joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140180850
Capabilities:
Resolve dns

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x48
movaps xmmword [rsp + 0x30], xmm6
mov rsi, r9
mov rax, qword [0x140430040]
xor rax, rsp
mov qword [rsp + 0x28], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r9, [rsp + 0x20]
mov qword [r9], rax
mov qword [rsi], 0
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov ebx, eax
test eax, eax
je 0x1401808b0
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
cmp rcx, qword [0x140430040]
je 0x1401808f2
call fcn.140278ca0
int3
mov r15, qword [rsp + 0x20]
test r15, r15
je 0x1401808db
xor r12d, r12d
xorps xmm6, xmm6
xor edi, edi
jmp 0x140180916
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x1401808d4
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
xor ebx, ebx
test rdi, rdi
jne 0x1401808ed
mov ebx, 0x2af9
mov ecx, 0x2af9
call qword [sym.imp.WS2_32.dll_WSASetLastError]
xor edi, edi
mov qword [rsi], rdi
jmp 0x140180899
mov eax, ebx
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov rbx, r12
mov r15, qword [r15 + 0x28]
mov r12, rbx
test r15, r15
je 0x1401808c4
mov eax, dword [r15 + 4]
cmp eax, 2
je 0x14018092c
cmp eax, 0x17
jne 0x140180907
mov r14d, 0x1c
jmp 0x140180932
mov r14d, reloc.WS2_32.dll_recv
cmp qword [r15 + 0x20], 0
je 0x140180907
cmp qword [r15 + 0x10], r14
jb 0x140180907
mov rax, qword [fcn.140119a10]
mov ecx, 0x30
call qword [str._a_]
test rax, rax
je 0x140180a0c
mov rbx, rax
mov eax, dword [r15]
mov dword [rbx], eax
mov eax, dword [r15 + 4]
mov dword [rbx + 4], eax
mov eax, dword [r15 + 8]
mov dword [rbx + 8], eax
mov eax, dword [r15 + 0xc]
mov dword [rbx + 0xc], eax
mov dword [rbx + 0x10], r14d
movups xmmword [rbx + 0x18], xmm6
mov qword [rbx + 0x28], 0
mov rax, qword [fcn.140119a10]
mov rcx, r14
call qword [str._a_]
mov qword [rbx + 0x20], rax
test rax, rax
je 0x1401809fc
mov rdx, qword [r15 + 0x20]
mov rcx, rax
mov r8, r14
call fcn.1402b6370
mov rcx, qword [r15 + 0x18]
test rcx, rcx
je 0x1401809d1
lea r14, [rbx + 0x18]
mov rax, qword [fcn.140292900]
call qword [str._a_]
mov qword [r14], rax
test rax, rax
je 0x1401809eb
test rdi, rdi
cmove rdi, rbx
test r12, r12
je 0x14018090a
mov qword [r12 + 0x28], rbx
jmp 0x14018090a
mov rax, qword [fcn.140119970]
mov rcx, qword [rbx + 0x20]
call qword [str._a_]
mov rax, qword [fcn.140119970]
mov rcx, rbx
call qword [str._a_]
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x140180a1c
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
mov ebx, 8
test rdi, rdi
je 0x1401808eb
mov rax, qword [fcn.140119970]
mov rcx, qword [rdi + 0x20]
call qword [str._a_]
mov rax, qword [fcn.140119970]
mov rcx, qword [rdi + 0x18]
call qword [str._a_]
mov r14, qword [rdi + 0x28]
mov rax, qword [fcn.140119970]
mov rcx, rdi
call qword [str._a_]
mov rdi, r14
test r14, r14
jne 0x140180a2a
jmp 0x1401808eb
Function at 0x140189bb0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov ebx, r8d
mov rsi, rcx
mov rax, qword [rcx]
lea ecx, [rbx - 0xd]
cmp ecx, 2
jb 0x140189bdb
mov r9d, 0x9b0
cmp ebx, 0xf
jne 0x140189be1
mov r9d, 0x9b8
jmp 0x140189be1
mov r9d, 0x9c0
mov r8, qword [rax + 0x1e0]
lea rcx, [rsi + 0xa00]
mov r9, qword [rax + r9]
test dl, dl
jne 0x140189c27
mov edx, dword [rsi + 0xaac]
lea r10d, [rdx + 1]
mov dword [rsi + 0xaac], r10d
test r9, r9
je 0x140189c88
test edx, edx
js 0x140189c36
xor r10d, r10d
mov r9, qword [r9 + 8]
cmp r10d, edx
jge 0x140189c31
inc r10d
test r9, r9
jne 0x140189c14
jmp 0x140189c31
mov dword [rsi + 0xaac], 0
test r9, r9
je 0x140189c88
mov rax, qword [r9]
xor edx, edx
cmp byte [rax], 0x2a
sete dl
lea r8, [rdx + rax]
mov dword [rsi + 0xab0], edx
lea rdx, [0x1403db9da]
call fcn.1401aa640
test eax, eax
je 0x140189c67
mov edi, eax
mov eax, edi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
mov dword [rsi + 0xab8], ebx
xor edi, edi
jmp 0x140189c5d
cmp dword [r8 + 0x10], 0
je 0x140189da8
mov dword [rsi + 0xab8], 0
jmp 0x140189c5d
xor edi, edi
cmp ebx, 0xd
je 0x140189c71
cmp ebx, 0xe
je 0x140189d88
cmp ebx, 0xf
je 0x140189c5d
cmp byte [rsi + 0xa92], 1
jne 0x140189cef
cmp byte [rax + 0xf09], 0
jne 0x140189cbc
cmp dword [rax + 0x9f8], 0
je 0x140189d99
mov r8, qword [rsi + 0xa88]
test r8, r8
je 0x140189d99
lea rdx, str.MDTM__s
call fcn.1401aa640
test eax, eax
jne 0x140189c5b
mov dword [rsi + 0xab8], 0x12
jmp 0x140189c5d
mov dword [rsi + 0xab0], 0
xor edx, edx
cmp dword [rax + 0xbac], 2
sete dl
mov dword [rsi + 0xab4], edx
cmp byte [rsi + 0x655], 1
jne 0x140189d44
mov r8, qword [rsi + 0xa70]
test r8, r8
je 0x140189d44
cmp dword [rsi + 0xa80], 0
je 0x140189d38
mov rdx, qword [rsi + 0xa78]
mov rdx, qword [rdx]
cmp byte [rdx], 0x2f
je 0x140189d44
mov dword [rsi + 0xa94], 0
jmp 0x140189d65
cmp dword [rsi + 0xa80], 0
je 0x140189ca6
mov dword [rsi + 0xa94], 1
mov rax, qword [rsi + 0xa78]
mov r8, qword [rax]
lea rdx, str.CWD__s
call fcn.1401aa640
test eax, eax
jne 0x140189c5b
mov dword [rsi + 0xab8], 0x10
jmp 0x140189c5d
mov rcx, rsi
xor edx, edx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.14018a2c0
mov rcx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.14018a4c0
mov rdx, qword [rsi + 0xad0]
cmp rdx, 0xffffffffffffffff
je 0x140189dd3
mov rcx, rax
call fcn.140170800
mov rdx, qword [rsi + 0xad0]
mov rcx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.14018a130
mov r8, qword [rsi + 0xa88]
cmp byte [rax + 0xf24], 1
jne 0x140189e06
lea rdx, str.RETR__s
call fcn.1401aa640
test eax, eax
jne 0x140189c5b
mov dword [rsi + 0xab8], 0x20
jmp 0x140189c5d
lea rdx, str.SIZE__s
call fcn.1401aa640
test eax, eax
jne 0x140189c5b
mov dword [rsi + 0xab8], 0x18
jmp 0x140189c5d
Function at 0x14018a4c0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov rax, qword [rcx]
mov rcx, qword [rax + 0x1e0]
cmp byte [rax + 0xf1c], 1
jne 0x14018a540
cmp qword [rsi + 0xa88], 0
je 0x14018a540
movzx edx, byte [rax + 0xf0b]
movsx r8d, byte [rsi + 0xaa8]
xor edx, 1
lea edx, [rdx*8 + 0x41]
cmp edx, r8d
je 0x14018a540
mov dword [rcx + 0x10], 1
mov bl, byte [rax + 0xf0b]
xor bl, 1
shl bl, 3
or bl, 0x41
cmp byte [rsi + 0xaa8], bl
jne 0x14018a5c3
mov dword [rsi + 0xab8], 0x13
mov rax, qword [rsi]
mov rax, qword [rax + 0x1e0]
mov eax, dword [rax + 0x10]
jmp 0x14018a543
mov eax, dword [rcx + 0x10]
test eax, eax
je 0x14018a57e
lea rcx, [rsi + 0xa00]
cmp eax, 1
je 0x14018a58d
cmp qword [rsi + 0xa88], 0
je 0x14018a57e
lea rdx, str.REST__d
xor edi, edi
xor r8d, r8d
call fcn.1401aa640
test eax, eax
jne 0x14018a5a9
mov dword [rsi + 0xab8], 0x1a
jmp 0x14018a5ab
mov rcx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.14018a5f0
mov r8, qword [rsi + 0xa88]
test r8, r8
je 0x14018a57e
lea rdx, str.SIZE__s
call fcn.1401aa640
test eax, eax
je 0x14018a5b5
mov edi, eax
mov eax, edi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
mov dword [rsi + 0xab8], 0x17
xor edi, edi
jmp 0x14018a5ab
movzx r8d, bl
lea rcx, [rsi + 0xa00]
lea rdx, str.TYPE__c
call fcn.1401aa640
test eax, eax
jne 0x14018a5a9
mov dword [rsi + 0xab8], 0x13
mov byte [rsi + 0xaa8], bl
jmp 0x14018a5bf

Function at 0x14018a5f0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov rax, qword [rcx]
mov rcx, qword [rax + 0x1e0]
cmp dword [rcx + 0x10], 0
je 0x14018a629
mov dword [rsi + 0xab8], 0xd
mov rcx, rsi
mov dl, 1
mov r8d, reloc.WS2_32.dll_listen
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.140189bb0
cmp byte [rax + 0xf0e], 1
jne 0x14018a642
mov rcx, rsi
xor edx, edx
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.14018a730
lea rcx, [rsi + 0xa00]
cmp byte [rax + 0xf11], 1
jne 0x14018a673
mov r8, qword [rsi + 0xa88]
test r8, r8
je 0x14018a6dc
cmp byte [rax + 0xf1d], 1
jne 0x14018a6d3
lea rdx, str.PRET_STOR__s
jmp 0x14018a708
mov al, byte [rsi + 0x666]
test al, al
jne 0x14018a68f
cmp byte [rsi + 0x65f], 1
jne 0x14018a68f
mov byte [rsi + 0x666], 1
mov al, 1
xor al, 1
movzx edi, al
lea rax, [rdi + rdi*4]
lea r8, str.EPSV
add r8, rax
lea rdx, [0x1403db9da]
call fcn.1401aa640
test eax, eax
jne 0x14018a71d
mov dword [rsi + 0xaac], edi
mov dword [rsi + 0xab8], 0x1e
mov rcx, qword [rsi]
lea rdx, str.Connect_data_stream_passively_n
call fcn.1401581f0
jmp 0x14018a71b
lea rdx, str.PRET_RETR__s
jmp 0x14018a708
mov r8, qword [rax + 0xc08]
test r8, r8
jne 0x14018a701
lea rdx, str.NLST
lea r8, str.LIST
cmp byte [rax + 0xf0d], 0
cmovne r8, rdx
lea rdx, str.PRET__s
call fcn.1401aa640
test eax, eax
jne 0x14018a71d
mov dword [rsi + 0xab8], 0x1d
xor eax, eax
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x14018b3a0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xc0
mov rsi, rcx
mov rax, qword [0x140430040]
xor rax, rsp
mov qword [rsp + 0xb8], rax
mov rdi, qword [rcx]
mov rbx, qword [rcx + 0x4c8]
movaps xmm0, xmmword [0x1403d4b30]
lea rdx, [rsp + 0x30]
movaps xmmword [rdx + 0x70], xmm0
movaps xmmword [rdx + 0x60], xmm0
movaps xmmword [rdx + 0x50], xmm0
movaps xmmword [rdx + 0x40], xmm0
movaps xmmword [rdx + 0x30], xmm0
movaps xmmword [rdx + 0x20], xmm0
movaps xmmword [rdx + 0x10], xmm0
movaps xmmword [rdx], xmm0
lea r8, [rsp + 0x2c]
mov dword [r8], Ordinal_133
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x14018b45d
mov rcx, rsi
mov rdx, rbx
call fcn.14015d840
lea rdx, str.Error_accept__ing_server_connect
mov rcx, rdi
call fcn.140158420
mov ebx, 0x1e
mov rcx, qword [rsp + 0xb8]
xor rcx, rsp
cmp rcx, qword [0x140430040]
je 0x14018b449
call fcn.140278ca0
int3
mov eax, ebx
add rsp, 0xc0
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
xor ebx, ebx
jmp 0x14018b42f
lea r8, [rsp + 0x2c]
mov dword [r8], Ordinal_133
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_accept]
mov r14, rax
mov rcx, rsi
mov rdx, rbx
call fcn.14015d840
cmp r14, 0xffffffffffffffff
je 0x14018b41b
lea rdx, str.Connection_accepted_from_server_n
mov rcx, rdi
call fcn.1401581f0
mov byte [rsi + 0x660], 0
mov qword [rsi + 0x4c8], r14
mov rcx, r14
mov edx, 1
call fcn.14019ac40
mov byte [rsi + 0xb2c], 1
cmp qword [rdi + 0x728], 0
je 0x14018b459
mov rcx, rdi
mov dl, 1
call fcn.14015c7d0
mov rax, qword [rdi + 0x728]
mov rcx, qword [rdi + 0x730]
mov rdx, r14
mov r8d, 1
call qword [str._a_]
mov ebp, eax
xor ebx, ebx
mov rcx, rdi
xor edx, edx
call fcn.14015c7d0
test ebp, ebp
je 0x14018b42f
mov rdx, qword [rsi + 0x4c8]
cmp rdx, 0xffffffffffffffff
je 0x14018b523
mov rcx, rsi
call fcn.14015d840
mov qword [rsi + 0x4c8], 0xffffffffffffffff
mov byte [rsi + 0x653], 0
mov ebx, Ordinal_46
jmp 0x14018b42f
Function at 0x14018dc50
Capabilities:
Send data
Send data on socket

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
cmp edx, 0x1f
jne 0x14018ddef
mov rdi, rcx
mov rsi, qword [rcx]
mov rbx, qword [rsi + 0x1e0]
lea r12, [rbx + 0x1eb8]
mov word [rbx + 0x1cb8], 0xfaff
lea r14, [rbx + 0x1cbb]
mov qword [rbx + 0x1eb8], r14
mov byte [rbx + 0x1cba], 0x1f
movzx ecx, word [rbx + 0x1ca8]
mov r15, qword [sym.imp.WS2_32.dll_htons]
call r15
mov ebp, eax
movzx ecx, word [rbx + 0x1caa]
call r15
mov r9, qword [rbx + 0x1eb8]
cmp r9, r12
jae 0x14018dcd1
lea rcx, [r9 + 1]
mov qword [r12], rcx
mov byte [r9], bpl
mov r9, qword [r12]
cmp r9, r12
jae 0x14018dce8
shr ebp, 8
lea rcx, [r9 + 1]
mov qword [r12], rcx
mov byte [r9], bpl
mov r9, qword [r12]
cmp r9, r12
jae 0x14018dcfc
lea rcx, [r9 + 1]
mov qword [r12], rcx
mov byte [r9], al
mov r9, qword [r12]
cmp r9, r12
jae 0x14018dd13
shr eax, 8
lea rcx, [r9 + 1]
mov qword [r12], rcx
mov byte [r9], al
mov r9, qword [r12]
cmp r9, r12
jae 0x14018dd28
lea rax, [r9 + 1]
mov qword [r12], rax
mov byte [r9], 0xff
mov r9, qword [r12]
lea r15, [rbx + 0x1cb8]
lea r8, [rbx + 0x1cba]
cmp r9, r12
jae 0x14018dd4b
lea rax, [r9 + 1]
mov qword [r12], rax
mov byte [r9], 0xf0
mov r9, qword [r12]
mov qword [rbx + 0x1ec0], r9
mov qword [rbx + 0x1eb8], r15
sub r9, r15
add r9, 0xfffffffffffffffe
mov rcx, rsi
mov edx, 0x3e
call fcn.14018de00
mov rcx, qword [rdi + 0x4c0]
mov rdx, r15
mov r8d, 3
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x14018dda2
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rsi
mov r8d, eax
call fcn.140158420
mov r8d, 4
mov rcx, rdi
mov rdx, r14
call fcn.14018d750
add rbx, 0x1cbf
mov rcx, qword [rdi + 0x4c0]
mov rdx, rbx
mov r8d, 2
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x14018ddef
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rsi
mov r8d, eax
call fcn.140158420
nop
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x140193950
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
test rcx, rcx
je 0x1401939f2
mov ebx, edx
mov rsi, rcx
xor r14d, r14d
lea rcx, [0x14040547d]
mov edx, 1
mov r8, rsi
xor r15d, r15d
xor eax, eax
jmp 0x14019398d
inc r14
jmp 0x14019398a
inc r15
inc r8
movzx r9d, byte [r8]
cmp r9d, 0x22
je 0x140193987
cmp r9d, 0x5c
je 0x140193982
test r9d, r9d
je 0x140193a00
test bl, bl
jne 0x14019398a
test al, 1
jne 0x14019398a
mov r11b, Ordinal_41
mov r10, rcx
cmp r9b, r11b
movzx eax, al
cmove eax, edx
mov r11b, byte [r10]
test r11b, r11b
je 0x14019398a
inc r10
test al, 1
je 0x1401939b0
jmp 0x14019398a
mov byte [rcx], 0x5c
inc rcx
mov dl, byte [rsi]
mov byte [rcx], dl
inc rsi
inc rcx
movzx edx, byte [rsi]
cmp edx, 0x22
je 0x1401939ca
cmp edx, 0x5c
je 0x1401939ca
test edx, edx
jne 0x1401939d2
mov byte [rax + r14], 0
jmp 0x1401939f4
xor eax, eax
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov rcx, r14
or rcx, r15
jne 0x140193a0c
test al, 1
je 0x140193a56
mov rcx, rsi
call fcn.14029c0d0
mov rdi, rax
mov eax, ebx
xor al, 1
movzx eax, al
lea r14, [r14 + rax*2]
add r14, r15
mov rax, qword [fcn.140119a10]
lea rcx, [rdi + r14]
inc rcx
call qword [str._a_]
test rax, rax
je 0x1401939f2
add r14, rdi
mov rcx, rax
test bl, bl
jne 0x1401939da
mov cl, 0x22
mov byte [rax], cl
mov byte [rax + r14 - 1], cl
mov rcx, rax
jmp 0x1401939d7
mov rax, qword [fcn.140292900]
mov rdx, qword [str._a_]
mov rcx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp rdx
Function at 0x1401995e0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Get local ipv4 addresses
Get socket information
Receive data
Receive data on socket
Send data
Send data on socket
Set socket configuration
Start tcp server

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rsi, r9
mov rax, qword [0x140430040]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x2c], reloc.WS2_32.dll_recv
mov dword [rsp + 0x28], 1
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x40], rax
movdqa xmm0, xmmword [0x1403d4b30]
movdqa xmmword [rsp + 0x30], xmm0
mov ecx, 2
mov edx, 1
mov r8d, 6
call qword [sym.imp.WS2_32.dll_socket]
cmp rax, 0xffffffffffffffff
je 0x1401997ca
mov rdi, rax
mov qword [rsp + 0x50], 0
mov word [rsp + 0x48], 2
mov ecx, 0x7f000001
call qword [sym.imp.WS2_32.dll_htonl]
mov dword [rsp + 0x4c], eax
mov word [rsp + 0x4a], 0
pcmpeqd xmm0, xmm0
movdqu xmmword [rsi], xmm0
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x28]
mov rcx, rdi
mov edx, 0xffff
mov r8d, 4
call qword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x140199782
lea rdx, [rsp + 0x48]
mov rcx, rdi
mov r8d, reloc.WS2_32.dll_recv
call qword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
je 0x140199782
lea rdx, [rsp + 0x48]
lea r8, [rsp + 0x2c]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
je 0x140199782
mov rcx, rdi
mov edx, 1
call qword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
je 0x140199782
mov ecx, 2
mov edx, 1
xor r8d, r8d
call qword [sym.imp.WS2_32.dll_socket]
mov qword [rsi], rax
cmp rax, 0xffffffffffffffff
je 0x140199782
lea rdx, [rsp + 0x48]
mov rcx, rax
mov r8d, reloc.WS2_32.dll_recv
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x140199782
mov rcx, rdi
xor edx, edx
xor r8d, r8d
call qword [sym.imp.WS2_32.dll_accept]
mov qword [rsi + 8], rax
cmp rax, 0xffffffffffffffff
je 0x140199782
lea r8, [0x1403dbf5a]
lea rbx, [rsp + 0x30]
mov edx, recv
mov rcx, rbx
mov r9, rsi
call fcn.140172120
mov rcx, rbx
call fcn.14029c0d0
mov r14, rax
mov rcx, qword [rsi]
mov rdx, rbx
mov r8d, r14d
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_send]
cdqe
cmp r14, rax
je 0x1401997d1
mov rbx, qword [sym.imp.WS2_32.dll_closesocket]
mov rcx, rdi
call rbx
mov rcx, qword [rsi]
call rbx
mov rdi, qword [rsi + 8]
mov ebx, 0xffffffff
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
cmp rcx, qword [0x140430040]
je 0x1401997bc
call fcn.140278ca0
int3
mov eax, ebx
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov ebx, 0xffffffff
jmp 0x1401997a5
lea r15, [rsp + 0x3c]
mov rcx, qword [rsi + 8]
xor ebx, ebx
mov rdx, r15
mov r8d, recv
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recv]
cdqe
cmp r14, rax
jne 0x140199782
lea rcx, [rsp + 0x30]
mov rdx, r15
mov r8, r14
call fcn.1402b6270
test eax, eax
jne 0x140199782
jmp 0x14019979c
Function at 0x14019ac40
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x38
mov rax, qword [0x140430040]
xor rax, rsp
mov qword [rsp + 0x30], rax
xor eax, eax
test edx, edx
setne al
lea r8, [rsp + 0x2c]
mov dword [r8], eax
mov edx, 0x8004667e
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
cmp rcx, qword [0x140430040]
je 0x14019ac84
call fcn.140278ca0
int3
add rsp, 0x38
ret
Function at 0x1401a4270
Capabilities:
Create thread

Disassembly:
push rsi
push rdi
sub rsp, 0x68
mov rsi, rcx
mov rax, qword [0x140430040]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r8, [0x1401a4320]
xor ecx, ecx
xor edx, edx
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsi + 8], rax
test rax, rax
je 0x1401a42d4
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
cmp rcx, qword [0x140430040]
je 0x1401a42cd
call fcn.140278ca0
int3
add rsp, 0x68
pop rdi
pop rsi
ret
lea rdx, str.Start
lea r8, str....._third_partycrashpadcrashpadutil_thread_thread_win.cc
lea rsi, [rsp + 0x38]
mov rcx, rsi
mov r9d, reloc.WLDAP32.dll_Ordinal_27
call fcn.14021c360
lea rdi, [rsp + 0x58]
mov rcx, rdi
mov rdx, rsi
call fcn.1402f8c50
lea rdx, [0x1403f281d]
mov rcx, rdi
call fcn.1402f5aa0
mov rcx, rdi
call fcn.1402f8d00
jmp 0x1401a42b6
Function at 0x1401ac960
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov rcx, rdx
mov rdx, r8
mov r8, rbx
call fcn.1401ac9b0
lea r8, [rbx + 7]
lea rdx, [rsi + 8]
mov rcx, rdi
call fcn.1401ac9b0
add rbx, 0xe
add rsi, 0x10
mov rcx, rdi
mov rdx, rsi
mov r8, rbx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.1401ac9b0

Function at 0x1401ac9b0
Capabilities:
Create new key via cryptacquirecontext
Encrypt or decrypt via wincrypt

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x140430040]
xor rax, rsp
mov qword [rsp + 0x68], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rcx, [rsp + 0x48]
mov qword [rcx], rax
mov qword [rsp + 0x40], rax
movaps xmm0, xmmword [0x1403d4b30]
movaps xmmword [rsp + 0x50], xmm0
mov dword [rsp + 0x60], 0xaaaaaaaa
mov dword [rsp + 0x3c], 8
mov dword [rsp + 0x20], 0xf0000040
xor edx, edx
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x1401acb42
lea rcx, [rsp + 0x5c]
movabs rax, 0x660100000000
mov qword [rcx - 0xc], rax
mov word [rcx - 0xc], 0x208
mov dword [rcx - 4], 8
mov al, byte [rbx]
mov byte [rcx], al
mov dl, byte [rbx + 1]
shl al, 7
mov r8d, edx
shr r8b, 1
or r8b, al
mov byte [rcx + 1], r8b
mov al, byte [rbx + 2]
shl dl, 6
mov r8d, eax
shr r8b, 2
or r8b, dl
mov byte [rcx + 2], r8b
mov dl, byte [rbx + 3]
shl al, 5
mov r8d, edx
shr r8b, 3
or r8b, al
mov byte [rcx + 3], r8b
mov al, byte [rbx + 4]
shl dl, 4
mov r8d, eax
shr r8b, 4
or r8b, dl
mov byte [rcx + 4], r8b
mov dl, byte [rbx + 5]
shl al, 3
mov r8d, edx
shr r8b, 5
or r8b, al
mov byte [rcx + 5], r8b
mov al, byte [rbx + 6]
shl dl, 2
mov r8d, eax
shr r8b, 6
or r8b, dl
mov byte [rcx + 6], r8b
add al, al
mov byte [rcx + 7], al
mov edx, 8
call fcn.1401f7000
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
lea rdx, [rsp + 0x50]
mov r8d, reloc.WS2_32.dll_sendto
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
je 0x1401acb35
mov rax, qword [rdi]
mov qword [rsi], rax
lea rax, [rsp + 0x3c]
mov edx, dword [rax]
mov rcx, qword [rsp + 0x40]
mov dword [rsp + 0x30], edx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rsp + 0x48]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
cmp rcx, qword [0x140430040]
je 0x1401acb59
call fcn.140278ca0
int3
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret

Function at 0x1401accf0
Capabilities:
Get hostname

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov ebx, edx
mov rdi, rcx
xor ebp, ebp
mov byte [rcx], bpl
call qword [sym.imp.WS2_32.dll_gethostname]
mov esi, eax
movsxd rax, ebx
mov byte [rdi + rax - 1], bpl
test esi, esi
jne 0x1401acd2b
mov rcx, rdi
mov edx, reloc.WLDAP32.dll_Ordinal_46
call fcn.14027a740
test rax, rax
je 0x1401acd2b
mov byte [rax], 0
mov eax, esi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x1401c73d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movzx r9d, byte [rdx + 1]
cmp r9, 9
ja case.0x1401c73f3.0
movzx eax, byte [rdx]
and eax, 0x3f
lea r10, [0x140418830]
movsxd r9, dword [r10 + r9*4]
add r9, r10
jmp r9
movsx rax, byte [rdx + rax]
cmp qword [r8 + 0x10], rax
jg 0x1401c7421
jl 0x1401c7430
cmp word [r8 + 0x1c], 2
jb 0x1401c7436
mov r9d, 1
jmp fcn.1401c5240
xor eax, eax
jmp 0x1401c73fb
mov eax, 1
jmp 0x1401c73fb
movsx eax, byte [r8 + 0x20]
ret
mov rax, qword [rdx + rax]
bswap rax
jmp 0x1401c73fb
movsx eax, byte [r8 + 0x21]
ret
movsx eax, byte [r8 + 0x1e]
mov byte [r8 + 0x22], 1
ret
mov r9d, dword [rdx + rax + 2]
bswap r9d
movsx r10d, byte [rdx + rax]
shl r10d, 8
movzx eax, byte [rdx + rax + 1]
or eax, r10d
shl rax, 0x20
jmp 0x1401c746e
movsx r9, byte [rdx + rax]
shl r9, 8
movzx eax, byte [rdx + rax + 1]
or rax, r9
jmp 0x1401c73fb
movzx r9d, byte [rdx + rax]
shl r9d, 0x18
movzx r10d, byte [rdx + rax + 1]
shl r10d, 0x10
movsxd r9, r9d
or r9, r10
movzx r10d, byte [rdx + rax + 2]
shl r10d, 8
or r10, r9
movzx eax, byte [rdx + rax + 3]
or rax, r10
jmp 0x1401c73fb
xor r9d, r9d
jmp fcn.1401c5240
movsx r9, byte [rdx + rax]
shl r9, 0x10
movzx r10d, byte [rdx + rax + 1]
shl r10d, 8
or r10, r9
movzx eax, byte [rdx + rax + 2]
jmp 0x1401c749e