joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400886e0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x98
lea rbp, [rsp + 0xd0]
xorps xmm4, xmm4
movaps xmmword [rbp - 0x50], xmm4
xor eax, eax
mov qword [rbp - 0x40], rax
mov rbx, rdx
mov rsi, r8
mov rdi, r9
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x48], rcx
lea rdx, [rbp - 0x40]
cmp dword [rcx], ecx
call fcn.140235120
nop
test rbx, rbx
je 0x140088736
add rbx, 0xc
mov rdx, rbx
jmp 0x140088738
xor edx, edx
mov qword [rbp - 0x50], rdx
mov rcx, qword [rbp - 0x48]
mov rbx, qword [rbp + 0x30]
mov qword [rsp + 0x20], rbx
mov rbx, qword [rbp + 0x38]
mov qword [rsp + 0x28], rbx
mov rcx, qword [rcx + 8]
mov qword [rbp - 0x80], rcx
mov qword [rbp - 0x88], rdx
mov r8, rsi
mov qword [rbp - 0x90], r8
mov r9, rdi
mov qword [rbp - 0x98], r9
lea rcx, [rbp - 0x78]
call fcn.14000c8e0
mov rcx, qword [rbp - 0x80]
mov rdx, qword [rbp - 0x88]
mov r8, qword [rbp - 0x90]
mov r9, qword [rbp - 0x98]
call sub.ADVAPI32.dll_RegQueryValueExW
mov ebx, eax
lea rcx, [rbp - 0x78]
call fcn.14000c930
nop
xor ecx, ecx
mov qword [rbp - 0x50], rcx
cmp byte [rbp - 0x40], 0
je 0x1400887c1
mov rcx, qword [rbp - 0x48]
cmp byte [rcx], cl
xor edx, edx
call fcn.140235160
mov eax, ebx
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret

Function at 0x1400b39f0
Capabilities:
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0xb0]
mov rbx, rcx
mov rsi, rdx
mov edi, r8d
xor ecx, ecx
mov dword [r9], ecx
mov qword [rbp - 0x40], r9
mov r14, r9
call sub.KERNEL32.dll_SetLastError
mov r15, qword [rbp + 0x30]
mov qword [rsp + 0x20], r15
mov rcx, rbx
mov qword [rbp - 0x74], rcx
mov rdx, rsi
mov qword [rbp - 0x7c], rdx
mov r8d, edi
mov dword [rbp - 0x6c], r8d
mov r9, r14
mov qword [rbp - 0x84], r9
lea rcx, [rbp - 0x68]
call fcn.14000c8e0
mov rcx, qword [rbp - 0x74]
mov rdx, qword [rbp - 0x7c]
mov r8d, dword [rbp - 0x6c]
mov r9, qword [rbp - 0x84]
call sub.KERNEL32.dll_WriteFile
mov ebx, eax
lea rcx, [rbp - 0x68]
call fcn.14000c930
call sub.KERNEL32.dll_GetLastError
mov esi, eax
xor eax, eax
mov qword [rbp - 0x40], rax
mov rax, qword gs:[0x58]
mov ecx, dword [0x140989d34]
mov edx, reloc.WS2_32.dll_recv
add rdx, qword [rax + rcx*8]
mov rdi, qword [rdx]
test rdi, rdi
je 0x1400b3abc
mov dword [rdi + 0xd8], esi
mov eax, ebx
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov rcx, rdx
lea rax, [0x140253180]
call rax
mov rdi, rax
jmp 0x1400b3aa3
Function at 0x1400bbbec
Capabilities:
Create process on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0xd8
lea rbp, [rsp + 0x110]
xor eax, eax
mov qword [rbp - 0x68], rax
xorps xmm4, xmm4
movaps xmmword [rbp - 0x60], xmm4
mov qword [rbp - 0x50], rax
mov rbx, rdx
mov r14, qword [rbp + 0x48]
mov rsi, qword [rbp + 0x50]
mov rdi, qword [rbp + 0x58]
cmp byte [rbp + 0x30], 0
setne r15b
movzx r15d, r15b
mov qword [rbp - 0x40], rdi
mov qword [rbp - 0x48], rsi
test r14, r14
je 0x1400bbc46
add r14, 0xc
jmp 0x1400bbc49
xor r14d, r14d
mov qword [rbp - 0x50], r14
mov qword [rbp - 0x58], r9
mov r13, r9
mov qword [rbp - 0x60], r8
mov r12, r8
test rcx, rcx
je 0x1400bbc69
add rcx, 0xc
mov rax, rcx
jmp 0x1400bbc6b
xor eax, eax
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x98], rax
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov dword [rsp + 0x20], r15d
mov r15d, dword [rbp + 0x38]
mov dword [rsp + 0x28], r15d
mov r15, qword [rbp + 0x40]
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rdi
mov rcx, qword [rbp - 0x98]
mov qword [rbp - 0xa0], rcx
mov rdx, rbx
mov qword [rbp - 0xa8], rdx
mov r8, r12
mov qword [rbp - 0xb0], r8
mov r9, r13
mov qword [rbp - 0xb8], r9
lea rcx, [rbp - 0x90]
call fcn.14000c8e0
mov rcx, qword [rbp - 0xa0]
mov rdx, qword [rbp - 0xa8]
mov r8, qword [rbp - 0xb0]
mov r9, qword [rbp - 0xb8]
call sub.KERNEL32.dll_CreateProcessW
mov ebx, eax
lea rcx, [rbp - 0x90]
call fcn.14000c930
call sub.KERNEL32.dll_GetLastError
mov esi, eax
xor eax, eax
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], rax
mov rax, qword gs:[0x58]
mov ecx, dword [0x140989d34]
mov edx, reloc.WS2_32.dll_recv
add rdx, qword [rax + rcx*8]
mov rdi, qword [rdx]
test rdi, rdi
je 0x1400bbd6d
mov dword [rdi + 0xd8], esi
test ebx, ebx
setne al
movzx eax, al
add rsp, 0xd8
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov rcx, rdx
lea rax, [0x140253180]
call rax
mov rdi, rax
jmp 0x1400bbd4b
Function at 0x1400bbd80
Capabilities:
Terminate process

