joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6bde30
Capabilities:
Create thread

Disassembly:
sub rsp, 0x48
mov rax, qword [0x00736490]
cmp byte [rax + 0x159], 0
jne 0x6bded3
cmp qword [0x007364c8], 0
jne 0x6bde76
call sub.kernel32.dll_GetCurrentThreadId_1
mov ecx, 3
mov rdx, qword [0x007272f0]
xor r8, r8
mov r9d, eax
call sub.user32.dll_SetWindowsHookExW
mov qword [0x007364c8], rax
cmp qword [0x007364c0], 0
jne 0x6bde98
xor rcx, rcx
xor rdx, rdx
xor r8, r8
xor r9, r9
call sub.kernel32.dll_CreateEventW
mov qword [0x007364c0], rax
cmp qword [0x007364d0], 0
jne 0x6bded3
xor rcx, rcx
mov edx, 0x3e8
mov r8, qword [0x007272e8]
xor r9, r9
mov dword [rsp + 0x20], 0
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
call sub.kernel32.dll_CreateThread_1
mov qword [0x007364d0], rax
add rsp, 0x48
ret

Function at 0x6bf120
Capabilities:
Enumerate gui resources

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x50
mov rbp, rsp
mov rbx, rcx
cmp qword [rbx + 0x2d0], 0
je 0x6bf206
cmp dword [rbx + 0x128], 0
jne 0x6bf1fc
mov rax, qword [rbx + 0x2d0]
mov qword [rbp + 0x40], rax
mov byte [rbp + 0x48], dl
lea rcx, [0x006bf000]
lea rdx, [rbp + 0x40]
call sub.user32.dll_EnumWindows
mov rax, qword [rbx + 0x120]
cmp dword [rax + 0x10], 0
je 0x6bf1fc
mov rcx, qword [rbp + 0x40]
mov edx, 3
call sub.user32.dll_GetWindow
mov qword [rbp + 0x40], rax
mov rcx, qword [rbp + 0x40]
mov edx, 0xffffffec
call sub.user32.dll_GetWindowLongPtrW
test rax, 8
je 0x6bf1aa
mov qword [rbp + 0x40], 0xfffffffffffffffe
mov rax, qword [rbx + 0x120]
mov esi, dword [rax + 0x10]
sub esi, 1
test esi, esi
jl 0x6bf1fb
mov rcx, qword [rbx + 0x120]
mov edx, esi
call fcn.00501190
mov rcx, rax
mov rdx, qword [rbp + 0x40]
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x30], 0x213
call sub.user32.dll_SetWindowPos
sub esi, 1
cmp esi, 0xffffffff
jne 0x6bf1bb
nop
lea rax, [rbx + 0x128]
add dword [rax], 1
lea rsp, [rbp + 0x50]
pop rbx
pop rsi
pop rbp
ret
Function at 0x6bf550
Capabilities:
Enumerate gui resources

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rbp, rsp
mov rbx, rcx
mov esi, edx
mov rax, qword [0x00736490]
cmp qword [rax + 0x2d0], 0
je 0x6bf72a
test sil, sil
jne 0x6bf649
cmp dword [rbx + 0x138], 0
jne 0x6bf63a
mov rcx, rbx
call fcn.006c3c90
lea rcx, [0x006bf3f0]
mov rdx, rax
call sub.user32.dll_EnumWindows
cmp qword [rbx + 0xa8], 0
je 0x6bf5fc
mov rax, qword [0x00736490]
cmp byte [rax + 0x193], 0
je 0x6bf5fc
mov rax, qword [rbx + 0x1a0]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x28]
test rax, rax
je 0x6bf5d5
mov rax, qword [rax - 8]
lea rdi, [rax - 1]
test edi, edi
jl 0x6bf5fb
mov rax, qword [rbx + 0x1a0]
movsxd rcx, edi
mov rcx, qword [rax + rcx*8]
xor rdx, rdx
call sub.user32.dll_ShowWindow
sub edi, 1
cmp edi, 0xffffffff
jne 0x6bf5dd
nop
mov rax, qword [rbx + 0x130]
mov edi, dword [rax + 0x10]
sub edi, 1
test edi, edi
jl 0x6bf639
mov rcx, qword [rbx + 0x130]
mov edx, edi
call fcn.00501190
mov rcx, rax
test sil, sil
setne al
movzx rax, al
neg eax
mov edx, eax
call sub.user32.dll_ShowOwnedPopups
sub edi, 1
cmp edi, 0xffffffff
jne 0x6bf60d
nop
lea rax, [rbx + 0x138]
add dword [rax], 1
jmp 0x6bf72a
cmp dword [rbx + 0x138], 0
jle 0x6bf72a
lea rax, [rbx + 0x138]
sub dword [rax], 1
cmp dword [rbx + 0x138], 0
jne 0x6bf72a
cmp qword [rbx + 0xa8], 0
je 0x6bf6c9
mov rax, qword [0x00736490]
cmp byte [rax + 0x193], 0
je 0x6bf6c9
mov rax, qword [rbx + 0x1a0]
mov qword [rbp + 0x20], rax
mov rax, qword [rbp + 0x20]
test rax, rax
je 0x6bf69f
mov rax, qword [rax - 8]
lea rdi, [rax - 1]
test edi, edi
jl 0x6bf6c8
mov rax, qword [rbx + 0x1a0]
movsxd rcx, edi
mov rcx, qword [rax + rcx*8]
mov edx, 5
call sub.user32.dll_ShowWindow
sub edi, 1
cmp edi, 0xffffffff
jne 0x6bf6a7
nop
mov rax, qword [rbx + 0x130]
mov edi, dword [rax + 0x10]
sub edi, 1
test edi, edi
jl 0x6bf706
mov rcx, qword [rbx + 0x130]
mov edx, edi
call fcn.00501190
mov rcx, rax
test sil, sil
setne al
movzx rax, al
neg eax
mov edx, eax
call sub.user32.dll_ShowOwnedPopups
sub edi, 1
cmp edi, 0xffffffff
jne 0x6bf6da
nop
mov rax, qword [rbx + 0x130]
mov rcx, rax
mov rsi, qword [rax]
call qword [rsi + 0x10]
lea rcx, [rbx + 0x1a0]
mov rdx, qword [0x006a94a8]
call fcn.00412500
lea rsp, [rbp + 0x38]
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x6c0930
Capabilities:
Get graphical window text

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x220
mov rbp, rsp
mov rbx, rcx
mov rsi, rdx
cmp byte [rbx + 0x158], 0
je 0x6c099f
cmp byte [rbx + 0x193], 0
jne 0x6c099f
mov rcx, qword [rbx + 0x2d0]
lea rdx, [rbp + 0x20]
mov r8d, pe_nt_image_headers64
call sub.user32.dll_GetWindowTextW
mov rcx, rsi
lea rdx, [rbp + 0x20]
mov r8d, eax
call fcn.0040f1b0
xor rax, rax
cmp qword [rsi], 0
je 0x6c098a
mov rax, qword [rsi]
mov eax, dword [rax - 4]
test eax, eax
jne 0x6c09ae
mov rcx, rsi
mov rdx, qword [rbx + 0x118]
call fcn.0040f520
jmp 0x6c09ae
mov rcx, rsi
mov rdx, qword [rbx + 0x118]
call fcn.0040f520
mov rax, rsi
lea rsp, [rbp + 0x220]
pop rbx
pop rsi
pop rbp
ret
Function at 0x6cd140
Capabilities:
Hide graphical window

