joyce8/EMBER2024-capa huggingface dataset:
Function at 0x556a60
Capabilities:
Send data
Send data on socket

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rsi
mov rsi, qword [rcx]
mov r8, qword [rsi + 0x1a8]
mov qword [rsp + 0x58], rdi
movsxd rdi, edx
mov r10d, dword [r8 + rdi*4 + 0xc08]
mov rbx, rcx
test r10d, r10d
je 0x556b6a
sub r10d, 2
je 0x556aff
dec r10d
jne 0x556c2c
mov ecx, dword [r8 + rdi*4 + 0x1008]
test ecx, ecx
je 0x556adf
dec ecx
jne 0x556c2c
mov dword [r8 + rdi*4 + 0xc08], 1
mov dword [r8 + rdi*4 + 0x1008], ecx
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x48]
add rsp, 0x38
ret
mov dword [r8 + rdi*4 + 0xc08], 0
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x48]
add rsp, 0x38
ret
mov ecx, dword [r8 + rdi*4 + 0x1008]
test ecx, ecx
je 0x556b4a
dec ecx
jne 0x556c2c
mov dword [r8 + rdi*4 + 0x1008], ecx
mov dword [r8 + rdi*4 + 0xc08], 3
mov edx, 0xfe
mov r8d, edi
mov rcx, rbx
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x48]
add rsp, 0x38
jmp fcn.00556830
mov dword [r8 + rdi*4 + 0xc08], 1
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x48]
add rsp, 0x38
ret
cmp dword [r8 + rdi*4 + 0x1408], 1
jne 0x556bd0
mov dword [r8 + rdi*4 + 0xc08], 1
mov rsi, qword [rcx]
mov rcx, qword [rcx + 0x1a8]
xor r9d, r9d
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x20], 0xff
lea r8d, [r9 + 3]
mov byte [rsp + 0x21], 0xfd
mov byte [rsp + 0x22], dil
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x556bc8
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rsi
mov r8d, eax
call fcn.0052eee0
mov r8d, 0xfd
jmp 0x556c1a
mov rcx, qword [rcx + 0x1a8]
xor r9d, r9d
lea rdx, [rsp + 0x20]
lea r8d, [r9 + 3]
mov byte [rsp + 0x20], 0xff
mov byte [rsp + 0x21], 0xfe
mov byte [rsp + 0x22], dil
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x556c14
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rsi
mov r8d, eax
call fcn.0052eee0
mov r8d, 0xfe
mov rcx, qword [rbx]
lea rdx, str.SENT
mov r9d, edi
call fcn.005566f0
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x48]
add rsp, 0x38
ret
Function at 0x556c40
Capabilities:
Send data
Send data on socket

Disassembly:
sub rsp, 0x38
mov rax, qword [rcx]
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x58], rdi
mov r8, qword [rax + 0x1a8]
movsxd rdi, edx
mov rbx, rcx
mov r10d, dword [r8 + rdi*4 + 0xc08]
dec r10d
je 0x556d13
dec r10d
je 0x556cc5
dec r10d
jne 0x556d86
mov ecx, dword [r8 + rdi*4 + 0x1008]
test ecx, ecx
je 0x556cfa
dec ecx
jne 0x556d86
xor eax, eax
mov dword [r8 + rdi*4 + 0xc08], 2
mov edx, 0xfd
mov dword [r8 + rdi*4 + 0x1008], eax
mov r8d, edi
mov rcx, rbx
mov rdi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x48]
add rsp, 0x38
jmp fcn.00556830
mov ecx, dword [r8 + rdi*4 + 0x1008]
test ecx, ecx
je 0x556cfa
dec ecx
jne 0x556d86
xor eax, eax
mov dword [r8 + rdi*4 + 0xc08], eax
mov dword [r8 + rdi*4 + 0x1008], eax
mov rdi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x48]
add rsp, 0x38
ret
xor eax, eax
mov dword [r8 + rdi*4 + 0xc08], eax
mov rdi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x48]
add rsp, 0x38
ret
xor eax, eax
mov qword [rsp + 0x50], rsi
lea rdx, [rsp + 0x20]
mov dword [r8 + rdi*4 + 0xc08], eax
mov rsi, qword [rcx]
mov rcx, qword [rcx + 0x1a8]
lea r8d, [rax + 3]
xor r9d, r9d
mov byte [rsp + 0x20], 0xff
mov byte [rsp + 0x21], 0xfe
mov byte [rsp + 0x22], dil
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x556d69
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rsi
mov r8d, eax
call fcn.0052eee0
mov rcx, qword [rbx]
lea rdx, str.SENT
mov r9d, edi
mov r8d, 0xfe
call fcn.005566f0
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x48]
add rsp, 0x38
ret
Function at 0x556f40
Capabilities:
Send data
Send data on socket

