joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400d20a0
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1498
call fcn.140001875
sub rsp, rax
mov rax, qword [0x140119048]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov eax, dword [rsp + 0x14b8]
sar eax, 6
cdqe
lea rcx, [0x14011bb70]
mov edx, dword [rsp + 0x14b8]
and edx, 0x3f
movsxd rdx, edx
imul rdx, rdx, 0x48
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + rdx + 0x28]
mov qword [rsp + 0x60], rax
mov eax, dword [rsp + 0x14c8]
mov rcx, qword [rsp + 0x14c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x68]
mov rdi, rax
xor eax, eax
mov ecx, 0xc
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x14c0]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rax
jae 0x1400d2292
lea rax, [rsp + 0x147f]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x38], rax
jae 0x1400d21e6
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rax
jae 0x1400d21e6
mov rax, qword [rsp + 0x48]
movzx eax, byte [rax]
mov byte [rsp + 0x31], al
mov rax, qword [rsp + 0x48]
inc rax
mov qword [rsp + 0x48], rax
movzx eax, byte [rsp + 0x31]
mov byte [rsp + 0x30], al
movsx eax, byte [rsp + 0x30]
cmp eax, 0xa
jne 0x1400d21cb
mov eax, dword [rsp + 0x70]
inc eax
mov dword [rsp + 0x70], eax
mov rax, qword [rsp + 0x38]
mov byte [rax], 0xd
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx ecx, byte [rsp + 0x30]
mov byte [rax], cl
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
jmp 0x1400d2168
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
mov r8d, dword [rsp + 0x40]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1400d2252
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x68], eax
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x1400d22b1
mov eax, dword [rsp + 0x44]
mov ecx, dword [rsp + 0x6c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6c], eax
mov eax, dword [rsp + 0x40]
cmp dword [rsp + 0x44], eax
jae 0x1400d228d
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x1400d22b1
jmp 0x1400d213e
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.140002662
add rsp, 0x1498
pop rdi
pop rsi
ret
Function at 0x1400d2360
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1498
call fcn.140001875
sub rsp, rax
mov rax, qword [0x140119048]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov eax, dword [rsp + 0x14b8]
sar eax, 6
cdqe
lea rcx, [0x14011bb70]
mov edx, dword [rsp + 0x14b8]
and edx, 0x3f
movsxd rdx, edx
imul rdx, rdx, 0x48
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + rdx + 0x28]
mov qword [rsp + 0x68], rax
mov eax, dword [rsp + 0x14c8]
mov rcx, qword [rsp + 0x14c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x70]
mov rdi, rax
xor eax, eax
mov ecx, 0xc
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x14c0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x50], rax
jae 0x1400d256d
lea rax, [rsp + 0x147e]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x60]
cmp qword [rsp + 0x38], rax
jae 0x1400d24b9
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x50], rax
jae 0x1400d24b9
mov rax, qword [rsp + 0x50]
movzx eax, word [rax]
mov word [rsp + 0x40], ax
mov rax, qword [rsp + 0x50]
add rax, 2
mov qword [rsp + 0x50], rax
movzx eax, word [rsp + 0x40]
mov word [rsp + 0x30], ax
movzx eax, word [rsp + 0x30]
cmp eax, 0xa
jne 0x1400d2499
mov eax, dword [rsp + 0x78]
add eax, 2
mov dword [rsp + 0x78], eax
mov eax, 0xd
mov rcx, qword [rsp + 0x38]
mov word [rcx], ax
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx ecx, word [rsp + 0x30]
mov word [rax], cx
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
jmp 0x1400d2428
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov eax, eax
shl rax, 1
mov dword [rsp + 0x44], eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
mov r8d, dword [rsp + 0x44]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1400d252d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x70], eax
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x1400d258c
mov eax, dword [rsp + 0x48]
mov ecx, dword [rsp + 0x74]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x74], eax
mov eax, dword [rsp + 0x44]
cmp dword [rsp + 0x48], eax
jae 0x1400d2568
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x1400d258c
jmp 0x1400d23fe
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.140002662
add rsp, 0x1498
pop rdi
pop rsi
ret
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x00404700]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x00404710]
mov dword [rax], 1
mov rax, qword [0x00404720]
mov dword [rax], 1
mov rax, qword [0x004046f0]
mov dword [rax], 1
mov rax, qword [0x004045c0]
cmp word [rax], 0x5a4d
jne 0x401067
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x4010d0
mov rax, qword [0x004046e0]
mov dword [0x00407020], ecx
mov eax, dword [rax]
test eax, eax
je 0x4010c0
mov ecx, 2
call sym.__set_app_type
call dbg.__p__fmode
mov rdx, qword [0x004046a0]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg.__p__commode
mov rdx, qword [0x00404680]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x00404570]
cmp dword [rax], 1
je 0x401108
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x401084
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x401120
cmp dx, 0x20b
jne 0x401067
cmp dword [rax + 0x84], 0xe
jbe 0x401067
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x401067
lea rcx, [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x401067
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x401067

