8d, eax
call fcn.1400b6d70
mov r8d, 4
mov rcx, rdi
mov rdx, r14
call fcn.1400e5560
add rbx, 0x1cbf
mov rcx, qword [rdi + 0x4c0]
mov rdx, rbx
mov r8d, 2
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x1400e5c0f
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rsi
mov r8d, eax
call fcn.1400b6d70
nop
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x1400f2c10
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Get local ipv4 addresses
Get socket information
Receive data
Receive data on socket
Send data
Send data on socket
Set socket configuration
Start tcp server

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rsi, r9
mov rax, qword [0x1402b3040]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x2c], 0x10
mov dword [rsp + 0x28], 1
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x40], rax
movdqa xmm0, xmmword [0x140272a70]
movdqa xmmword [rsp + 0x30], xmm0
mov ecx, 2
mov edx, 1
mov r8d, 6
call qword [sym.imp.WS2_32.dll_socket]
cmp rax, 0xffffffffffffffff
je 0x1400f2dfa
mov rdi, rax
mov qword [rsp + 0x50], 0
mov word [rsp + 0x48], 2
mov ecx, 0x7f000001
call qword [sym.imp.WS2_32.dll_htonl]
mov dword [rsp + 0x4c], eax
mov word [rsp + 0x4a], 0
pcmpeqd xmm0, xmm0
movdqu xmmword [rsi], xmm0
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x28]
mov rcx, rdi
mov edx, 0xffff
mov r8d, 4
call qword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x1400f2db2
lea rdx, [rsp + 0x48]
mov rcx, rdi
mov r8d, 0x10
call qword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
je 0x1400f2db2
lea rdx, [rsp + 0x48]
lea r8, [rsp + 0x2c]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
je 0x1400f2db2
mov rcx, rdi
mov edx, 1
call qword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
je 0x1400f2db2
mov ecx, 2
mov edx, 1
xor r8d, r8d
call qword [sym.imp.WS2_32.dll_socket]
mov qword [rsi], rax
cmp rax, 0xffffffffffffffff
je 0x1400f2db2
lea rdx, [rsp + 0x48]
mov rcx, rax
mov r8d, 0x10
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x1400f2db2
mov rcx, rdi
xor edx, edx
xor r8d, r8d
call qword [sym.imp.WS2_32.dll_accept]
mov qword [rsi + 8], rax
cmp rax, 0xffffffffffffffff
je 0x1400f2db2
lea r8, [0x14027818d]
lea rbx, [rsp + 0x30]
mov edx, Ordinal_14
mov rcx, rbx
mov r9, rsi
call fcn.1400c3ce0
mov rcx, rbx
call fcn.1401bebc0
mov r14, rax
mov rcx, qword [rsi]
mov rdx, rbx
mov r8d, r14d
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_send]
cdqe
cmp r14, rax
je 0x1400f2e01
mov rbx, qword [sym.imp.WS2_32.dll_closesocket]
mov rcx, rdi
call rbx
mov rcx, qword [rsi]
call rbx
mov rdi, qword [rsi + 8]
mov ebx, 0xffffffff
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
cmp rcx, qword [0x1402b3040]
je 0x1400f2dec
call fcn.14019d280
int3
mov eax, ebx
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov ebx, 0xffffffff
jmp 0x1400f2dd5
lea r15, [rsp + 0x3c]
mov rcx, qword [rsi + 8]
xor ebx, ebx
mov rdx, r15
mov r8d, Ordinal_14
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recv]
cdqe
cmp r14, rax
jne 0x1400f2db2
lea rcx, [rsp + 0x30]
mov rdx, r15
mov r8, r14
call fcn.1401d5ec0
test eax, eax
jne 0x1400f2db2
jmp 0x1400f2dcc
Function at 0x1400f5940
Capabilities:
Receive data
Receive data on socket

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov r14, r9
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [rsp + 0x90]
mov qword [rax], 0
mov rcx, qword [rcx]
xor edx, edx
mov r8b, 1
call fcn.1400bbc20
test rax, rax
js 0x1400f5a16
xor r12d, r12d
movabs r13, 0x7fffffffffffffff
mov r15, qword [sym.imp.WS2_32.dll_recv]
mov ebp, 0xffffffff
jmp 0x1400f59ca
movsxd rdx, eax
mov rcx, r14
sub rcx, rdx