Disassembly:
sub rsp, 0x38
mov rax, qword [rcx]
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x58], rdi
mov r8, qword [rax + 0x1a8]
movsxd rdi, edx
mov rbx, rcx
mov r10d, dword [r8 + rdi*4 + 8]
dec r10d
je 0x557007
dec r10d
je 0x556fbf
dec r10d
jne 0x557077
mov ecx, dword [r8 + rdi*4 + 0x408]
test ecx, ecx
je 0x556ff1
dec ecx
jne 0x557077
xor eax, eax
mov dword [r8 + rdi*4 + 8], 2
mov edx, 0xfb
mov dword [r8 + rdi*4 + COleControlSite::XOleClientSite::AddRef], eax
mov r8d, edi
mov rcx, rbx
mov rdi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x48]
add rsp, 0x38
jmp fcn.00556830
mov ecx, dword [r8 + rdi*4 + 0x408]
test ecx, ecx
je 0x556ff1
dec ecx
jne 0x557077
xor eax, eax
mov dword [r8 + rdi*4 + 8], eax
mov dword [r8 + rdi*4 + COleControlSite::XOleClientSite::AddRef], eax
mov rdi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x48]
add rsp, 0x38
ret
xor eax, eax
mov dword [r8 + rdi*4 + 8], eax
mov rdi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x48]
add rsp, 0x38
ret
xor eax, eax
mov qword [rsp + 0x50], rsi
lea rdx, [rsp + 0x20]
mov dword [r8 + rdi*4 + 8], eax
mov rsi, qword [rcx]
mov rcx, qword [rcx + 0x1a8]
lea r8d, [rax + 3]
xor r9d, r9d
mov byte [rsp + 0x20], 0xff
mov byte [rsp + 0x21], 0xfc
mov byte [rsp + 0x22], dil
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x55705a
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rsi
mov r8d, eax
call fcn.0052eee0
mov rcx, qword [rbx]
lea rdx, str.SENT
mov r9d, edi
mov r8d, 0xfc
call fcn.005566f0
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x48]
add rsp, 0x38
ret
Function at 0x557c80
Capabilities:
Send data
Send data on socket

Disassembly:
sub rsp, 0x48
mov rax, qword [rcx]
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbp
mov rbp, qword [rax + 0x1a8]
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x38], r13
xor r13d, r13d
mov r12, rcx
add rbp, 0x1408
mov edi, r13d
mov ebx, COleControlSite::XOleClientSite::AddRef
mov qword [rsp + 0x60], rsi
cmp edi, 1
je 0x557e54
cmp dword [rbp - 0xc00], 1
jne 0x557d87
mov rax, qword [r12]
mov rdx, qword [rax + 0x1a8]
mov ecx, dword [rbx + rdx - 0x400]
test ecx, ecx
je 0x557d1a
sub ecx, 2
je 0x557d0d
dec ecx
jne 0x557d87
cmp dword [rbx + rdx], r13d
jne 0x557d87
mov dword [rbx + rdx], 1
jmp 0x557d87
mov ecx, dword [rbx + rdx]
dec ecx
jne 0x557d87
mov dword [rbx + rdx], r13d
jmp 0x557d87
mov dword [rbx + rdx - 0x400], 2
mov rcx, qword [r12 + 0x1a8]
mov rsi, qword [r12]
xor r9d, r9d
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x20], 0xff
lea r8d, [r9 + 3]
mov byte [rsp + 0x21], 0xfb
mov byte [rsp + 0x22], dil
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x557d6e
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rsi
mov r8d, eax
call fcn.0052eee0
mov rcx, qword [r12]
lea rdx, str.SENT
mov r9d, edi
mov r8d, 0xfb
call fcn.005566f0
cmp dword [rbp], 1
jne 0x557e54
mov rax, qword [r12]
mov rdx, qword [rax + 0x1a8]
mov ecx, dword [rbx + rdx + 0x800]
test ecx, ecx
je 0x557de7
sub ecx, 2
je 0x557dd2
dec ecx
jne 0x557e54
cmp dword [rbx + rdx + 0xc00], r13d
jne 0x557e54
mov dword [rbx + rdx + 0xc00], 1
jmp 0x557e54
mov ecx, dword [rbx + rdx + 0xc00]
dec ecx
jne 0x557e54
mov dword [rbx + rdx + 0xc00], r13d
jmp 0x557e54
mov dword [rbx + rdx + 0x800], 2
mov rcx, qword [r12 + 0x1a8]
mov rsi, qword [r12]
xor r9d, r9d
lea rdx, [rsp + 0x24]
mov byte [rsp + 0x24], 0xff
lea r8d, [r9 + 3]
mov byte [rsp + 0x25], 0xfd
mov byte [rsp + 0x26], dil
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x557e3b
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rsi
mov r8d, eax
call fcn.0052eee0
mov rcx, qword [r12]
lea rdx, str.SENT
mov r9d, edi
mov r8d, 0xfd
call fcn.005566f0
inc edi
add rbx, 4
add rbp, 4
cmp edi, 0x28
jl 0x557cc1
mov r13, qword [rsp + 0x38]
mov r12, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
add rsp, 0x48
ret
Function at 0x557e90
Capabilities:
Send data
Send data on socket

