joyce8/EMBER2024-capa huggingface dataset:
Function at 0x518615
Capabilities:
Enumerate process modules

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x1b0
mov rcx, qword [rbp + 0x10]
mov edx, dword [rbp + 0x18]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_RtlZeroMemory]
add rsp, 0x20
push rax
lea rax, [rbp - 0x168]
push rax
call fcn.0058b1c5
pop rcx
push rax
lea rax, [rbp - 0x168]
push rax
push 0x40
push qword [rbp + 0x20]
call fcn.0058b22a
pop rcx
lea rax, [rbp - 0x168]
push rax
lea rax, [rbp - 0x1a8]
push rax
call fcn.0058b3f6
mov eax, dword [rbp + 0x18]
mov dword [rbp - 8], eax
mov dword [rbp - 4], 0
jmp 0x5186f5
push qword [rbp - 8]
push 0x40
call fcn.004c233c
mov dword [rbp - 0xc], eax
mov eax, dword [rbp - 0xc]
mov dword [rbp - 0x1ac], eax
mov eax, dword [rbp + 0x18]
sub eax, dword [rbp - 0x1ac]
jb 0x5186ff
cmp eax, dword [rbp - 4]
jb 0x5186ff
mov rax, qword [rbp + 0x10]
mov ebx, dword [rbp - 4]
mov esi, dword [rbp - 0xc]
mov dword [rbp - 0x1b0], esi
mov esi, 0x40
sub esi, dword [rbp - 0x1b0]
jb 0x5186ff
mov esi, dword [rbp - 0x1b0]
cmp esi, dword [rbp - 0x1ac]
jne 0x5186ff
mov r8d, esi
lea rdx, [rbp - 0x1a8]
lea rcx, [rax + rbx]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_RtlMoveMemory]
add rsp, 0x20
mov eax, dword [rbp - 0xc]
add dword [rbp - 4], eax
mov eax, dword [rbp - 0xc]
sub dword [rbp - 8], eax
cmp dword [rbp - 8], 0
jg 0x51867c
leave
ret 0x18
int 5
Function at 0x518a02
Capabilities:
Enumerate process modules

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x250
mov rax, qword [rbp + 0x10]
xor ebx, ebx
mov qword [rax], rbx
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbx
push rax
push rax
push 0
push 0x18
mov ecx, dword [rsp]
mov edx, dword [rsp + 8]
call qword [sym.imp.KERNEL32.DLL_CreateToolhelp32Snapshot]
add rsp, 0x20
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0xffffffffffffffff
jne 0x518a48
leave
ret 0x10
mov dword [rbp - 0x240], 0x238
push rax
push rax
lea rax, [rbp - 0x240]
push rax
push qword [rbp - 8]
mov rcx, qword [rsp]
mov rdx, qword [rsp + 8]
call qword [sym.imp.KERNEL32.DLL_Module32First]
add rsp, 0x20
cmp eax, 0
jne 0x518a90
sub rsp, 0x18
push qword [rbp - 8]
mov rcx, qword [rsp]
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
add rsp, 0x20
leave
ret 0x10
mov rax, qword [rbp - 0x228]
mov qword [rbp - 0x248], rax
mov rax, qword [rbp + 0x18]
cmp rax, qword [rbp - 0x248]
jl 0x518af2
mov eax, dword [rbp - 0x220]
add rax, qword [rbp - 0x248]
cmp rax, qword [rbp + 0x18]
jle 0x518af2
push rax
push 0x20
push qword [rbp + 0x10]
push 0x100
lea rax, [rbp - 0x210]
push rax
push 0x20
call fcn.0040597f
pop rcx
sub rsp, 0x18
push qword [rbp - 8]
mov rcx, qword [rsp]
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
add rsp, 0x20
leave
ret 0x10
push rax
push rax
lea rax, [rbp - 0x240]
push rax
push qword [rbp - 8]
mov rcx, qword [rsp]
mov rdx, qword [rsp + 8]
call qword [sym.imp.KERNEL32.DLL_Module32Next]
add rsp, 0x20
cmp eax, 0
je 0x518b1c
jmp 0x518a90
sub rsp, 0x18
push qword [rbp - 8]
mov rcx, qword [rsp]
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
add rsp, 0x20
leave
ret 0x10
Function at 0x5287dc
Capabilities:
Check for software breakpoints