je 0x1400f5a2e
test eax, eax
je 0x1400f5a1b
add rsi, rdx
add r12, rdx
mov r14, rcx
mov rcx, qword [rbx]
xor edx, edx
mov r8b, 1
call fcn.1400bbc20
test rax, rax
js 0x1400f5a16
test rax, rax
cmove rax, r13
mov rcx, rdi
mov rdx, 0xffffffffffffffff
mov r8, 0xffffffffffffffff
mov r9, rax
call fcn.1400d6a80
test eax, eax
jle 0x1400f5a1b
mov rcx, rdi
mov rdx, rsi
mov r8d, r14d
xor r9d, r9d
call r15
cmp eax, 0xffffffff
jne 0x1400f599c
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x1400f59b8
mov ebp, 0x38
jmp 0x1400f5a1b
mov ebp, 0x1c
mov eax, ebp
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
add r12, r14
mov rax, qword [rsp + 0x90]
mov qword [rax], r12
xor ebp, ebp
jmp 0x1400f5a1b
Function at 0x1400fe1a0
Capabilities:
Check for time delay via gettickcount
Check for time delay via queryperformancecounter

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov ebx, edx
mov rdi, rcx
mov rax, qword [0x1402b3040]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov r14, qword [rcx + 0x58]
mov r12, qword [r14]
mov ebp, dword [r12 + 0x798]
test ebp, ebp
jne 0x1400fe1da
mov ebp, dword [rdi + 0x50]
cmp byte [0x1402c8640], 1
je 0x1400fe206
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
imul rcx, rcx, 0x10624dd3
shr rcx, 0x26
imul edx, ecx, 0x3e8
sub eax, edx
imul eax, eax, 0x3e8
jmp 0x1400fe23f
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rsi, [rsp + 0x28]
mov qword [rsi], rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsi]
mov r8, qword [0x1402c8648]
cqo
idiv r8
mov rcx, rax
imul rax, rdx, 0xf4240
cqo
idiv r8
movsxd rsi, ebp
movabs r15, 0x7fffffffffffffff
movabs r13, 0x20c49ba5e353f6
sub rcx, qword [rdi + 0x40]
mov rdx, r15
cmp rcx, r13
jg 0x1400fe29d
movabs rdx, 0xffdf3b645a1cac0a
cmp rcx, rdx
jl 0x1400fe299
imul rcx, rcx, 0x3e8
sub eax, dword [rdi + 0x48]
cdqe
imul rax, rax, 0x10624dd3
mov rdx, rax
shr rdx, 0x3f
sar rax, 0x26
add eax, edx
movsxd rdx, eax
add rdx, rcx
jmp 0x1400fe29d
lea rdx, [r15 + 1]
sub rsi, rdx
test bl, bl
jne 0x1400fe375
mov ebx, dword [r12 + 0x788]
test ebx, ebx
je 0x1400fe375
cmp byte [0x1402c8640], 1
je 0x1400fe2e4
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
imul rcx, rcx, 0x10624dd3
shr rcx, 0x26
imul edx, ecx, 0x3e8
sub eax, edx
imul eax, eax, 0x3e8
jmp 0x1400fe31d
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x28]
mov qword [rdi], rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rdi]
mov r8, qword [0x1402c8648]
cqo
idiv r8
mov rcx, rax
imul rax, rdx, 0xf4240
cqo
idiv r8
movsxd rdx, ebx
sub rcx, qword [r14 + 0x490]
cmp rcx, r13
jg 0x1400fe36b
movabs r8, 0xffdf3b645a1cac0a
cmp rcx, r8
jl 0x1400fe368
imul rcx, rcx, 0x3e8
sub eax, dword [r14 + 0x498]
cdqe
imul rax, rax, 0x10624dd3
mov r8, rax
shr r8, 0x3f
sar rax, 0x26
add eax, r8d
movsxd r15, eax
add r15, rcx
jmp 0x1400fe36b
inc r15
sub rdx, r15
cmp rsi, rdx
cmovge rsi, rdx
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
cmp rcx, qword [0x1402b3040]
je 0x1400fe38c
call fcn.14019d280
int3
mov rax, rsi
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400fe770
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rax, qword [0x1402b3040]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [rcx + 0x58]
test rbx, rbx
je 0x1400fe959
mov rdi, r8
mov rsi, rcx
lea rcx, str._s_r_n
call fcn.1400c3d70
mov ebp, reloc.WLDAP32.dll_Ordinal_27
test rax, rax
je 0x1400fe95e
mov r14, rax
mov rcx, rax
mov rdx, rdi
call fcn.1400c3e50
mov rdi, rax
mov rax, qword [fcn.1400581d0]
mov rcx, r14
call qword [0x1402a4958]
test rdi, rdi
je 0x1400fe95e
mov rcx, rdi
call fcn.1401bebc0
mov r14, rax
mov r15, rax
mov rax, qword [rsi + 0x58]