Disassembly:
mov rax, rsp
sub rsp, 0x78
cmp edx, 0x1f
mov qword [rax + 0x18], rsi
mov qword [rax - 0x18], r14
mov qword [rax - 0x20], r15
mov r15, qword [rcx]
mov rsi, rcx
mov r14, qword [r15 + 0x1a8]
jne 0x5580f9
mov qword [rax + 8], rbx
lea rbx, [r14 + 0x1eb8]
mov qword [rax + 0x20], rdi
lea rdi, [r14 + 0x1cb8]
cmp rdi, rbx
mov qword [rbx], rdi
jae 0x557edd
mov byte [rdi], 0xff
inc qword [rbx]
mov rax, qword [rbx]
cmp rax, rbx
jae 0x557eeb
mov byte [rax], 0xfa
inc qword [rbx]
mov rax, qword [rbx]
cmp rax, rbx
jae 0x557ef9
mov byte [rax], Ordinal_33
inc qword [rbx]
movzx ecx, word [r14 + 0x1ca8]
mov qword [rsp + 0x88], rbp
call qword [sym.imp.WS2_32.dll_htons]
movzx ecx, word [r14 + 0x1caa]
movzx ebp, ax
mov word [rsp + 0x30], ax
call qword [sym.imp.WS2_32.dll_htons]
mov rcx, qword [rbx]
movzx r11d, ax
mov word [rsp + 0x34], ax
cmp rcx, rbx
jae 0x557f3c
mov byte [rcx], bpl
inc qword [rbx]
mov rdx, qword [rbx]
cmp rdx, rbx
jae 0x557f4e
movzx ecx, byte [rsp + 0x31]
mov byte [rdx], cl
inc qword [rbx]
mov rax, qword [rbx]
cmp rax, rbx
jae 0x557f5c
mov byte [rax], r11b
inc qword [rbx]
mov rcx, qword [rbx]
cmp rcx, rbx
jae 0x557f6e
movzx eax, byte [rsp + 0x35]
mov byte [rcx], al
inc qword [rbx]
mov rax, qword [rbx]
cmp rax, rbx
jae 0x557f7c
mov byte [rax], 0xff
inc qword [rbx]
mov rax, qword [rbx]
cmp rax, rbx
jae 0x557f8a
mov byte [rax], pe_nt_image_headers64
inc qword [rbx]
mov rax, qword [rbx]
lea r8, [r14 + 0x1cba]
mov edx, 0x3e
mov r9, rax
mov rcx, r15
mov qword [rbx], rdi
sub r9, rdi
mov qword [r14 + 0x1ec0], rax
sub r9, 2
call fcn.00557090
mov rcx, qword [rsi + 0x1a8]
xor r9d, r9d
lea r8d, [r9 + 3]
mov rdx, rdi
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x557fe8
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, r15
mov r8d, eax
call fcn.0052eee0
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x68], r13
lea r13, [r14 + 0x1cbb]
mov r12d, 4
nop
mov rax, r12
dec r12
test rax, rax
je 0x5580a0
movzx eax, byte [r13]
inc r13
mov ebp, 1
cmp al, 0xff
mov byte [rsp + 0x30], al
jne 0x55802d
mov byte [rsp + 0x31], al
mov ebp, 2
xor ebx, ebx
nop
mov rax, qword [rsi + 0x1a8]
mov edx, 1
lea rcx, [rsp + 0x40]
lea r8d, [rdx - 2]
mov qword [rsp + 0x40], rax
mov word [rsp + 0x48], 4
call fcn.0052fb00
inc eax
cmp eax, 1
jbe 0x5580a0
mov rdx, qword [rsi + 0x1a8]
lea rax, [rsp + 0x38]
movsxd rdi, ebp
mov r9, rdi
lea r8, [rsp + rbx + 0x30]
mov rcx, rsi
sub r9, rbx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x20], rax
call fcn.0052e870
add rbx, qword [rsp + 0x38]
test eax, eax
jne 0x5580a0
cmp rbx, rdi
jl 0x558030
jmp 0x558000
mov rcx, qword [rsi + 0x1a8]
xor r9d, r9d
lea rdx, [r14 + 0x1cbf]
lea r8d, [r9 + 2]
call qword [sym.imp.WS2_32.dll_send]
mov r13, qword [rsp + 0x68]
mov r12, qword [rsp + 0x70]
test eax, eax
mov rdi, qword [rsp + 0x98]
mov rbp, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x80]
jns 0x5580f9
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, r15
mov r8d, eax
call fcn.0052eee0
mov r15, qword [rsp + 0x58]
mov r14, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x90]
add rsp, 0x78
ret
Function at 0x558110
Capabilities:
Send data
Send data on socket

Disassembly:
sub rsp, 0x38
mov rax, qword [rcx]
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
mov rbx, qword [rax + 0x1a8]
mov qword [rsp + 0x50], rsi
movsxd rbp, edx
mov rsi, rcx
mov ecx, dword [rbx + rbp*4 + 8]
mov qword [rsp + 0x58], rdi
test ecx, ecx
je 0x5581dc
sub ecx, 2
je 0x558177
dec ecx
jne 0x5581a5
mov ecx, dword [rbx + rbp*4 + 0x408]
test ecx, ecx
je 0x55816d
dec ecx
jne 0x5581a5
mov dword [rbx + rbp*4 + 8], 1
mov dword [rbx + rbp*4 + COleControlSite::XOleClientSite::AddRef], ecx
jmp 0x5581a5
mov dword [rbx + rbp*4 + 8], 0
jmp 0x5581a5
mov ecx, dword [rbx + rbp*4 + 0x408]
test ecx, ecx
je 0x5581be
dec ecx
jne 0x5581a5
mov dword [rbx + rbp*4 + 8], 3
mov dword [rbx + rbp*4 + 0x1008], ecx
mov r8d, ebp
mov edx, 0xfc
mov rcx, rsi
call fcn.00556830
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
add rsp, 0x38
ret
mov dword [rbx + rbp*4 + 8], 1
cmp dword [rbx + rbp*4 + 0x1808], 1
jne 0x5581a5
mov edx, ebp
mov rcx, rsi
call fcn.00557e90
jmp 0x5581a5
cmp dword [rbx + rbp*4 + 0x808], 1
jne 0x55825c
mov dword [rbx + rbp*4 + 8], 1
mov rcx, qword [rsi + 0x1a8]
xor r9d, r9d
lea rdx, [rsp + 0x20]
lea r8d, [r9 + 3]
mov qword [rsp + 0x30], r12
mov r12, qword [rsi]
mov byte [rsp + 0x20], 0xff
mov byte [rsp + 0x21], 0xfb
mov byte [rsp + 0x22], bpl
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x55823a
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, r12
mov r8d, eax
call fcn.0052eee0
mov rcx, qword [rsi]
lea rdx, str.SENT
mov r9d, ebp
mov r8d, 0xfb
call fcn.005566f0
mov r12, qword [rsp + 0x30]
jmp 0x5581c6
cmp dword [rbx + rbp*4 + 0x1808], 1
jne 0x558195
mov r8d, ebp
mov edx, 0xfb
mov rcx, rsi
mov dword [rbx + rbp*4 + 8], 1
call fcn.00556830
mov edx, ebp
mov rcx, rsi
call fcn.00557e90
jmp 0x5581a5
Function at 0x559080
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub rsp, 0x48
mov rax, qword [0x0072f1d0]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rbp
mov rbp, qword [rcx + 0x1b0]
mov qword [rsp + 0x68], rsi
mov rsi, qword [rcx]
mov rbx, rcx
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x28]
mov rcx, rbp
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
mov rdi, 0xffffffffffffffff
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x5590f5
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x28]
mov rcx, rbp
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
call qword [sym.imp.WS2_32.dll_accept]
mov rdi, rax
mov rdx, rbp
mov rcx, rbx
call fcn.0053f420
cmp rdi, 0xffffffffffffffff
mov rbp, qword [rsp + 0x60]
jne 0x55911f
lea rdx, str.Error_accept__ing_server_connect
mov rcx, rsi
call fcn.0052eee0
lea eax, [rdi + 0x1f]
jmp 0x55918d
lea rdx, str.Connection_accepted_from_server_n
mov rcx, rsi
call fcn.0052ede0
mov edx, 1
mov rcx, rdi
mov qword [rbx + 0x1b0], rdi
call fcn.0056bb50
mov dword [rbx + 0x1cc], 1
mov rax, qword [rsi + 0x278]
test rax, rax
je 0x55918b
mov rcx, qword [rsi + 0x280]
mov r8d, 1
mov rdx, rdi
call rax
test eax, eax
je 0x55918b
mov rdx, rdi
mov rcx, rbx
call fcn.0053f420
mov qword [rbx + 0x1b0], 0xffffffffffffffff
mov eax, Ordinal_46
jmp 0x55918d
xor eax, eax
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x38]
call fcn.00693b90
add rsp, 0x48
ret
Function at 0x55dcf0
Capabilities:
Check http status code