Function at 0x401e30
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call dbg.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call dbg.__acrt_iob_func
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sym.vfprintf
call sym.abort
nop
nop word [rax + rax]
Function at 0x401ea0
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x50
movsxd rbx, dword [0x004070d4]
mov r12, rcx
test ebx, ebx
jle 0x401fd0
mov rax, qword [0x004070d8]
xor ecx, ecx
add rax, 0x18
nop word [rax + rax]
mov rdx, qword [rax]
cmp rdx, r12
ja 0x401eec
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x401f73
add ecx, 1
add rax, 0x28
cmp ecx, ebx
jne 0x401ed0
mov rcx, r12
call dbg.__mingw_GetSectionForAddress
mov rsi, rax
test rax, rax
je 0x401ff2
mov rax, qword [0x004070d8]
lea rbx, [rbx + rbx*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rsi
mov dword [rax], 0
call dbg._GetPEImageBase
mov ecx, dword [rsi + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x004070d8]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x401fd7
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x401f6c
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x401f80
add dword [0x004070d4], 1
add rsp, 0x50
pop rbx
pop rsi
pop r12
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 4
mov eax, 0x40
cmovne r8d, eax
add rbx, qword [0x004070d8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x401f6c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call dbg.__report_error
nop dword [rax]
xor ebx, ebx
jmp 0x401ef7
mov rax, qword [0x004070d8]
mov edx, dword [rsi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call dbg.__report_error
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call dbg.__report_error
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x4024c0
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x00407140]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x00407120]
test rbx, rbx
je 0x402514
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x40250b
test r12, r12
je 0x40250b
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x4024f0
lea rcx, [0x00407140]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x402730
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x402748
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
je 0x402750
ret
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret
Function at 0x402760
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
mov r8, rdx
lea rdx, [rax + rcx]
movzx eax, word [rdx + 0x14]
lea rax, [rdx + rax + 0x18]
movzx edx, word [rdx + 6]
test edx, edx
je 0x4027ac
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov ecx, dword [rax + 0xc]
mov rdx, rcx
cmp rcx, r8
ja 0x4027a3
add edx, dword [rax + 8]
cmp rdx, r8
ja 0x4027ae
add rax, 0x28
cmp rax, r9
jne 0x402790
xor eax, eax
ret

Function at 0x4027b0
Capabilities:
Parse pe header

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
call sym.strlen
cmp rax, 8
ja 0x402840
mov rdx, qword [0x004045c0]
xor r12d, r12d
cmp word [rdx], 0x5a4d
jne 0x40282e
movsxd rax, dword [rdx + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
jne 0x40282e
cmp word [rax + 0x18], 0x20b
jne 0x40282e
movzx edx, word [rax + 0x14]
lea r12, [rax + rdx + 0x18]
movzx eax, word [rax + 6]
test eax, eax
je 0x402840
sub eax, 1
lea rax, [rax + rax*4]
lea rsi, [r12 + rax*8 + 0x28]
jmp 0x402819
add r12, 0x28
cmp r12, rsi
je 0x402840
mov r8d, 8
mov rdx, rbx
mov rcx, r12
call sym.strncmp
test eax, eax
jne 0x402810
mov rax, r12
add rsp, 0x20
pop rbx
pop rsi
pop r12
ret
xor r12d, r12d
mov rax, r12
add rsp, 0x20
pop rbx
pop rsi
pop r12
ret

Function at 0x402850
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x004045c0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x402870
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x402878
ret
cmp word [r8 + 0x18], 0x20b
jne 0x402870
movzx eax, word [r8 + 0x14]
sub rcx, rdx
movzx edx, word [r8 + 6]
lea rax, [r8 + rax + 0x18]
test edx, edx
je 0x4028c5
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x4028bc
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x402870
add rax, 0x28
cmp rax, r9
jne 0x4028a8
xor eax, eax
ret

Function at 0x4028d0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x004045c0]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x4028f0
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x4028f8
mov eax, r8d
ret
cmp word [rax + 0x18], 0x20b
jne 0x4028f0
movzx r8d, word [rax + 6]
mov eax, r8d
ret

Function at 0x402910
Capabilities:
Parse pe header

Disassembly:
mov r8, qword [0x004045c0]
xor eax, eax
cmp word [r8], 0x5a4d
jne 0x402930
movsxd rdx, dword [r8 + 0x3c]
add rdx, r8
cmp dword [rdx], 0x4550
je 0x402938
ret
cmp word [rdx + 0x18], 0x20b
jne 0x402930
movzx eax, word [rdx + 0x14]
lea rax, [rdx + rax + 0x18]
movzx edx, word [rdx + 6]
test edx, edx
je 0x402978
sub edx, 1
lea rdx, [rdx + rdx*4]
lea rdx, [rax + rdx*8 + 0x28]
nop dword [rax]
test byte [rax + 0x27], 0x20
je 0x40296f
test rcx, rcx
je 0x402930
sub rcx, 1
add rax, 0x28
cmp rax, rdx
jne 0x402960
xor eax, eax
ret

Function at 0x402980
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x004045c0]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x4029a0
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
cmp dword [rdx], 0x4550
je 0x4029a8
mov rax, r8
ret
cmp word [rdx + 0x18], 0x20b
cmove r8, rax
mov rax, r8
ret
Function at 0x4029c0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rax, qword [0x004045c0]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x4029e0
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
cmp dword [rdx], 0x4550
je 0x4029e8
mov eax, r8d
ret
cmp word [rdx + 0x18], 0x20b
jne 0x4029e0
sub rcx, rax
movzx eax, word [rdx + 0x14]
lea rax, [rdx + rax + 0x18]
movzx edx, word [rdx + 6]
test edx, edx
je 0x4029e0
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x402a24
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x402a38
add rax, 0x28
cmp r9, rax
jne 0x402a10
xor r8d, r8d
mov eax, r8d
ret
mov r8d, dword [rax + 0x24]
not r8d
shr r8d, 0x1f
mov eax, r8d
ret

Function at 0x402a50
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov r11, qword [0x004045c0]
xor r9d, r9d
cmp word [r11], 0x5a4d
jne 0x402a72
movsxd r8, dword [r11 + 0x3c]
add r8, r11
cmp dword [r8], 0x4550
je 0x402a80
mov rax, r9
ret
cmp word [r8 + 0x18], 0x20b
jne 0x402a72
mov eax, dword [r8 + 0x90]
test eax, eax
je 0x402a72
movzx edx, word [r8 + 0x14]
lea rdx, [r8 + rdx + 0x18]
movzx r8d, word [r8 + 6]
test r8d, r8d
je 0x402a72
sub r8d, 1
lea r8, [r8 + r8*4]
lea r10, [rdx + r8*8 + 0x28]
nop dword [rax]
mov r9d, dword [rdx + 0xc]
mov r8, r9
cmp rax, r9
jb 0x402acd
add r8d, dword [rdx + 8]
cmp rax, r8
jb 0x402ae0
add rdx, 0x28
cmp r10, rdx
jne 0x402ab8
xor r9d, r9d
mov rax, r9
ret
add rax, r11
jmp 0x402aef
sub ecx, 1
add rax, 0x14
mov r8d, dword [rax + 4]
test r8d, r8d
jne 0x402aff
mov edx, dword [rax + 0xc]
test edx, edx
je 0x402ad6
test ecx, ecx
jg 0x402ae8
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
ret
Function at 0x140008650
Capabilities:
Hash data using crc32b