mov qword [rsi + 0x10], 0
mov rax, qword [rax]
mov rax, qword [rax + 0x1128]
mov qword [rsi + 0x18], rax
mov byte [rsi + 0x20], 1
cmp byte [0x1402c8640], 1
je 0x1400fe83e
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
imul rcx, rcx, 0x10624dd3
shr rcx, 0x26
imul edx, ecx, 0x3e8
sub eax, edx
imul eax, eax, 0x3e8
jmp 0x1400fe879
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r12, [rsp + 0x28]
mov qword [r12], rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [r12]
mov r8, qword [0x1402c8648]
cqo
idiv r8
mov rcx, rax
imul rax, rdx, 0xf4240
cqo
idiv r8
movabs r13, 0xaaaaaaaa00000000
mov eax, eax
or rax, r13
mov qword [rsi + 0x40], rcx
mov qword [rsi + 0x48], rax
mov rax, qword [rbx + 0x4c0]
lea rcx, [rsp + 0x28]
mov dword [rcx], 0
xor edx, edx
cmp rax, qword [rbx + 0x4c8]
sete dl
mov rax, qword [rbx + rdx*8 + 0x4f8]
mov qword [rsp + 0x20], rcx
mov rcx, rbx
mov r8, rdi
mov r9, r15
call qword [0x1402a4958]
mov r12, rax
test rax, rax
js 0x1400fe988
mov rcx, qword [rbx]
cmp byte [rcx + 0xf1e], 1
jne 0x1400fe8f2
mov edx, 2
mov r8, rdi
mov r9, r12
call fcn.1400b6c70
sub r14, r12
jne 0x1400fe949
mov rax, qword [fcn.1400581d0]
mov rcx, rdi
call qword [0x1402a4958]
xorps xmm0, xmm0
movups xmmword [rsi + 0x28], xmm0
mov qword [rsi + 0x38], 0
cmp byte [0x1402c8640], 1
je 0x1400fe9b4
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
imul rcx, rcx, 0x10624dd3
shr rcx, 0x26
imul edx, ecx, 0x3e8
sub eax, edx
imul eax, eax, 0x3e8
jmp 0x1400fe9ed
mov qword [rsi + 0x28], rdi
mov qword [rsi + 0x38], r15
mov qword [rsi + 0x30], r14
xor ebp, ebp
jmp 0x1400fe95e
mov ebp, 0x37
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
cmp rcx, qword [0x1402b3040]
je 0x1400fe975
call fcn.14019d280
int3
mov eax, ebp
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov ebp, dword [rsp + 0x28]
test ebp, ebp
je 0x1400fe99d
cmp ebp, 0x51
jne 0x1400fe9a2
xor r12d, r12d
jmp 0x1400fe8d6
mov ebp, 0x37
mov rax, qword [fcn.1400581d0]
mov rcx, rdi
call qword [0x1402a4958]
jmp 0x1400fe95e
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x28]
mov qword [rdi], rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rdi]
mov r8, qword [0x1402c8648]
cqo
idiv r8
mov rcx, rax
imul rax, rdx, 0xf4240
cqo
idiv r8
mov eax, eax
or rax, r13
mov qword [rsi + 0x40], rcx
mov qword [rsi + 0x48], rax
jmp 0x1400fe955
Function at 0x140104d70
Capabilities:
Hash data using md4
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x1402b3040]
xor rax, rsp
mov qword [rsp + 0x50], rax
xorps xmm0, xmm0
lea rcx, [rsp + 0x30]
movaps xmmword [rcx], xmm0
mov dword [rsp + 0x20], 0xf0000040
xor r14d, r14d
xor edx, edx
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x140104ddb
lea rax, [rsp + 0x38]
mov rcx, qword [rax - 8]
mov qword [rsp + 0x20], rax
mov edx, 0x8002
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
mov rcx, qword [rsp + 0x38]
mov rdx, rbx
mov r8d, edi
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
lea rdi, [rsp + 0x4c]
mov dword [rdi], r14d
mov rcx, qword [rsp + 0x38]
mov dword [rsp + 0x20], r14d
mov edx, 2
xor r8d, r8d
mov r9, rdi
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
cmp dword [rdi], 0x10
jne 0x140104e37
mov rcx, qword [rsp + 0x38]
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4c]
mov edx, 2
mov r8, rsi
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140104e47
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140104e59
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
cmp rcx, qword [0x1402b3040]
je 0x140104e70
call fcn.14019d280
int3
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
ret