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rsi
mov eax, 0x51eb851f
mov esi, r8d
mov r8d, edx
mov qword [rsp + 0x48], rdi
xor ebx, ebx
mov rdi, rcx
mov rcx, qword [rcx]
imul edx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp edx, 2
je 0x55dd4a
lea rdx, str.Couldnt_set_desired_mode
call fcn.0052eee0
lea eax, [rbx + 0x11]
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
add rsp, 0x28
ret
cmp r8d, 0xc8
je 0x55dd5f
lea rdx, str.Got_a__03d_response_code_instead_of_the_assumed_200_n
call fcn.0052ede0
cmp esi, 0x13
jne 0x55dddf
mov rax, qword [rdi]
lea rcx, [rdi + 0x568]
mov rdx, qword [rax + 0x1a8]
mov eax, dword [rdx + 0x18]
cmp eax, 1
jne 0x55dda7
mov r8, qword [rcx + 0x80]
test r8, r8
je 0x55dda7
lea rdx, str.SIZE__s
call fcn.0056bfe0
test eax, eax
mov ebx, eax
jne 0x55de13
mov dword [rdi + 0x620], 0x17
jmp 0x55de13
test eax, eax
je 0x55ddd5
cmp qword [rdi + 0x5e8], rbx
je 0x55ddd5
lea rdx, str.REST__d
xor r8d, r8d
call fcn.0056bfe0
test eax, eax
mov ebx, eax
jne 0x55de13
mov dword [rdi + 0x620], 0x1a
jmp 0x55de13
mov rcx, rdi
call fcn.0055d8b0
jmp 0x55de11
cmp esi, 0x14
jne 0x55ddee
mov rcx, rdi
call fcn.00559c90
jmp 0x55de11
cmp esi, 0x15
jne 0x55ddfd
mov rcx, rdi
call fcn.0055dbd0
jmp 0x55de11
cmp esi, 0x16
jne 0x55de13
lea edx, [rsi - 0x15]
lea r8d, [rsi - 8]
mov rcx, rdi
call fcn.0055cb20
mov ebx, eax
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x38]
add rsp, 0x28
ret

Function at 0x55e700
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub rsp, 0x48
cmp edx, 0xc8
mov qword [rsp + 0x58], rbx
mov ebx, dword [rcx + 0x614]
mov qword [rsp + 0x60], rbp
mov rbp, qword [rcx]
mov qword [rsp + 0x68], rdi
mov rdi, rcx
je 0x55e78a
test ebx, ebx
jne 0x55e740
lea rdx, str.disabling_EPRT_usage_n
mov rcx, rbp
call fcn.0052ede0
mov dword [rdi + 0x2ec], ebx
inc ebx
cmp ebx, 2
jne 0x55e76d
lea rdx, str.Failed_to_do_PORT
mov rcx, rbp
call fcn.0052eee0
lea eax, [rbx + 0x1c]
mov rdi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x58]
add rsp, 0x48
ret
mov edx, ebx
mov rcx, rdi
mov rdi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x58]
add rsp, 0x48
jmp 0x559410
lea rdx, str.Connect_data_stream_actively_n
mov rcx, rbp
call fcn.0052ede0
mov dword [rdi + 0x620], 0
mov rax, qword [rdi]
mov rcx, qword [rax + 0x1a8]
cmp dword [rcx + 0x18], 0
je 0x55e7e2
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov rcx, rdi
lea edx, [r9 - 1]
lea r8, [r9 - 1]
mov dword [rsp + 0x28], 0xffffffff
mov qword [rsp + 0x20], 0
call fcn.00568e60
jmp 0x55e7ec
mov dword [rdi + 0x2c8], 1
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x58]
mov dword [rdi + 0x5f4], 1
mov rdi, qword [rsp + 0x68]
xor eax, eax
add rsp, 0x48
ret
Function at 0x5664e0
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x148
mov rax, qword [0x0072f1d0]
mov qword [rsp + 0x130], rax
call qword [sym.imp.msvcrt.dll_getenv]
mov byte [rsp + 0x20], 0
test rax, rax
je 0x566541
lea rdx, [rsp + 0x20]
mov r8d, 0x104
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [rsp + 0x20], 0
je 0x566541
lea rcx, [rsp + 0x20]
call qword [0x0072f1f8]
mov rcx, qword [rsp + 0x130]
call fcn.00693b90
add rsp, 0x148
ret
xor eax, eax
mov rcx, qword [rsp + 0x130]
call fcn.00693b90
add rsp, 0x148
ret

Function at 0x566c70
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
call qword [sym.imp.msvcrt.dll__read]
cdqe
add rsp, 0x28
ret

Function at 0x56bb50
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x28
xor eax, eax
test edx, edx
lea r8, [rsp + 0x38]
setne al
mov edx, 0x8004667e
mov dword [rsp + 0x38], eax
call qword [sym.imp.WS2_32.dll_ioctlsocket]
add rsp, 0x28
ret

Function at 0x56d6c0
Capabilities:
Get hostname

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x40], rbx
movsxd rbx, edx
mov qword [rsp + 0x48], rdi
mov edx, ebx
mov rdi, rcx
mov byte [rcx], 0
call qword [sym.imp.WS2_32.dll_gethostname]
mov byte [rbx + rdi - 1], 0
mov rbx, qword [rsp + 0x40]
test eax, eax
jne 0x56d703
lea edx, [rax + 0x2e]
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_strchr]
test rax, rax
je 0x56d701
mov byte [rax], 0
xor eax, eax
mov rdi, qword [rsp + 0x48]
add rsp, 0x28
ret
Function at 0x570250
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
sub rsp, 0x38
mov eax, dword [rcx + 0x18]
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
lea r9d, [rax + rax]
mov eax, dword [rcx + 0x20]
mov rbx, rcx
lea rcx, [r9 + rax + 0x18]
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x30], r12
mov r12d, r8d
mov rbp, rdx
call qword [sub.msvcrt.dll_malloc]
test rax, rax
mov rdi, rax
je 0x57037b
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
mov qword [rdi + 0x10], rax
cmp r12d, dword [rbx + 0x1c]
jbe 0x5702d1
call qword [rbx]
mov rcx, qword [rdi + 8]
mov r8d, r12d
mov rdx, rbp
call qword [rbx + reloc.WS2_32.dll_htonl]
mov ebp, dword [rbx + 0x18]
mov rdx, qword [rdi + 8]
add rbp, qword [rdi + 0x10]
mov rcx, rbp
call qword [rbx + reloc.WS2_32.dll_recv]
mov r12d, dword [rbx + 0x20]
mov rcx, qword [rdi + 8]
mov qword [rsp + 0x50], rsi
call qword [rbx]
mov rcx, qword [rdi + 0x10]
call qword [rbx]
xor esi, esi
test r12, r12
je 0x570334
mov rsi, r12
nop
movzx eax, byte [rbp]
lea rdx, [rsp + 0x20]
mov r8d, 1
xor al, 0x36
mov byte [rsp + 0x20], al
mov rcx, qword [rdi + 8]
call qword [rbx + reloc.WS2_32.dll_htonl]
movzx r11d, byte [rbp]
lea rdx, [rsp + 0x20]
xor r11b, 0x5c
mov r8d, 1
inc rbp
mov byte [rsp + 0x20], r11b
mov rcx, qword [rdi + 0x10]
call qword [rbx + reloc.WS2_32.dll_htonl]
dec r12
jne 0x5702f0
mov eax, dword [rbx + 0x1c]
cmp rsi, rax
jae 0x570373
nop
mov rcx, qword [rdi + 8]
lea rdx, [0x006b631b]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov rcx, qword [rdi + 0x10]
lea rdx, [0x006b631c]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov eax, dword [rbx + 0x1c]
inc rsi
cmp rsi, rax
jb 0x570340
mov rsi, qword [rsp + 0x50]
mov rax, rdi
mov r12, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
add rsp, 0x38
ret
Function at 0x59b280
Capabilities:
Encode data using xor

Disassembly:
mov eax, reloc.WS2_32.dll_getservbyport
call fcn.00693bc0
sub rsp, rax
mov eax, dword [rcx]
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
cmp eax, 0x302
mov rbx, rdx
lea ebp, [r9 + 1]
mov rdx, rcx
jge 0x59b2c7
cmp eax, 0x100
je 0x59b2c7
cmp ebp, dword [rbx + 4]
jbe 0x59b2e4
xor eax, eax
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
add rsp, 0x38
ret
mov ecx, dword [rbx + 4]
lea eax, [rbp + r8]
cmp eax, ecx
ja 0x59b2b6
mov eax, r8d
add qword [rbx + 0x10], rax
add qword [rbx + 0x18], rax
sub ecx, r8d
mov dword [rbx + 4], ecx
mov ecx, dword [rbx + 4]
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x50], rsi
dec ecx
bt dword [rdx + 0x19c], 9
mov qword [rsp + 0x58], rdi
movzx edi, byte [rcx + rax]
mov esi, 0xffffffff
jae 0x59b34a
cmp qword [rdx + 0xe0], 0
jne 0x59b34a
mov rax, qword [rdx + 0x80]
mov rax, qword [rax + 8]
cmp rax, qword [0x007737b8]
jne 0x59b338
test dil, 1
jne 0x59b338
mov rax, qword [rdx + 0x80]
or dword [rax], 8
mov rax, qword [rdx + 0x80]
test byte [rax], 8
je 0x59b34a
test edi, edi
je 0x59b34a
add edi, esi
mov rcx, qword [rdx + 0xd0]
mov rcx, qword [rcx]
call fcn.005b43c0
bt eax, 0x15
jae 0x59b36e
sub esi, edi
mov eax, 1
add dword [rbx + 4], esi
jmp 0x59b43a
mov r10d, dword [rbx + 4]
lea ecx, [rdi + rbp]
mov qword [rsp + 0x28], r13
mov r13d, 0xff
mov r8d, r10d
mov eax, r10d
xor r8d, ecx
sub eax, ecx
not ecx
or r8d, eax
and ecx, r10d
lea eax, [r10 - 1]
not r8d
or r8d, ecx
sar r8d, 0x1f
cmp eax, r13d
cmovb r13d, eax
xor ebp, ebp
test r13d, r13d
je 0x59b407
mov r9d, edi
mov qword [rsp + 0x30], r12
mov r12, qword [rbx + 0x10]
sar r9d, 0x1f
mov r11d, edi
mov eax, ebp
xor eax, edi
or eax, r11d
add r11d, esi
not eax
sar eax, 0x1f
movzx edx, al
mov eax, ebp
not eax
sar eax, 0x1f
movzx ecx, al
movzx eax, r9b
and ecx, eax
mov eax, r10d
or edx, ecx
sub eax, ebp
inc ebp
dec eax
movzx ecx, byte [rax + r12]
xor ecx, edi
and edx, ecx
not edx
and r8d, edx
cmp ebp, r13d
jb 0x59b3c2
mov r12, qword [rsp + 0x30]
mov r13, qword [rsp + 0x28]
not r8d
movzx eax, r8b
lea ecx, [rax - 1]
not eax
sar eax, 0x1f
sar ecx, 0x1f
and ecx, eax
lea eax, [rdi + 1]
and eax, ecx
sub r10d, eax
shl eax, 8
or dword [rbx], eax
mov eax, ecx
not ecx
and eax, 1
mov dword [rbx + 4], r10d
or eax, ecx
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
add rsp, 0x38
ret