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0xa0]
xor eax, eax
mov qword [rbp - 0x48], rax
mov ebx, edx
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x48], rcx
lea rdx, [rbp - 0x40]
cmp dword [rcx], ecx
call fcn.140235120
mov rcx, qword [rbp - 0x48]
mov rsi, qword [rcx + 8]
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov rcx, rsi
mov qword [rbp - 0x7c], rcx
mov edx, ebx
mov dword [rbp - 0x74], edx
lea rcx, [rbp - 0x70]
call fcn.14000c8e0
mov rcx, qword [rbp - 0x7c]
mov edx, dword [rbp - 0x74]
call sub.KERNEL32.dll_TerminateProcess
mov ebx, eax
lea rcx, [rbp - 0x70]
call fcn.14000c930
call sub.KERNEL32.dll_GetLastError
mov esi, eax
test ebx, ebx
setne bl
movzx ebx, bl
cmp byte [rbp - 0x40], 0
je 0x1400bbe13
mov rcx, qword [rbp - 0x48]
cmp byte [rcx], cl
xor edx, edx
call fcn.140235160
mov rax, qword gs:[0x58]
mov ecx, dword [0x140989d34]
mov edx, reloc.WS2_32.dll_recv
add rdx, qword [rax + rcx*8]
mov rdi, qword [rdx]
test rdi, rdi
je 0x1400bbe4d
mov dword [rdi + 0xd8], esi
movzx eax, bl
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov rcx, rdx
lea rax, [0x140253180]
call rax
mov rdi, rax
jmp 0x1400bbe33
Function at 0x1400bc578
Capabilities:
Create pipe