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rbx, rcx
cmp qword [rbx + 0xc0], 0
jne 0x6cd1f6
mov rcx, qword [rbx + 0x10]
call fcn.005c0060
mov rcx, qword [0x005d31e0]
mov dl, 1
mov r8, rax
call fcn.005b6e70
mov qword [rbx + 0xc0], rax
mov rsi, qword [rbx + 0xc0]
mov rcx, rsi
xor rdx, rdx
call fcn.005d9f10
lea rax, [rsi + 0x4a8]
mov qword [rax + 8], rbx
lea rcx, [0x006cc7b0]
mov qword [rax], rcx
mov rcx, qword [rbx + 0xc0]
call fcn.005c0060
mov rsi, rax
mov ecx, 3
call sub.user32.dll_GetSystemMetrics
mov rcx, rsi
xor rdx, rdx
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x30], 8
call sub.user32.dll_SetWindowPos
mov rcx, qword [rbx + 0xc0]
call fcn.005c0060
mov rcx, rax
xor rdx, rdx
call sub.user32.dll_ShowWindow
cmp qword [rbx + 0xe0], 0
jne 0x6cd2a1
mov rcx, qword [rbx + 0x10]
call fcn.005c0060
mov rcx, qword [0x005d31e0]
mov dl, 1
mov r8, rax
call fcn.005b6e70
mov qword [rbx + 0xe0], rax
mov rsi, qword [rbx + 0xe0]
mov rcx, rsi
mov dl, 1
call fcn.005d9f10
lea rax, [rsi + 0x4a8]
mov qword [rax + 8], rbx
lea rcx, [0x006cc810]
mov qword [rax], rcx
mov rcx, qword [rbx + 0xe0]
call fcn.005c0060
mov rsi, rax
mov ecx, 2
call sub.user32.dll_GetSystemMetrics
mov rcx, rsi
xor rdx, rdx
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x30], 8
call sub.user32.dll_SetWindowPos
mov rcx, qword [rbx + 0xe0]
call fcn.005c0060
mov rcx, rax
xor rdx, rdx
call sub.user32.dll_ShowWindow
cmp qword [rbx + 0xd0], 0
jne 0x6cd33d
mov rcx, qword [rbx + 0x10]
call fcn.005c0060
mov rcx, qword [0x005d41a8]
mov dl, 1
mov r8, rax
call fcn.005b6e70
mov qword [rbx + 0xd0], rax
mov rax, qword [rbx + 0xd0]
mov byte [rax + 0x478], 1
mov rcx, qword [rbx + 0xd0]
call fcn.005c0060
mov rsi, rax
mov ecx, 2
call sub.user32.dll_GetSystemMetrics
mov edi, eax
mov ecx, 3
call sub.user32.dll_GetSystemMetrics
mov rcx, rsi
xor rdx, rdx
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], edi
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x30], 8
call sub.user32.dll_SetWindowPos
mov rcx, qword [rbx + 0xd0]
call fcn.005c0060
mov rcx, rax
xor rdx, rdx
call sub.user32.dll_ShowWindow
add rsp, 0x40
pop rbx
pop rsi
pop rdi
ret

Function at 0x6d4450
Capabilities:
Initialize winsock library

Disassembly:
push rbp
push rbx
sub rsp, 0x78
mov rbp, rsp
mov qword [rbp + 0x38], 0
nop
mov cx, 0x101
lea rdx, [0x007364f0]
call sub.wsock32.dll_WSAStartup
mov ebx, eax
test ebx, ebx
je 0x6d44ce
lea rcx, [rbp + 0x38]
mov edx, ebx
call fcn.00438520
mov rax, qword [rbp + 0x38]
mov qword [rbp + 0x40], rax
mov byte [rbp + 0x48], 0x11
mov dword [rbp + 0x50], ebx
mov byte [rbp + 0x58], 0
lea rax, [0x006d4510]
mov qword [rbp + 0x60], rax
mov byte [rbp + 0x68], 0x11
mov rcx, qword [0x006d2040]
mov dl, 1
mov r8, qword [0x0072b5c8]
lea r9, [rbp + 0x40]
mov dword [rsp + 0x20], 2
call fcn.0043a600
mov rcx, rax
call fcn.0040dfe0
nop
lea rcx, [rbp + 0x38]
call fcn.0040eef0
lea rsp, [rbp + 0x78]
pop rbx
pop rbp
ret
Function at 0x6d5040
Capabilities:
Set socket configuration

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x30
mov rbp, rsp
mov rbx, rcx
xor rsi, rsi
xor rax, rax
movzx rcx, byte [rbx + 0x40]
cmp cl, byte [0x006d50b4]
je 0x6d506e
mov esi, 0x401
mov rcx, rbx
call fcn.006d5230
mov rcx, qword [rbx + 8]
mov rdx, rax
mov r8d, esi
movzx r9, byte [rbx + 0x40]
call sub.wsock32.dll_WSAAsyncSelect
movzx rax, byte [rbx + 0x40]
cmp al, byte [0x006d50b4]
jne 0x6d50a9
mov dword [rbp + 0x2c], 0
mov rcx, qword [rbx + 8]
mov edx, 0x8004667e
lea r8, [rbp + 0x2c]
call sub.wsock32.dll_ioctlsocket
lea rsp, [rbp + 0x30]
pop rbx
pop rsi
pop rbp
ret

