joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140036030
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x1b8
mov r9, qword [rcx + 0x98]
mov rbx, rcx
mov rsi, rdx
cmp r9, 0xffffffffffffffff
je 0x140036062
mov rax, qword [rdx + 0x20]
mov rax, qword [rax + 0x3a8]
test byte [rax + 0x8d], 8
je 0x140036070
add rsp, 0x1b8
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea rbp, [rsp + 0x30]
xor eax, eax
mov ecx, 0x10
mov dword [rsp + 0x2c], pe_nt_image_headers64
mov rdi, rbp
lea r8, [rsp + 0x2c]
mov rdx, rbp
rep stosq qword [rdi], rax
mov rcx, r9
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x140036100
mov edx, dword [rsp + 0x2c]
lea r9, [rbx + 0x100]
lea r8, [rbx + 0xce]
mov rcx, rbp
call sym.Curl_addr2string
test al, al
jne 0x140036062
mov rdi, qword [sym.imp.msvcrt.dll__errno]
call rdi
lea rdx, [rsp + 0xb0]
mov r8d, 0x100
mov ecx, dword [rax]
call sym.Curl_strerror
mov rbx, rax
call rdi
mov r9, rbx
lea rdx, str.ssloc_inet_ntop___failed_with_errno__d:__s
mov rcx, rsi
mov r8d, dword [rax]
call sym.Curl_failf
jmp 0x140036062
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, [rsp + 0xb0]
mov r8d, 0x100
mov ecx, eax
mov ebx, eax
call sym.Curl_strerror
mov r8d, ebx
lea rdx, str.getsockname___failed_with_errno__d:__s
mov rcx, rsi
mov r9, rax
call sym.Curl_failf
jmp 0x140036062

Function at 0x1400368c0
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x40
mov eax, dword [0x140147200]
mov dword [rsp + 0x34], 0x4020
mov rbx, rcx
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x3c], 4
test eax, eax
je 0x140036950
cmp eax, 2
je 0x140036942
lea rax, [rsp + 0x3c]
lea r9, [rsp + 0x38]
mov edx, 0xffff
mov rcx, rbx
mov qword [rsp + 0x20], rax
mov r8d, 0x1001
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x140036920
mov eax, dword [rsp + 0x34]
cmp dword [rsp + 0x38], eax
jg 0x140036942
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x34]
mov edx, 0xffff
mov rcx, rbx
mov r8d, 0x1001
call qword [sym.imp.WS2_32.dll_setsockopt]
nop
add rsp, 0x40
pop rbx
ret
xor r8d, r8d
xor edx, edx
mov r9d, 2
mov ecx, 6
mov dword [rsp + 0x20], 3
call sym.curlx_verify_windows_version
test al, al
je 0x140036988
mov dword [0x140147200], 2
add rsp, 0x40
pop rbx
ret
mov dword [0x140147200], 1
jmp 0x1400368ef
Function at 0x14003fc70
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x14003fc88
call sym.Curl_host_is_ipnum
test al, al
je 0x14003fc98
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov rcx, rbx
call sym.strlen
mov edx, 0x2e
mov rcx, rbx
mov r8, rax
mov rsi, rax
call sym.Curl_memrchr
test rax, rax
je 0x14003fce0
sub rax, rbx
mov edx, 0x2e
mov rcx, rbx
mov r8, rax
call sym.Curl_memrchr
test rax, rax
je 0x14003fce0
add rax, 1
mov rdx, rax
sub rdx, rbx
mov rbx, rax
sub rsi, rdx
add rsi, rbx
cmp rbx, rsi
jae 0x14003fd50
mov edi, 0x1505
nop dword [rax]
movsx ecx, byte [rbx]
add rbx, 1
call sym.Curl_raw_toupper
mov rdx, rdi
shl rdx, 5
movsx rax, al
add rdx, rdi
xor rax, rdx
mov rdi, rax
cmp rsi, rbx
jne 0x14003fcf0
movabs rdx, 0x410410410410411
mul rdx
mov rax, rdi
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 5
mov rdx, rax
shl rdx, 6
sub rdx, rax
mov rax, rdi
sub rax, rdx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov eax, 0x1a
jmp 0x14003fc8a
Function at 0x140042710
Capabilities:
Resolve dns

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov qword [r9], 0
mov r12, r9
lea r9, [rsp + 0x38]
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov r14d, eax
test eax, eax
jne 0x1400428ab
mov rbx, qword [rsp + 0x38]
mov r13, qword [0x140129dc0]
xor r15d, r15d
xor ebp, ebp
test rbx, rbx
je 0x140042918
mov dword [rsp + 0x2c], eax
mov qword [rsp + 0xa8], r12
nop word cs:[rax + rax]
mov rcx, qword [rbx + 0x18]
xor esi, esi
test rcx, rcx
je 0x140042784
call sym.strlen
lea rsi, [rax + 1]
mov eax, dword [rbx + 4]
cmp eax, 2
je 0x1400428c0
cmp eax, 0x17
jne 0x140042878
mov r12d, 0x1c
mov r14d, 0x1c
cmp qword [rbx + 0x20], 0
je 0x140042878
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x140042878
cmp rax, r14
jb 0x140042878
lea rcx, [r14 + rsi + 0x30]
call qword [r13]
mov rdi, rax
test rax, rax
je 0x1400428d8
movdqu xmm0, xmmword [rbx]
mov r9, qword [rbx + 0x20]
lea rcx, [rax + 0x30]
mov dword [rax + 0x10], r12d
mov qword [rax + 0x18], 0
lea r11, [rdi + 0x38]
mov qword [rax + 0x28], 0
and r11, 0xfffffffffffffff8
mov qword [rax + 0x20], rcx
movups xmmword [rax], xmm0
mov rax, qword [r9]
mov qword [rdi + 0x30], rax
mov rax, qword [r9 + r14 - 8]
mov qword [rcx + r14 - 8], rax
mov rax, rcx
sub rax, r11
sub r9, rax
add eax, r14d
and eax, 0xfffffff8
cmp eax, 8
jb 0x140042846
and eax, 0xfffffff8
xor edx, edx
mov r8d, edx
add edx, 8
mov r10, qword [r9 + r8]
mov qword [r11 + r8], r10
cmp edx, eax
jb 0x140042834
test rsi, rsi
je 0x14004285e
add rcx, r14
mov rdx, qword [rbx + 0x18]
mov r8, rsi
mov qword [rdi + 0x18], rcx
call sym.memcpy
test rbp, rbp
cmove rbp, rdi
test r15, r15
je 0x14004286e
mov qword [r15 + 0x28], rdi
mov r15, rdi
nop dword [rax]
mov rbx, qword [rbx + 0x28]
test rbx, rbx
jne 0x140042770
mov rcx, qword [rsp + 0x38]
mov r14d, dword [rsp + 0x2c]
mov r12, qword [rsp + 0xa8]
test rcx, rcx
je 0x1400428a2
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
test rbp, rbp
je 0x140042918
mov qword [r12], rbp
mov eax, r14d
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov r12d, 0x10
mov r14d, 0x10
jmp 0x1400427a5
mov rcx, qword [rsp + 0x38]
mov r12, qword [rsp + 0xa8]
test rcx, rcx
je 0x1400428f0
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
mov rbx, qword [0x140129da0]
test rbp, rbp
je 0x14004290e
nop dword [rax]
mov rcx, rbp
mov rbp, qword [rbp + 0x28]
call qword [rbx]
test rbp, rbp
jne 0x140042900
xor ebp, ebp
mov r14d, 8
jmp 0x1400428a7
mov ecx, 0x2af9
mov r14d, 0x2af9
xor ebp, ebp
call qword [sym.imp.WS2_32.dll_WSASetLastError]
jmp 0x1400428a7
Function at 0x140042ba0
Capabilities:
Convert ip address from string

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rdi, qword [sym.imp.WS2_32.dll_inet_pton]
lea rbp, [rsp + 0x2c]
mov rbx, rcx
mov esi, edx
mov rdx, rcx
mov r8, rbp
mov ecx, 2
call rdi
test eax, eax
jg 0x140042c10
lea rbp, [rsp + 0x30]
mov rdx, rbx
mov ecx, 0x17
mov r8, rbp
call rdi
mov edx, eax
xor eax, eax
test edx, edx
jg 0x140042bf0
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov r9d, esi
mov r8, rbx
mov rdx, rbp
mov ecx, 0x17
call sym.Curl_ip2addr
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov r9d, esi
mov r8, rbx
mov rdx, rbp
mov ecx, 2
call sym.Curl_ip2addr
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x140043630
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
mov r8, rcx
mov r9, rdx
xor ecx, ecx
xor edx, edx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.msvcrt.dll__beginthreadex]
lea rdx, [rax - 1]
cmp rdx, 0xfffffffffffffffe
mov edx, 0
cmovae rax, rdx
add rsp, 0x38
ret

Function at 0x1400436d0
Capabilities:
Write file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x840
mov rsi, rcx
mov rbp, r8
lea rdi, [rsp + 0x30]
mov r12, r9
test rdx, rdx
je 0x1400437e8
mov r9, qword [rdx]
mov rcx, rdi
mov edx, 0x800
lea r8, [0x1401057c0]
call sym.curl_msnprintf
mov edx, 0x800
movsxd rcx, eax
sub edx, ecx
mov rbx, rcx
add rcx, rdi
movsxd rdx, edx
mov r9, r12
mov r8, rbp
call sym.curl_mvsnprintf
mov edx, 0xa
add ebx, eax
movsxd rax, ebx
mov word [rsp + rax + 0x30], dx
test byte [rsi + 0xa37], 0x10
je 0x140043792
add ebx, 1
cmp qword [rsi + 0x260], 0
movsxd rbx, ebx
je 0x1400437a0
mov rcx, rsi
call sym.Curl_is_in_callback
mov edx, 1
mov rcx, rsi
mov ebp, eax
call sym.Curl_set_in_callback
xor edx, edx
mov rcx, rsi
mov r9, rbx
mov rax, qword [rsi + 0x1d8]
mov r8, rdi
mov qword [rsp + 0x20], rax
call qword [rsi + 0x260]
movzx edx, bpl
mov rcx, rsi
call sym.Curl_set_in_callback
nop
add rsp, 0x840
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov r9, qword [rsi + 0x1d0]
mov r8d, 1
mov edx, 2
lea rcx, [0x1401057e0]
call sym.fwrite
mov r9, qword [rsi + 0x1d0]
mov rdx, rbx
mov rcx, rdi
mov r8d, 1
call sym.fwrite
nop
add rsp, 0x840
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rcx, rdi
mov edx, 0x800
xor ebx, ebx
jmp 0x14004371e
Function at 0x140043800
Capabilities:
Write file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rbx, rcx
mov esi, edx
mov rbp, r8
mov rdi, r9
test byte [rcx + 0xa37], 0x10
je 0x140043875
cmp qword [rcx + 0x260], 0
je 0x140043870
call sym.Curl_is_in_callback
mov rcx, rbx
mov edx, 1
mov r12d, eax
call sym.Curl_set_in_callback
mov edx, esi
mov rcx, rbx
mov r9, rdi
mov rax, qword [rbx + 0x1d8]
mov r8, rbp
mov qword [rsp + 0x20], rax
call qword [rbx + 0x260]
movzx edx, r12b
mov rcx, rbx
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp sym.Curl_set_in_callback
cmp esi, 2
jbe 0x140043880
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov r9, qword [rbx + 0x1d0]
lea rcx, [rsi + rsi*2]
mov edx, 2
lea rax, [0x1401057e0]
add rcx, rax
mov r8d, 1
call sym.fwrite
mov r9, qword [rbx + 0x1d0]
mov rdx, rdi
mov rcx, rbp
mov r8d, 1
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp sym.fwrite

Function at 0x1400438d0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x158
mov qword [rsp + 0x190], r8
mov rbx, rcx
mov qword [rsp + 0x198], r9
test byte [rcx + 0xa37], 0x10
jne 0x140043905
cmp qword [rcx + 0x1e0], 0
je 0x1400439a5
lea rdi, [rsp + 0x40]
lea r9, [rsp + 0x190]
mov r8, rdx
mov edx, 0x100
mov rcx, rdi
mov qword [rsp + 0x38], r9
call sym.curl_mvsnprintf
mov rcx, qword [rbx + 0x1e0]
mov esi, eax
test rcx, rcx
je 0x14004393e
test byte [rbx + 0x1264], 8
je 0x1400439b8
movsxd rax, esi
mov edx, 0xa
mov word [rsp + rax + 0x40], dx
test byte [rbx + 0xa37], 0x10
je 0x1400439a5
add esi, 1
cmp qword [rbx + 0x260], 0
movsxd rsi, esi
je 0x1400439d0
mov rcx, rbx
call sym.Curl_is_in_callback
mov edx, 1
mov rcx, rbx
mov ebp, eax
call sym.Curl_set_in_callback
xor edx, edx
mov rcx, rbx
mov r9, rsi
mov rax, qword [rbx + 0x1d8]
mov r8, rdi
mov qword [rsp + 0x20], rax
call qword [rbx + 0x260]
movzx edx, bpl
mov rcx, rbx
call sym.Curl_set_in_callback
nop
add rsp, 0x158
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov rdx, rdi
call sym.strcpy
or byte [rbx + 0x1264], 8
jmp 0x14004393e
mov r9, qword [rbx + 0x1d0]
mov r8d, 1
mov edx, 2
lea rcx, [0x1401057e0]
call sym.fwrite
mov r9, qword [rbx + 0x1d0]
mov rdx, rsi
mov rcx, rdi
mov r8d, 1
call sym.fwrite
nop
add rsp, 0x158
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x140048ad0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xb0
mov rsi, qword [rcx + 0x20]
mov rdi, qword [rsi + 0x228]
lea r12, [rsp + 0x24]
lea rbp, [rsp + 0x30]
mov rbx, rcx
mov qword [rsp + 0x28], 0xffffffffffffffff
mov dword [rsp + 0x24], pe_nt_image_headers64
mov r8, r12
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x140048be0
mov rcx, qword [rsp + 0x28]
cmp rcx, 0xffffffffffffffff
je 0x140048c28
test byte [rbx + 0xa37], 0x10
je 0x140048b5e
mov rax, qword [rbx + 0x11e8]
test rax, rax
je 0x140048b4a
mov r8d, dword [rax + 8]
test r8d, r8d
jle 0x140048b5e
mov rcx, rbx
lea rdx, str.Connection_accepted_from_server
call sym.Curl_infof
mov rcx, qword [rsp + 0x28]
and byte [rsi + 0x3a1], 0xdf
mov edx, 1
call sym.curlx_nonblock
mov rdx, rsi
lea r9, [rsp + 0x28]
mov rcx, rbx
mov r8d, 1
call sym.Curl_conn_tcp_accepted_set
mov esi, eax
test eax, eax
jne 0x140048c08
cmp qword [rbx + 0x270], 0
je 0x140048bca
mov edx, 1
mov rcx, rbx
call sym.Curl_set_in_callback
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rbx + 0x278]
mov r8d, 1
call qword [rbx + 0x270]
xor edx, edx
mov rcx, rbx
mov edi, eax
call sym.Curl_set_in_callback
test edi, edi
jne 0x140048c40
mov eax, esi
add rsp, 0xb0
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rcx, rdi
mov dword [rsp + 0x24], pe_nt_image_headers64
mov r8, r12
mov rdx, rbp
call qword [sym.imp.WS2_32.dll_accept]
mov qword [rsp + 0x28], rax
mov rcx, rax
jmp 0x140048b22
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.WS2_32.dll_closesocket]
mov eax, esi
add rsp, 0xb0
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
lea rdx, str.Error_accept__ing_server_connect
mov rcx, rbx
mov esi, 0x1e
call sym.Curl_failf
jmp 0x140048bca
test byte [rbx + 0xa37], 0x10
je 0x140048c9b
mov rax, qword [rbx + 0x11e8]
test rax, rax
je 0x140048c5c
mov edx, dword [rax + 8]
test edx, edx
jle 0x140048c9b
mov rax, qword [0x140129ed0]
mov eax, dword [rax + 8]
test eax, eax
jle 0x140048c9b
mov rax, qword [rbx + 0x20]
lea r8, [0x14010606d]
test rax, rax
je 0x140048c8c
movzx edx, byte [rax + 0x76e]
lea rax, str.STOP
mov r8, qword [rax + rdx*8]
lea rdx, str.__s__closing_DATA_connection
mov rcx, rbx
call sym.Curl_trc_ftp
mov edx, 1
mov rcx, rbx
mov esi, 0x2a
call sym.Curl_conn_close
mov rdx, qword [rbx + 0x20]
mov r8d, 1
mov rcx, rbx
call sym.Curl_conn_cf_discard_all
jmp 0x140048bca
Function at 0x14004b1b0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
mov rdi, qword [rcx + 0x20]
movzx eax, byte [rdi + 0x76e]
mov rbp, rdi
mov rsi, rcx
mov ebx, edx
cmp dl, al
je 0x14004b1da
test byte [rcx + 0xa37], 0x10
jne 0x14004b210
mov byte [rdi + 0x76e], bl
cmp bl, 0x13
je 0x14004b288
cmp bl, 0x14
je 0x14004b2a0
mov r8d, 0xd
cmp bl, 0x15
je 0x14004b26e
cmp bl, 0x16
je 0x14004b268
xor eax, eax
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rdx, qword [rcx + 0x11e8]
test rdx, rdx
je 0x14004b225
mov r9d, dword [rdx + 8]
test r9d, r9d
jle 0x14004b1da
mov rdx, qword [0x140129ed0]
mov rbp, rdi
mov r8d, dword [rdx + 8]
test r8d, r8d
jle 0x14004b1da
lea rcx, str.STOP
movzx edx, bl
mov r9, qword [rcx + rdx*8]
mov r8, qword [rcx + rax*8]
lea rdx, str.__s_______s_
mov rcx, rsi
call sym.Curl_trc_ftp
mov rbp, qword [rsi + 0x20]
jmp 0x14004b1da
mov r8d, 0xe
mov edx, 1
mov rcx, rsi
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp sym.ftp_state_quote
mov rdx, rbp
mov rcx, rsi
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp sym.ftp_state_size
cmp byte [rsi + 0x6e0], 2
mov rax, qword [rsi + 0x1b8]
mov rdi, qword [0x140129da0]
je 0x14004b390
lea r9, [0x14010608b]
xor r12d, r12d
mov r8, r9
mov rdx, qword [rsi + 0x7e8]
test rdx, rdx
je 0x14004b400
lea rcx, [0x14010662c]
call sym.curl_maprintf
mov rcx, r12
mov rbx, rax
call qword [rdi]
test rbx, rbx
je 0x14004b420
lea rdx, [rbp + 0x660]
mov r9, rbx
lea r8, [0x1401061f9]
mov rcx, rsi
call sym.Curl_pp_sendf
mov rcx, rbx
mov dword [rsp + 0x3c], eax
call qword [rdi]
mov eax, dword [rsp + 0x3c]
test eax, eax
jne 0x14004b204
mov rbx, qword [rsi + 0x20]
movzx eax, byte [rbx + 0x76e]
cmp al, 0x1f
je 0x14004b380
test byte [rsi + 0xa37], 0x10
je 0x14004b380
mov rdx, qword [rsi + 0x11e8]
test rdx, rdx
je 0x14004b34e
mov ecx, dword [rdx + 8]
test ecx, ecx
jle 0x14004b380
mov rdx, qword [0x140129ed0]
mov edx, dword [rdx + 8]
test edx, edx
jle 0x14004b380
lea rdx, str.STOP
lea r9, [0x1401065bb]
mov rcx, rsi
mov r8, qword [rdx + rax*8]
lea rdx, str.__s_______s_
call sym.Curl_trc_ftp
nop dword [rax]
mov byte [rbx + 0x76e], 0x1f
jmp 0x14004b202
mov rcx, qword [rax]
test rcx, rcx
je 0x14004b2bb
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor edx, edx
lea r8, [rsp + 0x48]
mov qword [rsp + 0x48], 0
call sym.Curl_urldecode
test eax, eax
jne 0x14004b204
mov r12, qword [rsp + 0x48]
mov edx, 0x2f
mov rcx, r12
call sym.strrchr
test rax, rax
je 0x14004b42a
sub rax, r12
mov edx, 1
mov r9, r12
cmove rax, rdx
lea r8, [0x14010662a]
mov byte [r12 + rax], 0
jmp 0x14004b2c8
test byte [rsi + 0x1265], 0x20
lea rdx, [0x1401065bb]
lea rax, str.NLST
cmovne rdx, rax
jmp 0x14004b2d8
mov eax, 0x1b
jmp 0x14004b204
mov rcx, r12
call qword [rdi]
jmp 0x14004b2bb
Function at 0x1400517e0
Capabilities:
Query environment variable

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbp, qword [0x140129dd0]
mov esi, 1
xor ebx, ebx
mov r12, qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov rdi, rcx
jmp 0x140051831
mov rdx, rax
mov r8d, esi
mov rcx, rdi
call r12
lea edx, [rax - 1]
cmp edx, 0x7fff
ja 0x140051868
cmp esi, eax
je 0x140051868
cmp eax, esi
jb 0x140051852
mov esi, eax
mov rcx, rbx
mov edx, esi
mov r13, rbx
call qword [rbp]
mov rbx, rax
test rax, rax
jne 0x140051810
mov rax, qword [0x140129da0]
mov rcx, r13
xor ebx, ebx
call qword [rax]
mov rax, rbx
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov rax, qword [0x140129da0]
mov rcx, rbx
xor ebx, ebx
call qword [rax]
jmp 0x140051852

Function at 0x140051be0
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
mov eax, 0x1505
add rdx, rcx
cmp rcx, rdx
jae 0x140051c0b
nop dword [rax]
mov r9, rax
add rcx, 1
shl r9, 5
add rax, r9
movsx r9, byte [rcx - 1]
xor rax, r9
cmp rdx, rcx
jne 0x140051bf0
xor edx, edx
div r8
mov rax, rdx
ret
Function at 0x140052e40
Capabilities:
Convert ip address from string

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x98
mov rdi, rcx
mov rsi, rdx
test byte [rcx + 0xa37], 0x10
je 0x140052e68
cmp byte [rdx + 0x18], 0
jne 0x140052e80
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea r13, [rdx + 0x18]
lea rbp, [rsp + 0x20]
mov ecx, 2
mov rbx, qword [sym.imp.WS2_32.dll_inet_pton]
mov r8, rbp
mov rdx, r13
call rbx
test eax, eax
jg 0x140052e68
lea r12, [rsp + 0x50]
mov rdx, r13
mov ecx, 0x17
mov r8, r12
call rbx
test eax, eax
jg 0x140052e68
mov rbx, qword [rsi]
test byte [rdi + 0xa37], 0x10
je 0x140052efa
mov rax, qword [rdi + 0x11e8]
test rax, rax
je 0x140052ed8
mov r8d, dword [rax + 8]
test r8d, r8d
jle 0x140052efa
cmp byte [rsi + 0x18], 0
mov r9d, dword [rsi + 0x14]
mov rcx, rdi
lea r8, str._none_
cmovne r8, r13
lea rdx, str.Host__s:_d_was_resolved.
call sym.Curl_infof
mov edx, 0x400
mov rcx, r12
lea r14, [rsp + 0x70]
call sym.Curl_dyn_init
mov edx, 0x400
mov rcx, r14
lea r15, [0x14010786a]
call sym.Curl_dyn_init
mov r13, qword [sym.imp.WS2_32.dll_inet_ntop]
test rbx, rbx
jne 0x140052f45
jmp 0x140053030
mov rbx, qword [rbx + 0x28]
test rbx, rbx
je 0x140053030
mov eax, dword [rbx + 4]
cmp eax, 0x17
je 0x140052f52
cmp eax, 2
jne 0x140052f38
xor esi, esi
cmp eax, 2
mov byte [rsp + 0x20], 0
setne sil
shl rsi, 5
add rsi, r12
cmp eax, 2
mov rax, qword [rbx + 0x20]
je 0x140052fe8
mov ecx, 0x17
lea rdx, [rax + 8]
mov r9d, 0x2e
mov r8, rbp
call r13
mov rcx, rsi
call sym.Curl_dyn_len
test rax, rax
jne 0x14005300a
mov rdx, rbp
mov rcx, rsi
call sym.Curl_dyn_add
test eax, eax
je 0x140052f38
test byte [rdi + 0xa37], 0x10
je 0x140052fd0
mov rax, qword [rdi + 0x11e8]
test rax, rax
je 0x140052fbd
mov ecx, dword [rax + 8]
test ecx, ecx
jle 0x140052fd0
lea rdx, str.too_many_IP__cannot_show
mov rcx, rdi
call sym.Curl_infof
nop dword [rax]
mov rcx, r12
call sym.Curl_dyn_free
mov rcx, r14
call sym.Curl_dyn_free
jmp 0x140052e68
mov ecx, 2
lea rdx, [rax + 4]
mov r9d, 0x2e
mov r8, rbp
call r13
mov rcx, rsi
call sym.Curl_dyn_len
test rax, rax
je 0x140052f92
mov r8d, 2
mov rdx, r15
mov rcx, rsi
call sym.Curl_dyn_addn
test eax, eax
je 0x140052f92
jmp 0x140052fa1
test byte [rdi + 0xa37], 0x10
je 0x140052fd0
mov rax, qword [rdi + 0x11e8]
test rax, rax
je 0x14005304c
mov edx, dword [rax + 8]
test edx, edx
jle 0x140052fd0
mov rcx, r14
call sym.Curl_dyn_len
lea r8, str._none_
test rax, rax
jne 0x1400530bb
lea rdx, str.IPv6:__s
mov rcx, rdi
call sym.Curl_infof
test byte [rdi + 0xa37], 0x10
je 0x140052fd0
mov rax, qword [rdi + 0x11e8]
test rax, rax
je 0x140053093
mov eax, dword [rax + 8]
test eax, eax
jle 0x140052fd0
mov rcx, r12
call sym.Curl_dyn_len
lea r8, str._none_
test rax, rax
jne 0x1400530c8
lea rdx, str.IPv4:__s
mov rcx, rdi
call sym.Curl_infof
jmp 0x140052fd0
mov rcx, r14
call sym.Curl_dyn_ptr
mov r8, rax
jmp 0x140053060
mov rcx, r12
call sym.Curl_dyn_ptr
mov r8, rax
jmp 0x1400530a7
Function at 0x1400536a0
Capabilities:
Convert ip address from string

Disassembly:
push rsi
push rbx
sub rsp, 0x48
mov rsi, qword [sym.imp.WS2_32.dll_inet_pton]
mov rdx, rcx
mov rbx, rcx
lea r8, [rsp + 0x2c]
mov ecx, 2
call rsi
mov edx, eax
mov eax, 1
test edx, edx
jg 0x1400536de
lea r8, [rsp + 0x30]
mov rdx, rbx
mov ecx, 0x17
call rsi
test eax, eax
setg al
add rsp, 0x48
pop rbx
pop rsi
ret

Function at 0x140053cf0
Capabilities:
Convert ip address from string

Disassembly:
cmp qword [rsp + 0x28], 0
mov qword [r9], 0
js 0x140053d10
mov qword [rsp + 0x28], r9
mov r9d, 1
jmp sym.Curl_resolv
mov eax, 0xfffffffe
ret
Function at 0x140063a30
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x38
xor eax, eax
test edx, edx
lea r8, [rsp + 0x2c]
mov edx, 0x8004667e
setne al
mov dword [rsp + 0x2c], eax
call qword [sym.imp.WS2_32.dll_ioctlsocket]
add rsp, 0x38
ret
Function at 0x140067ae0
Capabilities:
Create new key via cryptacquirecontext
Initialize hashing via wincrypt

Disassembly:
push rbx
sub rsp, 0x30
xor edx, edx
mov r9d, 0x18
xor r8d, r8d
mov dword [rsp + 0x20], 0xf0000040
mov rbx, rcx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
mov edx, eax
mov eax, 0x1b
test edx, edx
je 0x140067b31
lea rax, [rbx + 8]
mov rcx, qword [rbx]
mov edx, 0x800c
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
mov edx, eax
xor eax, eax
test edx, edx
je 0x140067b40
add rsp, 0x30
pop rbx
ret
mov rcx, qword [rbx]
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov qword [rbx], 0
mov eax, 2
jmp 0x140067b31

Function at 0x140067b60
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
mov r9d, 0x18
mov dword [rsp + 0x20], 0xf0000040
mov rdi, rcx
mov rsi, rdx
mov rbx, r8
xor edx, edx
lea rcx, [rsp + 0x40]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
mov edx, eax
mov eax, 0x1b
test edx, edx
je 0x140067c2c
lea rax, [rsp + 0x48]
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov edx, 0x800c
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x140067c70
mov rcx, rbx
call sym.curlx_uztoui
mov rdx, rsi
lea rsi, [rsp + 0x3c]
xor r9d, r9d
mov rcx, qword [rsp + 0x48]
mov r8d, eax
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
xor r8d, r8d
mov rcx, qword [rsp + 0x48]
mov r9, rsi
mov dword [rsp + 0x3c], 0
mov rbx, qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov edx, 2
mov dword [rsp + 0x20], 0
call rbx
cmp dword [rsp + 0x3c], 0x20
je 0x140067c38
mov rcx, qword [rsp + 0x48]
test rcx, rcx
jne 0x140067c68
mov rcx, qword [rsp + 0x40]
test rcx, rcx
jne 0x140067c58
xor eax, eax
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
mov rcx, qword [rsp + 0x48]
mov r9, rsi
mov r8, rdi
mov edx, 2
mov dword [rsp + 0x20], 0
call rbx
jmp 0x140067c16
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
jmp 0x140067c2c
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
jmp 0x140067c20
mov rcx, qword [rsp + 0x40]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, 2
jmp 0x140067c2c