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov rax, qword [rbp + 0x10]
cmp dword [rax + 0x2c], 0xca
jne 0x52882f
push rax
push qword [rbp + 0x10]
call fcn.0059d4ba
pop rcx
cmp eax, 0
je 0x528809
xor al, al
leave
ret 8
mov rax, qword [rbp + 0x10]
test byte [rax + 0x60], 0xff
je 0x528824
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x2c], 0xcf
mov al, 1
leave
ret 8
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x2c], 0xcb
mov rax, qword [rbp + 0x10]
cmp dword [rax + 0x2c], 0xcb
jne 0x5288f8
mov rax, qword [rbp + 0x10]
mov rax, qword [rax + 0x228]
test byte [rax + 0x20], 0xff
je 0x5288e2
mov rax, qword [rbp + 0x10]
cmp qword [rax + 0x18], 0
je 0x52886f
mov rax, qword [rbp + 0x10]
push rax
push qword [rbp + 0x10]
mov rax, qword [rax + 0x18]
call qword [rax]
pop rcx
mov rax, qword [rbp + 0x10]
push rax
push qword [rbp + 0x10]
mov rax, qword [rax + 0x228]
call qword [rax]
pop rcx
mov dword [rbp - 4], eax
cmp dword [rbp - 4], 0
jne 0x528890
xor al, al
leave
ret 8
cmp dword [rbp - 4], 2
je 0x5288e2
mov rax, qword [rbp + 0x10]
cmp qword [rax + 0x18], 0
je 0x5288dd
cmp dword [rbp - 4], 3
je 0x5288ad
cmp dword [rbp - 4], 1
jne 0x5288dd
mov rax, qword [rbp + 0x10]
mov rax, qword [rax + 0x18]
inc dword [rax + 8]
mov rbx, qword [rbp + 0x10]
mov rbx, qword [rbx + 0x18]
mov eax, dword [rax + 8]
cmp eax, dword [rbx + 0xc]
jl 0x5288dd
mov rax, qword [rbp + 0x10]
mov rax, qword [rax + 0x18]
mov rbx, qword [rbp + 0x10]
mov ebx, dword [rbx + 0x18c]
add dword [rax + 0xc], ebx
jmp 0x528855
mov rax, qword [rbp + 0x10]
mov rbx, qword [rbp + 0x10]
mov ebx, dword [rbx + 0xa4]
mov dword [rax + 0xac], ebx
jmp 0x52890b
mov rax, qword [rbp + 0x10]
cmp dword [rax + 0x2c], 0xcc
je 0x52890b
xor al, al
leave
ret 8
push rax
push qword [rbp + 0x10]
call fcn.0059d518
pop rcx
leave
ret 8
Function at 0x52b4d6
Capabilities:
Check for software breakpoints

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [rbp + 0x18]
mov dword [rax], 0
mov dword [rbp - 8], 0
mov rax, qword [rbp + 0x20]
mov eax, dword [rax + 0x74c]
mov dword [rbp - 0xc], eax
mov dword [rbp - 0x14], 0
jmp 0x52b632
mov rax, qword [rbp + 0x20]
cmp dword [rax + 0x744], 0
jne 0x52b5ff
mov rax, qword [rbp + 0x20]
mov rbx, qword [rbp + 0x20]
mov eax, dword [rax + 0x738]
cmp eax, dword [rbx + 0x73c]
jne 0x52b5c3
push rax
push qword [rbp + 0x10]
push 1
lea rax, [rbp - 1]
push rax
call fcn.0059d919
pop rcx
mov dword [rbp - 0x18], eax
cmp dword [rbp - 0x18], 0
jge 0x52b557
mov eax, dword [rbp - 0x18]
leave
ret 0x18
movzx eax, byte [rbp - 1]
cmp eax, 0
jne 0x52b569
mov eax, 0xffffffed
leave
ret 0x18
push rax
push qword [rbp + 0x10]
movzx eax, byte [rbp - 1]
mov dword [rbp - 0x1c], eax
mov eax, 0x100
sub eax, dword [rbp - 0x1c]
jb 0x52b64d
mov rax, qword [rbp + 0x20]
push qword [rbp - 0x1c]
lea rax, [rax + 0x635]
push rax
call fcn.0059d919
pop rcx
mov dword [rbp - 0x18], eax
cmp dword [rbp - 0x18], 0
jge 0x52b5a7
mov eax, dword [rbp - 0x18]
leave
ret 0x18
mov rax, qword [rbp + 0x20]
mov dword [rax + 0x738], 0
mov rax, qword [rbp + 0x20]
movzx ebx, byte [rbp - 1]
mov dword [rax + 0x73c], ebx
mov rax, qword [rbp + 0x20]
mov rbx, qword [rbp + 0x20]
mov esi, dword [rbx + 0x738]
inc dword [rbx + 0x738]
cmp esi, 0x100
jae 0x52b64f
mov rbx, qword [rbp + 0x20]
movzx ebx, byte [rbx + rsi + 0x635]
mov byte [rax + 0x740], bl
mov rax, qword [rbp + 0x20]
mov dword [rax + 0x744], 8
mov rax, qword [rbp + 0x20]
movzx eax, byte [rax + 0x740]
and eax, 1
mov dword [rbp - 0x10], eax
mov rax, qword [rbp + 0x20]
shr byte [rax + 0x740], 1
mov rax, qword [rbp + 0x20]
dec dword [rax + 0x744]
mov ecx, dword [rbp - 0x14]
mov eax, dword [rbp - 0x10]
shl eax, cl
or dword [rbp - 8], eax
inc dword [rbp - 0x14]
mov eax, dword [rbp - 0x14]
cmp eax, dword [rbp - 0xc]
jb 0x52b50b
mov rax, qword [rbp + 0x18]
mov ebx, dword [rbp - 8]
mov dword [rax], ebx
xor eax, eax
leave
ret 0x18
int 5
int 5
Function at 0x52dab0
Capabilities:
Get local ipv4 addresses
Get socket information
Validate payment card number using luhn algorithm

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rax, qword [rbp + 0x18]
test byte [rax], 0xff
je 0x52dbdc
mov rax, qword [rbp + 0x10]
cmp dword [rax], 0
jge 0x52dafe
mov rax, qword [rbp + 0x18]
mov rax, qword [rax + 0x18]
mov ebx, 1
call fcn.006df099
mov rax, qword [rbp + 0x18]
xor ebx, ebx
mov qword [rax], rbx
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbx
xor eax, eax
leave
ret 0x10
mov rax, qword [rbp + 0x18]
mov rax, qword [rax + 0x18]
lock inc dword [rax]
cmp dword [rax + 4], 1
jne 0x52dc63
mov qword [rbp - 0x28], rax
mov rbx, qword [rbp + 0x18]
mov ebx, dword [rbx + 0x14]
mov dword [rbp - 0x2c], ebx
mov rax, qword [rax + 8]
mov ebx, dword [rax]
sub ebx, dword [rbp - 0x2c]
jb 0x52dc63
mov ebx, dword [rbp - 0x2c]
mov dword [rbp - 0x1c], ebx
lea rax, [rax + 4]
mov qword [rbp - 0x10], rax
mov eax, dword [rbp - 0x1c]
mov dword [rbp - 0x20], eax
mov eax, dword [rbp - 0x20]
add eax, 4
mov r8d, eax
mov edx, 4
mov rcx, qword [section..bss]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_HeapAlloc]
add rsp, 0x20
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
mov ebx, dword [rbp - 0x1c]
mov dword [rax], ebx
mov rax, qword [rbp - 0x18]
mov r8d, dword [rbp - 0x20]
mov rdx, qword [rbp - 0x10]
lea rcx, [rax + 4]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_RtlMoveMemory]
add rsp, 0x20
mov rax, qword [rbp - 0x28]
lock dec dword [rax]
mov rax, qword [rbp - 0x18]
call fcn.006defae
mov dword [rax + 4], 1
mov qword [rbp - 8], rax
mov rax, qword [rbp + 0x18]
mov rax, qword [rax + 0x18]
mov ebx, 1
call fcn.006df099
mov rax, qword [rbp + 0x18]
xor ebx, ebx
mov qword [rax], rbx
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbx
mov rax, qword [rbp - 8]
leave
ret 0x10
mov rax, qword [rbp + 0x10]
cmp dword [rax], 0
jge 0x52dc22
push rax
mov rax, qword [rbp + 0x18]
push qword [rax + 4]
call fcn.0040ab09
pop rcx
mov rax, qword [rbp + 0x18]
mov rax, qword [rax + 8]
lock inc dword [rax]
cmp dword [rax + 4], 8
jne 0x52dc65
mov qword [rbp - 8], rax
mov rax, qword [rax + 8]
mov ebx, dword [rax]
push rbx
lea rax, [rax + 4]
push rax
call fcn.0041916b
mov rbx, qword [rbp - 8]
lock dec dword [rbx]
jmp 0x52dc36
push rax
mov rax, qword [rbp + 0x18]
push qword [rax + 4]
call fcn.0040ab09
pop rcx
mov rbx, qword [rbp + 0x10]
mov dword [rbx], eax
mov rax, qword [rbp + 0x18]
mov rax, qword [rax + 8]
mov ebx, 8
call fcn.006df099
mov rax, qword [rbp + 0x18]
xor ebx, ebx
mov qword [rax], rbx
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbx
xor eax, eax
leave
ret 0x10
int 5
int 5
Function at 0x52dc67
Capabilities:
Get local ipv4 addresses
Get socket information
Validate payment card number using luhn algorithm

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
cmp dword [rbp + 0x10], 0
jne 0x52dc7c
leave
ret 0x10
cmp dword [rbp + 0x10], 0
jle 0x52dda2
mov rax, qword [rbp + 0x18]
cmp qword [rax], 0
jne 0x52dc94
xor eax, eax
jmp 0x52dcbb
mov rax, qword [rbp + 0x18]
mov rax, qword [rax]
lock inc dword [rax]
cmp dword [rax + 4], 0x44
jne 0x52dda4
mov qword [rbp - 0x18], rax
mov rax, qword [rax + 8]
mov ebx, dword [rax]
mov rsi, qword [rbp - 0x18]
lock dec dword [rsi]
mov eax, ebx
mov dword [rbp - 4], eax
mov eax, dword [rbp - 4]
add eax, dword [rbp + 0x10]
mov dword [rbp - 0x14], eax
mov eax, dword [rbp - 0x14]
cmp eax, 0xfffffff
jae 0x52dda6
shl eax, 3
add eax, 8
mov r8d, eax
mov edx, 0xc
mov rcx, qword [section..bss]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_HeapAlloc]
add rsp, 0x20
mov ebx, dword [rbp - 0x14]
mov dword [rax], ebx
call fcn.006defae
mov dword [rax + 4], 0x44
mov qword [rbp - 0x10], rax
cmp dword [rbp - 4], 0
jle 0x52dd82
mov rax, qword [rbp - 0x10]
lock inc dword [rax]
cmp dword [rax + 4], 0x44
jne 0x52dda8
mov qword [rbp - 0x18], rax
mov ebx, dword [rbp - 4]
mov dword [rbp - 0x1c], ebx
mov rax, qword [rax + 8]
mov ebx, dword [rax]
sub ebx, dword [rbp - 0x1c]
jb 0x52dda8
mov rbx, qword [rbp + 0x18]
mov rbx, qword [rbx]
lock inc dword [rbx]
cmp dword [rbx + 4], 0x44
jne 0x52dda8
mov qword [rbp - 0x28], rbx
mov rbx, qword [rbx + 8]
mov esi, dword [rbx]
cmp esi, dword [rbp - 0x1c]
jne 0x52dda8
shl esi, 3
mov r8d, esi
lea rdx, [rbx + 8]
lea rcx, [rax + 8]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_RtlMoveMemory]
add rsp, 0x20
mov rax, qword [rbp - 0x18]
lock dec dword [rax]
mov rax, qword [rbp - 0x28]
lock dec dword [rax]
mov rax, qword [rbp + 0x18]
mov rax, qword [rax]
mov ebx, 0x44
call fcn.006df099
mov rax, qword [rbp + 0x18]
mov rbx, qword [rbp - 0x10]
mov qword [rax], rbx
leave
ret 0x10
int 5
int 5
int 5
int 5

Function at 0x52ddaa
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [rbp + 0x10]
mov dword [rbp - 4], eax
cmp dword [rbp + 0x10], 0
jge 0x52ddc7
xor eax, eax
leave
ret 0x20
movzx eax, word [rbp + 0x18]
mov word [rbp - 0x2a], ax
mov eax, 0x10
mov bx, word [rbp - 0x2a]
jmp 0x52dddf
mov word [rbp + rax*2 - 0x28], bx
dec eax
jns 0x52ddda
jmp 0x52de08
push rax
push qword [rbp + 0x28]
push 0x10
lea rax, [rbp - 0x28]
push rax
call qword [rbp + 0x20]
pop rcx
mov dword [rbp - 8], eax
cmp dword [rbp - 8], 0
je 0x52de04
mov eax, dword [rbp - 8]
leave
ret 0x20
sub dword [rbp - 4], 0x10
cmp dword [rbp - 4], 0x10
jge 0x52dde5
push rax
push qword [rbp + 0x28]
mov eax, dword [rbp - 4]
mov dword [rbp - 0x2c], eax
mov eax, 0x10
sub eax, dword [rbp - 0x2c]
jb 0x52de32
push qword [rbp - 0x2c]
lea rax, [rbp - 0x28]
push rax
call qword [rbp + 0x20]
pop rcx
leave
ret 0x20
int 5
Function at 0x52de34
Capabilities:
Get local ipv4 addresses
Get socket information
Validate payment card number using luhn algorithm

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
lea rcx, [rbp - 0x48]
mov edx, 0x28
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_RtlZeroMemory]
add rsp, 0x20
mov rax, qword [rbp + 0x18]
mov qword [rbp - 0x18], rax
mov dword [rbp - 8], 0x14
mov byte [rbp - 1], 0
cmp qword [rbp - 0x18], 0
jge 0x52deb8
mov rax, qword [rbp - 0x18]
movabs rbx, 0x8000000000000000
cmp rax, rbx
jne 0x52dea9
mov r8d, 0x28
mov edx, str._9223372036854775808
mov rcx, qword [rbp + 0x10]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_RtlMoveMemory]
add rsp, 0x20
mov eax, 0x14
leave
ret 0x10
mov byte [rbp - 1], 1
mov rax, qword [rbp - 0x18]
neg rax
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
mov rbx, 0xa
cqo
idiv rbx
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
shl rax, 1
mov rbx, qword [rbp - 0x18]
sub rbx, rax
mov rax, qword [rbp - 0x20]
shl rax, 3
sub rbx, rax
mov ebx, ebx
mov dword [rbp - 0xc], ebx
mov rax, qword [rbp - 0x20]
mov qword [rbp - 0x18], rax
dec dword [rbp - 8]
mov eax, dword [rbp - 8]
cmp eax, 0x14
jae 0x52dfa9
mov ebx, dword [rbp - 0xc]
add ebx, 0x30
mov word [rbp + rax*2 - 0x48], bx
cmp qword [rbp - 0x18], 0
je 0x52df15
jmp 0x52deb8
test byte [rbp - 1], 0xff
je 0x52df31
dec dword [rbp - 8]
mov eax, dword [rbp - 8]
cmp eax, 0x14
jae 0x52dfab
mov word [rbp + rax*2 - 0x48], 0x2d
mov rcx, qword [rbp + 0x10]
mov edx, 0x28
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_RtlZeroMemory]
add rsp, 0x20
mov eax, 0x14
sub eax, dword [rbp - 8]
mov dword [rbp - 0x10], eax
mov eax, dword [rbp - 0x10]
mov dword [rbp - 0x4c], eax
mov eax, 0x14
sub eax, dword [rbp - 0x4c]
jb 0x52dfad
mov rax, qword [rbp + 0x10]
mov ebx, dword [rbp - 0x10]
mov dword [rbp - 0x50], ebx
mov ebx, 0x14
sub ebx, dword [rbp - 0x50]
jb 0x52dfad
cmp ebx, dword [rbp - 8]
jb 0x52dfad
mov ebx, dword [rbp - 8]
mov esi, dword [rbp - 0x50]
cmp esi, dword [rbp - 0x4c]
jne 0x52dfad
shl esi, 1
mov r8d, esi
lea rdx, [rbp + rbx*2 - 0x48]
mov rcx, rax
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_RtlMoveMemory]
add rsp, 0x20
mov eax, dword [rbp - 0x10]
leave
ret 0x10
int 5
int 5
int 5
Function at 0x52dfaf
Capabilities:
Get local ipv4 addresses
Get socket information
Validate payment card number using luhn algorithm

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
xor eax, eax
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp - 0x10], rax
mov dword [rbp - 4], 0x10
dec dword [rbp - 4]
mov eax, dword [rbp - 4]
cmp eax, 0x10
jae 0x52e09f
mov ebx, dword [rbp - 0x10]
and ebx, 0xf
cmp ebx, 0x10
jae 0x52e09f
movzx ebx, word [rbx*2 + str.0123456789abcdef]
mov word [rbp + rax*2 - 0x30], bx
mov rax, qword [rbp - 0x10]
sar rax, 4
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
sete al
cmp dword [rbp - 4], 0
sete bl
or al, bl
test al, al
jne 0x52e029
jmp 0x52dfdb
mov eax, 0x10
sub eax, dword [rbp - 4]
mov dword [rbp - 8], eax
mov rax, qword [rbp + 0x10]
xor ebx, ebx
mov qword [rax], rbx
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbx
mov eax, dword [rbp - 8]
mov dword [rbp - 0x34], eax
mov eax, 0x10
sub eax, dword [rbp - 0x34]
jb 0x52e0a1
mov rax, qword [rbp + 0x10]
mov ebx, dword [rbp - 8]
mov dword [rbp - 0x38], ebx
mov ebx, 0x10
sub ebx, dword [rbp - 0x38]
jb 0x52e0a1
cmp ebx, dword [rbp - 4]
jb 0x52e0a1
mov ebx, dword [rbp - 4]
mov esi, dword [rbp - 0x38]
cmp esi, dword [rbp - 0x34]
jne 0x52e0a1
shl esi, 1
mov r8d, esi
lea rdx, [rbp + rbx*2 - 0x30]
mov rcx, rax
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_RtlMoveMemory]
add rsp, 0x20
mov eax, dword [rbp - 8]
leave
ret 0x10
int 5
int 5
Function at 0x52e744
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rax, qword [rbp + 0x20]
cmp qword [rax], 0
jle 0x52e8d5
mov rax, qword [rbp + 0x10]
xor ebx, ebx
mov qword [rax], rbx
mov qword [rax + 8], rbx
mov word [rax + 0x10], bx
mov rax, qword [rbp + 0x20]
test byte [rax + 0x10], 0xff
je 0x52e80f
mov dword [rbp - 4], 0x1c
test byte [rbp + 0x18], 0xff
je 0x52e7b7
push rax
lea rax, [rbp - 4]
push rax
lea rax, [rbp - 0x28]
push rax
mov rax, qword [rbp + 0x20]
push qword [rax]
mov rcx, qword [rsp]
mov rdx, qword [rsp + 8]
mov r8, qword [rsp + 0x10]
call qword [sym.imp.ws2_32.dll_getsockname]
add rsp, 0x20
mov dword [rbp - 8], eax
jmp 0x52e7e3
push rax
lea rax, [rbp - 4]
push rax
lea rax, [rbp - 0x28]
push rax
mov rax, qword [rbp + 0x20]
push qword [rax]
mov rcx, qword [rsp]
mov rdx, qword [rsp + 8]
mov r8, qword [rsp + 0x10]
call qword [sym.imp.ws2_32.dll_getpeername]
add rsp, 0x20
mov dword [rbp - 8], eax
mov rax, qword [rbp + 0x10]
mov rbx, qword [rbp - 0x20]
mov rsi, qword [rbp - 0x18]
mov qword [rax], rbx
mov qword [rax + 8], rsi
movzx ebx, word [rbp - 0x26]
shr ebx, 8
movzx esi, word [rbp - 0x26]
shl esi, 8
add ebx, esi
mov word [rax + 0x10], bx
jmp 0x52e8c0
mov dword [rbp - 4], 0x10
test byte [rbp + 0x18], 0xff
je 0x52e84a
push rax
lea rax, [rbp - 4]
push rax
lea rax, [rbp - 0x18]
push rax
mov rax, qword [rbp + 0x20]
push qword [rax]
mov rcx, qword [rsp]
mov rdx, qword [rsp + 8]
mov r8, qword [rsp + 0x10]
call qword [sym.imp.ws2_32.dll_getsockname]
add rsp, 0x20
mov dword [rbp - 8], eax
jmp 0x52e876
push rax
lea rax, [rbp - 4]
push rax
lea rax, [rbp - 0x18]
push rax
mov rax, qword [rbp + 0x20]
push qword [rax]
mov rcx, qword [rsp]
mov rdx, qword [rsp + 8]
mov r8, qword [rsp + 0x10]
call qword [sym.imp.ws2_32.dll_getpeername]
add rsp, 0x20
mov dword [rbp - 8], eax
mov rax, qword [rbp + 0x10]
xor ebx, ebx
mov qword [rax], rbx
mov qword [rax + 8], rbx
mov word [rax + 0x10], bx
mov rax, qword [rbp + 0x10]
mov rbx, qword [0x006fd91a]
mov esi, dword [0x006fd922]
mov qword [rax], rbx
mov dword [rax + 8], esi
mov rax, qword [rbp + 0x10]
mov ebx, dword [rbp - 0x14]
mov dword [rax + 0xc], ebx
mov rax, qword [rbp + 0x10]
movzx ebx, word [rbp - 0x16]
shr ebx, 8
movzx esi, word [rbp - 0x16]
shl esi, 8
add ebx, esi
mov word [rax + 0x10], bx
cmp dword [rbp - 8], 0xffffffff
jne 0x52e8cf
call fcn.0042464b
leave
ret 0x18
xor eax, eax
leave
ret 0x18
int 5

Function at 0x531ad1
Capabilities:
Send data
Send data on socket

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x1c0
lea rcx, [rbp - 0x1b8]
mov edx, 0x1b0
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_RtlZeroMemory]
add rsp, 0x20
mov eax, dword [rbp + 0x18]
mov dword [rbp - 0x1b8], eax
mov eax, dword [rbp + 0x10]
mov dword [rbp - 0x1b4], eax
push qword [0x009d60d0]
push 0x1b0
lea rax, [rbp - 0x1b8]
push rax
push 2
push 5
push 0x6f279a
call fcn.0040ece8
mov dword [rbp - 4], eax
cmp dword [rbp - 4], 0
jne 0x531b4b
push rax
push qword [rbp + 0x20]
push qword [rbp + 0x18]
movzx eax, byte [rbp - 0xf9]
push rax
call fcn.0052f64b
pop rcx
leave
ret 0x18
int 5
Function at 0x531de9
Capabilities:
Send data
Send data on socket

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x2f0
lea rcx, [rbp - 0x2e8]
mov edx, 0x2dc
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_RtlZeroMemory]
add rsp, 0x20
mov eax, dword [rbp + 0x10]
mov dword [rbp - 0x2e8], eax
push qword [0x009d6128]
push 0x2dc
lea rax, [rbp - 0x2e8]
push rax
push 2
push 7
push 0x6f0dd0
call fcn.0040ece8
mov dword [rbp - 4], eax
cmp dword [rbp - 4], 0
je 0x531e4a
cmp dword [rbp - 4], 0xffffff12
jne 0x531e66
cmp dword [rbp - 4], 0
jge 0x531e56
xor al, al
leave
ret 8
mov al, byte [rbp - 0x1a0]
and al, byte [rbp - 0x19f]
leave
ret 8
int 5

Function at 0x531e68
Capabilities:
Send data
Send data on socket

Disassembly:
push rbp
mov rbp, rsp
mov rax, qword [rbp + 0x20]
cmp qword [rax], 0
jle 0x531e9b
push qword [rbp + 0x18]
push qword [rbp + 0x10]
push qword [rbp + 0x18]
push qword [rbp + 0x10]
mov rax, qword [rbp + 0x20]
push qword [rax + 0x28]
mov rax, qword [rbp + 0x20]
lea rax, [rax + 0x15]
push rax
call fcn.005a1bb6
leave
ret 0x18
int 5

Function at 0x531e9d
Capabilities:
Send data
Send data on socket

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov rax, qword [rbp + 0x28]
cmp qword [rax], 0
jle 0x531fc9
mov rax, qword [rbp + 0x10]
mov eax, dword [rax]
cmp eax, dword [rbp + 0x20]
jb 0x531eca
mov eax, 0xffffb1d4
leave
ret 0x20
mov rax, qword [rbp + 0x10]
mov ebx, dword [rbp + 0x20]
sub ebx, dword [rax]
mov dword [rbp - 8], ebx
cmp dword [rbp - 8], 0x16d0
jbe 0x531ee6
mov dword [rbp - 8], 0x16d0
push 0
push qword [rbp - 8]
mov rax, qword [rbp + 0x10]
mov eax, dword [rax]
cmp eax, dword [rbp + 0x20]
jae 0x531fcb
mov rbx, qword [rbp + 0x18]
lea rax, [rbx + rax]
push rax
mov rax, qword [rbp + 0x28]
push qword [rax]
mov rcx, qword [rsp]
mov rdx, qword [rsp + 8]
mov r8d, dword [rsp + 0x10]
mov r9d, dword [rsp + 0x18]
call qword [sym.imp.ws2_32.dll_send]
add rsp, 0x20
mov dword [rbp - 4], eax
cmp dword [rbp - 4], 0xffffffff
jne 0x531f89
call fcn.0042464b
mov dword [rbp - 4], eax
cmp dword [rbp - 4], 0xffffd8cd
je 0x531f46
cmp dword [rbp - 4], 0xfffffff4
jne 0x531f4c
xor eax, eax
leave
ret 0x20
cmp dword [rbp - 4], 0xffffd8bc
je 0x531f79
cmp dword [rbp - 4], 0xffffd8be
je 0x531f79
cmp dword [rbp - 4], 0xffffd8bd
je 0x531f79
cmp dword [rbp - 4], 0xffffd8bb
je 0x531f79
cmp dword [rbp - 4], 0xffffd8ba
jne 0x531f82
mov eax, 0xffffb1d3
leave
ret 0x20
mov eax, dword [rbp - 4]
leave
ret 0x20
mov rax, qword [rbp + 0x10]
mov ebx, dword [rbp - 4]
add dword [rax], ebx
mov rax, qword [rbp + 0x28]
mov ebx, dword [rbp - 4]
add dword [rax + 0x28], ebx
sub rsp, 0x18
mov rax, qword [rbp + 0x28]
push qword [rax + 8]
mov rcx, qword [rsp]
call qword [sym.imp.ws2_32.dll_WSASetEvent]
add rsp, 0x20
cmp eax, 0
jne 0x531fc3
call fcn.0042464b
leave
ret 0x20
xor eax, eax
leave
ret 0x20
int 5
int 5