joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002170
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
push r14
sub rsp, 0x50
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x80], rbx
movzx edi, r8b
mov r14, rdx
mov rsi, rcx
mov qword [rsp + 0x30], rcx
lea rax, vtable.ServerCoreImpl.0
mov qword [rcx], rax
mov qword [rcx + 8], 0
mov byte [rcx + 0x10], 0
lea rbx, [rcx + 0x18]
mov qword [rsp + 0x20], rbx
mov edx, 0x20
mov rcx, rbx
call qword [sym.imp.CONCRT140.dll_protected:_void___cdecl_Concurrency::details::_Concurrent_queue_base_v4::constructor_unsigned_long_long_unsigned___int64_____ptr64]
lea rax, vtable.Concurrency::concurrent_queue_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t____class_std::allocator_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t____.0
mov qword [rbx], rax
mov qword [rsi + 0x40], 0
mov dword [rsi + 0x48], 0
mov byte [rsi + 0x50], 0
mov byte [rsi + 0x10], dil
cmp qword [0x1400bde50], 0
jne 0x140002232
cmp qword [r14 + 0x18], 0x10
jb 0x1400021fb
mov r14, qword [r14]
mov r8d, 0x20
lea rdx, [0x14008ec7c]
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fsopen]
mov qword [0x1400bde50], rax
test rax, rax
jne 0x140002232
lea rcx, str.Couldnt_open_log_file_path
call fcn.140002e60
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov ecx, 8
call fcn.14003c848
test rax, rax
je 0x140002244
mov qword [rax], rsi
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x38]
call fcn.140001cf0
nop
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x14000226d
mov edx, 8
call fcn.14003c884
cmp dword [rsi + 0x48], 0
je 0x14000227a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
movups xmm0, xmmword [rsp + 0x38]
movups xmmword [rsi + 0x40], xmm0
mov rax, rsi
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
Function at 0x140015f30
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x1400bb1a8]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140015fdc
cmp byte [rcx + 0x71], 0
je 0x140015fdc
mov rax, qword [rcx]
mov edx, 0xffffffff
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x140015f9d
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140015fa1
sub eax, 1
je 0x140015fa5
sub eax, 2
je 0x140015fdc
xor al, al
jmp 0x140015fde
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140015fd3
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x140015f9d
cmp byte [rbx + 0x71], 0
sete al
jmp 0x140015fde
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14003ccc0
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
Function at 0x1400233f0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x1400bb1a8]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov esi, edx
mov rdi, rcx
cmp edx, 0xffffffff
jne 0x14002341d
xor eax, eax
jmp 0x140023581
mov qword [rsp + 0xa0], rbx
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
test rax, rax
je 0x14002345f
mov rdx, qword [rdi + 0x58]
mov rcx, rdi
movsxd rbx, dword [rdx]
mov rdx, qword [rdi + 0x40]
add rbx, qword [rdx]
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
cmp rax, rbx
jae 0x14002345f
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], sil
mov eax, esi
jmp 0x140023579
cmp qword [rdi + 0x80], 0
je 0x140023574
mov r8, qword [rdi + 0x18]
lea rax, [rdi + 0x70]
cmp qword [r8], rax
jne 0x14002349a
mov rcx, qword [rdi + 0x88]
mov rdx, qword [rdi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rdi + 0x38]
mov qword [rax], rcx
mov rax, qword [rdi + 0x50]
mov dword [rax], edx
mov rcx, qword [rdi + 0x68]
test rcx, rcx
jne 0x1400234c5
mov rdx, qword [rdi + 0x80]
movsx ecx, sil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, esi
mov eax, ecx
jmp 0x140023579
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], sil
mov qword [rsp + 0x38], rax
lea rdx, [rdi + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
js 0x140023574
cmp eax, 1
jle 0x140023534
cmp eax, 3
jne 0x140023574
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rdi + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, esi
mov eax, ecx
jmp 0x140023579
mov rbx, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rbx, rax
je 0x140023562
mov r9, qword [rdi + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rbx
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rbx, rax
jne 0x140023574
lea rax, [rsp + 0x50]
mov byte [rdi + 0x71], 1
cmp qword [rsp + 0x48], rax
mov eax, esi
jne 0x140023579
mov eax, 0xffffffff
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14003ccc0
mov rsi, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x140026440
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x120
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rax, qword [0x1400bb1a8]
xor rax, rsp
mov qword [rsp + 0x110], rax
mov rbx, rcx
mov dword [rsp + 0x88], edx
call fcn.14003be00
movsd qword [rsp + 0x98], xmm0
mov dword [rsp + 0x90], 0
xor edx, edx
lea r8d, [rdx + 0x68]
lea rcx, [rsp + 0xa0]
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x20], rbx
lea rax, [rsp + 0x98]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x88]
mov qword [rsp + 0x30], rax
lea rax, vtable.std::_Func_impl_no_alloc_class__lambda_9d465f33b9769b117b0811a9a254c61c___void___.0
mov qword [rsp + 0x48], rax
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rsp + 0x50], xmm0
movsd xmm1, qword [rsp + 0x30]
movsd qword [rsp + 0x60], xmm1
lea rax, [rsp + 0x48]
mov qword [rsp + 0x80], rax
lea r9, [rsp + 0x90]
lea r8, [rsp + 0x48]
mov edx, dword [rsp + 0x88]
lea rcx, [rsp + 0xa0]
call fcn.140086de0
nop
mov edx, dword [rsp + 0x90]
test edx, edx
je 0x140026530
lea rcx, str.TimerProcess_failed_with__d
call fcn.14003c660
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov ecx, 0xa
call sub.KERNEL32.dll_Sleep
jmp 0x140026530
Function at 0x14002d740
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je case.default.0x14002d770
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rsi
mov rsi, rbx
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Gnavail_void_const___ptr64]
mov rbp, rax
test rbx, rbx
jle 0x14002d7f8
test rax, rax
jle 0x14002d7c6
cmp rbx, rax
mov rcx, rdi
cmovl rbp, rbx
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gptr_void_const___ptr64]
mov r8, rbp
mov rcx, r14
mov rdx, rax
call sub.VCRUNTIME140.dll_memcpy
mov edx, ebp
mov rcx, rdi
add r14, rbp
sub rbx, rbp
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int____ptr64]
test rbx, rbx
jle 0x14002d7f8
cmp qword [rdi + 0x80], 0
je 0x14002d7f8
mov rcx, rdi
call fcn.140016580
mov r9, qword [rdi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
mov rbp, qword [rsp + 0x30]
sub rsi, rbx
mov rbx, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x14002d820
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je case.default.0x14002d850
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rsi
mov rsi, rbx
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov rbp, rax
test rbx, rbx
jle 0x14002d8cb
test rax, rax
jle 0x14002d8a6
cmp rbx, rax
mov rcx, rdi
cmovl rbp, rbx
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, rbp
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov edx, ebp
mov rcx, rdi
add r14, rbp
sub rbx, rbp
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
test rbx, rbx
jle 0x14002d8cb
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x14002d8cb
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov rbp, qword [rsp + 0x30]
sub rsi, rbx
mov rbx, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140036080
Capabilities:
Initialize winsock library

Disassembly:
sub rsp, 0x1c8
mov ecx, 0x202
lea rdx, [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x1400360a7
lea rcx, str.ERROR:_WSAStartup_failed_n
call fcn.140002e60
add rsp, 0x1c8
ret

Function at 0x1400360c0
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx]
lea r8, [rsp + 0x38]
movzx eax, dl
mov edx, 0x8004667e
mov dword [rsp + 0x38], eax
call qword [sym.imp.WS2_32.dll_ioctlsocket]
add rsp, 0x28
ret
xor dl, 1
jmp 0x1400360c0

Function at 0x1400360f0
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x38
mov rcx, qword [rcx]
lea r9, [rsp + 0x48]
add dl, 0x30
mov dword [rsp + 0x20], 1
mov byte [rsp + 0x48], dl
mov r8d, 0x20
mov edx, 0xffff
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
setns al
add rsp, 0x38
ret

Function at 0x140036130
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x38
mov rcx, qword [rcx]
lea r9, [rsp + 0x48]
add dl, 0x30
mov dword [rsp + 0x20], 1
mov byte [rsp + 0x48], dl
mov r8d, 4
mov edx, 0xffff
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
setns al
add rsp, 0x38
ret

Function at 0x1400388a0
Capabilities:
Create udp socket

Disassembly:
push rbx
sub rsp, 0x20
xor eax, eax
mov edx, 2
mov qword [rcx + 0x10], rax
mov rbx, rcx
mov qword [rcx + 0x18], rax
mov qword [rcx + 0x20], rax
mov word [rcx + 0x28], ax
lea r8d, [rax + 0x11]
mov qword [rcx + 0x30], rax
mov ecx, edx
call qword [sym.imp.WS2_32.dll_socket]
mov qword [rbx], rax
mov rax, rbx
mov byte [rbx + 8], 1
add rsp, 0x20
pop rbx
ret

Function at 0x140038dd0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x860
xor ebp, ebp
mov dword [rax + reloc.WS2_32.dll_recv], 0x10
mov r15d, edx
mov r14, rcx
lea edi, [rbp + 1]
test edx, edx
jle 0x140038eaf
test edi, edi
jle 0x140038eaf
mov rcx, qword [r14]
lea rax, [rsp + 0x888]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x60]
lea rax, [rsp + 0x50]
xor r9d, r9d
mov r8d, 0x800
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_recvfrom]
mov edi, eax
test eax, eax
jle 0x140038ea6
movups xmm0, xmmword [rsp + 0x50]
mov rbx, qword [r14 + 0x10]
lea rax, [rsp + 0x60]
mov rsi, qword [r14 + 0x18]
mov byte [rsp + 0x4c], 1
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x38], edi
movups xmmword [rsp + 0x3c], xmm0
cmp rbx, rsi
je 0x140038e8d
nop dword [rax + rax]
mov rcx, qword [rbx + 0x38]
test rcx, rcx
je 0x140038ece
mov rax, qword [rcx]
lea rdx, [rsp + 0x30]
call qword [rax + reloc.WS2_32.dll_recv]
add rbx, 0x40
cmp rbx, rsi
jne 0x140038e70
mov ecx, dword [0x1400bdec0]
inc ebp
add ecx, 0x1c
add ecx, edi
inc dword [0x1400bdec4]
mov dword [0x1400bdec0], ecx
cmp ebp, r15d
jl 0x140038e05
lea r11, [rsp + 0x860]
mov eax, ebp
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
call sub.MSVCP140.dll_void___cdecl_std::_Xbad_function_call_void_
int3
Function at 0x140038ee0
Capabilities:
Send data
Send data on socket

Disassembly:
sub rsp, 0x38
mov r10d, dword [0x1400bdebc]
inc dword [0x1400bdec8]
add r10d, 0x1c
add r10d, r8d
mov dword [rsp + 0x28], reloc.WS2_32.dll_recv
mov dword [0x1400bdebc], r10d
mov rcx, qword [rcx]
mov qword [rsp + 0x20], r9
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_sendto]
add rsp, 0x38
ret

Function at 0x140038f20
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx]
lea r8, [rsp + 0x38]
movzx eax, dl
mov edx, 0x8004667e
mov dword [rsp + 0x38], eax
call qword [sym.imp.WS2_32.dll_ioctlsocket]
add rsp, 0x28
ret
xor dl, 1
jmp 0x1400360c0

Function at 0x140038f30
Capabilities:
Set socket configuration

Disassembly:
mov dword [rsp + 0x10], edx
sub rsp, 0x38
mov rcx, qword [rcx]
lea r9, [rsp + 0x48]
mov edx, 0xffff
mov dword [rsp + 0x20], 4
mov r8d, 0x1002
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x140038f74
mov edx, dword [rsp + 0x48]
lea rcx, str.ERROR:_Setting_RECEIVE_buffer_on_UDP_socket_to__d_failed_n
call fcn.14003c660
xor al, al
add rsp, 0x38
ret
mov al, 1
add rsp, 0x38
ret

Function at 0x140038f80
Capabilities:
Set socket configuration

Disassembly:
mov dword [rsp + 0x10], edx
sub rsp, 0x38
mov rcx, qword [rcx]
lea r9, [rsp + 0x48]
mov edx, 0xffff
mov dword [rsp + 0x20], 4
mov r8d, 0x1001
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x140038fc4
mov edx, dword [rsp + 0x48]
lea rcx, str.ERROR:_Setting_SEND_buffer_on_UDP_socket_to__d_failed_n
call fcn.14003c660
xor al, al
add rsp, 0x38
ret
mov al, 1
add rsp, 0x38
ret

Function at 0x140039440
Capabilities:
Connect socket
Set socket configuration

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
xor r8d, r8d
mov rdi, rdx
mov rbx, rcx
lea edx, [r8 + 1]
lea ecx, [rdx + 1]
call qword [sym.imp.WS2_32.dll_socket]
lea r9, [rsp + 0x40]
mov dword [rsp + 0x40], 1
mov rcx, rax
mov qword [rbx + 0x60], rax
mov edx, 0xffff
mov dword [rsp + 0x20], 4
mov r8d, 1
call qword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x14003949e
lea rcx, str.ERROR:_Could_not_set_TCP_NODELAY_n
call fcn.140002e60
mov rcx, qword [rbx + 0x60]
mov r8d, reloc.WS2_32.dll_recv
mov rdx, rdi
call qword [sym.imp.WS2_32.dll_connect]
mov edx, eax
lea rcx, str.TCP_connect_returns:__d_n
mov ebx, eax
call fcn.140002e60
test ebx, ebx
mov rbx, qword [rsp + 0x48]
sete al
add rsp, 0x30
pop rdi
ret

Function at 0x1400394e0
Capabilities:
Send data
Send data on socket

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx + 0x60]
mov eax, 0x3531dec1
movzx r10d, dx
mul r10d
mov r8d, r10d
mov word [rsp + 0x38], r10w
shr edx, 4
mov r9d, r10d
imul eax, edx, 0x4d
sub r8d, eax
mov eax, 0x86186187
mul r10d
mov eax, r10d
mov byte [rsp + 0x3a], r8b
sub eax, edx
mov r8d, pe_nt_image_headers64
shr eax, 1
add eax, edx
lea rdx, [rsp + 0x38]
shr eax, 4
imul eax, eax, 0x15
sub r9d, eax
mov byte [rsp + 0x3b], r9b
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_send]
xor eax, eax
add rsp, 0x28
ret
Function at 0x140039b90
Capabilities:
Send data
Send data on socket

Disassembly:
inc dword [0x1400bded8]
xor r9d, r9d
add dword [0x1400bdecc], r8d
mov rcx, qword [rcx + 0x60]
jmp qword [sym.imp.WS2_32.dll_send]

Function at 0x140039bb0
Capabilities:
Set socket configuration

Disassembly:
xor dl, 1
add rcx, 0x60
jmp 0x1400360c0

Function at 0x140039bc0
Capabilities:
Set socket configuration

Disassembly:
mov dword [rsp + 0x10], edx
sub rsp, 0x38
mov rcx, qword [rcx + 0x60]
lea r9, [rsp + 0x48]
mov edx, 0xffff
mov dword [rsp + 0x20], 4
mov r8d, 0x1002
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x140039c08
mov edx, dword [rsp + 0x48]
lea rcx, str.ERROR:_Setting_RECEIVE_buffer_on_TCP_socket_to__d_failed:__d
mov r8d, eax
call fcn.14003c660
xor al, al
add rsp, 0x38
ret
mov al, 1
add rsp, 0x38
ret

Function at 0x140039c10
Capabilities:
Set socket configuration

Disassembly:
mov dword [rsp + 0x10], edx
sub rsp, 0x38
mov rcx, qword [rcx + 0x60]
lea r9, [rsp + 0x48]
mov edx, 0xffff
mov dword [rsp + 0x20], 4
mov r8d, 0x1001
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x140039c58
mov edx, dword [rsp + 0x48]
lea rcx, str.ERROR:_Setting_SEND_buffer_on_TCP_socket_to__d_failed:__d
mov r8d, eax
call fcn.14003c660
xor al, al
add rsp, 0x38
ret
mov al, 1
add rsp, 0x38
ret

Function at 0x14003a8e0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push rbx
sub rsp, 0x20
cmp qword [rcx + 0x18], 8
mov rbx, rcx
jb 0x14003a8f3
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14003a902
test al, 0x10
jne 0x14003a91d
cmp qword [rbx + 0x18], 8
jb case.default.0x14003a916
mov rbx, qword [rbx]
xor edx, edx
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
add rsp, 0x20
pop rbx
ret

Function at 0x14003af80
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x28
cmp qword [rcx + 0x18], 8
jb 0x14003af8e
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14003afa4
test al, 0x10
je 0x14003afa4
mov al, 1
add rsp, 0x28
ret
xor al, al
add rsp, 0x28
ret
Function at 0x140045600
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push rbx
sub rsp, 0x30
movaps xmmword [rsp + 0x20], xmm6
mov rbx, rcx
movss xmm6, dword [0x1400a1b30]
movaps xmm0, xmm6
call qword [sym.imp.api_ms_win_crt_math_l1_1_0.dll_log2f]
movss xmm1, dword [0x1400a1b14]
divss xmm1, xmm0
cvttss2si ecx, xmm1
cmp ecx, 0x80000000
je 0x140045658
movd xmm0, ecx
cvtdq2ps xmm0, xmm0
ucomiss xmm0, xmm1
je 0x140045658
unpcklps xmm1, xmm1
movmskps eax, xmm1
and eax, 1
xor eax, 1
add ecx, eax
movd xmm1, ecx
cvtdq2ps xmm1, xmm1
movss xmm2, dword [0x140098988]
mov ecx, 1
cvttss2si eax, xmm1
xorps xmm0, xmm0
cmp eax, ecx
cmovl eax, ecx
test eax, eax
jle 0x14004581e
mov edx, dword [rbx]
mov qword [rsp + 0x40], rsi
xor esi, esi
mov qword [rsp + 0x48], rdi
mov edi, eax
nop dword [rax]
cmp edx, 0x270
jne 0x1400456e0
lea r8, [rbx + 8]
mov r9d, edx
nop
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x1400456a0
mov edx, dword [rbx]
jmp 0x1400457c0
cmp edx, 0x4e0
jb 0x1400457c0
lea r10, [rbx + 0x9c4]
mov r11d, 0xe3
mov eax, dword [r10]
nop dword [rax]
mov edx, dword [r10 + 4]
lea r8, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 - 0x9c0], ecx
lea r10, [r8]
sub r11, 1
jne 0x140045700
lea r10, [rbx + 0xd50]
mov r11d, 0x18c
mov eax, dword [r10]
nop dword [rax]
mov edx, eax
lea r8, [r10 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 - 0xd4c]
xor ecx, edx
mov dword [r10 - 0x9c0], ecx
lea r10, [r8]
sub r11, 1
jne 0x140045750
mov edx, dword [rbx + 0x1380]
xor edx, dword [rbx + 4]
btr edx, 0x1f
xor edx, dword [rbx + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [rbx + 0x634]
xor ecx, edx
mov edx, esi
mov dword [rbx + 0x9c0], ecx
mov dword [rbx], esi
mov eax, edx
xorps xmm1, xmm1
inc edx
mov ecx, dword [rbx + rax*4 + 4]
mov eax, ecx
shr eax, 0xb
and eax, dword [rbx + 0x1384]
xor ecx, eax
mov dword [rbx], edx
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
cvtsi2ss xmm1, rax
mulss xmm1, xmm2
mulss xmm2, xmm6
addss xmm0, xmm1
sub rdi, 1
jne 0x140045690
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
movaps xmm6, xmmword [rsp + 0x20]
divss xmm0, xmm2
add rsp, 0x30
pop rbx
ret
Function at 0x1400602c0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, qword [rcx]
movzx edi, dx
mov r8, qword [rbx + 0x18]
mov rax, r8
cmp r8, qword [rbx + 0x10]
jb 0x1400602ff
mov rcx, qword [rbx + 8]
cmp r8, rcx
je 0x1400602ff
mov r9, qword [rbx]
sub r8, rcx
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rax, qword [rbx + 8]
mov qword [rbx + 0x18], rax
mov byte [rax], dil
mov r8, qword [rbx + 0x18]
inc r8
mov rax, r8
mov qword [rbx + 0x18], r8
cmp r8, qword [rbx + 0x10]
jb 0x140060338
mov rcx, qword [rbx + 8]
cmp r8, rcx
je 0x140060338
mov r9, qword [rbx]
sub r8, rcx
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rax, qword [rbx + 8]
mov qword [rbx + 0x18], rax
shr di, 8
mov byte [rax], dil
inc qword [rbx + 0x18]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400603a0
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx + 0x20]
mov rbx, rcx
cmp rax, qword [rcx + 0x18]
jae 0x1400603c0
inc rax
mov qword [rcx + 0x20], rax
add rsp, 0x20
pop rbx
ret
cmp byte [rcx + 0x38], 0
jne 0x14006040d
mov rax, qword [rcx + 0x28]
mov edx, 1
add qword [rcx + 0x30], rax
mov r9, qword [rcx]
mov r8, qword [rcx + 0x10]
mov rcx, qword [rcx + 8]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rdx, qword [rbx + 8]
mov qword [rbx + 0x28], rax
mov qword [rbx + 0x20], rdx
lea rcx, [rdx - 1]
add rcx, rax
mov qword [rbx + 0x18], rcx
cmp rax, qword [rbx + 0x10]
jae 0x14006040d
mov byte [rdx + rax], 0
inc qword [rbx + 0x18]
mov byte [rbx + 0x38], 1
add rsp, 0x20
pop rbx
ret