Disassembly:
xor r9d, r9d
lea r10, [0x140123860]
nop word [rax + rax]
xor eax, eax
test r9b, 1
je 0x14000866c
bts eax, 7
mov ecx, r9d
shr ecx, 1
test cl, 1
je 0x14000867a
bts eax, 6
shr ecx, 1
test cl, 1
je 0x140008685
bts eax, 5
shr ecx, 1
test cl, 1
je 0x140008690
bts eax, 4
shr ecx, 1
test cl, 1
je 0x14000869b
bts eax, 3
shr ecx, 1
test cl, 1
je 0x1400086a6
bts eax, 2
shr ecx, 1
test cl, 1
je 0x1400086b1
bts eax, 1
test cl, 2
je 0x1400086ba
bts eax, 0
shl eax, 0x18
lea ecx, [rax + rax]
mov edx, ecx
xor edx, 0x4c11db7
test eax, eax
cmovns edx, ecx
lea eax, [rdx + rdx]
mov ecx, eax
xor ecx, 0x4c11db7
test edx, edx
cmovns ecx, eax
lea eax, [rcx + rcx]
mov edx, eax
xor edx, 0x4c11db7
test ecx, ecx
cmovns edx, eax
lea eax, [rdx + rdx]
mov ecx, eax
xor ecx, 0x4c11db7
test edx, edx
cmovns ecx, eax
lea eax, [rcx + rcx]
mov edx, eax
xor edx, 0x4c11db7
test ecx, ecx
cmovns edx, eax
lea eax, [rdx + rdx]
mov ecx, eax
xor ecx, 0x4c11db7
test edx, edx
cmovns ecx, eax
lea eax, [rcx + rcx]
mov edx, eax
xor edx, 0x4c11db7
test ecx, ecx
cmovns edx, eax
lea eax, [rdx + rdx]
mov r8d, eax
xor r8d, 0x4c11db7
test edx, edx
cmovns r8d, eax
xor ecx, ecx
lea edx, [rcx + 0x1e]
test r8b, 1
je 0x140008751
lea eax, [rdx + 1]
bts ecx, eax
sar r8d, 1
test r8b, 1
je 0x14000875d
bts ecx, edx
sar r8d, 1
sub edx, 2
cmp edx, 0xfffffffe
jg 0x140008745
mov dword [r10], ecx
inc r9d
add r10, 4
cmp r9d, 0x100
jl 0x140008660
mov dword [0x140123850], 1
ret
Function at 0x14000b580
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp dword [r8 + 0x38], 1
mov rdi, r9
mov rbx, r8
mov r14, rdx
mov rbp, rcx
je 0x14000b5af
xor eax, eax
jmp 0x14000b767
mov ecx, dword [r9 + 0x10]
mov qword [rsp + 0x30], rsi
call qword [sym.imp.WS2_32.dll_ntohl]
mov esi, eax
lea rax, [rsi - 1]
cmp rax, 0xfe
ja 0x14000b728
mov ecx, dword [rdi + 0x1c]
call qword [sym.imp.WS2_32.dll_ntohl]
cmp eax, dword [rbx + 0xa4]
jne 0x14000b728
mov ecx, dword [rdi + 0x20]
call qword [sym.imp.WS2_32.dll_ntohl]
cmp eax, dword [rbx + 0x9c]
jne 0x14000b728
mov ecx, dword [rdi + 0x24]
call qword [sym.imp.WS2_32.dll_ntohl]
cmp eax, dword [rbx + 0xa0]
jne 0x14000b728
mov eax, dword [rbx + 0x1c]
cmp dword [rdi + 0x28], eax
jne 0x14000b728
mov edx, 1
mov r8b, 0xff
mov rcx, rbx
call fcn.14000b780
cmp rsi, qword [rbx + 0x48]
jae 0x14000b635
mov qword [rbx + 0x48], rsi
movzx ecx, word [rdi + 4]
call qword [sym.imp.WS2_32.dll_ntohs]
mov word [rbx + 0x18], ax
movzx eax, byte [rdi + 6]
mov byte [rbx + 0x21], al
movzx eax, byte [rdi + 7]
mov byte [rbx + 0x20], al
mov ecx, dword [rdi + 8]
call qword [sym.imp.WS2_32.dll_ntohl]
mov ecx, 0x240
mov esi, 0x1000
cmp eax, ecx
jb 0x14000b66f
cmp eax, esi
mov ecx, eax
cmova ecx, esi
cmp ecx, dword [rbx + 0xd0]
jae 0x14000b67d
mov dword [rbx + 0xd0], ecx
mov ecx, dword [rdi + 0xc]
call qword [sym.imp.WS2_32.dll_ntohl]
cmp eax, esi
jb 0x14000b696
mov ecx, 0x10000
mov esi, eax
cmp eax, ecx
cmova esi, ecx
cmp esi, dword [rbx + 0xd4]
jae 0x14000b6a4
mov dword [rbx + 0xd4], esi
mov ecx, dword [rdi + 0x14]
call qword [sym.imp.WS2_32.dll_ntohl]
mov dword [rbx + 0x50], eax
mov ecx, dword [rdi + 0x18]
call qword [sym.imp.WS2_32.dll_ntohl]
mov dword [rbx + 0x54], eax
mov rcx, rbx
mov dword [rbp + 0x24], 1
test r14, r14
je 0x14000b6f0
call fcn.140008cc0
mov dword [rbx + 0x38], 5
mov dword [r14], 1
mov qword [r14 + 8], rbx
mov eax, dword [rbx + 0x1c8]
mov dword [r14 + 0x14], eax
xor eax, eax
jmp 0x14000b762
xor edi, edi
cmp dword [rbx + 0x38], 1
sete dil
add edi, 3
call fcn.140008cf0
cmp dword [rbx + 0x140], 0
mov dword [rbx + 0x38], edi
jne 0x14000b724
lea rcx, [rbp + 0x48]
mov rdx, rbx
call fcn.140008470
mov dword [rbx + 0x140], 1
xor eax, eax
jmp 0x14000b762
xor edi, edi
mov rcx, rbx
mov dword [rbx + 0x1c8], edi
call fcn.140008cf0
mov dword [rbx + 0x38], 9
cmp dword [rbx + 0x140], edi
jne 0x14000b75d
lea rcx, [rbp + 0x48]
mov rdx, rbx
call fcn.140008470
mov dword [rbx + 0x140], 1
mov eax, 0xffffffff
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x14000c660
Capabilities:
Resolve dns

Disassembly:
push rbx
push r14
sub rsp, 0x58
mov rax, qword [0x140120600]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov r14, rcx
mov rbx, rdx
mov rcx, rdx
call qword [sym.imp.WS2_32.dll_gethostbyname]
test rax, rax
je 0x14000c6a5
cmp word [rax + 0x10], 2
jne 0x14000c6a5
mov rax, qword [rax + 0x18]
mov rcx, qword [rax]
mov eax, dword [rcx]
mov dword [r14], eax
xor eax, eax
jmp 0x14000c759
mov qword [rsp + 0x80], rbp
mov qword [rsp + 0x50], rsi
xor esi, esi
mov qword [rsp + 0x48], rdi
mov ebp, esi
mov qword [rsp + 0x40], r15
mov edi, esi
mov dword [rsp + 0x28], 0
lea r15d, [rsi + 0x2e]
nop
lea rdx, [rbx + 1]
mov qword [rsp + 0x20], rdx
cmp byte [rbx], 0x30
je 0x14000c713
mov r8d, 0xa
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtol]
cmp eax, 0xff
ja 0x14000c73b
mov rdx, qword [rsp + 0x20]
cmp rdx, rbx
je 0x14000c73b
mov rcx, rdx
sub rcx, rbx
cmp rcx, 3
jg 0x14000c73b
mov byte [rsp + rdi + 0x28], al
movsx eax, byte [rdx]
cmp ebp, 3
mov ecx, esi
cmovl ecx, r15d
cmp eax, ecx
jne 0x14000c73b
inc ebp
lea rbx, [rdx + 1]
inc rdi
cmp rdi, 4
jl 0x14000c6d0
mov eax, dword [rsp + 0x28]
mov dword [r14], eax
jmp 0x14000c740
mov esi, 0xffffffff
mov r15, qword [rsp + 0x40]
mov eax, esi
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400db680
add rsp, 0x58
pop r14
pop rbx
ret

Function at 0x14000c780
Capabilities:
Initialize winsock library

Disassembly:
sub rsp, 0x1d8
mov rax, qword [0x140120600]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov ecx, 0x101
lea rdx, [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x14000c7e9
movzx eax, word [rsp + 0x20]
cmp al, 1
jne 0x14000c7e3
shr ax, 8
cmp al, 1
jne 0x14000c7e3
mov ecx, 1
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
xor eax, eax
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.1400db680
add rsp, 0x1d8
ret
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.1400db680
add rsp, 0x1d8
ret

Function at 0x14000c8e0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x140120600]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rdx
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
lea rdx, [rsp + 0x28]
lea r8, [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
jne 0x14000c928
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400db680
add rsp, 0x40
pop rbx
ret
mov eax, dword [rsp + 0x2c]
movzx ecx, word [rsp + 0x2a]
mov dword [rbx], eax
call qword [sym.imp.WS2_32.dll_ntohs]
mov word [rbx + 4], ax
xor eax, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400db680
add rsp, 0x40
pop rbx
ret