joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001130
Capabilities:
Terminate thread

Disassembly:
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx + 8]
test rcx, rcx
jne 0x14000114a
xor eax, eax
add rsp, 0x20
pop rdi
ret
mov edx, 1
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rdi + 8]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r11d, r11d
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov qword [rdi + 8], r11
mov dword [rdi + 0x10], r11d
add rsp, 0x20
pop rdi
ret

Function at 0x1400014c0
Capabilities:
Encode data using base64

Disassembly:
sub rsp, 8
mov r11d, edx
mov r10, rcx
test rcx, rcx
je 0x140001504
test edx, edx
jle 0x140001504
lea eax, [rdx + 2]
mov edx, 2
movd xmm0, eax
cvtdq2ps xmm0, xmm0
divss xmm0, dword [0x1402ab668]
cvttss2si eax, xmm0
shl eax, 2
sub edx, eax
lea eax, [rdx - 1]
cmp eax, dword [r9]
jle 0x14000150e
test r8, r8
je 0x140001506
mov byte [r8], 0
xor edx, edx
mov dword [r9], edx
add rsp, 8
ret
lea eax, [rdx - 2]
lea ecx, [r11 - 2]
xor edx, edx
mov qword [rsp], rdi
lea rdi, [0x14029fcb0]
mov dword [r9], eax
test ecx, ecx
jle 0x1400015c2
dec ecx
mov eax, 0xaaaaaaab
mov qword [rsp + 0x10], rbx
lea rbx, [r10 + 1]
mul ecx
shr edx, 1
inc edx
mov r9d, edx
lea edx, [rdx + rdx*2]
nop dword [rax]
movzx eax, byte [rbx - 1]
add r8, 4
add rbx, 3
shr rax, 2
movzx eax, byte [rax + rdi]
mov byte [r8 - 4], al
movsx eax, byte [rbx - 4]
and eax, 3
shl eax, 4
movsxd rcx, eax
movzx eax, byte [rbx - 3]
shr eax, 4
or rcx, rax
movzx eax, byte [rcx + rdi]
mov byte [r8 - 3], al
movsx eax, byte [rbx - 3]
and eax, 0xf
shl eax, 2
movsxd rcx, eax
movzx eax, byte [rbx - 2]
shr rax, 6
or rcx, rax
movzx eax, byte [rcx + rdi]
mov byte [r8 - 2], al
movsx rax, byte [rbx - 2]
and eax, 0x3f
sub r9, 1
movzx eax, byte [rax + rdi]
mov byte [r8 - 1], al
jne 0x140001550
mov rbx, qword [rsp + 0x10]
cmp edx, r11d
jge 0x14000165d
movsxd r9, edx
movzx eax, byte [r9 + r10]
shr rax, 2
movzx eax, byte [rax + rdi]
mov byte [r8], al
lea eax, [r11 - 1]
cmp edx, eax
jne 0x140001619
movsx eax, byte [r9 + r10]
add r8, 3
and eax, 3
shl eax, 4
inc r8
cdqe
movzx eax, byte [rax + rdi]
mov rdi, qword [rsp]
mov byte [r8 - 3], al
mov byte [r8 - 2], 0x3d
mov byte [r8 - 1], 0x3d
mov byte [r8], 0
add rsp, 8
ret
movsx eax, byte [r9 + r10]
add r8, 3
and eax, 3
shl eax, 4
movsxd rcx, eax
movzx eax, byte [r9 + r10 + 1]
shr eax, 4
or rcx, rax
movzx eax, byte [rcx + rdi]
mov byte [r8 - 2], al
movsx eax, byte [r9 + r10 + 1]
and eax, 0xf
shl eax, 2
inc r8
cdqe
movzx eax, byte [rax + rdi]
mov byte [r8 - 2], al
mov byte [r8 - 1], 0x3d
mov byte [r8], 0
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x140001ba0
Capabilities:
Encode data using xor
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, r8
mov rsi, rdx
test rdx, rdx
jne 0x140001bbb
xor eax, eax
add rsp, 0x28
pop rdi
pop rsi
ret
lea rdx, [0x14029fcf4]
mov qword [rsp + 0x50], rbp
call fcn.1401e97ac
mov rbp, rax
test rax, rax
jne 0x140001be0
mov rbp, qword [rsp + 0x50]
add rsp, 0x28
pop rdi
pop rsi
ret
mov qword [rsp + 0x40], rbx
test rdi, rdi
jne 0x140001bfc
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rsi
repne scasb al, byte [rdi]
not rcx
lea rdi, [rcx - 1]
mov rcx, rdi
call fcn.1401e6440
mov rbx, rax
test rax, rax
jne 0x140001c27
mov rcx, rbp
call fcn.1401e95fc
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
xor eax, eax
add rsp, 0x28
pop rdi
pop rsi
ret
mov r8, rdi
mov rdx, rsi
mov rcx, rax
call fcn.1401e75a0
xor r9d, r9d
mov r11d, edi
mov r10d, edi
mov r8, r9
test edi, edi
je 0x140001c8c
mov rsi, qword [0x1402e28b8]
mov qword [rsp + 0x20], r12
lea r12, str.8437jhdf8834kmklsi7__kdf8lsdjf2__aksdjsd0__dkfk____sksldfjsa_sdasdkj23knfsmmjjd
nop dword [rax + rax]
movsx ecx, byte [r8 + rbx]
mov eax, r11d
xor edx, edx
div rsi
inc r8
inc r11d
movzx eax, byte [rdx + r12]
add r9d, ecx
xor al, cl
mov byte [r8 + rbx - 1], al
cmp r8, r10
jb 0x140001c60
mov r12, qword [rsp + 0x20]
mov eax, r9d
mov edx, 8
lea rcx, [0x14029fcf8]
lea r8d, [rdx - 7]
mov r9, rbp
mov qword [rsp + 0x48], rax
call fcn.1401e9984
mov edx, 4
lea rcx, [rsp + 0x48]
lea r8d, [rdx - 3]
mov r9, rbp
call fcn.1401e9984
mov r9, rbp
mov r8d, 1
mov rdx, rdi
mov rcx, rbx
call fcn.1401e9984
mov rcx, rbx
call fcn.1401e64f8
mov rcx, rbp
call fcn.1401e95fc
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov eax, 1
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x140002e50
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push r12
sub rsp, 0x20
mov rbp, rdx
xor edx, edx
mov rbx, rcx
lea r8d, [rdx + 2]
mov rcx, rbp
call fcn.1401e94c0
mov rcx, rbp
call fcn.1401e93a4
xor r8d, r8d
xor edx, edx
mov rcx, rbp
movsxd r12, eax
call fcn.1401e94c0
cmp r12d, 0x4000000
jle 0x140002ea0
mov dword [rbx + 0x38], 0xfffffffe
xor al, al
add rsp, 0x20
pop r12
pop rbp
pop rbx
ret
lea eax, [r12 + 2]
mov ecx, eax
mov dword [rbx + 0x30], eax
call fcn.1401e65ec
mov qword [rbx + 0x28], rax
test rax, rax
jne 0x140002ec8
mov dword [rbx + 0x38], 0xfffffffb
add rsp, 0x20
pop r12
pop rbp
pop rbx
ret
mov edx, 1
mov qword [rsp + 0x40], rsi
mov r9, rbp
lea r8d, [rdx + 0xb]
mov rcx, rax
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x58], r13
call fcn.1401e91c0
mov rsi, rax
cmp rax, 0xc
jne 0x140002f8a
mov rcx, qword [rbx + 0x28]
cmp byte [rcx], 0x31
jne 0x140002f8a
cmp byte [rcx + 1], 0x32
jne 0x140002f8a
cmp byte [rcx + 2], 0x78
jne 0x140002f8a
cmp byte [rcx + 3], 0
jne 0x140002f8a
mov eax, dword [rcx + 8]
movsx r13d, byte [rcx + 4]
xor edi, edi
mov qword [rsp + 0x50], rdi
mov dword [rsp + 0x50], eax
lea eax, [r12 - 0xc]
movsxd rsi, eax
lea r8d, [rdi + 1]
mov r9, rbp
mov rdx, rsi
call fcn.1401e91c0
mov rcx, qword [rbx + 0x28]
mov r9d, esi
xor r8d, r8d
mov edx, esi
call fcn.1400041d0
mov ecx, eax
cmp rcx, qword [rsp + 0x50]
je 0x140002f7c
mov dword [rbx + 0x38], 0xfffffffd
xor al, al
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov r13, qword [rsp + 0x58]
add rsp, 0x20
pop r12
pop rbp
pop rbx
ret
test r13d, r13d
setne dil
inc edi
mov dword [rbx + 0x38], edi
jmp 0x140002fb1
xor edi, edi
mov dword [rbx + 0x38], edi
cmp r12, rax
jbe 0x140002fb1
mov rcx, qword [rbx + 0x28]
mov rdx, r12
lea r8d, [rdi + 1]
sub rdx, rax
mov r9, rbp
add rcx, 0xc
call fcn.1401e91c0
mov rsi, r12
test rsi, rsi
je 0x140002f62
mov rax, qword [rbx + 0x28]
mov rcx, rbx
mov byte [rsi + rax], 0
call fcn.140002fd0
mov al, 1
jmp 0x140002f64
Function at 0x1400039c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push r13
push r14
sub rsp, 0x20
mov r13, r9
mov r14, r8
mov rbx, rdx
mov rbp, rcx
cmp rdx, 0xffff
jbe 0x1400039fb
mov qword [r9], 0
xor eax, eax
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r13
pop rbp
ret
mov qword [rsp + 0x40], rsi
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], r12
test rsi, rsi
je 0x140003a2d
cmp byte [rsi], 0
je 0x140003a2d
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rsi
repne scasb al, byte [rdi]
not rcx
lea r12, [rcx - 1]
jmp 0x140003a3b
mov r12, qword [0x1402e28b8]
lea rsi, str.8437jhdf8834kmklsi7__kdf8lsdjf2__aksdjsd0__dkfk____sksldfjsa_sdasdkj23knfsmmjjd
lea rax, [rdx + 4]
lea rdi, [r8 + 4]
mov qword [r9], rax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [r14]
xor ecx, eax
xor edx, edx
and ecx, 0x7ffff
xor ecx, dword [r14]
mov rax, rcx
and eax, 0x7ffff
div r12
shl edx, 0x13
xor edx, ecx
and edx, 0x1f80000
xor edx, ecx
mov dword [r14], edx
cmp rbx, 0x7f
jbe 0x140003a95
and edx, 0x1ffffff
add rdi, 2
add qword [r13], 2
mov dword [r14], edx
mov word [rdi - 2], bx
jmp 0x140003aa5
mov eax, ebx
and edx, 0x1ffffff
shl eax, 0x19
or edx, eax
mov dword [r14], edx
mov edx, dword [r14]
shr edx, 0x13
and edx, 0x3f
test rbx, rbx
je 0x140003ae1
sub rbp, rdi
nop word [rax + rax]
movsxd rax, edx
inc rdi
movzx ecx, byte [rax + rsi]
lea eax, [rdx + 3]
xor edx, edx
xor cl, byte [rdi + rbp - 1]
cdqe
mov byte [rdi - 1], cl
div r12
sub rbx, 1
jne 0x140003ac0
mov r12, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x58]
mov eax, 1
add rsp, 0x20
pop r14
pop r13
pop rbp
ret

Function at 0x1400041d0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
xor r10d, r10d
mov r11d, edx
test edx, edx
je 0x14000422e
mov qword [rsp + 0x10], rbx
mov rbx, qword [0x1402e28b8]
mov qword [rsp], rdi
lea rdi, str.8437jhdf8834kmklsi7__kdf8lsdjf2__aksdjsd0__dkfk____sksldfjsa_sdasdkj23knfsmmjjd
nop word [rax + rax]
mov eax, r9d
xor edx, edx
inc r10
div rbx
inc r9d
movzx eax, byte [rdx + rdi]
xor byte [r10 + rcx - 1], al
movsx eax, byte [r10 + rcx - 1]
add r8d, eax
cmp r10, r11
jb 0x140004200
mov rdi, qword [rsp]
mov rbx, qword [rsp + 0x10]
mov eax, r8d
add rsp, 8
ret
Function at 0x1400045f0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x20], r9
push rbx
sub rsp, 0x8b0
mov rax, qword [0x1402e0068]
xor rax, rsp
mov qword [rsp + 0x8a0], rax
movsxd rbx, ecx
lea r8, [rsp + 0x8e0]
lea rcx, [rsp + 0x4a0]
mov rdx, r9
mov byte [rsp + 0x50], 0x56
mov byte [rsp + 0x51], 0x49
mov byte [rsp + 0x52], 0x57
mov byte [rsp + 0x53], 0x45
call fcn.1401eb3d8
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
test byte [reloc.WS2_32.dll_bind], 8
je 0x1400046a3
movsx ebx, byte [rsp + rbx + 0x50]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
movzx ecx, word [rsp + 0x66]
movzx edx, word [rsp + 0x64]
movzx r9d, word [rsp + 0x62]
movzx r8d, word [rsp + 0x60]
lea r10, [rsp + 0x4a0]
mov qword [rsp + 0x40], r10
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], edx
lea rdx, str.__02d:_02d:_02d__03d_thread:_d__c___s
lea rcx, [rsp + 0x70]
call fcn.1401e8aa0
jmp 0x1400046e8
movzx edx, word [rsp + 0x64]
movsx ecx, byte [rsp + rbx + 0x50]
movzx eax, word [rsp + 0x66]
movzx r9d, word [rsp + 0x62]
movzx r8d, word [rsp + 0x60]
lea r10, [rsp + 0x4a0]
mov qword [rsp + 0x38], r10
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], edx
lea rcx, [rsp + 0x70]
lea rdx, str.__02d:_02d:_02d__03d__c___s
call fcn.1401e8aa0
test byte [reloc.WS2_32.dll_bind], 4
je 0x14000472e
lea rdx, [0x14029fddc]
lea rcx, [0x1402e6760]
call fcn.1401e97ac
mov rbx, rax
test rax, rax
je 0x14000472e
lea rcx, [rsp + 0x70]
mov rdx, rax
call fcn.1401eb1c8
mov rdx, rbx
mov ecx, 0xa
call fcn.1401eb090
mov rcx, rbx
call fcn.1401e95fc
test byte [reloc.WS2_32.dll_bind], 1
je 0x140004741
lea rcx, [rsp + 0x70]
call fcn.1401eb3e4
test byte [reloc.WS2_32.dll_bind], 2
je 0x140004762
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, [0x14029fde0]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, qword [rsp + 0x8a0]
xor rcx, rsp
call fcn.1401e6720
add rsp, 0x8b0
pop rbx
ret

Function at 0x140004780
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x830
mov rax, qword [0x1402e0068]
xor rax, rsp
mov qword [rsp + 0x820], rax
mov rdi, rdx
lea rdx, [0x14029fd14]
xor ebx, ebx
call fcn.1401e97ac
mov rsi, rax
test rax, rax
je 0x14000483d
lea rdx, [0x14029fcf4]
mov rcx, rdi
call fcn.1401e97ac
mov rdi, rax
test rax, rax
je 0x140004835
mov ebx, 1
lea rcx, [rsp + 0x20]
mov r9, rsi
mov rdx, rbx
mov r8d, 0x800
call fcn.1401e91c0
test eax, eax
jle 0x14000482d
nop word [rax + rax]
lea rcx, [rsp + 0x20]
movsxd rdx, eax
mov r9, rdi
mov r8, rbx
call fcn.1401e9984
lea rcx, [rsp + 0x20]
mov r9, rsi
mov r8d, 0x800
mov rdx, rbx
call fcn.1401e91c0
test eax, eax
jg 0x140004800
mov rcx, rdi
call fcn.1401e95fc
mov rcx, rsi
call fcn.1401e95fc
mov eax, ebx
mov rcx, qword [rsp + 0x820]
xor rcx, rsp
call fcn.1401e6720
lea r11, [rsp + 0x830]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140007040
Capabilities:
Resolve dns

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
jne 0x140007056
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov qword [rsp + 0x30], rdi
call sub.WS2_32.dll_inet_addr
mov edi, eax
cmp eax, 0xffffffff
jne 0x14000707d
mov rcx, rbx
call sub.WS2_32.dll_gethostbyname
test rax, rax
je 0x14000707d
mov rax, qword [rax + 0x18]
mov rcx, qword [rax]
mov edi, dword [rcx]
mov eax, edi
mov rdi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret

Function at 0x140007090
Capabilities:
Connect socket
Get socket status
Resolve dns

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x278
mov rax, qword [0x1402e0068]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor r12d, r12d
mov edi, r9d
movzx r13d, r8w
mov rsi, rdx
mov rbp, rcx
test rdx, rdx
jne 0x1400070cc
mov ebx, r12d
jmp 0x1400070f1
mov rcx, rdx
call sub.WS2_32.dll_inet_addr
mov ebx, eax
cmp eax, 0xffffffff
jne 0x1400070f1
mov rcx, rsi
call sub.WS2_32.dll_gethostbyname
test rax, rax
je 0x1400070f1
mov rax, qword [rax + 0x18]
mov rcx, qword [rax]
mov ebx, dword [rcx]
movzx ecx, r13w
mov dword [rsp + 0x254], ebx
call sub.WS2_32.dll_htons
mov ecx, dword [rsp + 0x254]
mov word [rsp + 0x252], ax
mov eax, 2
mov word [rsp + 0x250], ax
cmp ecx, 0xffffffff
jne 0x140007153
cmp dword [reloc.WS2_32.dll_accept], 1
jg 0x14000714c
mov qword [rsp + 0x20], rsi
lea r9, str._s_cant_be_resolved.
lea r8d, [rax + 0x22]
lea rdx, str....._base_srcwin32TSocket.c
mov ecx, 1
call fcn.1400045f0
xor eax, eax
jmp 0x140007247
cmp dword [reloc.WS2_32.dll_accept], 1
jg 0x14000718b
movzx ebx, r13w
call sub.WS2_32.dll_inet_ntoa
mov r8d, 0x28
lea r9, str.Socket_connecting_to__s:_d_...
lea rdx, str....._base_srcwin32TSocket.c
lea ecx, [r8 - 0x27]
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
call fcn.1400045f0
lea rdx, [rsp + 0x250]
mov r8d, reloc.WS2_32.dll_recv
mov rcx, rbp
call sub.WS2_32.dll_connect
test eax, eax
je 0x140007242
call sub.WS2_32.dll_WSAGetLastError
cmp eax, 0x2733
jne 0x140007267
cmp edi, 0xffffffff
je 0x1400071e3
mov eax, 0x10624dd3
lea r12, [rsp + 0x30]
mul edi
shr edx, 6
mov dword [rsp + 0x30], edx
imul edx, edx, 0x3e8
sub edi, edx
imul edi, edi, 0x3e8
mov dword [rsp + 0x34], edi
xor edx, edx
lea r8, [rsp + 0x40]
xor r9d, r9d
lea ecx, [rdx + 1]
mov qword [rsp + 0x48], rbp
mov dword [rsp + 0x40], 1
mov qword [rsp + 0x20], r12
call sub.WS2_32.dll_select
test eax, eax
jle 0x140007267
lea rdx, [rsp + 0x40]
mov rcx, rbp
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x140007267
cmp dword [reloc.WS2_32.dll_accept], 1
jg 0x140007242
mov r8d, 0x4b
lea r9, str.Connected.
lea rdx, str....._base_srcwin32TSocket.c
lea ecx, [r8 - 0x4a]
call fcn.1400045f0
mov eax, 1
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1401e6720
add rsp, 0x278
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
cmp dword [reloc.WS2_32.dll_accept], 1
jg 0x14000714c
call sub.WS2_32.dll_WSAGetLastError
lea r9, str.Connect_failed__error_d
mov r8d, 0x4f
mov dword [rsp + 0x20], eax
jmp 0x14000713b
Function at 0x140007290
Capabilities:
Get socket status

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x240
xor r9d, r9d
mov r8d, edx
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], 1
cmp edx, 0xffffffff
je 0x1400072da
mov eax, 0x10624dd3
lea r9, [r11 + 0x18]
mul r8d
shr edx, 6
mov dword [r11 + 0x18], edx
imul edx, edx, 0x3e8
sub r8d, edx
imul r8d, r8d, 0x3e8
mov dword [r11 + 0x1c], r8d
mov qword [rsp + 0x20], r9
xor r9d, r9d
lea rdx, [rsp + 0x30]
lea ecx, [r9 + 1]
xor r8d, r8d
call sub.WS2_32.dll_select
mov ebx, eax
cmp eax, 0xffffffff
je 0x1400072fe
test eax, eax
jne 0x14000732f
cmp dword [reloc.WS2_32.dll_accept], 3
jg 0x14000732f
call sub.WS2_32.dll_WSAGetLastError
mov r8d, WSASetLastError
lea r9, str.socket_error__u
lea ecx, [r8 - 0x68]
lea rdx, str....._base_srcwin32TSocket.c
mov dword [rsp + 0x20], eax
call fcn.1400045f0
mov eax, ebx
add rsp, 0x240
pop rbx
ret

Function at 0x140007340
Capabilities:
Get socket status

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x240
xor r9d, r9d
mov r8d, edx
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], 1
cmp edx, 0xffffffff
je 0x14000738a
mov eax, 0x10624dd3
lea r9, [r11 + 0x18]
mul r8d
shr edx, 6
mov dword [r11 + 0x18], edx
imul edx, edx, 0x3e8
sub r8d, edx
imul r8d, r8d, 0x3e8
mov dword [r11 + 0x1c], r8d
xor edx, edx
mov qword [rsp + 0x20], r9
lea r8, [rsp + 0x30]
lea ecx, [rdx + 1]
xor r9d, r9d
call sub.WS2_32.dll_select
mov ebx, eax
cmp eax, 0xffffffff
je 0x1400073ac
test eax, eax
jne 0x1400073de
cmp dword [reloc.WS2_32.dll_accept], 3
jg 0x1400073de
call sub.WS2_32.dll_WSAGetLastError
lea r9, str.socket_error__u
lea rdx, str....._base_srcwin32TSocket.c
mov r8d, 0x85
mov ecx, 3
mov dword [rsp + 0x20], eax
call fcn.1400045f0
mov eax, ebx
add rsp, 0x240
pop rbx
ret
Function at 0x140007870
Capabilities:
Receive data
Receive data on socket
Resolve dns
Send data
Send data on socket

Disassembly:
push rbp
push rdi
push r12
sub rsp, 0x470
mov rax, qword [0x1402e0068]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov rbp, qword [rsp + 0x4b8]
mov rdi, r9
mov r9d, dword [rsp + 0x4c8]
mov r12, rcx
call fcn.140007090
test eax, eax
je 0x140007a80
mov qword [rsp + 0x468], rbx
test rdi, rdi
mov qword [rsp + 0x460], rsi
lea rbx, [0x14028e586]
mov qword [rsp + 0x458], r13
cmovne rbx, rdi
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
xor esi, esi
repne scasb al, byte [rdi]
not rcx
lea r13, [rcx - 1]
test rbp, rbp
jne 0x14000796c
mov edi, esi
movzx ecx, word [rsp + 0x4c0]
mov byte [rsp + 0x40], 4
mov byte [rsp + 0x41], 1
call sub.WS2_32.dll_htons
lea rcx, [rsp + 0x48]
mov dword [rsp + 0x44], edi
mov word [rsp + 0x42], ax
sub rcx, rbx
nop word [rax + rax]
movzx eax, byte [rbx]
inc rbx
mov byte [rcx + rbx - 1], al
test al, al
jne 0x140007920
lea edi, [r13 + 9]
lea rdx, [rsp + 0x40]
xor r9d, r9d
mov r8d, edi
mov rcx, r12
call sub.WS2_32.dll_send
cmp eax, edi
je 0x1400079cd
cmp dword [reloc.WS2_32.dll_accept], 3
jg 0x140007a20
lea r9, str.Fail_to_send_SOCK4_request.
mov r8d, 0x156
jmp 0x140007a0f
mov rcx, rbp
call sub.WS2_32.dll_inet_addr
mov edi, eax
cmp eax, 0xffffffff
jne 0x140007991
mov rcx, rbp
call sub.WS2_32.dll_gethostbyname
test rax, rax
je 0x140007991
mov rax, qword [rax + 0x18]
mov rcx, qword [rax]
mov edi, dword [rcx]
cmp edi, 0xffffffff
jne 0x1400078f2
cmp dword [reloc.WS2_32.dll_accept], 3
jg 0x140007a20
lea r9, str.The_host__s_cant_be_resolved.
lea rdx, str....._base_srcwin32TSocket.c
mov r8d, 0x14a
mov ecx, 3
mov qword [rsp + 0x20], rbp
call fcn.1400045f0
xor eax, eax
jmp 0x140007a68
mov edx, dword [rsp + 0x4c8]
mov rcx, r12
call fcn.140007290
test eax, eax
jle 0x140007a20
xor r9d, r9d
lea rdx, [rsp + 0x30]
mov rcx, r12
lea r8d, [r9 + 8]
call sub.WS2_32.dll_recv
cmp eax, 8
je 0x140007a24
cmp dword [reloc.WS2_32.dll_accept], 3
jg 0x140007a20
lea r9, str.Fail_to_read_socks4_response.
mov r8d, 0x160
lea rdx, str....._base_srcwin32TSocket.c
mov ecx, 3
call fcn.1400045f0
xor eax, eax
jmp 0x140007a68
cmp dword [reloc.WS2_32.dll_accept], 1
jg 0x140007a5d
movzx ecx, byte [rsp + 0x31]
movzx edx, byte [rsp + 0x30]
lea r9, str.SOCKS4_response_read._ver_d_status_d
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], edx
lea rdx, str....._base_srcwin32TSocket.c
mov r8d, 0x165
mov ecx, 1
call fcn.1400045f0
cmp byte [rsp + 0x31], 0x5a
sete sil
mov eax, esi
mov rsi, qword [rsp + 0x460]
mov rbx, qword [rsp + 0x468]
mov r13, qword [rsp + 0x458]
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.1401e6720
add rsp, 0x470
pop r12
pop rdi
pop rbp
ret
Function at 0x140008430
Capabilities:
Send data
Send data on socket

Disassembly:
push rbx
push rbp
push rsi
sub rsp, 0x50
mov rax, qword [0x1402e0068]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov eax, 2
mov rbx, rcx
mov rbp, r8
lea ecx, [rax + 7]
mov rsi, rdx
mov word [rsp + 0x30], ax
call sub.WS2_32.dll_htons
mov word [rsp + 0x32], ax
test rbx, rbx
je 0x1400084e2
mov qword [rsp + 0x88], rdi
lea rcx, [rbx + 8]
call sub.WS2_32.dll_inet_addr
lea rcx, [rbx + 0x18]
mov edi, eax
call sub.WS2_32.dll_inet_addr
test edi, edi
je 0x1400084c0
not eax
xor r9d, r9d
mov rdx, rsi
or eax, edi
lea r8d, [r9 + 0x66]
mov rcx, rbp
mov dword [rsp + 0x34], eax
lea rax, [rsp + 0x30]
mov dword [rsp + 0x28], reloc.WS2_32.dll_recv
mov qword [rsp + 0x20], rax
call sub.WS2_32.dll_sendto
mov rbx, qword [rbx]
test rbx, rbx
jne 0x140008474
mov rdi, qword [rsp + 0x88]
mov eax, 1
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1401e6720
add rsp, 0x50
pop rsi
pop rbp
pop rbx
ret
mov eax, 1
jmp 0x1400084cd

Function at 0x1400085f0
Capabilities:
Create udp socket
Set socket configuration

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0xc0
mov rax, qword [0x1402e0068]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov edx, 2
mov rbx, rcx
xor r8d, r8d
mov ecx, edx
mov dword [rsp + 0x30], 1
call sub.WS2_32.dll_socket
lea r9, [rsp + 0x30]
mov edx, 0xffff
mov r8d, 0x20
mov rcx, rax
mov dword [rsp + 0x20], 4
mov rdi, rax
call sub.WS2_32.dll_setsockopt
or r11, 0xffffffffffffffff
lea edx, [r11 + 0x11]
mov dword [rsp + 0x40], r11d
mov word [rsp + 0x44], r11w
lea rcx, [rsp + 0x46]
nop word [rax + rax]
mov eax, dword [rbx]
add rcx, 6
sub rdx, 1
mov dword [rcx - 6], eax
movzx eax, word [rbx + 4]
mov word [rcx - 2], ax
jne 0x140008670
lea rcx, [rsp + 0x40]
mov rdx, rdi
call fcn.1400084f0
mov rcx, rdi
call sub.WS2_32.dll_closesocket
xor eax, eax
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1401e6720
mov rbx, qword [rsp + 0xd0]
add rsp, 0xc0
pop rdi
ret
Function at 0x140008ac0
Capabilities:
Resolve dns

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rcx
push rdi
push r12
push r13
sub rsp, 0x50
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
mov r13, r9
mov rsi, rcx
xor ebp, ebp
mov qword [rcx + 8], rbp
mov dword [rcx + 0x10], ebp
mov qword [rcx + 0x18], rcx
lea rax, vtable.TPinger::PING_ITEM.0
mov qword [rcx], rax
mov qword [rcx + 0x20], r9
mov dword [rcx + 0x28], 0xffffffff
mov dword [rcx + 0x2c], ebp
mov qword [rcx + 0x38], 0xffffffffffffffff
mov dword [rcx + 0x40], r8d
mov qword [rcx + 0x48], rbp
mov eax, dword [r9 + 0x40]
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x2c], eax
mov qword [r11 - 0x38], rbp
mov qword [r11 - 0x30], rbp
mov qword [r11 - 0x28], rbp
lea rcx, [r11 - 0x40]
call fcn.1400087d0
nop
mov rdi, qword [rsp + 0x30]
test rdi, rdi
je 0x140008b7e
mov rbx, qword [rdi]
test rbx, rbx
je 0x140008b7e
test rbx, rbx
je 0x140008b7e
mov rcx, rbx
call sub.WS2_32.dll_inet_addr
mov ebp, eax
cmp eax, 0xffffffff
jne 0x140008b7e
mov rcx, rbx
call sub.WS2_32.dll_gethostbyname
test rax, rax
je 0x140008b7e
mov rax, qword [rax + 0x18]
mov rcx, qword [rax]
mov ebp, dword [rcx]
mov dword [rsi + 0x30], ebp
mov eax, dword [rsp + 0x2c]
mov dword [rsi + 0x34], eax
xor r8d, r8d
lea edx, [r8 + 1]
lea ecx, [rdx + 1]
call sub.WS2_32.dll_socket
mov qword [rsi + 0x38], rax
cmp dword [r13 + 0x44], 0
je 0x140008bb1
lea rdx, [rsp + 0x30]
lea rcx, [rsi + 0x48]
call fcn.140009930
nop
mov rbx, qword [rsp + 0x40]
test rbx, rbx
je 0x140008bda
dec dword [rbx + 0x10]
cmp dword [rbx + 0x10], 0
jg 0x140008bda
mov rcx, qword [rbx]
test rcx, rcx
je 0x140008bd1
call fcn.1401e64f8
mov rcx, rbx
call fcn.1401e60f0
nop
mov rbx, qword [rsp + 0x38]
test rbx, rbx
je 0x140008c03
dec dword [rbx + 0x10]
cmp dword [rbx + 0x10], 0
jg 0x140008c03
mov rcx, qword [rbx]
test rcx, rcx
je 0x140008bfa
call fcn.1401e64f8
mov rcx, rbx
call fcn.1401e60f0
nop
test rdi, rdi
je 0x140008c31
dec dword [rdi + 0x10]
cmp dword [rdi + 0x10], 0
jg 0x140008c2c
mov rcx, qword [rdi]
test rcx, rcx
je 0x140008c1e
call fcn.1401e64f8
mov rcx, rdi
call fcn.1401e60f0
nop
mov rax, rsi
jmp 0x140008c34
mov rax, rsi
jmp 0x140008c34
mov rax, rsi
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret