joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401a9380
Capabilities:
Get common file path

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
lea rcx, str.kernel32
xor esi, esi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdi, rax
test rax, rax
jne 0x1401a93aa
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret
lea rdx, str.LoadLibraryExA
mov rcx, rax
mov qword [rsp + 0x40], rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x140271918]
mov rcx, rbx
mov rbp, rax
call fcn.14017bef0
test rax, rax
je 0x1401a940c
mov rcx, rbx
test rbp, rbp
je 0x1401a93f6
xor edx, edx
lea r8d, [rdx + 8]
call rbp
mov rbp, qword [rsp + 0x40]
mov rsi, rax
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbp, qword [rsp + 0x40]
mov rsi, rax
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret
test rbp, rbp
je 0x1401a9443
lea rdx, str.AddDllDirectory
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1401a9443
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call rbp
mov rbp, qword [rsp + 0x40]
mov rsi, rax
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x50], r13
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov r13d, eax
test eax, eax
je 0x1401a9507
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasb al, byte [rdi]
mov qword [rsp + 0x48], r12
not rcx
lea rax, [rcx - 1]
lea ecx, [r13 + 1]
add rcx, rax
call qword [fcn.14017cf5c]
mov r12, rax
test rax, rax
je 0x1401a94f9
mov edx, r13d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x1401a94f9
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r12
repne scasb al, byte [rdi]
mov eax, 0x5c
mov rdi, r12
not rcx
mov word [rcx + r12 - 1], ax
or rcx, 0xffffffffffffffff
xor eax, eax
repne scasb al, byte [rdi]
not rcx
lea rdx, [rcx - 1]
add rdx, r12
sub rdx, rbx
nop word [rax + rax]
movzx eax, byte [rbx]
inc rbx
mov byte [rdx + rbx - 1], al
test al, al
jne 0x1401a94d0
mov rcx, r12
test rbp, rbp
je 0x1401a94f0
xor edx, edx
lea r8d, [rdx + 8]
call rbp
jmp 0x1401a94f6
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
mov rcx, r12
call qword [fcn.14017cf1c]
mov r12, qword [rsp + 0x48]
mov r13, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x40]
mov rax, rsi
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret

Function at 0x1401a9580
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
mov r9d, ecx
mov rcx, r8
call fcn.1401a9550
mov ecx, r9d
mov r8d, eax
call fcn.14018ad3c
cdqe
add rsp, 0x28
ret
Function at 0x1401a9630
Capabilities:
Resolve dns

Disassembly:
push rbp
push rsi
push r12
push r13
push r14
sub rsp, 0x20
xor r14d, r14d
mov r13, r9
mov qword [r9], r14
lea r9, [rsp + 0x68]
mov esi, r14d
mov r12d, r14d
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov ebp, eax
test eax, eax
jne 0x1401a97be
mov qword [rsp + 0x50], rbx
mov rbx, qword [rsp + 0x68]
test rbx, rbx
je 0x1401a97a6
mov qword [rsp + 0x58], rdi
nop dword [rax]
cmp dword [rbx + 4], 2
jne 0x1401a973d
cmp qword [rbx + 0x20], r14
je 0x1401a973d
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x1401a973d
cmp rax, 0x10
jb 0x1401a973d
mov ecx, reloc.ODBC32.dll_SQLParamData
call qword [fcn.14017cf5c]
mov rdi, rax
test rax, rax
je 0x1401a9776
mov ecx, dword [rbx]
mov dword [rax], ecx
mov ecx, dword [rbx + 4]
mov dword [rax + 4], ecx
mov ecx, dword [rbx + 8]
mov dword [rax + 8], ecx
mov ecx, dword [rbx + 0xc]
mov dword [rax + reloc.ODBC32.dll_SQLFreeStmt], 0x10
mov dword [rax + 0xc], ecx
mov ecx, reloc.ODBC32.dll_SQLFreeStmt
mov qword [rax + 0x20], r14
mov qword [rax + 0x18], r14
mov qword [rax + 0x28], r14
call qword [fcn.14017cf5c]
mov qword [rdi + 0x20], rax
test rax, rax
je 0x1401a9766
mov rdx, qword [rbx + 0x20]
mov rcx, qword [rdx]
mov qword [rax], rcx
mov rcx, qword [rdx + 8]
mov qword [rax + 8], rcx
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x1401a9729
call qword [fcn.140181134]
mov qword [rdi + 0x18], rax
test rax, rax
je 0x1401a974c
test rsi, rsi
cmove rsi, rdi
test r12, r12
je 0x1401a973a
mov qword [r12 + 0x28], rdi
mov r12, rdi
mov rbx, qword [rbx + 0x28]
test rbx, rbx
jne 0x1401a9680
jmp 0x1401a977b
mov rcx, qword [rdi + 0x20]
mov ebp, 8
call qword [fcn.14017cf1c]
mov rcx, rdi
call qword [fcn.14017cf1c]
jmp 0x1401a977b
mov rcx, rdi
mov ebp, 8
call qword [fcn.14017cf1c]
jmp 0x1401a977b
mov ebp, 8
mov rcx, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x58]
test rcx, rcx
je 0x1401a9790
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
test ebp, ebp
je 0x1401a97a1
mov rcx, rsi
call fcn.1401a95e0
mov rsi, r14
jmp 0x1401a97b3
test rsi, rsi
jne 0x1401a97b3
mov ebp, 0x2af9
mov ecx, ebp
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov rbx, qword [rsp + 0x50]
mov qword [r13], rsi
mov eax, ebp
add rsp, 0x20
pop r14
pop r13
pop r12
pop rsi
pop rbp
ret

Function at 0x1401ab030
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
xor eax, eax
mov r9, rdx
mov r8, rcx
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call fcn.14017f554
test rax, rax
je 0x1401ab059
cmp rax, 0xffffffffffffffff
jne 0x1401ab05b
xor eax, eax
add rsp, 0x38
ret
Function at 0x1401adf60
Capabilities:
Generate random numbers via winapi

Disassembly:
mov rcx, rdx
mov rdx, r8
jmp 0x1401adf60
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
mov rbx, rdx
lea rcx, [rsp + 0x50]
mov r9d, 1
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x50], 0
mov dword [rsp + 0x20], 0xf0000040
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x1401adfbc
mov rcx, qword [rsp + 0x50]
mov r8, rdi
mov edx, ebx
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov rcx, qword [rsp + 0x50]
xor edx, edx
test eax, eax
jne 0x1401adfcc
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, 2
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rbx, qword [rsp + 0x40]
xor eax, eax
add rsp, 0x30
pop rdi
ret
Function at 0x1401b86a0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0xd0
mov rax, qword [0x1402ded38]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rbx, qword [rcx + 0x940]
mov rdi, qword [rcx]
mov dword [rsp + 0x30], 0x80
mov r8d, dword [rbx + 0x15c]
mov rdx, qword [rbx + 0x168]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov rbp, rcx
mov rcx, qword [rbx + 0x18]
lea rax, [rsp + 0x40]
add r8d, 4
xor r9d, r9d
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_recvfrom]
cmp dword [rbx + 0x150], 0
mov dword [rbx + 0x154], eax
jne 0x1401b8742
movsxd r8, dword [rsp + 0x30]
lea rcx, [rbx + 0xd0]
lea rdx, [rsp + 0x40]
call fcn.14017b330
mov r11d, dword [rsp + 0x30]
mov dword [rbx + 0x150], r11d
mov r9d, dword [rbx + 0x154]
cmp r9d, 4
jge 0x1401b8790
lea rdx, str.Received_too_short_packet
mov rcx, rdi
call fcn.1401a5030
mov dword [rbx + 0xc], 7
xor eax, eax
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.14017ae40
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
lea rcx, [rbx + 0x168]
call fcn.1401b7300
movzx r8d, ax
mov dword [rbx + 0xc], r8d
sub r8d, 3
je 0x1401b8830
dec r8d
je 0x1401b88a7
dec r8d
je 0x1401b8800
dec r8d
je 0x1401b87dc
lea r8, str.Internal_error:_Unexpected_packet
lea rdx, [0x140226568]
mov rcx, rdi
call fcn.1401a5030
jmp 0x1401b88a7
mov rdx, qword [rbx + 0x168]
lea r8d, [r9 - 2]
mov rcx, rbx
add rdx, 2
call fcn.1401b7400
test eax, eax
je 0x1401b88a7
jmp 0x1401b8767
lea rcx, [rbx + 0x168]
call fcn.1401b7310
lea rdx, [0x1402714a4]
mov rcx, rdi
movzx r8d, ax
mov dword [rbx + 8], r8d
mov r8, qword [rbx + 0x168]
add r8, 4
call fcn.1401a4f80
jmp 0x1401b88a7
cmp r9d, 4
jle 0x1401b88a7
lea rcx, [rbx + 0x168]
call fcn.1401b7310
movzx ecx, word [rbx + 0x48]
inc ecx
cmp cx, ax
jne 0x1401b88a7
mov r8, qword [rbx + 0x168]
lea eax, [r9 - 4]
mov edx, 1
add r8, 4
movsxd r9, eax
mov rcx, rbp
call fcn.1401a5490
mov esi, eax
test eax, eax
je 0x1401b8886
mov edx, 5
mov rcx, rbx
call fcn.1401b8620
mov eax, esi
jmp 0x1401b8767
mov eax, dword [rbx + 0x154]
mov rcx, rdi
sub eax, 4
cdqe
add qword [rdi + 0xb0], rax
mov rdx, qword [rdi + 0xb0]
call fcn.1401aea50
mov rcx, rbp
call fcn.1401aeb90
test eax, eax
je 0x1401b8765
mov edx, 5
mov rcx, rbx
call fcn.1401b8620
mov eax, SQLGetFunctions
jmp 0x1401b8767
Function at 0x1401ba420
Capabilities:
Initialize winsock library

Disassembly:
push rbx
sub rsp, 0x1d0
mov rax, qword [0x1402ded38]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov rbx, rcx
lea rdx, [rsp + 0x20]
mov ecx, 2
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x1401ba466
lea rdx, str.WSAStartup_failed___d_
mov r8d, eax
mov rcx, rbx
call fcn.1401a5030
jmp 0x1401ba495
call qword [sym.imp.WS2_32.dll_WSACleanup]
movzx r11d, word [rsp + 0x20]
cmp r11b, 2
jne 0x1401ba486
shr r11w, 8
test r11b, r11b
jne 0x1401ba486
xor eax, eax
jmp 0x1401ba49a
lea rdx, str.insufficient_winsock_version_to_support_telnet
mov rcx, rbx
call fcn.1401a5030
mov eax, 2
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.14017ae40
add rsp, 0x1d0
pop rbx
ret

Function at 0x1401ba6a0
Capabilities:
Send data
Send data on socket

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x20
mov rbp, qword [rcx]
xor r9d, r9d
mov rbx, rcx
mov rcx, qword [rcx + 0x210]
mov edi, r8d
mov esi, edx
mov byte [rax + 0x11], dl
mov byte [rax + 0x12], r8b
lea r8d, [r9 + 3]
lea rdx, [rax + 0x10]
mov byte [rax + 0x10], 0xff
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x1401ba6fe
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rbp
mov r8d, eax
call fcn.1401a5030
mov rcx, qword [rbx]
lea rdx, str.SENT
mov r9d, edi
mov r8d, esi
call fcn.1401ba560
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x1401ba730
Capabilities:
Send data
Send data on socket

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx]
movsxd r11, edx
mov rbx, rcx
mov r9, qword [rax + 0x1a8]
cmp r8d, 1
jne 0x1401ba7a3
mov r10d, dword [r9 + r11*4 + 0xc08]
test r10d, r10d
je 0x1401ba785
sub r10d, 2
je 0x1401ba7b7
dec r10d
jne 0x1401ba7ed
cmp dword [r9 + r11*4 + 0x1008], 0
jne 0x1401ba7ed
mov dword [r9 + r11*4 + 0x1008], 1
add rsp, 0x20
pop rbx
ret
mov edx, 0xfd
mov r8d, r11d
mov dword [r9 + r11*4 + 0xc08], 2
add rsp, 0x20
pop rbx
jmp fcn.1401ba6a0
mov ecx, dword [r9 + r11*4 + 0xc08]
dec ecx
je 0x1401ba7d1
dec ecx
je 0x1401ba768
dec ecx
jne 0x1401ba7ed
mov ecx, dword [r9 + r11*4 + 0x1008]
dec ecx
jne 0x1401ba7ed
mov dword [r9 + r11*4 + 0x1008], ecx
add rsp, 0x20
pop rbx
ret
mov edx, 0xfe
mov rcx, rbx
mov r8d, r11d
mov dword [r9 + r11*4 + 0xc08], 3
call fcn.1401ba6a0
add rsp, 0x20
pop rbx
ret
Function at 0x1401ba800
Capabilities:
Send data
Send data on socket

Disassembly:
sub rsp, 0x28
mov rax, qword [rcx]
movsxd r9, edx
mov r11, rcx
mov r8, qword [rax + 0x1a8]
mov r10d, dword [r8 + r9*4 + 0xc08]
test r10d, r10d
je 0x1401ba8b4
sub r10d, 2
je 0x1401ba86a
dec r10d
jne 0x1401ba89e
mov ecx, dword [r8 + r9*4 + 0x1008]
test ecx, ecx
je 0x1401ba859
dec ecx
jne 0x1401ba89e
mov dword [r8 + r9*4 + 0xc08], 1
mov dword [r8 + r9*4 + 0x1008], ecx
add rsp, 0x28
ret
mov dword [r8 + r9*4 + 0xc08], 0
add rsp, 0x28
ret
mov ecx, dword [r8 + r9*4 + 0x1008]
test ecx, ecx
je 0x1401ba8a3
dec ecx
jne 0x1401ba89e
mov dword [r8 + r9*4 + 0x1008], ecx
mov dword [r8 + r9*4 + 0xc08], 3
mov rcx, r11
mov r8d, edx
mov edx, 0xfe
call fcn.1401ba6a0
add rsp, 0x28
ret
mov dword [r8 + r9*4 + 0xc08], 1
add rsp, 0x28
ret
cmp dword [r8 + r9*4 + 0x1408], 1
jne 0x1401ba891
mov dword [r8 + r9*4 + 0xc08], 1
mov r8d, edx
mov edx, 0xfd
add rsp, 0x28
jmp fcn.1401ba6a0

Function at 0x1401ba8e0
Capabilities:
Send data
Send data on socket

Disassembly:
sub rsp, 0x28
mov rax, qword [rcx]
movsxd r9, edx
mov r11, rcx
mov r8, qword [rax + 0x1a8]
mov r10d, dword [r8 + r9*4 + 0xc08]
dec r10d
je 0x1401ba97f
dec r10d
je 0x1401ba958
dec r10d
jne 0x1401ba996
mov ecx, dword [r8 + r9*4 + 0x1008]
test ecx, ecx
je 0x1401ba949
dec ecx
jne 0x1401ba996
xor eax, eax
mov dword [r8 + r9*4 + 0xc08], 2
mov rcx, r11
mov dword [r8 + r9*4 + 0x1008], eax
mov r8d, edx
mov edx, 0xfd
add rsp, 0x28
jmp fcn.1401ba6a0
xor eax, eax
mov dword [r8 + r9*4 + 0xc08], eax
add rsp, 0x28
ret
mov ecx, dword [r8 + r9*4 + 0x1008]
test ecx, ecx
je 0x1401ba949
dec ecx
jne 0x1401ba996
xor eax, eax
mov dword [r8 + r9*4 + 0xc08], eax
mov dword [r8 + r9*4 + 0x1008], eax
add rsp, 0x28
ret
xor eax, eax
mov dword [r8 + r9*4 + 0xc08], eax
mov r8d, edx
mov edx, 0xfe
call fcn.1401ba6a0
add rsp, 0x28
ret

Function at 0x1401ba9a0
Capabilities:
Send data
Send data on socket

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx]
movsxd r11, edx
mov rbx, rcx
mov r9, qword [rax + 0x1a8]
cmp r8d, 1
jne 0x1401baa09
mov r10d, dword [r9 + r11*4 + 8]
test r10d, r10d
je 0x1401ba9ee
sub r10d, 2
je 0x1401baa1a
dec r10d
jne 0x1401baa4d
cmp dword [r9 + r11*4 + 0x408], 0
jne 0x1401baa4d
mov dword [r9 + r11*4 + 0x408], 1
add rsp, 0x20
pop rbx
ret
mov edx, 0xfb
mov r8d, r11d
mov dword [r9 + r11*4 + 8], 2
add rsp, 0x20
pop rbx
jmp fcn.1401ba6a0
mov ecx, dword [r9 + r11*4 + 8]
dec ecx
je 0x1401baa34
dec ecx
je 0x1401ba9d1
dec ecx
jne 0x1401baa4d
mov ecx, dword [r9 + r11*4 + 0x408]
dec ecx
jne 0x1401baa4d
mov dword [r9 + r11*4 + 0x408], ecx
add rsp, 0x20
pop rbx
ret
mov edx, 0xfc
mov rcx, rbx
mov r8d, r11d
mov dword [r9 + r11*4 + 8], 3
call fcn.1401ba6a0
add rsp, 0x20
pop rbx
ret
Function at 0x1401baa60
Capabilities:
Send data
Send data on socket

Disassembly:
sub rsp, 0x28
mov rax, qword [rcx]
movsxd r9, edx
mov r11, rcx
mov r8, qword [rax + 0x1a8]
mov r10d, dword [r8 + r9*4 + 8]
dec r10d
je 0x1401baaef
dec r10d
je 0x1401baacb
dec r10d
jne 0x1401bab03
mov ecx, dword [r8 + r9*4 + 0x408]
test ecx, ecx
je 0x1401baabf
dec ecx
jne 0x1401bab03
xor eax, eax
mov dword [r8 + r9*4 + 8], 2
mov rcx, r11
mov dword [r8 + r9*4 + 0x408], eax
mov r8d, edx
mov edx, 0xfb
add rsp, 0x28
jmp fcn.1401ba6a0
xor eax, eax
mov dword [r8 + r9*4 + 8], eax
add rsp, 0x28
ret
mov ecx, dword [r8 + r9*4 + 0x408]
test ecx, ecx
je 0x1401baabf
dec ecx
jne 0x1401bab03
xor eax, eax
mov dword [r8 + r9*4 + 8], eax
mov dword [r8 + r9*4 + 0x408], eax
add rsp, 0x28
ret
xor eax, eax
mov dword [r8 + r9*4 + 8], eax
mov r8d, edx
mov edx, 0xfc
call fcn.1401ba6a0
add rsp, 0x28
ret
Function at 0x1401bb6a0
Capabilities:
Send data
Send data on socket

Disassembly:
cmp edx, 0x1f
jne 0x1401bb84e
push rbp
push rdi
push r13
sub rsp, 0x30
mov rbp, qword [rcx]
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x28], rsi
mov rdi, qword [rbp + 0x1a8]
mov r13, rcx
mov qword [rsp + 0x20], r12
lea rsi, [rdi + 0x1cb8]
lea rbx, [rdi + 0x1eb8]
mov qword [rbx], rsi
cmp rsi, rbx
jae 0x1401bb6e9
mov byte [rsi], 0xff
inc qword [rbx]
mov rax, qword [rbx]
cmp rax, rbx
jae 0x1401bb6f7
mov byte [rax], 0xfa
inc qword [rbx]
mov rax, qword [rbx]
cmp rax, rbx
jae 0x1401bb705
mov byte [rax], Ordinal_33
inc qword [rbx]
movzx ecx, word [rdi + 0x1ca8]
call qword [sym.imp.WS2_32.dll_htons]
movzx ecx, word [rdi + 0x1caa]
movzx r12d, ax
mov word [rsp + 0x58], ax
call qword [sym.imp.WS2_32.dll_htons]
mov rcx, qword [rbx]
movzx r11d, ax
mov word [rsp + 0x50], ax
cmp rcx, rbx
jae 0x1401bb73f
mov byte [rcx], r12b
inc qword [rbx]
mov rdx, qword [rbx]
mov r12, qword [rsp + 0x20]
cmp rdx, rbx
jae 0x1401bb756
movzx ecx, byte [rsp + 0x59]
mov byte [rdx], cl
inc qword [rbx]
mov rax, qword [rbx]
cmp rax, rbx
jae 0x1401bb764
mov byte [rax], r11b
inc qword [rbx]
mov rcx, qword [rbx]
cmp rcx, rbx
jae 0x1401bb776
movzx eax, byte [rsp + 0x51]
mov byte [rcx], al
inc qword [rbx]
mov rax, qword [rbx]
cmp rax, rbx
jae 0x1401bb784
mov byte [rax], 0xff
inc qword [rbx]
mov rax, qword [rbx]
cmp rax, rbx
jae 0x1401bb792
mov byte [rax], 0xf0
inc qword [rbx]
mov rax, qword [rbx]
lea r8, [rdi + 0x1cba]
mov edx, 0x3e
mov r9, rax
mov rcx, rbp
mov qword [rbx], rsi
sub r9, rsi
mov qword [rdi + 0x1ec0], rax
sub r9, 2
call fcn.1401bab10
mov rcx, qword [r13 + 0x210]
xor r9d, r9d
lea r8d, [r9 + 3]
mov rdx, rsi
call qword [sym.imp.WS2_32.dll_send]
mov rsi, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x60]
test eax, eax
jns 0x1401bb7fa
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rbp
mov r8d, eax
call fcn.1401a5030
lea rdx, [rdi + 0x1cbb]
mov r8d, 4
mov rcx, r13
call fcn.1401bb4b0
mov rcx, qword [r13 + 0x210]
xor r9d, r9d
lea r8d, [r9 + 2]
lea rdx, [rdi + 0x1cbf]
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x1401bb846
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rbp
mov r8d, eax
call fcn.1401a5030
add rsp, 0x30
pop r13
pop rdi
pop rbp
repz ret
Function at 0x1401bc470
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x1402ded38]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbp, qword [rcx + 0x218]
mov rsi, qword [rcx]
mov rbx, rcx
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x28]
mov rcx, rbp
or rdi, 0xffffffffffffffff
mov dword [rsp + 0x20], reloc.ODBC32.dll_SQLFreeStmt
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x1401bc4e1
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x28]
mov rcx, rbp
mov dword [rsp + 0x20], reloc.ODBC32.dll_SQLFreeStmt
call qword [sym.imp.WS2_32.dll_accept]
mov rdi, rax
mov rdx, rbp
mov rcx, rbx
call fcn.1401a8750
mov rcx, rsi
cmp rdi, 0xffffffffffffffff
jne 0x1401bc506
lea rdx, str.Error_accept__ing_server_connect
call fcn.1401a5030
lea eax, [rdi + 0x1f]
jmp 0x1401bc56d
lea rdx, str.Connection_accepted_from_server_n
call fcn.1401a4f80
mov edx, 1
mov rcx, rdi
mov dword [rbx + 0x568], 0
mov qword [rbx + 0x218], rdi
call fcn.1401cb820
mov dword [rbx + 0x234], 1
mov rax, qword [rsi + 0x278]
test rax, rax
je 0x1401bc56b
mov rcx, qword [rsi + 0x280]
mov r8d, 1
mov rdx, rdi
call rax
test eax, eax
je 0x1401bc56b
mov rcx, rbx
call fcn.1401bc340
mov eax, SQLGetFunctions
jmp 0x1401bc56d
xor eax, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14017ae40
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x1401c0050
Capabilities:
Check http status code

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov eax, 0x51eb851f
mov edi, r8d
mov r8d, edx
xor ebx, ebx
mov rsi, rcx
mov rcx, qword [rcx]
imul edx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp edx, 2
je 0x1401c00a2
lea rdx, str.Couldnt_set_desired_mode
call fcn.1401a5030
lea eax, [rbx + 0x11]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
cmp r8d, 0xc8
je 0x1401c00b7
lea rdx, str.Got_a__03d_response_code_instead_of_the_assumed_200_n
call fcn.1401a4f80
cmp edi, 0x13
jne 0x1401c00c6
mov rcx, rsi
call fcn.1401bffd0
jmp 0x1401c00f1
cmp edi, 0x14
jne 0x1401c00d5
mov rcx, rsi
call fcn.1401bcfc0
jmp 0x1401c00f1
cmp edi, 0x15
jne 0x1401c00e4
mov rcx, rsi
call fcn.1401c0030
jmp 0x1401c00f1
cmp edi, 0x16
jne 0x1401c00f3
mov rcx, rsi
call fcn.1401c0040
mov ebx, eax
mov rsi, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1401c07e0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, qword [rcx]
mov ebx, dword [rcx + 0x9ec]
mov eax, 0x51eb851f
imul edx
sar edx, 5
mov rdi, rcx
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp edx, 2
je 0x1401c086c
test ebx, ebx
jne 0x1401c082a
lea rdx, str.disabling_EPRT_usage_n
mov rcx, rsi
call fcn.1401a4f80
mov dword [rdi + 0x58c], ebx
inc ebx
cmp ebx, 2
jne 0x1401c0853
lea rdx, str.Failed_to_do_PORT
mov rcx, rsi
call fcn.1401a5030
lea eax, [rbx + 0x1c]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov edx, ebx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x1401bc7d0
lea rdx, str.Connect_data_stream_actively_n
mov rcx, rsi
call fcn.1401a4f80
xor edx, edx
mov rcx, rdi
call fcn.1401bc690
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.1401c0640
Function at 0x1401c7a70
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x148
mov rax, qword [0x1402ded38]
xor rax, rsp
mov qword [rsp + 0x130], rax
call fcn.1401945e8
mov byte [rsp + 0x20], 0
test rax, rax
je 0x1401c7ad6
lea rdx, [rsp + 0x20]
mov r8d, 0x104
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [rsp + 0x20], 0
je 0x1401c7ad6
lea rcx, [rsp + 0x20]
call qword [fcn.140181134]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.14017ae40
add rsp, 0x148
ret
xor eax, eax
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.14017ae40
add rsp, 0x148
ret
jmp 0x1401c7a70

Function at 0x1401c7af0
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x148
mov rax, qword [0x1402ded38]
xor rax, rsp
mov qword [rsp + 0x130], rax
call fcn.1401945e8
mov byte [rsp + 0x20], 0
test rax, rax
je 0x1401c7ad6
lea rdx, [rsp + 0x20]
mov r8d, 0x104
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [rsp + 0x20], 0
je 0x1401c7ad6
lea rcx, [rsp + 0x20]
call qword [fcn.140181134]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.14017ae40
add rsp, 0x148
ret
xor eax, eax
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.14017ae40
add rsp, 0x148
ret
jmp 0x1401c7a70

Function at 0x1401cb820
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x28
xor eax, eax
test edx, edx
lea r8, [rsp + 0x38]
setne al
mov edx, 0x8004667e
mov dword [rsp + 0x38], eax
call qword [sym.imp.WS2_32.dll_ioctlsocket]
add rsp, 0x28
ret

Function at 0x1401ce510
Capabilities:
Get hostname

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
movsxd rbx, edx
mov rdi, rcx
mov byte [rcx], 0
mov edx, ebx
call qword [sym.imp.WS2_32.dll_gethostname]
mov byte [rbx + rdi - 1], 0
test eax, eax
jne 0x1401ce549
lea edx, [rax + 0x2e]
mov rcx, rdi
call fcn.140186604
test rax, rax
je 0x1401ce547
mov byte [rax], 0
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret