joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140037f70
Capabilities:
Receive data
Receive data on socket

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x148
mov rdi, qword [rcx + 0x10]
mov rbp, qword [rsp + 0x1b0]
mov dword [rbp], 0
mov rsi, r9
mov r13, rcx
mov r12, rdx
mov rcx, qword [rdi + 0x98]
mov rdx, r8
xor r9d, r9d
mov r8d, esi
call qword [sym.imp.WS2_32.dll_recv]
movsxd r14, eax
mov rbx, r14
cmp r14d, 0xffffffff
je 0x140038018
test r12, r12
je 0x140037ff0
test byte [r12 + 0xa47], 0x10
je 0x140037ff0
mov rax, qword [r12 + 0x1270]
test rax, rax
je 0x140037fe5
mov edx, dword [rax + 8]
test edx, edx
jle 0x140037ff0
mov rax, qword [r13]
mov eax, dword [rax + 0xc]
test eax, eax
jg 0x140038060
test r14, r14
jle 0x140037ffe
test byte [rdi + 0x150], 1
je 0x140038040
mov rax, r14
add rsp, 0x148
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r15d, eax
cmp eax, 0x2733
jne 0x140038088
mov dword [rbp], 0x51
test r12, r12
jne 0x140037fc6
jmp 0x140037ffe
lea rcx, [rsp + 0x30]
call sym.Curl_now
movdqu xmm0, xmmword [rsp + 0x30]
or byte [rdi + 0x150], 1
movups xmmword [rdi + 0x128], xmm0
jmp 0x140037ffe
mov eax, dword [rbp]
mov dword [rsp + 0x20], ebx
mov r9, rsi
mov rdx, r13
lea r8, str.recv_len_zu______d__err_d
mov rcx, r12
mov dword [rsp + 0x28], eax
call sym.Curl_trc_cf_infof
jmp 0x140037ff0
lea rdx, [rsp + 0x40]
mov r8d, 0x100
mov ecx, eax
call sym.Curl_strerror
lea rdx, str.Recv_failure:__s
mov rcx, r12
mov r8, rax
call sym.Curl_failf
mov dword [r12 + 0xc7c], r15d
mov dword [rbp], 0x38
test byte [r12 + 0xa47], 0x10
je 0x140037ffe
jmp 0x140037fd1
Function at 0x1400380d0
Capabilities:
Send data
Send data on socket
Set socket configuration