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0xa8
lea rbp, [rsp + 0xe0]
xor eax, eax
mov qword [rbp - 0x58], rax
mov rbx, rcx
mov rsi, rdx
mov rdi, r8
mov r14d, r9d
xor ecx, ecx
mov dword [rbp - 0x3c], ecx
mov qword [rbp + 0x10], rbx
mov qword [rbx], rcx
mov qword [rbp + 0x18], rsi
mov qword [rsi], rcx
mov qword [rbp - 0x48], rcx
mov qword [rbp - 0x50], rcx
mov byte [rbp - 0x84], 0
lea rcx, [0x140501278]
call fcn.140471244
mov qword [rbp - 0x90], rax
mov byte [rbp - 0x88], 0
lea rcx, [0x140501278]
call fcn.140471244
mov qword [rbp - 0x98], rax
mov qword [rbp - 0x58], rdi
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
lea rcx, [rbp - 0x48]
mov qword [rbp - 0xa4], rcx
lea rdx, [rbp - 0x50]
mov qword [rbp - 0xac], rdx
mov r8, rdi
mov qword [rbp - 0xb4], r8
mov r9d, r14d
mov dword [rbp - 0x9c], r9d
lea rcx, [rbp - 0x80]
call fcn.14000c8e0
mov rcx, qword [rbp - 0xa4]
mov rdx, qword [rbp - 0xac]
mov r8, qword [rbp - 0xb4]
mov r9d, dword [rbp - 0x9c]
call sub.KERNEL32.dll_CreatePipe
mov ebx, eax
lea rcx, [rbp - 0x80]
call fcn.14000c930
call sub.KERNEL32.dll_GetLastError
mov esi, eax
xor ecx, ecx
mov qword [rbp - 0x58], rcx
mov dword [rbp - 0x3c], 1
mov rcx, qword [rbp - 0x50]
mov byte [rbp - 0x84], 1
mov rax, qword [rbp - 0x90]
mov qword [rax + 8], rcx
mov rcx, qword [rbp - 0x48]
mov byte [rbp - 0x88], 1
mov r8, qword [rbp - 0x98]
mov qword [r8 + 8], rcx
test ebx, ebx
setne bl
movzx ebx, bl
mov rcx, qword [rbp + 0x18]
mov rdx, rax
call fcn.14000ae50
mov rcx, qword [rbp + 0x10]
mov rdx, qword [rbp - 0x98]
call fcn.14000ae50
nop
mov rax, qword gs:[0x58]
mov ecx, dword [0x140989d34]
mov edx, reloc.WS2_32.dll_recv
add rdx, qword [rax + rcx*8]
mov rdi, qword [rdx]
test rdi, rdi
je 0x1400bc700
mov dword [rdi + 0xd8], esi
movzx eax, bl
add rsp, 0xa8
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov rcx, rdx
lea rax, [0x140253180]
call rax
mov rdi, rax
jmp 0x1400bc6e3
Function at 0x1400c4114
Capabilities:
Enumerate process modules

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
lea rcx, [0x14050bf28]
cmp qword [rcx - 8], 0
jne 0x1400c4152
mov rcx, rbx
call fcn.1400c3d58
test eax, eax
jne 0x1400c4140
add rsp, 0x20
pop rbx
jmp fcn.1400c52a0
mov rcx, rbx
mov edx, 1
add rsp, 0x20
pop rbx
jmp fcn.1400c5220
call fcn.1400010cb
jmp 0x1400c412a
Function at 0x1401a06e4
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0xb0]
xor eax, eax
mov qword [rbp - 0x48], rax
mov rbx, rdx
mov rsi, r8
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x48], rcx
lea rdx, [rbp - 0x40]
cmp dword [rcx], ecx
call fcn.140235120
mov rcx, qword [rbp - 0x48]
mov rdi, qword [rcx + 8]
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov rcx, rdi
mov qword [rbp - 0x78], rcx
mov rdx, rbx
mov qword [rbp - 0x80], rdx
mov r8, rsi
mov qword [rbp - 0x88], r8
lea rcx, [rbp - 0x70]
call fcn.14000c8e0
mov rcx, qword [rbp - 0x78]
mov rdx, qword [rbp - 0x80]
mov r8, qword [rbp - 0x88]
call sub.WS2_32.dll_getsockname
mov ebx, eax
lea rcx, [rbp - 0x70]
call fcn.14000c930
call sub.KERNEL32.dll_GetLastError
mov esi, eax
cmp byte [rbp - 0x40], 0
je 0x1401a0787
mov rcx, qword [rbp - 0x48]
cmp byte [rcx], cl
xor edx, edx
call fcn.140235160
mov rax, qword gs:[0x58]
mov ecx, dword [0x140989d34]
mov edx, reloc.WS2_32.dll_recv
add rdx, qword [rax + rcx*8]
mov rdi, qword [rdx]
test rdi, rdi
je 0x1401a07c0
mov dword [rdi + 0xd8], esi
mov eax, ebx
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov rcx, rdx
lea rax, [0x140253180]
call rax
mov rdi, rax
jmp 0x1401a07a7

Function at 0x1401a0ef8
Capabilities:
Set socket configuration

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0xa0]
mov rbx, rcx
mov esi, edx
mov qword [rbp - 0x40], r8
mov rdi, r8
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov rcx, rbx
mov qword [rbp - 0x74], rcx
mov edx, esi
mov dword [rbp - 0x6c], edx
mov r8, rdi
mov qword [rbp - 0x7c], r8
lea rcx, [rbp - 0x68]
call fcn.14000c8e0
mov rcx, qword [rbp - 0x74]
mov edx, dword [rbp - 0x6c]
mov r8, qword [rbp - 0x7c]
call sub.WS2_32.dll_ioctlsocket
mov ebx, eax
lea rcx, [rbp - 0x68]
call fcn.14000c930
call sub.KERNEL32.dll_GetLastError
mov esi, eax
xor eax, eax
mov qword [rbp - 0x40], rax
mov rax, qword gs:[0x58]
mov ecx, dword [0x140989d34]
mov edx, reloc.WS2_32.dll_recv
add rdx, qword [rax + rcx*8]
mov rdi, qword [rdx]
test rdi, rdi
je 0x1401a0fa0
mov dword [rdi + 0xd8], esi
mov eax, ebx
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov rcx, rdx
lea rax, [0x140253180]
call rax
mov rdi, rax
jmp 0x1401a0f87
Function at 0x1401a0fb4
Capabilities:
Set socket configuration

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0xb0]
xorps xmm4, xmm4
movaps xmmword [rbp - 0x50], xmm4
xor eax, eax
mov qword [rbp - 0x40], rax
mov esi, edx
mov rbx, r8
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x48], rcx
lea rdx, [rbp - 0x40]
cmp dword [rcx], ecx
call fcn.140235120
nop
mov qword [rbp - 0x50], rbx
mov rcx, qword [rbp - 0x48]
mov rdi, qword [rcx + 8]
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov rcx, rdi
mov qword [rbp - 0x84], rcx
mov edx, esi
mov dword [rbp - 0x7c], edx
mov r8, rbx
mov qword [rbp - 0x8c], r8
lea rcx, [rbp - 0x78]
call fcn.14000c8e0
mov rcx, qword [rbp - 0x84]
mov edx, dword [rbp - 0x7c]
mov r8, qword [rbp - 0x8c]
call sub.WS2_32.dll_ioctlsocket
mov ebx, eax
lea rcx, [rbp - 0x78]
call fcn.14000c930
call sub.KERNEL32.dll_GetLastError
mov esi, eax
xor ecx, ecx
mov qword [rbp - 0x50], rcx
cmp byte [rbp - 0x40], 0
je 0x1401a106b
mov rcx, qword [rbp - 0x48]
cmp byte [rcx], cl
xor edx, edx
call fcn.140235160
mov rax, qword gs:[0x58]
mov ecx, dword [0x140989d34]
mov edx, reloc.WS2_32.dll_recv
add rdx, qword [rax + rcx*8]
mov rdi, qword [rdx]
test rdi, rdi
je 0x1401a10a4
mov dword [rdi + 0xd8], esi
mov eax, ebx
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov rcx, rdx
lea rax, [0x140253180]
call rax
mov rdi, rax
jmp 0x1401a108b

Function at 0x1401a1114
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0xb0]
xor eax, eax
mov qword [rbp - 0x48], rax
mov rbx, rdx
mov esi, r8d
mov edi, r9d
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x48], rcx
lea rdx, [rbp - 0x40]
cmp dword [rcx], ecx
call fcn.140235120
mov rcx, qword [rbp - 0x48]
mov r14, qword [rcx + 8]
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov rcx, r14
mov qword [rbp - 0x80], rcx
mov rdx, rbx
mov qword [rbp - 0x88], rdx
mov r8d, esi
mov dword [rbp - 0x74], r8d
mov r9d, edi
mov dword [rbp - 0x78], r9d
lea rcx, [rbp - 0x70]
call fcn.14000c8e0
mov rcx, qword [rbp - 0x80]
mov rdx, qword [rbp - 0x88]
mov r8d, dword [rbp - 0x74]
mov r9d, dword [rbp - 0x78]
call sub.WS2_32.dll_recv
mov ebx, eax
lea rcx, [rbp - 0x70]
call fcn.14000c930
call sub.KERNEL32.dll_GetLastError
mov esi, eax
cmp byte [rbp - 0x40], 0
je 0x1401a11c5
mov rcx, qword [rbp - 0x48]
cmp byte [rcx], cl
xor edx, edx
call fcn.140235160
mov rax, qword gs:[0x58]
mov ecx, dword [0x140989d34]
mov edx, reloc.WS2_32.dll_recv
add rdx, qword [rax + rcx*8]
mov rdi, qword [rdx]
test rdi, rdi
je 0x1401a11fe
mov dword [rdi + 0xd8], esi
mov eax, ebx
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov rcx, rdx
lea rax, [0x140253180]
call rax
mov rdi, rax
jmp 0x1401a11e5
Function at 0x1401a1374
Capabilities:
Set socket configuration

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x88
lea rbp, [rsp + 0xc0]
xorps xmm4, xmm4
movaps xmmword [rbp - 0x50], xmm4
xor eax, eax
mov qword [rbp - 0x40], rax
mov esi, edx
mov edi, r8d
mov rbx, r9
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x48], rcx
lea rdx, [rbp - 0x40]
cmp dword [rcx], ecx
call fcn.140235120
nop
mov qword [rbp - 0x50], rbx
mov rcx, qword [rbp - 0x48]
mov r14, qword [rcx + 8]
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov r15d, dword [rbp + 0x30]
mov dword [rsp + 0x20], r15d
mov rcx, r14
mov qword [rbp - 0x88], rcx
mov edx, esi
mov dword [rbp - 0x7c], edx
mov r8d, edi
mov dword [rbp - 0x80], r8d
mov r9, rbx
mov qword [rbp - 0x90], r9
lea rcx, [rbp - 0x78]
call fcn.14000c8e0
mov rcx, qword [rbp - 0x88]
mov edx, dword [rbp - 0x7c]
mov r8d, dword [rbp - 0x80]
mov r9, qword [rbp - 0x90]
call sub.WS2_32.dll_setsockopt
mov ebx, eax
lea rcx, [rbp - 0x78]
call fcn.14000c930
call sub.KERNEL32.dll_GetLastError
mov esi, eax
xor ecx, ecx
mov qword [rbp - 0x50], rcx
cmp byte [rbp - 0x40], 0
je 0x1401a1445
mov rcx, qword [rbp - 0x48]
cmp byte [rcx], cl
xor edx, edx
call fcn.140235160
mov rax, qword gs:[0x58]
mov ecx, dword [0x140989d34]
mov edx, reloc.WS2_32.dll_recv
add rdx, qword [rax + rcx*8]
mov rdi, qword [rdx]
test rdi, rdi
je 0x1401a1481
mov dword [rdi + 0xd8], esi
mov eax, ebx
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov rcx, rdx
lea rax, [0x140253180]
call rax
mov rdi, rax
jmp 0x1401a1465