Function at 0x6d5180
Capabilities:
Connect socket

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
mov rcx, rbx
call fcn.006d5040
mov rcx, rbx
or edx, 0xffffffff
call fcn.0040c0d0
mov rsi, rax
mov rcx, rbx
mov rdx, rbx
mov r8b, 1
call rsi
mov rcx, qword [rbx + 8]
lea rdx, [rbx + 0x30]
mov r8d, 0x10
call sub.wsock32.dll_connect
mov ecx, eax
lea rdx, [0x006d5214]
call fcn.006d4340
mov byte [rbx + 0x41], 0
movzx rax, byte [rbx + 0x40]
test al, 0x10
jne 0x6d51fe
cmp qword [rbx + 8], 0xffffffffffffffff
setne al
mov byte [rbx + 0x10], al
mov rcx, rbx
or edx, 0xffffffff
call fcn.0040c0d0
mov rsi, rax
mov rcx, rbx
mov rdx, rbx
mov r8b, 2
call rsi
add rsp, 0x28
pop rbx
pop rsi
ret

Function at 0x6d5270
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rbp
sub rsp, 0x50
mov rbp, rsp
mov qword [rbp + 0x28], rbp
mov qword [rbp + 0x60], rcx
mov qword [rbp + 0x68], rdx
mov rcx, qword [rbp + 0x60]
call fcn.006d4dc0
nop
mov rcx, qword [rbp + 0x68]
call fcn.0040eef0
mov rax, qword [rbp + 0x60]
cmp qword [rax + 8], 0xffffffffffffffff
je 0x6d52e2
mov dword [rbp + 0x3c], 0x10
mov rax, qword [rbp + 0x60]
mov rcx, qword [rax + 8]
lea rdx, [rbp + 0x40]
lea r8, [rbp + 0x3c]
call sub.wsock32.dll_getsockname
test eax, eax
jne 0x6d52d6
mov ecx, dword [rbp + 0x44]
call sub.wsock32.dll_inet_ntoa
mov rcx, qword [rbp + 0x68]
mov rdx, rax
call fcn.004106e0
nop
mov rcx, qword [rbp + 0x60]
call fcn.006d4de0
jmp 0x6d52ee
xor rcx, rcx
mov rdx, qword [rbp + 0x28]
call fcn.006d5300
mov rax, qword [rbp + 0x68]
lea rsp, [rbp + 0x50]
pop rbp
ret
Function at 0x6d5840
Capabilities:
Resolve dns

Disassembly:
push rbp
push rbx
sub rsp, 0x48
mov rbp, rsp
mov qword [rbp + 0x20], rdx
mov qword [rbp + 0x28], 0
nop
lea rcx, [rbp + 0x28]
mov rdx, qword [rbp + 0x20]
xor r8, r8
call fcn.004101b0
mov rcx, qword [rbp + 0x28]
call fcn.0040ff70
mov rcx, rax
call sub.wsock32.dll_gethostbyname
mov rbx, rax
lea rcx, [rbp + 0x38]
mov edx, 4
xor r8, r8
call fcn.0040a9d0
test rbx, rbx
je 0x6d58cc
mov rax, qword [rbx + 0x18]
mov rax, qword [rax]
movzx rax, byte [rax]
mov byte [rbp + 0x38], al
mov rax, qword [rbx + 0x18]
mov rax, qword [rax]
movzx rax, byte [rax + 1]
mov byte [rbp + 0x39], al
mov rax, qword [rbx + 0x18]
mov rax, qword [rax]
movzx rax, byte [rax + 2]
mov byte [rbp + 0x3a], al
mov rax, qword [rbx + 0x18]
mov rax, qword [rax]
movzx rax, byte [rax + 3]
mov byte [rbp + 0x3b], al
mov eax, dword [rbp + 0x38]
mov dword [rbp + 0x3c], eax
nop
lea rcx, [rbp + 0x28]
call fcn.0040ef40
mov eax, dword [rbp + 0x3c]
lea rsp, [rbp + 0x48]
pop rbx
pop rbp
ret
Function at 0x6d61b0
Capabilities:
Send data
Send data on socket

