joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001b180
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push r12
push r13
push r15
sub rsp, 0x28
xor r15d, r15d
mov r13d, r9d
mov r12d, edx
mov ebp, r15d
cmp edx, 1
jl 0x14001b2e4
mov qword [rsp + 0x50], rbx
test rcx, rcx
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x20], r14
lea r14, [0x140054210]
mov rbx, r14
mov edi, r15d
cmovne rbx, rcx
test r8, r8
cmovne r14, r8
mov rsi, rbx
movzx ecx, word [r14]
test cx, cx
je 0x14001b2b0
cmp word [r14 + 2], di
je 0x14001b2b0
or rax, 0xffffffffffffffff
nop
inc rax
cmp word [r14 + rax*2], di
jne 0x14001b1f0
movsxd r15, eax
nop dword [rax]
mov r8, r15
mov rdx, r14
mov rcx, rbx
call sub.msvcrt.dll_wcsncmp
test eax, eax
je 0x14001b21d
cmp word [rbx], bp
je 0x14001b21d
add rbx, 2
jmp 0x14001b200
inc edi
cmp edi, r12d
je 0x14001b232
cmp word [rbx], bp
je 0x14001b23b
lea rbx, [rbx + r15*2]
mov rsi, rbx
jmp 0x14001b200
mov rbp, rbx
sub rbp, rsi
sar rbp, 1
xor r15d, r15d
mov rcx, rbx
call fcn.140028520
mov r14, qword [rsp + 0x20]
mov edi, eax
test eax, eax
je 0x14001b26a
mov ecx, r13d
call fcn.140028600
movsxd r8, ebp
mov rdx, rsi
mov rcx, rax
add r8, r8
call sub.msvcrt.dll_memmove
mov edx, r13d
mov ecx, ebp
call fcn.1400283a0
test edi, edi
mov rdi, qword [rsp + 0x60]
mov rbx, rax
jne 0x14001b28e
movsxd r8, ebp
mov rdx, rsi
mov rcx, rax
call sub.msvcrt.dll_wcsncpy
mov rsi, qword [rsp + 0x58]
movsxd rcx, ebp
mov word [rbx + rcx*2], r15w
mov rbx, qword [rsp + 0x50]
add rsp, 0x28
pop r15
pop r13
pop r12
pop rbp
ret
movzx eax, word [rbx]
cmp ax, cx
je 0x14001b2bd
test ax, ax
jne 0x14001b2d0
inc edi
cmp edi, edx
je 0x14001b2d6
test ax, ax
je 0x14001b23e
lea rsi, [rbx + 2]
add rbx, 2
jmp 0x14001b2b0
mov rbp, rbx
sub rbp, rsi
sar rbp, 1
jmp 0x14001b23e
mov ecx, r9d
add rsp, 0x28
pop r15
pop r13
pop r12
pop rbp
jmp fcn.1400285c0

Function at 0x14001b670
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
cmp edx, 0xd
jne 0x14001b6bd
mov ebx, 0x40
mov edx, r8d
mov ecx, ebx
call fcn.1400283a0
mov rdx, rdi
mov rcx, rax
call fcn.14004ad14
or rdx, 0xffffffffffffffff
inc rdx
cmp word [rax + rdx*2], 0
jne 0x14001b6a0
sub ebx, edx
mov ecx, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1400284e0
cmp edx, 1
je 0x14001b6db
cmp edx, 0x18
je 0x14001b6db
cmp edx, 3
je 0x14001b6d6
cmp edx, 0x19
je 0x14001b6d6
cmp edx, 0xb
jne 0x14001b6de
movzx edi, cx
jmp 0x14001b6de
movzx edi, cl
mov ebx, 0x20
mov edx, r8d
mov ecx, ebx
call fcn.1400283a0
lea rdx, [0x140054570]
mov r8d, edi
mov rcx, rax
call fcn.14004baa0
sub ebx, eax
mov ecx, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1400284e0
Function at 0x14001be44
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [0x14007ce20]
call fcn.140025e04
xor ebp, ebp
or esi, 0xffffffff
mov r14, rax
mov ebx, ebp
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
movzx edx, word [rax]
test dx, dx
je 0x14001bf41
mov rcx, qword [rsp + 0x40]
mov r9w, 0x22
cmp dx, 0x20
jne 0x14001be9b