Function at 0x1401a203c
Capabilities:
Initialize winsock library

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x1f8
lea rbp, [rsp + 0x230]
lea rdx, [rbp - 0x1d0]
mov qword [rbp - 0x204], rdx
mov ecx, 0x202
mov dword [rbp - 0x1fc], ecx
lea rcx, [rbp - 0x1f8]
call fcn.14000c8e0
mov rdx, qword [rbp - 0x204]
mov ecx, dword [rbp - 0x1fc]
call sub.WS2_32.dll_WSAStartup
mov ebx, eax
lea rcx, [rbp - 0x1f8]
call fcn.14000c930
test ebx, ebx
jne 0x1401a20e8
lea rcx, [0x140968a7c]
mov edx, 1
xor eax, eax
lock cmpxchg dword [rcx], edx
test eax, eax
je 0x1401a20d3
lea rcx, [rbp - 0x1f8]
call fcn.14000c8e0
call sub.WS2_32.dll_WSACleanup
lea rcx, [rbp - 0x1f8]
call fcn.14000c930
nop
add rsp, 0x1f8
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea rcx, [0x1405454e8]
call fcn.14000abd0
mov rsi, rax
mov rcx, rsi
mov edx, ebx
call fcn.14017faa0
mov rcx, rsi
call fcn.14000b140
int3
Function at 0x1401a3cb4
Capabilities:
Set socket configuration

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0xb0]
mov rbx, rcx
test dl, dl
jne 0x1401a3db1
mov rcx, qword [rbx + 8]
call fcn.140172fc0
cmp eax, 0xffffffff
jne 0x1401a3d13
mov rax, qword gs:[0x58]
mov ecx, dword [0x140989d34]
mov r8d, reloc.WS2_32.dll_recv
add r8, qword [rax + rcx*8]
mov rsi, qword [r8]
test rsi, rsi
je 0x1401a3e9c
mov rax, rsi
mov eax, dword [rax + 0xd8]
cmp eax, 0x2733
jne 0x1401a3e8b
xor ecx, ecx
mov dword [rbp - 0x48], ecx
mov rcx, qword [rbx + 8]
lea r8, [rbp - 0x48]
mov edx, 0x8004667e
call fcn.1401a0ef8
cmp eax, 0xffffffff
jne 0x1401a3d67
mov rax, qword gs:[0x58]
mov ecx, dword [0x140989d34]
mov edx, reloc.WS2_32.dll_recv
add rdx, qword [rax + rcx*8]
mov rdi, qword [rdx]
test rdi, rdi
je 0x1401a3eb0
mov rax, rdi
mov eax, dword [rax + 0xd8]
test eax, eax
jne 0x1401a3db1
mov rcx, qword [rbx + 8]
call fcn.140172fc0
cmp eax, 0xffffffff
jne 0x1401a3da6
mov rax, qword gs:[0x58]
mov ecx, dword [0x140989d34]
mov edx, reloc.WS2_32.dll_recv
add rdx, qword [rax + rcx*8]
mov r14, qword [rdx]
test r14, r14
je 0x1401a3ec4
mov rax, r14
mov eax, dword [rax + 0xd8]
cmp eax, 0x2733
jne 0x1401a3e8b
mov word [rbp - 0x40], 1
mov word [rbp - 0x3e], 0
mov qword [rbp + 0x10], rbx
mov rsi, qword [rbx + 8]
lea rdi, [rbp - 0x40]
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov dword [rsp + 0x20], 4
mov rcx, rsi
mov qword [rbp - 0x80], rcx
mov r9, rdi
mov qword [rbp - 0x88], r9
mov edx, 0xffff
mov dword [rbp - 0x74], edx
mov r8d, 0x80
mov dword [rbp - 0x78], r8d
lea rcx, [rbp - 0x70]
call fcn.14000c8e0
mov rcx, qword [rbp - 0x80]
mov r9, qword [rbp - 0x88]
mov edx, dword [rbp - 0x74]
mov r8d, dword [rbp - 0x78]
call sub.WS2_32.dll_setsockopt
mov ebx, eax
lea rcx, [rbp - 0x70]
call fcn.14000c930
call sub.KERNEL32.dll_GetLastError
mov esi, eax
mov rcx, qword gs:[0x58]
mov eax, dword [0x140989d34]
mov edx, reloc.WS2_32.dll_recv
add rdx, qword [rcx + rax*8]
mov rdi, qword [rdx]
test rdi, rdi
je 0x1401a3ed8
mov rax, rdi
mov dword [rax + 0xd8], esi
cmp ebx, 0xffffffff
cmove ebx, dword [rax + 0xd8]
test ebx, ebx
je 0x1401a3e7a
cmp ebx, 0x2726
je 0x1401a3e7a
cmp ebx, 0x273a
mov eax, ebx
jne 0x1401a3e8b
mov rbx, qword [rbp + 0x10]
mov rcx, qword [rbx + 8]
call fcn.140172fc0
mov ebx, eax
mov eax, ebx
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov rcx, r8
lea rax, [0x140253180]
call rax
mov rsi, rax
jmp 0x1401a3d0a
mov rcx, rdx
lea rax, [0x140253180]
call rax
mov rdi, rax
jmp 0x1401a3d5e
mov rcx, rdx
lea rax, [0x140253180]
call rax
mov r14, rax
jmp 0x1401a3d9d
mov rcx, rdx
lea rax, [0x140253180]
call rax
mov rdi, rax
jmp 0x1401a3e51
Function at 0x1401ac110
Capabilities:
Get socket status

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x98
lea rbp, [rsp + 0x30]
mov rax, qword [0x140968900]
mov qword [rbp + 0x28], rax
mov qword [rbp + 0xb0], rcx
mov qword [rbp + 0xb8], rdx
xor edx, edx
mov dword [rbp + 0x60], edx
lea rdx, [rbp + 0x60]
cmp dword [rcx], ecx
call fcn.140235120
mov rcx, qword [rbp + 0xb0]
mov rsi, qword [rcx + 8]
test dword [rsp], esp
sub rsp, 0x10
lea rdi, [rsp + 0x30]
mov qword [rdi], 1
mov qword [rdi + 8], rsi
test dword [rsp], esp
sub rsp, 0x10
lea r14, [rsp + 0x30]
mov qword [r14], 1
mov qword [r14 + 8], rsi
xor edx, edx
mov qword [rbp + 0x58], rdx
lea rdx, [rbp + 0x58]
xor ecx, ecx
call fcn.1401ab44c
lea r15, [rbp + 0x58]
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov qword [rsp + 0x20], r15
mov r9, r14
mov qword [rbp + 0x1c], r9
mov r8, rdi
mov qword [rbp + 0x14], r8
xor ecx, ecx
mov dword [rbp + 0x24], ecx
xor edx, edx
mov qword [rbp + 0xc], rdx
lea rcx, [rbp + 0x30]
call fcn.14000c8e0
mov r9, qword [rbp + 0x1c]
mov r8, qword [rbp + 0x14]
mov ecx, dword [rbp + 0x24]
mov rdx, qword [rbp + 0xc]
call sub.WS2_32.dll_select
mov ebx, eax
lea rcx, [rbp + 0x30]
call fcn.14000c930
call sub.KERNEL32.dll_GetLastError
mov r15d, eax
mov rcx, qword gs:[0x58]
mov edx, dword [0x140989d34]
mov eax, reloc.WS2_32.dll_recv
add rax, qword [rcx + rdx*8]
mov r13, qword [rax]
test r13, r13
je 0x1401ac26d
mov dword [r13 + 0xd8], r15d
cmp ebx, 0xffffffff
je 0x1401ac27e
cmp dword [r14], 0
je 0x1401ac241
cmp qword [r14 + 8], rsi
jne 0x1401ac241
mov rbx, qword [rbp + 0xb8]
mov byte [rbx], 0
mov r13d, 1
jmp 0x1401ac2d5
cmp dword [rdi], 0
je 0x1401ac25e
cmp qword [rdi + 8], rsi
jne 0x1401ac25e
mov rbx, qword [rbp + 0xb8]
mov byte [rbx], 1
mov r13d, 1
jmp 0x1401ac2d5
mov rbx, qword [rbp + 0xb8]
mov byte [rbx], 0
xor r13d, r13d
jmp 0x1401ac2d5
mov rcx, rax
lea rax, [0x140253180]
call rax
mov r13, rax
jmp 0x1401ac214
lea rcx, [0x1405454e8]
call fcn.14000abd0
mov rbx, rax
mov rcx, qword gs:[0x58]
mov eax, dword [0x140989d34]
mov edx, reloc.WS2_32.dll_recv
add rdx, qword [rcx + rax*8]
mov rsi, qword [rdx]
test rsi, rsi
je 0x1401ac2af
jmp 0x1401ac2be
mov rcx, rdx
lea rax, [0x140253180]
call rax
mov rsi, rax
mov edx, dword [rsi + 0xd8]
mov rcx, rbx
call fcn.14017faa0
mov rcx, rbx
call fcn.14000b140
int3
cmp byte [rbp + 0x60], 0
je 0x1401ac2e9
mov rcx, qword [rbp + 0xb0]
xor edx, edx
call fcn.140235160
movzx eax, r13b
lea rcx, [0x140968900]
mov rcx, qword [rcx]
cmp qword [rbp + 0x28], rcx
je 0x1401ac302
call fcn.14000a700
nop
lea rsp, [rbp + 0x68]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x1401aca28
Capabilities:
Generate random numbers via winapi

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0xa0]
mov r8d, edx
mov dword [rbp - 0x64], r8d
mov rdx, rcx
mov qword [rbp - 0x70], rdx
xor ecx, ecx
mov qword [rbp - 0x78], rcx
mov r9d, 2
mov dword [rbp - 0x68], r9d
lea rcx, [rbp - 0x60]
call fcn.14000c8e0
mov r8d, dword [rbp - 0x64]
mov rdx, qword [rbp - 0x70]
mov rcx, qword [rbp - 0x78]
mov r9d, dword [rbp - 0x68]
call sub.bcrypt.dll_BCryptGenRandom
mov ebx, eax
lea rcx, [rbp - 0x60]
call fcn.14000c930
test ebx, ebx
jne 0x1401aca9c
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
cmp ebx, 0xc0000017
je 0x1401acac4
lea rcx, [0x14054b1c0]
call fcn.14000abd0
mov rbx, rax
mov rcx, rbx
call fcn.1401d91a0
mov rcx, rbx
call fcn.14000b140
int3
lea rcx, [0x14054ba38]
call fcn.14000abd0
mov rbx, rax
mov rcx, rbx
call fcn.1401de48c
mov rcx, rbx
call fcn.14000b140
int3

Function at 0x1401acf4c
Capabilities:
Inspect section memory permissions

Disassembly:
push rbp
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x50]
mov rbx, rcx
mov eax, dword [rbx + 0x38]
cmp eax, 0xffffffff
je 0x1401acf69
add rsp, 0x48
pop rbx
pop rbp
ret
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
lea r8, [rbp - 0x10]
lea rdx, [rbp - 0x20]
mov rcx, rbx
mov r9d, 4
call fcn.140259e60
mov ecx, eax
test ecx, ecx
jne 0x1401acff6
xor eax, eax
mov ecx, 0x40000000
test byte [rbp - 0x10], 0x30
cmove eax, ecx
mov ecx, eax
or ecx, 0x80000000
test byte [rbp - 0x10], 2
cmovne eax, ecx
mov ecx, eax
or ecx, 0x10000000
test dword [rbp - 0x10], 0x800
cmovne eax, ecx
mov ecx, eax
or ecx, 0x8000000
test byte [rbp - 0x10], 4
cmovne eax, ecx
mov ecx, eax
or ecx, 0x4000000
test dword [rbp - 0x10], 0x1000
cmovne eax, ecx
mov ecx, eax
or ecx, 0x20000000
test byte [rbp - 0x10], 8
cmovne eax, ecx
mov dword [rbx + 0x38], eax
add rsp, 0x48
pop rbx
pop rbp
ret
call fcn.140259e04
mov ecx, eax
lea rdx, [0x140480a50]
xor r8d, r8d
call fcn.140228290
mov rcx, rax
call fcn.14000b140
int3

Function at 0x1401b176c
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
test rcx, rcx
je 0x1401b177e
add rsp, 0x28
jmp fcn.1401b1f40
lea rcx, [0x1404ea3b0]
call fcn.1400b18bc
int3