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x1a8
movaps xmmword [rsp + 0x190], xmm6
mov rbp, qword [rsp + 0x218]
mov r13, qword [rcx + 0x10]
mov dword [rbp], 0
movsxd rax, dword [rcx + 0x20]
mov rbx, rcx
mov r12, rdx
mov rdx, r8
mov r8, qword [rcx + 0x18]
mov rcx, qword [r13 + 0x98]
add rax, 0x46
mov rdi, r9
xor r9d, r9d
mov r14, qword [r8 + rax*8 + 8]
mov qword [r8 + rax*8 + 8], rcx
mov r8d, edi
call qword [sym.imp.WS2_32.dll_send]
movsxd r15, eax
mov rsi, r15
cmp r15d, 0xffffffff
je 0x140038268
mov ecx, dword [rbp]
test ecx, ecx
je 0x1400381b0
test r12, r12
je 0x14003817c
test byte [r12 + 0xa47], 0x10
je 0x14003817c
mov rax, qword [r12 + 0x1270]
test rax, rax
je 0x14003816e
mov edx, dword [rax + 8]
test edx, edx
jle 0x14003817c
mov rax, qword [rbx]
mov eax, dword [rax + 0xc]
test eax, eax
jg 0x140038288
mov rax, qword [rbx + 0x18]
movsxd rdx, dword [rbx + 0x20]
mov qword [rax + rdx*8 + 0x238], r14
movaps xmm6, xmmword [rsp + 0x190]
mov rax, r15
add rsp, 0x1a8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x58], rcx
call sym.Curl_now
mov rcx, qword [rsp + 0x58]
lea rdx, [rsp + 0x60]
movdqu xmm0, xmmword [r13 + 0x138]
movdqu xmm6, xmmword [rsp + 0x70]
movaps xmmword [rsp + 0x60], xmm0
call sym.Curl_timediff
cmp rax, 0x3e8
jle 0x14003814a
lea r10, [rsp + 0x8c]
mov rcx, qword [r13 + 0x98]
xor r9d, r9d
xor r8d, r8d
lea rax, [rsp + 0x90]
mov dword [rsp + 0x28], 4
mov edx, 0x4004747b
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x20], r10
mov qword [rsp + 0x58], r10
call qword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
jne 0x140038257
mov eax, dword [rsp + 0x8c]
cmp dword [r13 + 0x148], eax
jne 0x1400382f0
movups xmmword [r13 + 0x138], xmm6
jmp 0x14003814a
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r13d, eax
cmp eax, 0x2733
jne 0x1400382b0
mov dword [rbp], 0x51
jmp 0x14003814a
mov eax, dword [rbp]
mov dword [rsp + 0x20], esi
mov r9, rdi
mov rdx, rbx
lea r8, str.send_len_zu______d__err_d
mov rcx, r12
mov dword [rsp + 0x28], eax
call sym.Curl_trc_cf_infof
jmp 0x14003817c
lea rdx, [rsp + 0x90]
mov r8d, 0x100
mov ecx, eax
call sym.Curl_strerror
lea rdx, str.Send_failure:__s
mov rcx, r12
mov r8, rax
call sym.Curl_failf
mov dword [r12 + 0xc7c], r13d
mov dword [rbp], 0x37
jmp 0x14003814f
mov r10, qword [rsp + 0x58]
mov r8d, 0x1001
mov edx, 0xffff
mov rcx, qword [r13 + 0x98]
mov dword [rsp + 0x20], 4
mov r9, r10
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jne 0x140038257
mov eax, dword [rsp + 0x8c]
mov dword [r13 + 0x148], eax
jmp 0x140038257
Function at 0x140038510
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rsi
push rbx
sub rsp, 0x428
mov r10, rdx
mov rbx, r8
test byte [rcx + 0x24], 1
je 0x140038582
mov rsi, qword [rcx + 0x10]
test rdx, rdx
je 0x140038570
test byte [rdx + 0xa47], 0x10
je 0x140038570
mov rax, qword [rdx + 0x1270]
test rax, rax
je 0x14003854a
mov edx, dword [rax + 8]
test edx, edx
jle 0x140038570
mov rax, qword [rcx]
mov eax, dword [rax + 0xc]
test eax, eax
jle 0x140038570
mov r9, qword [rsi + 0x98]
mov rdx, rcx
lea r8, str.cf_socket_shutdown__zd_
mov rcx, r10
call sym.Curl_trc_cf_infof
nop dword [rax]
mov rcx, qword [rsi + 0x98]
cmp rcx, 0xffffffffffffffff
je 0x140038582
cmp dword [rsi], 3
je 0x140038598
xor eax, eax
mov byte [rbx], 1
add rsp, 0x428
pop rbx
pop rsi
ret
mov edx, 1
call sym.curlx_nonblock
test eax, eax
js 0x140038582
mov rcx, qword [rsi + 0x98]
lea rdx, [rsp + 0x20]
xor r9d, r9d
mov r8d, 0x400
call qword [sym.imp.WS2_32.dll_recv]
jmp 0x140038582

Function at 0x1400385d0
Capabilities:
Set socket configuration

Disassembly:
push r12
sub rsp, 0x140
mov r8d, 1
mov r12, rcx
mov dword [rsp + 0x3c], 1
mov rcx, rdx
lea r9, [rsp + 0x3c]
mov dword [rsp + 0x20], 4
mov edx, 6
call qword [sym.imp.WS2_32.dll_setsockopt]
test r12, r12
je 0x14003860e
test eax, eax
js 0x140038620
add rsp, 0x140
pop r12
ret
test byte [r12 + 0xa47], 0x10
je 0x14003860e
mov rax, qword [r12 + 0x1270]
test rax, rax
je 0x14003863f
mov eax, dword [rax + 8]
test eax, eax
jle 0x14003860e
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, [rsp + 0x40]
mov r8d, 0x100
mov ecx, eax
call sym.Curl_strerror
lea rdx, str.Could_not_set_TCP_NODELAY:__s
mov rcx, r12
mov r8, rax
call sym.Curl_infof
jmp 0x14003860e

Function at 0x140039040
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push r13
push r12
push rdi
push rbx
sub rsp, 0x1b8
mov r9, qword [rcx + 0x98]
mov rbx, rcx
mov r12, rdx
cmp r9, 0xffffffffffffffff
je 0x140039074
mov rax, qword [rdx + 0x18]
mov rax, qword [rax + 0x3c0]
test byte [rax + 0x8d], 8
je 0x140039088
add rsp, 0x1b8
pop rbx
pop rdi
pop r12
pop r13
ret
lea r13, [rsp + 0x30]
xor eax, eax
mov ecx, 0x10
mov dword [rsp + 0x2c], pe_nt_image_headers64
mov rdi, r13
lea r8, [rsp + 0x2c]
mov rdx, r13
rep stosq qword [rdi], rax
mov rcx, r9
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x140039118
mov edx, dword [rsp + 0x2c]
lea r9, [rbx + 0x100]
lea r8, [rbx + 0xce]
mov rcx, r13
call sym.Curl_addr2string
test al, al
jne 0x140039074
mov rdi, qword [sym.imp.msvcrt.dll__errno]
call rdi
lea rdx, [rsp + 0xb0]
mov r8d, 0x100
mov ecx, dword [rax]
call sym.Curl_strerror
mov rbx, rax
call rdi
mov r9, rbx
lea rdx, str.ssloc_inet_ntop___failed_with_errno__d:__s
mov rcx, r12
mov r8d, dword [rax]
call sym.Curl_failf
jmp 0x140039074
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, [rsp + 0xb0]
mov r8d, 0x100
mov ecx, eax
mov ebx, eax
call sym.Curl_strerror
mov r8d, ebx
lea rdx, str.getsockname___failed_with_errno__d:__s
mov rcx, r12
mov r9, rax
call sym.Curl_failf
jmp 0x140039074
Function at 0x14003a060
Capabilities:
Set socket configuration

Disassembly:
push r12
sub rsp, 0x40
mov eax, dword [0x1401a51a0]
mov dword [rsp + 0x34], 0x4020
mov r12, rcx
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x3c], 4
test eax, eax
je 0x14003a0f0
cmp eax, 2
je 0x14003a0e3
lea rax, [rsp + 0x3c]
lea r9, [rsp + 0x38]
mov edx, 0xffff
mov rcx, r12
mov qword [rsp + 0x20], rax
mov r8d, 0x1001
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x14003a0c1
mov eax, dword [rsp + 0x34]
cmp dword [rsp + 0x38], eax
jg 0x14003a0e3
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x34]
mov edx, 0xffff
mov rcx, r12
mov r8d, 0x1001
call qword [sym.imp.WS2_32.dll_setsockopt]
nop
add rsp, 0x40
pop r12
ret
xor r8d, r8d
xor edx, edx
mov r9d, 2
mov ecx, 6
mov dword [rsp + 0x20], 3
call sym.curlx_verify_windows_version
test al, al
je 0x14003a128
mov dword [0x1401a51a0], 2
add rsp, 0x40
pop r12
ret
mov dword [0x1401a51a0], 1
jmp 0x14003a090
Function at 0x140043540
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x140043558
call sym.Curl_host_is_ipnum
test al, al
je 0x140043568
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov rcx, rbx
call sym.strlen
mov edx, 0x2e
mov rcx, rbx
mov r8, rax
mov rsi, rax
call sym.Curl_memrchr
test rax, rax
je 0x1400435b0
sub rax, rbx
mov edx, 0x2e
mov rcx, rbx
mov r8, rax
call sym.Curl_memrchr
test rax, rax
je 0x1400435b0
add rax, 1
mov rdx, rax
sub rdx, rbx
mov rbx, rax
sub rsi, rdx
add rsi, rbx
cmp rsi, rbx
jbe 0x140043620
mov edi, 0x1505
nop dword [rax]
movsx ecx, byte [rbx]
add rbx, 1
call sym.Curl_raw_toupper
movsx rdx, al
mov rax, rdi
shl rax, 5
add rax, rdi
xor rdx, rax
mov rdi, rdx
cmp rsi, rbx
jne 0x1400435c0
movabs rdx, 0x410410410410411
mov rax, rdi
mul rdx
mov rax, rdi
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 5
mov rdx, rax
shl rdx, 6
sub rdx, rax
mov rax, rdi
sub rax, rdx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov eax, 0x1a
jmp 0x14004355a
Function at 0x1400456b0
Capabilities:
Resolve dns

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov qword [rsp + 0x98], r9
mov qword [r9], 0
lea r9, [rsp + 0x28]
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov r13d, eax
test eax, eax
jne 0x14004583d
mov rbx, qword [rsp + 0x28]
test rbx, rbx
je 0x1400458b0
xor r12d, r12d
xor ebp, ebp
nop dword [rax + rax]
mov rcx, qword [rbx + 0x18]
xor edi, edi
test rcx, rcx
je 0x140045714
call sym.strlen
lea rdi, [rax + 1]
mov eax, dword [rbx + 4]
cmp eax, 2
je 0x140045858
cmp eax, 0x17
jne 0x140045810
mov r15d, 0x1c
mov r14d, 0x1c
cmp qword [rbx + 0x20], 0
je 0x140045810
mov rax, qword [rbx + 0x10]
cmp rax, r14
jb 0x140045810
test rax, rax
je 0x140045810
mov rax, qword [0x1401719a0]
lea rcx, [r14 + rdi + 0x30]
call qword [rax]
mov rsi, rax
test rax, rax
je 0x140045878
movdqu xmm0, xmmword [rbx]
mov rcx, qword [rbx + 0x20]
lea r10, [rax + 0x30]
mov dword [rax + 0x10], r15d
mov qword [rax + 0x18], 0
lea r9, [rsi + 0x38]
mov qword [rax + 0x28], 0
and r9, 0xfffffffffffffff8
mov qword [rax + 0x20], r10
movups xmmword [rax], xmm0
mov rax, qword [rcx]
mov qword [rsi + 0x30], rax
mov rax, qword [rcx + r14 - 8]
mov qword [r10 + r14 - 8], rax
mov rax, r10
sub rax, r9
sub rcx, rax
add eax, r14d
and eax, 0xfffffff8
cmp eax, 8
jb 0x1400457db
and eax, 0xfffffff8
xor edx, edx
mov r8d, edx
add edx, 8
mov r11, qword [rcx + r8]
mov qword [r9 + r8], r11
cmp edx, eax
jb 0x1400457c9
test rdi, rdi
je 0x1400457f4
lea rcx, [r10 + r14]
mov rdx, qword [rbx + 0x18]
mov r8, rdi
mov qword [rsi + 0x18], rcx
call sym.memcpy
test rbp, rbp
cmove rbp, rsi
test r12, r12
je 0x140045870
mov qword [r12 + 0x28], rsi
mov r12, rsi
nop dword [rax + rax]
mov rbx, qword [rbx + 0x28]
test rbx, rbx
jne 0x140045700
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x14004582d
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
test rbp, rbp
je 0x1400458b0
mov rax, qword [rsp + 0x98]
mov qword [rax], rbp
mov eax, r13d
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov r15d, 0x10
mov r14d, 0x10
jmp 0x140045735
mov r12, rsi
jmp 0x140045810
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x140045888
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
mov rbx, qword [0x1401718c0]
test rbp, rbp
je 0x1400458a6
nop dword [rax]
mov rcx, rbp
mov rbp, qword [rbp + 0x28]
call qword [rbx]
test rbp, rbp
jne 0x140045898
xor ebp, ebp
mov r13d, 8
jmp 0x140045832
mov ecx, 0x2af9
mov r13d, 0x2af9
xor ebp, ebp
call qword [sym.imp.WS2_32.dll_WSASetLastError]
jmp 0x140045832

Function at 0x140046180
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
mov r8, rcx
mov r9, rdx
xor ecx, ecx
xor edx, edx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.msvcrt.dll__beginthreadex]
lea rdx, [rax - 1]
cmp rdx, 0xfffffffffffffffe
mov edx, 0
cmovae rax, rdx
add rsp, 0x38
ret
Function at 0x140046230
Capabilities:
Write file on windows

Disassembly:
push r14
push r13
push r12
push rsi
push rbx
sub rsp, 0x840
mov r12, rcx
mov r13, r8
lea r14, [rsp + 0x30]
mov rsi, r9
test rdx, rdx
je 0x140046388
mov r9, qword [rdx]
mov rcx, r14
mov edx, 0x801
lea r8, [0x140161560]
call sym.curl_msnprintf
mov edx, 0x801
movsxd rcx, eax
sub edx, ecx
mov rbx, rcx
add rcx, r14
movsxd rdx, edx
mov r9, rsi
mov r8, r13
call sym.curl_mvsnprintf
add eax, ebx
cmp eax, 0x7ff
jle 0x1400462b5
lea edx, [rax - 1]
movsxd rcx, eax
movsxd rdx, edx
mov byte [rsp + rdx + 0x30], 0x2e
lea edx, [rax + 1]
add eax, 2
movsxd rdx, edx
mov byte [rsp + rcx + 0x30], 0x2e
mov byte [rsp + rdx + 0x30], 0x2e
lea r13d, [rax + 1]
cdqe
movsxd r13, r13d
mov byte [rsp + rax + 0x30], 0xa
mov byte [rsp + r13 + 0x30], 0
test byte [r12 + 0xa47], 0x10
je 0x140046322
cmp qword [r12 + 0x270], 0
je 0x140046338
mov rcx, r12
call sym.Curl_is_in_callback
mov edx, 1
mov rcx, r12
mov ebx, eax
call sym.Curl_set_in_callback
xor edx, edx
mov rcx, r12
mov r9, r13
mov rax, qword [r12 + 0x1e8]
mov r8, r14
mov qword [rsp + 0x20], rax
call qword [r12 + 0x270]
movzx edx, bl
mov rcx, r12
call sym.Curl_set_in_callback
nop
add rsp, 0x840
pop rbx
pop rsi
pop r12
pop r13
pop r14
ret
mov r9, qword [r12 + 0x1e0]
mov r8d, 1
mov edx, 2
lea rcx, [0x140161590]
call sym.fwrite
mov r9, qword [r12 + 0x1e0]
mov rdx, r13
mov rcx, r14
mov r8d, 1
call sym.fwrite
nop
add rsp, 0x840
pop rbx
pop rsi
pop r12
pop r13
pop r14
ret
mov rcx, r14
mov edx, 0x801
xor ebx, ebx
jmp 0x140046280

Function at 0x1400463a0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbx
sub rsp, 0x30
mov r12, rcx
mov r13d, edx
mov r15, r8
mov r14, r9
test byte [rcx + 0xa47], 0x10
je 0x140046426
cmp qword [rcx + 0x270], 0
je 0x140046420
call sym.Curl_is_in_callback
mov rcx, r12
mov edx, 1
mov ebx, eax
call sym.Curl_set_in_callback
mov edx, r13d
mov rcx, r12
mov r9, r14
mov rax, qword [r12 + 0x1e8]
mov r8, r15
mov qword [rsp + 0x20], rax
call qword [r12 + 0x270]
movzx edx, bl
mov rcx, r12
add rsp, 0x30
pop rbx
pop r12
pop r13
pop r14
pop r15
jmp sym.Curl_set_in_callback
cmp r13d, 2
jbe 0x140046438
add rsp, 0x30
pop rbx
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [r13 + r13*2]
mov r9, qword [r12 + 0x1e0]
mov edx, 2
lea rax, [0x140161590]
add rcx, rax
mov r8d, 1
call sym.fwrite
mov r9, qword [r12 + 0x1e0]
mov rdx, r14
mov rcx, r15
mov r8d, 1
add rsp, 0x30
pop rbx
pop r12
pop r13
pop r14
pop r15
jmp sym.fwrite
Function at 0x140046490
Capabilities:
Write file on windows

Disassembly:
push r14
push r13
push r12
push rbx
sub rsp, 0x158
mov qword [rsp + 0x190], r8
mov r12, rcx
mov qword [rsp + 0x198], r9
test byte [rcx + 0xa47], 0x10
jne 0x1400464c8
cmp qword [rcx + 0x1f0], 0
je 0x140046570
lea r14, [rsp + 0x40]
lea r9, [rsp + 0x190]
mov r8, rdx
mov edx, 0x100
mov rcx, r14
mov qword [rsp + 0x38], r9
call sym.curl_mvsnprintf
mov rcx, qword [r12 + 0x1f0]
movsxd rbx, eax
test rcx, rcx
je 0x140046505
test byte [r12 + 0x131c], 0x20
je 0x140046580
lea r13d, [rbx + 1]
mov byte [rsp + rbx + 0x40], 0xa
movsxd r13, r13d
mov byte [rsp + r13 + 0x40], 0
test byte [r12 + 0xa47], 0x10
je 0x140046570
cmp qword [r12 + 0x270], 0
je 0x1400465a0
mov rcx, r12
call sym.Curl_is_in_callback
mov edx, 1
mov rcx, r12
mov ebx, eax
call sym.Curl_set_in_callback
xor edx, edx
mov rcx, r12
mov r9, r13
mov rax, qword [r12 + 0x1e8]
mov r8, r14
mov qword [rsp + 0x20], rax
call qword [r12 + 0x270]
movzx edx, bl
mov rcx, r12
call sym.Curl_set_in_callback
nop
add rsp, 0x158
pop rbx
pop r12
pop r13
pop r14
ret
mov rdx, r14
call sym.strcpy
or byte [r12 + 0x131c], 0x20
jmp 0x140046505
mov r9, qword [r12 + 0x1e0]
mov r8d, 1
mov edx, 2
lea rcx, [0x140161590]
call sym.fwrite
mov r9, qword [r12 + 0x1e0]
mov rdx, r13
mov rcx, r14
mov r8d, 1
call sym.fwrite
nop
add rsp, 0x158
pop rbx
pop r12
pop r13
pop r14
ret
Function at 0x14004e1b0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rbx
sub rsp, 0x58
mov rsi, qword [rcx + 0x18]
movzx eax, byte [rsi + 0x75e]
mov r13, rsi
mov r12, rcx
mov ebx, edx
cmp dl, al
je 0x14004e1de
test byte [rcx + 0xa47], 0x10
jne 0x14004e220
mov byte [rsi + 0x75e], bl
cmp bl, 0x13
je 0x14004e2a0
cmp bl, 0x14
je 0x14004e2c0
mov r8d, 0xd
cmp bl, 0x15
je 0x14004e27e
xor eax, eax
cmp bl, 0x16
je 0x14004e278
add rsp, 0x58
pop rbx
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rdx, qword [rcx + 0x1270]
test rdx, rdx
je 0x14004e235
mov r10d, dword [rdx + 8]
test r10d, r10d
jle 0x14004e1de
mov rdx, qword [0x140171ad0]
mov r13, rsi
mov r9d, dword [rdx + 8]
test r9d, r9d
jle 0x14004e1de
lea rcx, [0x140163240]
movzx edx, bl
mov r9, qword [rcx + rdx*8]
mov r8, qword [rcx + rax*8]
lea rdx, str.__s_______s_
mov rcx, r12
call sym.Curl_trc_ftp
mov r13, qword [r12 + 0x18]
jmp 0x14004e1de
mov r8d, 0xe
mov edx, 1
mov rcx, r12
add rsp, 0x58
pop rbx
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp sym.ftp_state_quote
mov rdx, r13
mov rcx, r12
add rsp, 0x58
pop rbx
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp sym.ftp_state_size
cmp byte [r12 + 0x6f0], 2
je 0x14004e3c0
lea r9, [0x140161eeb]
mov rbx, qword [0x1401718c0]
xor r15d, r15d
mov r8, r9
mov rdx, qword [r12 + 0x7f8]
test rdx, rdx
je 0x14004e460
lea rcx, [0x140162419]
call sym.curl_maprintf
mov rcx, r15
mov r14, rax
call qword [rbx]
test r14, r14
je 0x14004e480
lea rdx, [r13 + 0x650]
mov r9, r14
lea r8, [0x140162001]
mov rcx, r12
call sym.Curl_pp_sendf
mov rcx, r14
mov dword [rsp + 0x3c], eax
call qword [rbx]
mov eax, dword [rsp + 0x3c]
test eax, eax
jne 0x14004e208
mov rbx, qword [r12 + 0x18]
movzx edx, byte [rbx + 0x75e]
cmp dl, 0x1f
je 0x14004e3b0
test byte [r12 + 0xa47], 0x10
je 0x14004e3b0
mov rcx, qword [r12 + 0x1270]
test rcx, rcx
je 0x14004e371
mov r8d, dword [rcx + 8]
test r8d, r8d
jle 0x14004e3b0
mov rcx, qword [0x140171ad0]
mov ecx, dword [rcx + 8]
test ecx, ecx
jle 0x14004e3b0
lea rcx, [0x140163240]
lea r9, [0x1401623ad]
mov dword [rsp + 0x3c], eax
mov r8, qword [rcx + rdx*8]
lea rdx, str.__s_______s_
mov rcx, r12
call sym.Curl_trc_ftp
mov eax, dword [rsp + 0x3c]
nop dword [rax + rax]
mov byte [rbx + 0x75e], 0x1f
jmp 0x14004e208
mov rax, qword [r12 + 0x1c8]
mov r15, qword [rax]
test r15, r15
je 0x14004e440
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor edx, edx
mov rcx, r15
mov qword [rsp + 0x48], 0
lea r8, [rsp + 0x48]
call sym.Curl_urldecode
test eax, eax
jne 0x14004e208
mov r15, qword [rsp + 0x48]
mov edx, 0x2f
mov rcx, r15
call sym.strrchr
test rax, rax
je 0x14004e48a
sub rax, r15
mov edx, 1
mov r9, r15
mov rbx, qword [0x1401718c0]
cmove rax, rdx
lea r8, [0x140162417]
mov byte [r15 + rax], 0
jmp 0x14004e2e3
lea r9, [0x140161eeb]
mov rbx, qword [0x1401718c0]
mov r8, r9
jmp 0x14004e2e3
cmp byte [r12 + 0x131d], 0
lea rdx, str.NLST
lea rax, [0x1401623ad]
cmovns rdx, rax
jmp 0x14004e2f4
mov eax, 0x1b
jmp 0x14004e208
mov rbx, qword [0x1401718c0]
mov rcx, r15
xor r15d, r15d
call qword [rbx]
lea r9, [0x140161eeb]
mov r8, r9
jmp 0x14004e2e3
Function at 0x140054eb0
Capabilities:
Query environment variable

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rdi, qword [0x1401719b0]
mov ebx, 1
xor r12d, r12d
mov rbp, qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov rsi, rcx
jmp 0x140054efe
mov rdx, rax
mov r8d, ebx
mov rcx, rsi
call rbp
lea edx, [rax - 1]
cmp edx, 0x7fff
ja 0x140054f30
cmp ebx, eax
je 0x140054f30
ja 0x140054f1c
mov ebx, eax
mov rcx, r12
mov edx, ebx
mov r13, r12
call qword [rdi]
mov r12, rax
test rax, rax
jne 0x140054ee0
mov rax, qword [0x1401718c0]
mov rcx, r13
call qword [rax]
mov rax, r12
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov rax, qword [0x1401718c0]
mov rcx, r12
xor r12d, r12d
call qword [rax]
mov rax, r12
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret

Function at 0x1400552c0
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
mov eax, 0x1505
lea r9, [rcx + rdx]
cmp rcx, r9
jae 0x1400552eb
nop
mov rdx, rax
add rcx, 1
shl rdx, 5
add rax, rdx
movsx rdx, byte [rcx - 1]
xor rax, rdx
cmp r9, rcx
jne 0x1400552d0
xor edx, edx
div r8
mov rax, rdx
ret

Function at 0x140068f60
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x38
xor eax, eax
test edx, edx
lea r8, [rsp + 0x2c]
mov edx, 0x8004667e
setne al
mov dword [rsp + 0x2c], eax
call qword [sym.imp.WS2_32.dll_ioctlsocket]
add rsp, 0x38
ret

Function at 0x14006d090
Capabilities:
Create new key via cryptacquirecontext
Initialize hashing via wincrypt

Disassembly:
push rbx
sub rsp, 0x30
xor r8d, r8d
mov r9d, 0x18
xor edx, edx
mov dword [rsp + 0x20], 0xf0000040
mov rbx, rcx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
mov r8d, eax
mov eax, 0x1b
test r8d, r8d
je 0x14006d0e5
lea rax, [rbx + 8]
xor r8d, r8d
mov rcx, qword [rbx]
xor r9d, r9d
mov qword [rsp + 0x20], rax
mov edx, 0x800c
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
mov r8d, eax
xor eax, eax
test r8d, r8d
je 0x14006d0f0
add rsp, 0x30
pop rbx
ret
mov rcx, qword [rbx]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov qword [rbx], 0
mov eax, 2
jmp 0x14006d0e5
Function at 0x14006d110
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push r13
push r12
push rbx
sub rsp, 0x50
mov r9d, 0x18
mov dword [rsp + 0x20], 0xf0000040
mov rbx, rcx
mov r13, rdx
mov r12, r8
lea rcx, [rsp + 0x40]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
mov r9d, eax
mov eax, 0x1b
test r9d, r9d
je 0x14006d1e1
lea rax, [rsp + 0x48]
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov edx, 0x800c
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x14006d230
mov rcx, r12
call sym.curlx_uztoui
mov rdx, r13
lea r13, [rsp + 0x3c]
xor r9d, r9d
mov rcx, qword [rsp + 0x48]
mov r8d, eax
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
xor r8d, r8d
mov rcx, qword [rsp + 0x48]
mov r9, r13
mov dword [rsp + 0x3c], 0
mov r12, qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov edx, 2
mov dword [rsp + 0x20], 0
call r12
cmp dword [rsp + 0x3c], 0x20
je 0x14006d1f0
mov rcx, qword [rsp + 0x48]
test rcx, rcx
jne 0x14006d220
mov rcx, qword [rsp + 0x40]
test rcx, rcx
jne 0x14006d210
xor eax, eax
add rsp, 0x50
pop rbx
pop r12
pop r13
ret
mov rcx, qword [rsp + 0x48]
mov r9, r13
mov r8, rbx
mov edx, 2
mov dword [rsp + 0x20], 0
call r12
jmp 0x14006d1cb
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
jmp 0x14006d1e1
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
jmp 0x14006d1d5
mov rcx, qword [rsp + 0x40]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, 2
jmp 0x14006d1e1