add rax, 2
cmp word [rax], 0x20
je 0x14001be91
movzx edx, word [rax]
mov r8d, 1
cmp dx, r9w
jne 0x14001bed9
add rax, 2
mov rbx, rax
movzx ecx, word [rax]
test cx, cx
je 0x14001bf19
cmp cx, r9w
je 0x14001becb
add rax, 2
movzx ecx, word [rax]
test cx, cx
jne 0x14001beb9
cmp word [rax], bp
je 0x14001bf19
mov rcx, rax
add rax, 2
jmp 0x14001bf21
test dx, dx
je 0x14001bf1e
mov rbx, rax
cmp dx, 0x20
je 0x14001becb
add rax, 2
cmp word [rax], r9w
jne 0x14001bf0f
add rax, 2
movzx ecx, word [rax]
test cx, cx
je 0x14001bf19
cmp cx, r9w
je 0x14001bf0f
add rax, 2
movzx ecx, word [rax]
test cx, cx
jne 0x14001befd
movzx edx, word [rax]
test dx, dx
jne 0x14001bee1
jmp 0x14001becb
mov rcx, rax
jmp 0x14001bf21
mov r8d, ebp
cmp dword [r14], esi
jne 0x14001bf2b
test rdi, rdi
jne 0x14001bf4b
test r8d, r8d
je 0x14001bf32
inc esi
movzx edx, word [rax]
mov rbx, rbp
test dx, dx
jne 0x14001be8b
test rdi, rdi
jne 0x14001bf60
movsxd rax, esi
jmp 0x14001bf62
test rbx, rbx
je 0x14001bf60
sub rcx, rbx
mov rax, rbx
sar rcx, 1
mov dword [rdi], ecx
inc dword [r14]
jmp 0x14001bf62
mov dword [rdi], ebp
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret

Function at 0x14001c00c
Capabilities:
Get thread local storage value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x20
mov ebx, ecx
mov rcx, qword [0x14007ce20]
xor ebp, ebp
mov esi, edx
mov dword [rax + 8], ebp
call fcn.140025e04
test ebx, ebx
js 0x14001c03b
mov dword [rax], ebx
lea rcx, [rsp + 0x30]
call fcn.14001be44
mov edi, dword [rsp + 0x30]
mov edx, esi
mov ecx, edi
mov rbx, rax
call fcn.1400283a0
mov ecx, ebp
jmp 0x14001c077
test edi, edi
je 0x14001c07c
movzx edx, word [rbx]
cmp dx, 0x22
jne 0x14001c06a
inc ecx
jmp 0x14001c071
mov word [rax], dx
add rax, 2
add rbx, 2
dec edi
cmp word [rbx], bp
jne 0x14001c059
mov word [rax], bp
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
jmp fcn.1400284e0
Function at 0x14001c87c
Capabilities:
Initialize winsock library

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x1c0
mov ebx, reloc.WS2_32.dll_recv
lea r8, [fcn.14001c788]
lea ecx, [rbx + 0x28]
mov edx, ebx
call fcn.140026130
xor r8d, r8d
xor edx, edx
mov ecx, ebx
mov qword [0x1400775c8], rax
call fcn.140025e9c
xor ebx, ebx
cmp word [0x1400775c0], bx
mov qword [0x14007cee0], rax
jne 0x14001c9a7
lea rdx, [rsp + 0x20]
mov ecx, 0x101
call qword [sym.imp.WS2_32.dll_WSAStartup]
lea edi, [rbx + 1]
mov word [0x1400775c0], di
test eax, eax
je 0x14001c8ed
mov word [0x1400775c0], bx
lea rcx, str.ws2_32.dll
xor edx, edx
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov qword [0x1400775f0], rax
test rax, rax
je 0x14001c9a7
lea rdx, str.getaddrinfo
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1400775f0]
lea rdx, str.freeaddrinfo
mov qword [0x1400775d0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1400775f0]
lea rdx, str.getnameinfo
mov qword [0x1400775d8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1400775f0]
lea rdx, str.WSAStringToAddressA
mov qword [0x1400775e0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp qword [0x1400775d0], rbx
mov qword [0x1400775e8], rax
je 0x14001c9a7
cmp qword [0x1400775d8], rbx
je 0x14001c9a7
cmp qword [0x1400775e0], rbx
je 0x14001c9a7
mov ecx, dword [0x1400775c4]
test rax, rax
cmovne ecx, edi
mov dword [0x1400775c4], ecx
mov rbx, qword [rsp + 0x1d0]
add rsp, 0x1c0
pop rdi
ret

Function at 0x14001cfd4
Capabilities:
Send data
Send data on socket

Disassembly:
sub rsp, 0x38
cmp dword [rcx], 1
mov r10d, r8d
mov r11, rdx
jne 0x14001cff2
mov rcx, qword [rcx + 8]
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_send]
jmp 0x14001d030
cmp byte [rcx + 0x20], 0
lea r8, [rcx + 4]
mov edx, 0x1c
jne 0x14001d006
mov edx, reloc.WS2_32.dll_recv
mov rax, qword [rcx + 0x28]
test rax, rax
je 0x14001d014
mov rcx, qword [rax]
jmp 0x14001d018
mov rcx, qword [rcx + 0x30]
mov dword [rsp + 0x28], edx
mov qword [rsp + 0x20], r8
xor r9d, r9d
mov r8d, r10d
mov rdx, r11
call qword [sym.imp.WS2_32.dll_sendto]
cdqe
add rsp, 0x38
ret
Function at 0x14001d1cc
Capabilities:
Set socket configuration

Disassembly:
xor r9d, r9d
jmp 0x14001d1d4
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r12d, edx
mov rdi, rcx
mov rdx, rcx
mov rcx, qword [0x1400775c8]
mov r13, r9
mov esi, r8d
xor r14d, r14d
call fcn.140026068
mov rbx, rax
test rax, rax
je 0x14001d30a
cmp r12d, 0xffff
ja 0x14001d2f3
bt esi, 0x1c
jae 0x14001d237
lea r15d, [r14 + 0x17]
btr esi, 0x1c
jmp 0x14001d23d
mov r15d, 2
mov eax, 1
test esi, esi
mov ecx, r15d
cmove esi, eax
xor r8d, r8d
mov edx, esi
call qword [sym.imp.WS2_32.dll_socket]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x14001d2f3
lea r8, [rsp + 0x30]
mov edx, 0x8004667e
mov rcx, rax
mov dword [rsp + 0x30], 1
call qword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
jle 0x14001d2e5
xor ecx, ecx
lea r8, [rbx + 8]
cmp r15d, 0x17
mov rdx, rbp
mov r9, r8
sete cl
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r13
call fcn.14001e088
test eax, eax
je 0x14001d2e5
cmp esi, 1
jne 0x14001d2bd
lea edx, [rsi + 0x63]
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_listen]
test eax, eax
jne 0x14001d2e5
xor eax, eax
cmp r15d, 0x17
mov qword [rbx], rbp
sete al
cmp rdi, 0xffffffffffffffff
mov word [rbx + 0x24], si
mov word [rbx + 0x26], ax
mov rax, rdi
mov r14, rbx
cmove rax, rbx
mov qword [rbx + 0x28], rax
jmp 0x14001d2ee
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_closesocket]
test r14, r14
jne 0x14001d30a
mov rcx, qword [0x1400775c8]
cmp rdi, 0xffffffffffffffff
cmove rdi, rbx
mov rdx, rdi
call fcn.140025f9c
lea r11, [rsp + 0x40]
mov rax, r14
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14001d1d4
Capabilities:
Set socket configuration

Disassembly:
xor r9d, r9d
jmp 0x14001d1d4
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r12d, edx
mov rdi, rcx
mov rdx, rcx
mov rcx, qword [0x1400775c8]
mov r13, r9
mov esi, r8d
xor r14d, r14d
call fcn.140026068
mov rbx, rax
test rax, rax
je 0x14001d30a
cmp r12d, 0xffff
ja 0x14001d2f3
bt esi, 0x1c
jae 0x14001d237
lea r15d, [r14 + 0x17]
btr esi, 0x1c
jmp 0x14001d23d
mov r15d, 2
mov eax, 1
test esi, esi
mov ecx, r15d
cmove esi, eax
xor r8d, r8d
mov edx, esi
call qword [sym.imp.WS2_32.dll_socket]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x14001d2f3
lea r8, [rsp + 0x30]
mov edx, 0x8004667e
mov rcx, rax
mov dword [rsp + 0x30], 1
call qword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
jle 0x14001d2e5
xor ecx, ecx
lea r8, [rbx + 8]
cmp r15d, 0x17
mov rdx, rbp
mov r9, r8
sete cl
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r13
call fcn.14001e088
test eax, eax
je 0x14001d2e5
cmp esi, 1
jne 0x14001d2bd
lea edx, [rsi + 0x63]
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_listen]
test eax, eax
jne 0x14001d2e5
xor eax, eax
cmp r15d, 0x17
mov qword [rbx], rbp
sete al
cmp rdi, 0xffffffffffffffff
mov word [rbx + 0x24], si
mov word [rbx + 0x26], ax
mov rax, rdi
mov r14, rbx
cmove rax, rbx
mov qword [rbx + 0x28], rax
jmp 0x14001d2ee
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_closesocket]
test r14, r14
jne 0x14001d30a
mov rcx, qword [0x1400775c8]
cmp rdi, 0xffffffffffffffff
cmove rdi, rbx
mov rdx, rdi
call fcn.140025f9c
lea r11, [rsp + 0x40]
mov rax, r14
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14001d32c
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x760]
sub rsp, 0x860
mov rsi, rcx
mov rcx, qword [0x14007cee0]
xor edi, edi
mov r15d, edi
call fcn.140025e04
mov rcx, qword [rsi]
lea r12d, [rdi + 1]
mov r14, rax
cmp word [rsi + 0x24], r12w
jne 0x14001d3b5
xor r8d, r8d
xor edx, edx
call qword [sym.imp.WS2_32.dll_accept]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14001d527
lea rcx, [rsi + 0x30]
lea edx, [rdi + 0x28]
call fcn.140026b38
mov r15d, r12d
mov dword [rax], r12d
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov rcx, rax
mov rax, qword [rsi + 0x28]
mov qword [r14 + 8], rax
mov qword [r14], rcx
jmp 0x14001d527
xor r9d, r9d
mov r8d, 0x800
lea rdx, [rsp + 0x60]
cmp word [rsi + 0x26], di
je 0x14001d3e6
lea rax, [rbp + 0x7a0]
mov dword [rbp + 0x7a0], 0x1c
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
jmp 0x14001d401
lea rax, [rbp + 0x7a8]
mov dword [rbp + 0x7a8], reloc.WS2_32.dll_recv
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_recvfrom]
mov r12d, eax
test eax, eax
jle 0x14001d527
mov rbx, qword [rsi + 0x30]
mov r15d, 2
test rbx, rbx
je 0x14001d461
lea rcx, [rbx + 0x14]
cmp word [rsi + 0x26], di
je 0x14001d43e
movsxd r8, dword [rbp + 0x7a0]
lea rdx, [rsp + 0x40]
jmp 0x14001d44a
movsxd r8, dword [rbp + 0x7a8]
lea rdx, [rsp + 0x30]
call sub.msvcrt.dll_memcmp
test eax, eax
je 0x14001d458
mov rbx, qword [rbx]
jmp 0x14001d421
lea rdi, [rbx + 0x10]
test rbx, rbx
jne 0x14001d4b0
lea rcx, [rsi + 0x30]
mov edx, 0x60
call fcn.140026b38
xor r8d, r8d
mov dword [rax], r15d
mov qword [rax + 0x28], rsi
mov rdi, rax
mov al, byte [rsi + 0x26]
mov byte [rdi + 0x20], al
cmp word [rsi + 0x26], r8w
je 0x14001d4a6
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rdi + 4], xmm0
movsd xmm1, qword [rsp + 0x50]
movsd qword [rdi + 0x14], xmm1
mov eax, dword [rsp + 0x58]
mov dword [rdi + 0x1c], eax
jmp 0x14001d4b0
movups xmm0, xmmword [rsp + 0x30]
movdqu xmmword [rdi + 4], xmm0
mov r8, qword [rdi + 0x38]
mov rcx, qword [0x140076f14]
test r8, r8
jne 0x14001d4ec
movsxd rbx, r12d
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
lea rdx, [rsp + 0x60]
mov r8, rbx
mov rcx, rax
mov qword [rdi + 0x38], rax
mov dword [rdi + 0x40], r12d
mov qword [rdi + 0x48], rax
call sub.msvcrt.dll_memcpy
jmp 0x14001d51c
mov eax, dword [rdi + 0x40]
mov edx, 8
add eax, r12d
movsxd r9, eax
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
movsxd rcx, dword [rdi + 0x40]
lea rdx, [rsp + 0x60]
add rcx, rax
movsxd r8, r12d
mov qword [rdi + 0x38], rax
call sub.msvcrt.dll_memcpy
add dword [rdi + 0x40], r12d
mov qword [r14], rdi
mov rcx, qword [rsi + 0x28]
mov qword [r14 + 8], rcx
mov eax, r15d
mov rbx, qword [rsp + 0x8b0]
add rsp, 0x860
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14001dbbc
Capabilities:
Get socket status
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x950]
sub rsp, 0xa50
xor ebx, ebx
cmp dword [rcx], 1
mov rdi, rcx
jne 0x14001dc66
movsxd rcx, dword [rcx + 8]
lea rax, [rbp + 0x980]
lea rdx, [rsp + 0x40]
mov rdi, rcx
mov qword [rsp + 0x48], rcx
xor r9d, r9d
xor r8d, r8d
inc ecx
mov dword [rsp + 0x40], 1
mov qword [rbp + 0x980], rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_select]
test eax, eax
js 0x14001dc5f
je 0x14001dce5
lea rdx, [rsp + 0x40]
mov rcx, rdi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x14001dce5
lea r8, [rbp + 0x970]
mov edx, 0x4004667f
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
jne 0x14001dc5f
cmp dword [rbp + 0x970], ebx
je 0x14001dc5f
lea ebx, [rax + 2]
jmp 0x14001dce5
mov ebx, 4
jmp 0x14001dce5
mov rcx, qword [rcx + 0x30]
lea rax, [rbp + 0x978]
lea rdx, [rbp + 0x150]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
xor r9d, r9d
mov r8d, 0x800
mov dword [rbp + 0x978], reloc.WS2_32.dll_recv
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_recvfrom]
mov dword [rbp + 0x970], eax
test eax, eax
jle 0x14001dce5
mov rcx, qword [0x140076f14]
movsxd r8, eax
xor edx, edx
mov ebx, 2
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
movsxd rcx, dword [rbp + 0x970]
mov dword [rdi + 0x40], ecx
mov r8, rcx
lea rdx, [rbp + 0x150]
mov rcx, rax
mov qword [rdi + 0x38], rax
mov qword [rdi + 0x48], rax
call sub.msvcrt.dll_memcpy
movsxd rax, ebx
add rsp, 0xa50
pop rdi
pop rbx
pop rbp
ret

Function at 0x14001dcf4
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor esi, esi
cmp dword [rcx], 1
mov rax, rdx
mov rdi, rcx
jne 0x14001dd21
mov rcx, qword [rcx + 8]
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recv]
mov esi, eax
jmp 0x14001dd69
cmp qword [rcx + 0x38], rsi
je 0x14001dd69
cmp r8d, dword [rcx + 0x40]
mov rdx, qword [rcx + 0x48]
mov esi, r8d
cmovg esi, dword [rcx + 0x40]
mov rcx, rax
movsxd rbx, esi
mov r8, rbx
call sub.msvcrt.dll_memcpy
sub dword [rdi + 0x40], esi
add qword [rdi + 0x48], rbx
cmp dword [rdi + 0x40], 0
jne 0x14001dd69
mov r8, qword [rdi + 0x38]
mov rcx, qword [0x140076f14]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
and qword [rdi + 0x38], 0
mov rbx, qword [rsp + 0x30]
movsxd rax, esi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14001e184
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov dword [rax + 0x10], edx
push rdi
sub rsp, 0x20
xor ebx, ebx
mov rsi, r8
movsxd rdi, ecx
cmp edx, 0xffffffff
jne 0x14001e1ba
lea r8, [rax + 0x10]
mov rcx, rdi
mov edx, 0x4004667f
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov edx, dword [rsp + 0x38]
test edx, edx
je 0x14001e1fd
mov r8d, edx
mov rcx, rdi
mov r9d, 2
mov rdx, rsi
call qword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
jne 0x14001e1f1
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
add eax, 0xffffd8bb
and eax, 0xfffffffa
neg eax
sbb ebx, ebx
not ebx
and ebx, 0xfffffffe
jmp 0x14001e1fd
mov ecx, 0xfffffffe
test eax, eax
cmove eax, ecx
mov ebx, eax
mov rsi, qword [rsp + 0x40]
movsxd rax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14001e210
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub rsp, 0x28
cmp qword [0x140077608], 0
jne 0x14001e276
lea rcx, [0x140077608]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x14001e262
movabs rax, 0x20c49ba5e353f7cf
lea rcx, [0x140077610]
imul qword [0x140077608]
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov qword [0x140077608], rdx
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
cmp qword [0x140077608], 0
jne 0x14001e276
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov eax, eax
jmp 0x14001e29c
and qword [rsp + 0x30], 0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x30]
sub rax, qword [0x140077610]
cqo
idiv qword [0x140077608]
add rsp, 0x28
ret
Function at 0x14001e3a8
Capabilities:
Check os version

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x298]
sub rsp, 0x380
lea rcx, [rbp + 0x40]
mov ebx, 0xc8
xor r14d, r14d
xor edi, edi
xor r15d, r15d
mov dword [rbp + 0x40], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x14001e583
mov eax, dword [rbp + 0x50]
dec eax
je 0x14001e561
dec eax
jne 0x14001e583
lea r8d, [rbx + 0x54]
lea rcx, [rsp + 0x20]
xor edx, edx
xor esi, esi
call sub.msvcrt.dll_memset
lea rcx, str.ntdll.dll
mov dword [rsp + 0x20], 0x11c
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001e454
lea rdx, str.RtlGetVersion
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14001e454
lea rcx, [rsp + 0x20]
call rax
xor ecx, ecx
test eax, eax
sete cl
jmp 0x14001e456
xor ecx, ecx
test ecx, ecx
je 0x14001e476
mov r14d, dword [rsp + 0x24]
mov edi, dword [rsp + 0x28]
mov r15d, dword [rsp + 0x2c]
mov eax, 1
cmp byte [rbp + 0x3a], al
jne 0x14001e4a6
mov esi, eax
jmp 0x14001e4a6
lea rcx, [rbp + 0x160]
mov dword [rbp + 0x160], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x14001e4a6
mov r14d, dword [rbp + 0x44]
mov edi, dword [rbp + 0x48]
mov eax, 1
cmp byte [rbp + 0x27a], al
cmove esi, eax
sub r14d, 3
je 0x14001e55a
dec r14d
je 0x14001e553
dec r14d
je 0x14001e52d
dec r14d
je 0x14001e4e9
cmp r14d, 4
jne 0x14001e583
test edi, edi
jne 0x14001e583
cmp r15d, 0x55f0
sbb ebx, ebx
and ebx, 0xfffffff6
add ebx, 0x78
jmp 0x14001e583
test edi, edi
je 0x14001e521
dec edi
je 0x14001e515
dec edi
je 0x14001e509
dec edi
jne 0x14001e583
neg esi
sbb ebx, ebx
and ebx, 0xfffffffb
add ebx, 0x69
jmp 0x14001e583
neg esi
sbb ebx, ebx
and ebx, 0xfffffffb
add ebx, 0x5f
jmp 0x14001e583
neg esi
sbb ebx, ebx
and ebx, 0xfffffffb
add ebx, 0x55
jmp 0x14001e583
neg esi
sbb ebx, ebx
and ebx, 0xfffffffb
add ebx, 0x4b
jmp 0x14001e583
test edi, edi
je 0x14001e54c
dec edi
je 0x14001e545
dec edi
jne 0x14001e583
neg esi
sbb ebx, ebx
and ebx, 0xfffffffb
add ebx, 0x41
jmp 0x14001e583
mov ebx, 0x3c
jmp 0x14001e583
mov ebx, gethostbyname
jmp 0x14001e583
mov ebx, reloc.WS2_32.dll_sendto
jmp 0x14001e583
mov ebx, 5
jmp 0x14001e583
mov eax, dword [rbp + 0x48]
test eax, eax
je 0x14001e57e
cmp eax, 0xa
je 0x14001e577
cmp eax, 0x5a
jne 0x14001e583
lea ebx, [rax - 0x32]
jmp 0x14001e583
mov ebx, 0x1e
jmp 0x14001e583
mov ebx, 0xa
lea r11, [rsp + 0x380]
movsxd rax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret

Function at 0x14001e5f0
Capabilities:
Get hostname

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov edi, ecx
mov edx, ecx
mov ebx, reloc.WS2_32.dll_recv
mov ecx, ebx
call fcn.1400283a0
lea rdx, [rsp + 0x38]
mov dword [rsp + 0x38], ebx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
je 0x14001e62d
sub ebx, dword [rsp + 0x38]
mov ecx, ebx
call fcn.1400284e0
jmp 0x14001e634
mov ecx, edi
call fcn.1400285c0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14001e6a8
Capabilities:
Get memory capacity
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xe0
xor edx, edx
mov ebx, ecx
lea rcx, [rbp - 0x69]
lea r8d, [rdx + 0x40]
call sub.msvcrt.dll_memset
cmp ebx, 6
jne 0x14001e6df
lea rcx, [rbp - 0x29]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rbp - 0x25]
jmp 0x14001e759
lea rcx, [rbp - 0x69]
mov dword [rbp - 0x69], 0x40
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
je 0x14001e732
mov ecx, ebx
test ebx, ebx
je 0x14001e72c
dec ecx
je 0x14001e726
dec ecx
je 0x14001e720
dec ecx
je 0x14001e71a
dec ecx
je 0x14001e714
dec ecx
jne 0x14001e732
mov rax, qword [rbp - 0x49]
jmp 0x14001e759
mov rax, qword [rbp - 0x51]
jmp 0x14001e759
mov rax, qword [rbp - 0x39]
jmp 0x14001e759
mov rax, qword [rbp - 0x41]
jmp 0x14001e759
mov rax, qword [rbp - 0x59]
jmp 0x14001e759
mov rax, qword [rbp - 0x61]
jmp 0x14001e759
cmp ebx, 7
jne 0x14001e757
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8d, [rbx + 0x49]
lea rdx, [rbp + 7]
mov rcx, rax
call sub.PSAPI.DLL_GetProcessMemoryInfo
test eax, eax
je 0x14001e757
mov rax, qword [rbp + 0x4f]
jmp 0x14001e759
xor eax, eax
mov rbx, qword [rsp + 0xf0]
add rsp, 0xe0
pop rbp
ret