Disassembly:
push rbp
push rbx
mov byte [rsp - 0x58], 0
mov byte [rsp - 0x1058], 0
sub rsp, 0x1058
mov rbp, rsp
mov qword [rbp + 0x28], rbp
mov qword [rbp + 0x1070], rcx
mov rcx, qword [rbp + 0x1070]
call fcn.006d4dc0
nop
mov byte [rbp + 0x104f], 0
mov rax, qword [rbp + 0x1070]
cmp qword [rax + 0x18], 0
je 0x6d638a
mov rax, qword [rbp + 0x1070]
cmp qword [rax + 8], 0xffffffffffffffff
je 0x6d6399
mov rax, qword [rbp + 0x1070]
cmp byte [rax + 0x10], 0
je 0x6d6399
mov rax, qword [rbp + 0x1070]
mov rcx, qword [rax + 0x18]
call fcn.00508ad0
mov dword [rbp + 0x48], eax
mov rax, qword [rbp + 0x1070]
mov rax, qword [rax + 0x18]
mov rcx, rax
lea rdx, [rbp + 0x4f]
mov r8d, 0x1000
mov rax, qword [rax]
call qword [rax + 0x18]
mov dword [rbp + 0x44], eax
cmp dword [rbp + 0x44], 0
jle 0x6d637a
mov rax, qword [rbp + 0x1070]
mov rcx, qword [rax + 8]
lea rdx, [rbp + 0x4f]
mov r8d, dword [rbp + 0x44]
xor r9, r9
call sub.wsock32.dll_send
mov dword [rbp + 0x40], eax
cmp dword [rbp + 0x40], 0xffffffff
jne 0x6d631b
call sub.wsock32.dll_WSAGetLastError
mov dword [rbp + 0x3c], eax
cmp dword [rbp + 0x3c], 0x2733
je 0x6d6305
mov rcx, qword [rbp + 0x1070]
mov dx, 0xfffe
call fcn.0040c0d0
mov rbx, rax
mov rcx, qword [rbp + 0x1070]
mov rdx, qword [rbp + 0x1070]
mov r8b, 1
lea r9, [rbp + 0x3c]
call rbx
mov rcx, qword [rbp + 0x1070]
mov rax, qword [rbp + 0x1070]
mov rdx, qword [rax + 8]
mov rax, qword [rbp + 0x1070]
mov rbx, qword [rax]
call qword [rbx + 0x10]
mov rcx, rbp
call fcn.006d6100
mov rax, qword [rbp + 0x1070]
movzx rax, byte [rax + 0x40]
cmp al, byte [0x006d63e8]
je 0x6d6382
call fcn.0043a150
jmp 0x6d6382
mov rax, qword [rbp + 0x1070]
mov rcx, qword [rax + 0x18]
movsxd rdx, dword [rbp + 0x48]
call fcn.00508af0
jmp 0x6d6382
mov eax, dword [rbp + 0x44]
cmp eax, dword [rbp + 0x40]
jle 0x6d6341
mov rax, qword [rbp + 0x1070]
mov rcx, qword [rax + 0x18]
mov edx, dword [rbp + 0x48]
add edx, dword [rbp + 0x40]
movsxd rdx, edx
call fcn.00508af0
jmp 0x6d621d
mov rax, qword [rbp + 0x1070]
mov rcx, qword [rax + 0x18]
call fcn.00508ad0
mov rbx, rax
mov rax, qword [rbp + 0x1070]
mov rax, qword [rax + 0x18]
mov rcx, rax
mov rax, qword [rax]
call qword [rax]
cmp rbx, rax
jne 0x6d621d
mov rcx, rbp
call fcn.006d6100
jmp 0x6d6382
mov rcx, rbp
call fcn.006d6100
nop
mov byte [rbp + 0x104f], 1
nop
mov rcx, qword [rbp + 0x1070]
call fcn.006d4de0
jmp 0x6d63a5
xor rcx, rcx
mov rdx, qword [rbp + 0x28]
call fcn.006d63c0
movzx rax, byte [rbp + 0x104f]
lea rsp, [rbp + 0x1058]
pop rbx
pop rbp
ret
Function at 0x6d6440
Capabilities:
Send data
Send data on socket

Disassembly:
push rbp
push rbx
sub rsp, 0x88
mov rbp, rsp
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x68], rbp
mov qword [rbp + 0xa0], rcx
mov qword [rbp + 0xa8], rdx
mov dword [rbp + 0xb0], r8d
nop
mov rcx, qword [rbp + 0xa0]
call fcn.006d4dc0
nop
mov dword [rbp + 0x7c], 0
mov rax, qword [rbp + 0xa0]
cmp byte [rax + 0x10], 0
je 0x6d658e
mov rax, qword [rbp + 0xa0]
mov rcx, qword [rax + 8]
mov rdx, qword [rbp + 0xa8]
mov r8d, dword [rbp + 0xb0]
xor r9, r9
call sub.wsock32.dll_send
mov dword [rbp + 0x7c], eax
cmp dword [rbp + 0x7c], 0xffffffff
jne 0x6d657f
call sub.wsock32.dll_WSAGetLastError
mov dword [rbp + 0x78], eax
cmp dword [rbp + 0x78], 0x2733
je 0x6d657f
mov rcx, qword [rbp + 0xa0]
mov dx, 0xfffe
call fcn.0040c0d0
mov rbx, rax
mov rcx, qword [rbp + 0xa0]
mov rdx, qword [rbp + 0xa0]
mov r8b, 1
lea r9, [rbp + 0x78]
call rbx
mov rcx, qword [rbp + 0xa0]
mov rax, qword [rbp + 0xa0]
mov rdx, qword [rax + 8]
mov rax, qword [rbp + 0xa0]
mov rbx, qword [rax]
call qword [rbx + 0x10]
cmp dword [rbp + 0x78], 0
je 0x6d657f
lea rcx, [rbp + 0x30]
mov edx, dword [rbp + 0x78]
call fcn.00438520
mov rax, qword [rbp + 0x30]
mov qword [rbp + 0x38], rax
mov byte [rbp + 0x40], 0x11
mov eax, dword [rbp + 0x78]
mov dword [rbp + 0x48], eax
mov byte [rbp + 0x50], 0
lea rax, [0x006d6620]
mov qword [rbp + 0x58], rax
mov byte [rbp + 0x60], 0x11
mov rcx, qword [0x006d2040]
mov dl, 1
mov r8, qword [0x0072b5c8]
lea r9, [rbp + 0x38]
mov dword [rsp + 0x20], 2
call fcn.0043a600
mov rcx, rax
call fcn.0040dfe0
nop
mov rcx, qword [rbp + 0xa0]
call fcn.006d4de0
jmp 0x6d659c
xor rcx, rcx
mov rdx, qword [rbp + 0x68]
call fcn.006d65c0
jmp 0x6d659d
nop
lea rcx, [rbp + 0x30]
call fcn.0040eef0
mov eax, dword [rbp + 0x7c]
lea rsp, [rbp + 0x88]
pop rbx
pop rbp
ret
Function at 0x6d66a0
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push rbp
push rbx
sub rsp, 0x88
mov rbp, rsp
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x68], rbp
mov qword [rbp + 0xa0], rcx
mov qword [rbp + 0xa8], rdx
mov dword [rbp + 0xb0], r8d
nop
mov rcx, qword [rbp + 0xa0]
call fcn.006d4dc0
nop
mov dword [rbp + 0x7c], 0
cmp dword [rbp + 0xb0], 0xffffffff
jne 0x6d6717
mov rax, qword [rbp + 0xa0]
cmp byte [rax + 0x10], 0
je 0x6d6717
mov rax, qword [rbp + 0xa0]
mov rcx, qword [rax + 8]
mov edx, 0x4004667f
lea r8, [rbp + 0x7c]
call sub.wsock32.dll_ioctlsocket
jmp 0x6d684c
mov rax, qword [rbp + 0xa0]
cmp byte [rax + 0x10], 0
je 0x6d685b
mov rax, qword [rbp + 0xa0]
mov rcx, qword [rax + 8]
mov edx, 0x4004667f
lea r8, [rbp + 0x74]
call sub.wsock32.dll_ioctlsocket
test eax, eax
jne 0x6d6760
cmp dword [rbp + 0x74], 0
jle 0x6d6760
mov eax, dword [rbp + 0x74]
cmp eax, dword [rbp + 0xb0]
jge 0x6d6760
mov eax, dword [rbp + 0x74]
mov dword [rbp + 0xb0], eax
mov rax, qword [rbp + 0xa0]
mov rcx, qword [rax + 8]
mov rdx, qword [rbp + 0xa8]
mov r8d, dword [rbp + 0xb0]
xor r9, r9
call sub.wsock32.dll_recv
mov dword [rbp + 0x7c], eax
cmp dword [rbp + 0x7c], 0xffffffff
jne 0x6d684c
call sub.wsock32.dll_WSAGetLastError
mov dword [rbp + 0x78], eax
cmp dword [rbp + 0x78], 0x2733
je 0x6d684c
mov rcx, qword [rbp + 0xa0]
mov dx, 0xfffe
call fcn.0040c0d0
mov rbx, rax
mov rcx, qword [rbp + 0xa0]
mov rdx, qword [rbp + 0xa0]
mov r8b, 2
lea r9, [rbp + 0x78]
call rbx
mov rcx, qword [rbp + 0xa0]
mov rax, qword [rbp + 0xa0]
mov rdx, qword [rax + 8]
mov rax, qword [rbp + 0xa0]
mov rbx, qword [rax]
call qword [rbx + 0x10]
cmp dword [rbp + 0x78], 0
je 0x6d684c
lea rcx, [rbp + 0x30]
mov edx, dword [rbp + 0x78]
call fcn.00438520
mov rax, qword [rbp + 0x30]
mov qword [rbp + 0x38], rax
mov byte [rbp + 0x40], 0x11
mov eax, dword [rbp + 0x78]
mov dword [rbp + 0x48], eax
mov byte [rbp + 0x50], 0
lea rax, [0x006d68e0]
mov qword [rbp + 0x58], rax
mov byte [rbp + 0x60], 0x11
mov rcx, qword [0x006d2040]
mov dl, 1
mov r8, qword [0x0072b5c8]
lea r9, [rbp + 0x38]
mov dword [rsp + 0x20], 2
call fcn.0043a600
mov rcx, rax
call fcn.0040dfe0
nop
mov rcx, qword [rbp + 0xa0]
call fcn.006d4de0
jmp 0x6d6869
xor rcx, rcx
mov rdx, qword [rbp + 0x68]
call fcn.006d6880
jmp 0x6d686a
nop
lea rcx, [rbp + 0x30]
call fcn.0040eef0
mov eax, dword [rbp + 0x7c]
lea rsp, [rbp + 0x88]
pop rbx
pop rbp
ret
Function at 0x6d7560
Capabilities:
Create a process with modified i/o handles and window
Create process on windows

Disassembly:
push rbp
push rbx
sub rsp, 0xf8
mov rbp, rsp
mov dword [rbp + 0x5c], r8d
mov qword [rbp + 0xe0], 0
mov qword [rbp + 0x110], rcx
mov qword [rbp + 0x118], rdx
mov rcx, qword [rbp + 0x110]
call fcn.0040f080
mov rcx, qword [rbp + 0x118]
call fcn.0040f080
nop
lea rcx, [rbp + 0xe0]
mov edx, 0x104
call fcn.00410900
xor rax, rax
mov byte [rbp + 0x5b], al
mov rcx, qword [rbp + 0x110]
call fcn.00410670
mov rbx, rax
mov rcx, qword [rbp + 0xe0]
call fcn.00410670
mov rcx, rbx
xor rdx, rdx
mov r8, rax
call sub.shell32.dll_FindExecutableW
mov dword [rbp + 0xec], eax
cmp dword [rbp + 0xec], 0x20
jb 0x6d76f8
mov rcx, qword [rbp + 0xe0]
call fcn.00410670
mov rcx, rax
call fcn.006d7550
lea rcx, [rbp + 0xe0]
mov edx, eax
call fcn.00410900
lea rcx, [rbp + 0x60]
mov edx, 0x68
xor r8, r8
call fcn.0040a9d0
mov dword [rbp + 0x60], 0x68
mov dword [rbp + 0x9c], 0x101
mov eax, dword [rbp + 0x5c]
mov word [rbp + 0xa0], ax
mov rcx, qword [rbp + 0xe0]
call fcn.00410670
mov rbx, rax
mov rcx, qword [rbp + 0x118]
call fcn.00410670
mov rcx, rbx
mov rdx, rax
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0x20
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
lea rax, [rbp + 0x60]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0xc8]
mov qword [rsp + 0x48], rax
call sub.kernel32.dll_CreateProcessW
test eax, eax
je 0x6d76ed
mov rcx, qword [rbp + 0xc8]
or edx, 0xffffffff
call sub.kernel32.dll_WaitForSingleObject_1
mov rcx, qword [rbp + 0xc8]
lea rdx, [rbp + 0xec]
call sub.kernel32.dll_GetExitCodeProcess
mov rcx, qword [rbp + 0xc8]
call sub.kernel32.dll_CloseHandle_2
mov rcx, qword [rbp + 0xd0]
call sub.kernel32.dll_CloseHandle_2
mov al, 1
mov byte [rbp + 0x5b], al
jmp 0x6d76f8
call sub.kernel32.dll_GetLastError
mov dword [rbp + 0xec], eax
nop
lea rcx, [rbp + 0xe0]
call fcn.0040eef0
lea rcx, [rbp + 0x110]
mov edx, 2
call fcn.0040efd0
movzx rax, byte [rbp + 0x5b]
lea rsp, [rbp + 0xf8]
pop rbx
pop rbp
ret
Function at 0x1400025a0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x1400025fd
lea rbx, [0x14005ac00]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x1400025e4
cmp r10, 2
jb 0x1400025e4
cmp byte [r9], r8b
jne 0x1400025e4
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x1400025c0
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x14000263f
lea rbx, [0x14005ac00]
cmp r8b, 0x23
jne 0x140002623
cmp byte [r9], r8b
jne 0x140002623
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x140002610
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x140002780
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x14000279a
mov qword [r8], 0
lea rdx, [0x14005a944]
call fcn.140002650
mov rbx, rax
test rax, rax
jne 0x1400027ba
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov esi, eax
cmp eax, 0xffffffff
je 0x140002891
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140002891
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x140002891
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140002891
cmp rdi, 0xffffffffffffffff
je 0x140002891
mov rax, qword [0x140069238]
test rax, rax
je 0x14000282e
inc dword [rax + 0xec]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x140002891
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x14000287e
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x140069238]
test rax, rax
je 0x140002873
dec dword [rax + 0xec]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x14000289a
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test r14, r14
je 0x14000288c
mov qword [r14], rdi
mov rax, rsi
jmp 0x14000289c
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x140004860
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
movsxd r8, dword [rcx + 0xc8]
mov rax, qword [rcx + 0xd0]
movsxd r9, edx
mov ebx, dword [rax + r8*4 - 4]
lea r8, [0x14005ac00]
not ebx
movzx eax, r9b
movzx ecx, bl
xor rcx, rax
shr ebx, 8
mov eax, r9d
shr eax, 8
movzx edx, al
mov eax, r9d
xor ebx, dword [r8 + rcx*4]
movzx ecx, bl
xor rdx, rcx
shr ebx, 8
shr eax, 0x10
xor ebx, dword [r8 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
mov rax, qword [0x140069238]
xor rdx, rcx
xor ebx, dword [r8 + rdx*4]
movzx ecx, bl
shr ebx, 8
mov edx, r9d
shr rdx, 0x18
xor rdx, rcx
xor ebx, dword [r8 + rdx*4]
not ebx
cmp dword [rax + 0x3e74], ebx
jne 0x1400048ed
mov dword [rax + 0x3e78], ebx
cmp dword [rax + 0x3ec0], ebx
jne 0x1400048fc
mov byte [rax + 0x3ec4], 1
cmp dword [rax + 0x3e5c], ebx
jne 0x140004913
mov r8, r9
mov edx, 4
mov ecx, ebx
call fcn.140016700
mov eax, ebx
add rsp, 0x20
pop rbx
ret