joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140020114
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x14002019b
mov rsi, rbx
cmp word [rax], bp
je 0x14002015a
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140020144
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140020140
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.140015a00
mov rdi, rax
test rax, rax
je 0x140020188
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.14002e3e0
mov rbp, rdi
xor ecx, ecx
call fcn.140013d30
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140028338
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.140018f24
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x1400283c2
cmp byte [rbp - 0x21], r15b
je 0x1400283bd
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x1400283f8
call fcn.140016ca0
test eax, eax
jne 0x1400283e4
cmp byte [rbp - 0x21], r15b
je 0x1400283dc
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x1400283f8
cmp byte [rbp - 0x21], r15b
je 0x1400283f5
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.140019fc4
test eax, eax
jne 0x140028498
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.140018f24
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x140028437
cmp byte [rbp - 0x21], r15b
je 0x14002846c
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x14002846c
call fcn.140016ca0
test eax, eax
jne 0x140028458
cmp byte [rbp - 0x21], r15b
je 0x140028451
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x14002846c
cmp byte [rbp - 0x21], r15b
je 0x140028469
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.140019fc4
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x140028498
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x14002849b
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x1400284a9
mov rcx, rdi
call fcn.140013d30
cmp byte [rbp + 0x3f], r15b
je 0x1400284b8
mov rcx, qword [rbp + 0x27]
call fcn.140013d30
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x14002aa50
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movsxd r15, ecx
lea r9, [0x1402114f0]
mov rax, r15
mov rbp, r15
and eax, 0x3f
sar rbp, 6
mov ecx, 4
xor esi, esi
mov r14, rdx
lea rdi, [rax + rax*8]
mov rax, qword [r9 + rbp*8]
lea r13d, [rcx + 6]
mov r10, qword [rax + rdi*8 + 0x28]
test r8, r8
je 0x14002aaa7
cmp word [rdx], r13w
jne 0x14002aaa7
or byte [rax + rdi*8 + 0x38], cl
jmp 0x14002aaac
and byte [rax + rdi*8 + 0x38], 0xfb
lea r8, [rdx + r8*2]
mov rbx, r14
cmp r14, r8
jae 0x14002abd1
mov r11d, reloc.WS2_32.dll_listen
lea r12d, [r11 - 0xb]
movzx ecx, word [rdx]
cmp cx, 0x1a
je 0x14002abf2
lea r9, [rdx + 2]
cmp cx, r11w
je 0x14002aae5
mov rdx, r9
mov word [rbx], cx
jmp 0x14002ab0c
cmp r9, r8
jae 0x14002ab1c
cmp word [r9], r13w
mov rax, r12
mov ecx, 4
cmove rax, rcx
add rdx, rax
mov eax, r13d
cmp word [r9], r13w
cmovne ax, r11w
mov word [rbx], ax
mov rax, r12
add rbx, rax
cmp rdx, r8
jb 0x14002aac6
jmp 0x14002abd1
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rsi
mov r8d, r12d
lea rdx, [rsp + 0x70]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14002abc6
cmp dword [rsp + 0x80], esi
je 0x14002abc6
lea r8, [0x1402114f0]
mov rax, qword [r8 + rbp*8]
test byte [rax + rdi*8 + 0x38], 0x48
je 0x14002ab9e
movzx eax, word [rsp + 0x70]
cmp ax, r13w
jne 0x14002ab6e
mov word [rbx], r13w
jmp 0x14002abce
mov ecx, reloc.WS2_32.dll_listen
mov word [rsp + 0x78], ax
mov word [rbx], cx
mov rax, qword [r8 + rbp*8]
lea rcx, [rax + rdi*8]
mov al, byte [rsp + rsi + 0x78]
mov byte [rcx + rsi + 0x3a], al
inc rsi
cmp rsi, r12
jl 0x14002ab7b
mov rax, qword [r8 + rbp*8]
mov byte [rax + rdi*8 + 0x3c], r13b
jmp 0x14002abce
cmp word [rsp + 0x70], r13w
jne 0x14002abab
cmp rbx, r14
je 0x14002ab68
mov rdx, 0xfffffffffffffffe
mov ecx, r15d
lea r8d, [rdx + 3]
call fcn.14002bfec
cmp word [rsp + 0x70], r13w
je 0x14002abd1
mov ecx, reloc.WS2_32.dll_listen
mov word [rbx], cx
add rbx, r12
sub rbx, r14
sar rbx, 1
lea eax, [rbx + rbx]
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea r8, [0x1402114f0]
mov rdx, qword [r8 + rbp*8]
mov al, byte [rdx + rdi*8 + 0x38]
test al, 0x40
jne 0x14002abcb
or al, r12b
mov byte [rdx + rdi*8 + 0x38], al
jmp 0x14002abd1
Function at 0x14003b868
Capabilities:
Create thread

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x30
lea rax, [r11 + 0x18]
mov r9, rdx
mov r8, rcx
mov qword [r11 - 0x10], rax
xor edi, edi
mov edx, 0x1000
xor ecx, ecx
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbp, rax
test rax, rax
je 0x14003b92c
lea rcx, [0x1402139c0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x140211b80]
jmp 0x14003b8f2
lea rsi, [rbx + 0x10]
xor edx, edx
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x14003b8ef
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rbx]
lea rcx, [0x140211b80]
mov rdx, rsi
call fcn.140072ab8
jmp 0x14003b8f2
mov rbx, qword [rbx]
test rbx, rbx
jne 0x14003b8bf
mov rdi, qword [reloc.WS2_32.dll_accept]
lea rcx, [0x140211b80]
lea rdx, [rdi + 1]
mov qword [reloc.WS2_32.dll_accept], rdx
lea edx, [rbx + 0x20]
call fcn.140072b00
lea rcx, [0x1402139c0]
mov qword [rax], rbp
mov qword [rax + 8], rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rbx, qword [rsp + 0x40]
mov rax, rdi
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x14003ba40
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call fcn.14003b9d0
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
lea rcx, [0x1402139c0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x140211b80]
jmp 0x14003ba7c
cmp qword [rbx + 0x18], rdi
je 0x14003ba83
mov rbx, qword [rbx]
test rbx, rbx
jne 0x14003ba73
jmp 0x14003ba9d
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbx + 0x10]
lea rcx, [0x140211b80]
call fcn.140072ab8
lea rcx, [0x1402139c0]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x14005a684
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x90
mov rax, qword [0x14020b948]
xor rax, rsp
mov qword [rsp + 0x80], rax
xor edi, edi
mov r13, r8
cmp dword [rcx + 0x20], 1
mov rbx, rdx
mov r12, rcx
mov r15d, edi
jne 0x14005a842
test rdx, rdx
je 0x14005a842
mov qword [rsp + 0x30], rdi
lea r8d, [rdi + 7]
mov dword [rsp + 0x28], pe_nt_image_headers64
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x14005a842
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov rcx, qword [0x140210620]
xor edx, edx
mov eax, eax
mov r8d, 0x200000
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r14, rax
test rax, rax
je 0x14005a839
call fcn.140089ec0
mov rsi, rax
test rax, rax
je 0x14005a827
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.14014ba44
mov edx, 0x1a4
mov rcx, rsi
call fcn.14008a460
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.14008ab70
mov rax, qword [r12 + 0x48]
mov ecx, dword [rax + 0x10]
dec ecx
test ecx, 0xfffffffd
je 0x14005a78f
mov rdx, r13
mov rcx, rsi
call fcn.140089810
jmp 0x14005a7ad
mov rcx, r13
call fcn.140127000
mov rdx, rax
mov rcx, rsi
mov rbx, rax
call fcn.14008a450
mov rcx, rbx
call fcn.140126ff0
mov rbx, qword [rsp + 0x48]
mov rcx, rsi
mov rdx, rbx
call fcn.14008a4a0
mov edx, 0x8000
mov rcx, rsi
call fcn.14008a270
mov rcx, qword [r12]
mov rdx, rsi
call fcn.14008ab60
jmp 0x14005a7f4
mov rcx, qword [r12]
mov rdx, r14
movsxd r8, eax
call fcn.14008aae0
movsxd rcx, dword [rsp + 0x40]
cmp rax, rcx
jne 0x14005a818
add r15, rcx
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rdi
mov r8d, 0x200000
mov rdx, r14
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rsp + 0x40]
test eax, eax
jg 0x14005a7d8
mov rcx, rsi
call fcn.140089b80
cmp r15, rbx
sete dil
mov rcx, qword [0x140210620]
mov r8, r14
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rdi
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1401276a0
mov rbx, qword [rsp + 0xe8]
add rsp, 0x90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14005c558
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov r14, rdx
mov ebp, r9d
mov rdx, rcx
mov r15d, r8d
mov rcx, qword [0x140213d20]
xor edi, edi
call fcn.140072078
mov rsi, rax
test rax, rax
je 0x14005c6f1
test r14, r14
je 0x14005c6f1
mov r8, qword [rax + 0x30]
mov dword [rax + 0x70], edi
mov dword [rax + 0x50], 0xa
test r8, r8
je 0x14005c5c1
mov rcx, qword [0x140210620]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r8, qword [rsi + 0x38]
test r8, r8
je 0x14005c5d9
mov rcx, qword [0x140210620]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r8, qword [rsi + 0x40]
test r8, r8
je 0x14005c5f1
mov rcx, qword [0x140210620]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rsp + 0x80]
mov qword [rsi + 0x30], rdi
mov qword [rsi + 0x38], rdi
mov dword [rsi + 0x48], ebp
test rcx, rcx
je 0x14005c625
call fcn.1401275b0
mov rcx, rax
mov rbx, rax
call fcn.14005cd50
mov rcx, rbx
mov qword [rsi + 0x30], rax
call fcn.1401275a0
mov rcx, qword [rsp + 0x88]
test rcx, rcx
je 0x14005c64e
call fcn.1401275b0
mov rcx, rax
mov rbx, rax
call fcn.14005cd50
mov rcx, rbx
mov qword [rsi + 0x38], rax
call fcn.1401275a0
mov rcx, r14
call fcn.1401275b0
mov rcx, rax
mov rbx, rax
call fcn.14014be40
mov rcx, qword [0x140210620]
xor edx, edx
lea r8, [rax + 0x80]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
lea rcx, str.smtp:___s:_d
test bpl, 4
lea rdx, str.smtps:___s:_d
mov qword [rsi + 0x40], rax
cmove rdx, rcx
mov r9d, r15d
mov rcx, rax
mov r8, rbx
call fcn.14005a3a0
mov rcx, rbx
call fcn.1401275a0
test bpl, 1
je 0x14005c6e7
lea rax, [rsp + 0x30]
mov r9, rsi
mov qword [rsp + 0x28], rax
lea r8, [0x14005c994]
mov edx, 0x20000
mov dword [rsp + 0x20], edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x14005c6f1
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, 1
jmp 0x14005c6f1
mov rcx, rsi
call fcn.14005c794
mov edi, eax
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
movsxd rax, edi
add rsp, 0x40
pop r15
pop r14
pop rdi
ret

Function at 0x14005e8f8
Capabilities:
Get thread local storage value

Disassembly:
cmp dword [rcx], 1
jne 0x14005e90a
mov rcx, qword [rcx + 8]
test rcx, rcx
jne fcn.1400732d0
mov ecx, edx
jmp fcn.1400732a0

Function at 0x14005eed4
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x30
mov ebx, dword [rcx + 0x10]
lea r9, [rax + 8]
mov rdx, qword [rcx + 8]
mov rdi, rcx
mov rcx, qword [rcx]
xor esi, esi
mov r8d, ebx
mov qword [rax - 0x18], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [rsp + 0x40], ebx
mov rbx, qword [rsp + 0x48]
mov dword [rdi + 0x10], esi
sete sil
mov eax, esi
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x14006208c
Capabilities:
Create thread
Reference http user-agent string

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov r12d, ecx
mov rsi, r9
mov rcx, qword [0x140213de0]
mov rbp, r8
mov r14, rdx
xor ebx, ebx
call fcn.140071e70
mov r15, rax
test r14, r14
je 0x1400621c5
mov rcx, qword [0x140210620]
lea edx, [rbx + 8]
mov r8d, 0x98
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, r14
mov rdi, rax
or dword [rax + 4], 0xffffffff
mov dword [rax], 1
call fcn.14014ba4c
lea rcx, str.Mozilla_5.0_Gecko_41.0_Firefox_41.0
mov qword [rdi + 8], rax
call fcn.14014ba4c
mov ecx, dword [rsp + 0x80]
mov qword [rdi + 0x60], rax
mov dword [rdi + 0x40], ecx
mov eax, dword [r15]
mov dword [rdi + 0x44], eax
mov eax, dword [r15 + 4]
mov dword [rdi + 0x48], eax
mov rax, qword [rsp + 0x88]
mov qword [rdi + 0x78], rax
mov dword [rdi + 0x80], r12d
mov qword [rdi + 0x88], rsi
test cl, 1
je 0x1400621b6
test rsi, rsi
je 0x140062171
mov rcx, qword [0x140210620]
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rdi + 0x70], rax
test rax, rax
je 0x14006216b
mov r8, rsi
mov rdx, rbp
mov rcx, rax
call fcn.14002e3e0
cmp qword [rdi + 0x70], rbx
je 0x1400621ac
lea rax, [rsp + 0x68]
mov r9, rdi
mov qword [rsp + 0x28], rax
lea r8, [0x1400621e0]
mov edx, 0x10000
mov dword [rsp + 0x20], ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x1400621a6
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400621c2
cmp dword [rsp + 0x68], ebx
jne 0x1400621c2
mov rcx, rdi
call fcn.140061ac4
jmp 0x1400621c5
mov rcx, rdi
mov qword [rdi + 0x70], rbp
call fcn.140061b90
mov rbx, rdi
mov rbp, qword [rsp + 0x70]
mov rax, rbx
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x1400633a4
Capabilities:
Send data
Send data on socket

Disassembly:
sub rsp, 0x38
cmp dword [rcx], 1
mov r10, rdx
jne 0x1400633bf
mov rcx, qword [rcx + 8]
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_send]
jmp 0x1400633f7
mov al, byte [rcx + 0x20]
lea r9, [rcx + 4]
neg al
mov rax, qword [rcx + 0x28]
sbb edx, edx
and edx, 0xc
add edx, 0x10
test rax, rax
je 0x1400633de
mov rcx, qword [rax]
jmp 0x1400633e2
mov rcx, qword [rcx + 0x30]
mov dword [rsp + 0x28], edx
mov rdx, r10
mov qword [rsp + 0x20], r9
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_sendto]
cdqe
add rsp, 0x38
ret

Function at 0x140063400
Capabilities:
Get socket status
Receive data
Receive data on socket
Set socket configuration

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x960]
sub rsp, 0xa60
mov rax, qword [0x14020b948]
xor rax, rsp
mov qword [rbp + 0x950], rax
xor ebx, ebx
mov rdi, rcx
cmp dword [rcx], 1
jne 0x1400634b1
movsxd rcx, dword [rcx + 8]
lea rax, [rsp + 0x38]
mov rdi, rcx
mov qword [rsp + 0x48], rcx
inc ecx
mov dword [rsp + 0x40], 1
xor r9d, r9d
mov qword [rsp + 0x38], rbx
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x40]
call qword [sym.imp.WS2_32.dll_select]
test eax, eax
js 0x1400634aa
je 0x140063516
lea rdx, [rsp + 0x40]
mov rcx, rdi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x140063516
lea r8, [rsp + 0x30]
mov edx, 0x4004667f
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
jne 0x1400634aa
cmp dword [rsp + 0x30], ebx
lea ebx, [rax + 2]
jne 0x140063516
mov ebx, 4
jmp 0x140063516
mov rcx, qword [rcx + 0x30]
lea rdx, [rbp + 0x150]
mov qword [rsp + 0x28], rbx
xor r9d, r9d
mov r8d, 0x800
mov qword [rsp + 0x20], rbx
call qword [sym.imp.WS2_32.dll_recvfrom]
mov dword [rsp + 0x30], eax
test eax, eax
jle 0x140063516
mov rcx, qword [0x140210620]
xor edx, edx
movsxd r8, eax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
movsxd rcx, dword [rsp + 0x30]
lea rdx, [rbp + 0x150]
mov dword [rdi + 0x40], ecx
mov r8, rcx
mov rcx, rax
mov qword [rdi + 0x38], rax
mov qword [rdi + 0x48], rax
call fcn.14002e3e0
mov ebx, 2
mov rax, rbx
mov rcx, qword [rbp + 0x950]
xor rcx, rsp
call fcn.1401276a0
lea r11, [rsp + 0xa60]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret

Function at 0x1400635a0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor esi, esi
mov rax, rdx
cmp dword [rcx], 1
mov rdi, rcx
jne 0x1400635cd
mov rcx, qword [rcx + 8]
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recv]
mov esi, eax
jmp 0x140063615
cmp qword [rcx + 0x38], rsi
je 0x140063615
cmp r8d, dword [rcx + 0x40]
mov esi, r8d
mov rdx, qword [rcx + 0x48]
cmovg esi, dword [rcx + 0x40]
mov rcx, rax
movsxd rbx, esi
mov r8, rbx
call fcn.14002e3e0
sub dword [rdi + 0x40], esi
add qword [rdi + 0x48], rbx
cmp dword [rdi + 0x40], 0
jne 0x140063615
mov r8, qword [rdi + 0x38]
xor edx, edx
mov rcx, qword [0x140210620]
call qword [sym.imp.KERNEL32.dll_HeapFree]
and qword [rdi + 0x38], 0
mov rbx, qword [rsp + 0x30]
movsxd rax, esi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14006370c
Capabilities:
Initialize winsock library

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x1d0
mov rax, qword [0x14020b948]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov ebx, reloc.OLEAUT32.dll_SafeArrayGetDim
lea r8, [0x140063628]
mov edx, ebx
lea ecx, [rbx + 0x28]
call fcn.1400721a8
xor r8d, r8d
mov qword [0x140212038], rax
xor edx, edx
mov ecx, ebx
call fcn.140071f08
xor ebx, ebx
mov qword [0x140213e40], rax
cmp word [0x140212030], bx
jne 0x140063841
mov ecx, 0x101
lea rdx, [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_WSAStartup]
lea edi, [rbx + 1]
test eax, eax
jne 0x140063786
movzx eax, di
jmp 0x140063788
mov eax, ebx
lea rcx, str.ws2_32.dll
mov word [0x140212030], ax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x140212040], rax
test rax, rax
je 0x140063841
lea rdx, [0x1401c0228]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140212040]
lea rdx, [0x1401c0238]
mov qword [0x140212010], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140212040]
lea rdx, str.getnameinfo
mov qword [0x140212018], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140212040]
lea rdx, str.WSAStringToAddressA
mov qword [0x140212020], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp qword [0x140212010], rbx
mov qword [0x140212028], rax
je 0x140063841
cmp qword [0x140212018], rbx
je 0x140063841
cmp qword [0x140212020], rbx
je 0x140063841
mov ecx, dword [0x140212034]
test rax, rax
cmovne ecx, edi
mov dword [0x140212034], ecx
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.1401276a0
mov rbx, qword [rsp + 0x1e0]
add rsp, 0x1d0
pop rdi
ret

Function at 0x140063afc
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub rsp, 0x28
cmp qword [0x140212048], 0
jne 0x140063b62
lea rcx, [0x140212048]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x140063b4e
movabs rax, 0x20c49ba5e353f7cf
lea rcx, [0x140212050]
imul qword [0x140212048]
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov qword [0x140212048], rdx
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
cmp qword [0x140212048], 0
jne 0x140063b62
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov eax, eax
jmp 0x140063b88
and qword [rsp + 0x30], 0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x30]
sub rax, qword [0x140212050]
cqo
idiv qword [0x140212048]
add rsp, 0x28
ret

Function at 0x140063e6c
Capabilities:
Get hostname

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov edi, ecx
mov edx, ecx
mov ebx, reloc.OLEAUT32.dll_SafeArrayGetDim
mov ecx, ebx
call fcn.1400731c0
lea rdx, [rsp + 0x38]
mov dword [rsp + 0x38], ebx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
je 0x140063ea9
sub ebx, dword [rsp + 0x38]
mov ecx, ebx
call fcn.140073270
jmp 0x140063eb0
mov ecx, edi
call fcn.1400732a0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140063ebc
Capabilities:
Get session user name

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, ecx
mov edx, ecx
mov ecx, 0x400
call fcn.1400731c0
lea rdx, [rsp + 0x38]
mov dword [rsp + 0x38], 0x400
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x140063efa
mov ecx, 0x401
sub ecx, dword [rsp + 0x38]
call fcn.140073270
jmp 0x140063f01
mov ecx, ebx
call fcn.1400732a0
add rsp, 0x20
pop rbx
ret

Function at 0x1400640c8
Capabilities:
Check if file exists
Get disk information
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x390]
sub rsp, 0x490
mov rax, qword [0x14020b948]
xor rax, rsp
mov qword [rbp + 0x380], rax
or rbx, 0xffffffffffffffff
xor edi, edi
test rcx, rcx
je 0x140064259
cmp word [rcx], di
je 0x140064259
mov rdx, rcx
mov r8d, 0x104
lea rcx, [rbp + 0x170]
call fcn.14014c098
lea rcx, [rbp + 0x170]
mov word [rbp + 0x378], di
call fcn.14001e0fc
mov rdx, rax
cdqe
lea rcx, [rbp + rax*2 + 0x16e]
lea eax, [rdx - 2]
cmp eax, 1
ja 0x14006418c
cmp word [rbp + 0x172], 0x3a
jne 0x14006418c
cmp edx, 2
jne 0x14006416a
lea rdx, [0x1401a45a8]
lea rcx, [rbp + 0x170]
call fcn.140148ed8
lea rcx, [rbp + 0x170]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x140064259
mov rbx, 0xfffffffffffffffe
jmp 0x140064259
cmp word [rcx], 0x5c
je 0x140064198
cmp word [rcx], 0x2f
jne 0x1400641a1
mov word [rcx], di
sub rcx, 2
jmp 0x14006418c
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x170]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rcx, rax
cmp rax, rbx
je 0x1400641e2
test byte [rsp + 0x20], 0x10
je 0x1400641cb
mov rbx, 0xfffffffffffffffe
jmp 0x1400641da
mov ebx, dword [rsp + 0x3c]
mov eax, dword [rsp + 0x40]
shl rbx, 0x20
or rbx, rax
call qword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x140064259
movzx ecx, word [rbp + 0x170]
movzx eax, word [rbp + 0x172]
cmp cx, 0x5c
jne 0x1400641fb
cmp ax, cx
je 0x140064211
cmp cx, 0x2f
jne 0x140064206
cmp ax, cx
je 0x140064211
cmp cx, 0x2e
jne 0x140064259
cmp ax, cx
jne 0x140064259
lea rcx, [rbp + 0x170]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140064238
not eax
mov rbx, 0xfffffffffffffffe
shr rax, 4
and eax, 1
or rbx, rax
jmp 0x140064259
lea rcx, [rbp + 0x170]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov rcx, rbx
mov rbx, 0xfffffffffffffffe
cmp eax, 1
cmova rcx, rbx
mov rbx, rcx
mov rax, rbx
mov rcx, qword [rbp + 0x380]
xor rcx, rsp
call fcn.1401276a0
lea r11, [rsp + 0x490]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret