joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000ec3c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rax, qword [0x140336400]
lea r8, [rsp + 0x30]
mov dword [rsp + 0x30], ecx
mov r9d, 4
mov rdi, qword [rax + 0x1b90]
add rdi, 0x108
movsxd rdx, dword [rdi]
mov rax, qword [rdi + 8]
mov ebx, dword [rax + rdx*4 - 4]
not ebx
movzx eax, byte [r8]
inc r8
movzx ecx, bl
xor rcx, rax
shr ebx, 8
lea rax, [0x1401dfc50]
xor ebx, dword [rax + rcx*4]
sub r9, 1
jne 0x14000ec77
mov ecx, dword [rdi + 4]
not ebx
cmp edx, ecx
jne 0x14000eccc
lea r8d, [rdx + 1]
test ecx, ecx
je 0x14000ecb3
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x14000ecb8
mov eax, 8
cmp eax, r8d
mov rcx, rdi
cmovg r8d, eax
mov edx, r8d
call fcn.14001cfdc
mov edx, dword [rdi]
mov rax, qword [rdi + 8]
movsxd rcx, edx
mov dword [rax + rcx*4], ebx
inc dword [rdi]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140013c10
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], r8
mov qword [rax + 0x20], r9
push rbx
push rbp
push rdi
sub rsp, 0x20
mov rbx, qword [0x140336400]
cmp byte [rbx + 0x3000], 0
je 0x140013cd0
cmp qword [rbx + 0x3008], 0
lea rbp, [rax + 0x10]
lea rdi, [rbx + 0x3010]
je 0x140013cc2
mov r9d, dword [rdi + 4]
test r9d, r9d
jns 0x140013c7b
mov eax, r9d
mov rcx, rdi
cdq
sub eax, edx
xor edx, edx
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.14001ce2c
mov rcx, qword [rsp + 0x40]
and dword [rdi], 0
mov rdx, rcx
mov rcx, rdi
mov r8, rbp
call fcn.1400033d8
mov eax, dword [rdi]
mov r9, qword [rbx + 0x3008]
lea ecx, [rax - 1]
neg eax
mov rax, qword [rbx + 0x3018]
sbb edx, edx
and edx, ecx
lea rcx, [0x1403363f8]
test rax, rax
movsxd r8, edx
mov edx, 1
cmovne rcx, rax
call fcn.140138d30
jmp 0x140013cd0
mov rdx, rcx
mov r8, rbp
mov rcx, rdi
call fcn.1400033d8
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret

Function at 0x140014320
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rax, qword [0x140336400]
mov rbx, rcx
and dword [rax + 0x2fbc], 0
test rcx, rcx
je 0x140014387
and qword [rsp + 0x30], 0
lea rcx, [rsp + 0x30]
call fcn.140014394
lea rdx, [0x1401df6b0]
mov rcx, rbx
mov rdi, rax
call fcn.140002b80
mov rbx, rax
test rax, rax
je 0x140014387
mov r8, qword [rsp + 0x30]
mov r9, rax
mov edx, 1
mov rcx, rdi
call fcn.140138d30
mov rcx, rbx
call fcn.140137140
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14003a654
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xb0
movaps xmmword [rax - 0x18], xmm6
call fcn.140042eb4
mov rcx, qword [0x140336420]
call fcn.14000e878
mov rax, qword [0x140336400]
lea r9, [rbp - 0x29]
movups xmm0, xmmword [0x14030a428]
movups xmm1, xmmword [0x14030a438]
or dword [rax + 0x1c40], 2
mov dword [rax + 0x1c64], 0x43d90000
xor r8d, r8d
mov dword [rax + 0x1c68], 0x43330000
mov dword [rax + 0x1c48], 1
movzx eax, word [0x14030a460]
movups xmmword [rbp - 0x29], xmm0
mov word [rbp + 0xf], ax
movups xmm0, xmmword [0x14030a448]
mov al, byte [0x14030a462]
movups xmmword [rbp - 0x19], xmm1
mov byte [rbp + 0x11], al
movsd xmm1, qword [0x14030a458]
movups xmmword [rbp - 9], xmm0
movsd qword [rbp + 7], xmm1
mov eax, 0x24924925
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x38
mov al, r8b
inc r8d
sub al, cl
add al, 0x39
xor byte [r9], al
inc r9
cmp r8d, 0x3b
jl 0x14003a6f1
mov r8d, Ordinal_41
lea rdx, [0x1403363fa]
lea rcx, [rbp - 0x29]
call fcn.14000beac
movss xmm0, dword [0x14030cb90]
lea rcx, [rbp + 0x67]
movss xmm1, dword [0x14030cbc4]
movss dword [rbp + 0x67], xmm0
movss dword [rbp + 0x6b], xmm1
call fcn.14000f0d0
movss xmm3, dword [0x14030cc70]
lea r8, [rbp + 0x67]
movss xmm4, dword [0x14030cc08]
mov edx, 1
and dword [rsp + 0x20], 0
mov r9b, 1
xor ecx, ecx
movss dword [rbp + 0x67], xmm3
movss dword [rbp + 0x6b], xmm4
call fcn.140009268
movaps xmm0, xmmword [0x14030a700]
lea r9, [rbp - 0x29]
movaps xmm1, xmmword [0x14030a710]
xor r8d, r8d
movaps xmmword [rbp - 0x29], xmm0
movaps xmm0, xmmword [0x14030a720]
movaps xmmword [rbp - 9], xmm0
movaps xmm0, xmmword [0x14030a740]
movaps xmmword [rbp - 0x19], xmm1
movaps xmm1, xmmword [0x14030a730]
movaps xmmword [rbp + 0x17], xmm0
movsd xmm0, qword [0x14030a760]
movaps xmmword [rbp + 7], xmm1
movaps xmm1, xmmword [0x14030a750]
movsd qword [rbp + 0x37], xmm0
movaps xmmword [rbp + 0x27], xmm1
mov eax, 0x24924925
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x38
mov al, r8b
inc r8d
sub al, cl
add al, 0x39
xor byte [r9], al
inc r9
cmp r8d, 0x68
jl 0x14003a7e2
lea rcx, [rbp - 0x29]
call fcn.14002d6cc
call fcn.140009468
movss xmm1, dword [0x140339920]
movss xmm6, dword [0x14030cc04]
comiss xmm6, xmm1
jbe 0x14003a863
addss xmm1, dword [0x14030cb28]
comiss xmm1, xmm6
movss dword [0x140339920], xmm1
jb 0x14003a858
and dword [0x140339920], 0
mov byte [0x1403363fa], 0
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
movss xmm0, dword [0x14030cb9c]
lea rcx, [rbp + 0x67]
movss xmm1, dword [0x14030cc24]
movss dword [rbp + 0x67], xmm0
movss dword [rbp + 0x6b], xmm1
call fcn.14000f0d0
movss xmm0, dword [0x14030cc6c]
call fcn.14000f148
movss xmm0, dword [0x140339920]
lea rdx, [rbp + 0x67]
and dword [rbp + 0x67], 0
and dword [rbp + 0x6b], 0
divss xmm0, xmm6
call fcn.14002f138
call fcn.14000f1e8
call fcn.14000e3b8
movaps xmm6, xmmword [rsp + 0xa0]
add rsp, 0xb0
pop rbp
jmp fcn.14000e910
Function at 0x14003a8d0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x1320]
mov eax, 0x1420
call fcn.14019e730
sub rsp, rax
mov rax, qword [0x14031f010]
xor rax, rsp
mov qword [rbp + 0x1310], rax
mov edi, edx
mov rbx, rcx
mov qword [rsp + 0x30], rcx
and dword [rsp + 0x20], 0
movups xmm0, xmmword [str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789]
movups xmmword [rbp + 0x12d0], xmm0
movups xmm1, xmmword [0x14030b3d0]
movups xmmword [rbp + 0x12e0], xmm1
movups xmm0, xmmword [0x14030b3e0]
movups xmmword [rbp + 0x12f0], xmm0
movsd xmm1, qword [0x14030b3f0]
movsd qword [rbp + 0x1300], xmm1
mov eax, dword [0x14030b3f8]
mov dword [rbp + 0x1308], eax
movzx eax, word [0x14030b3fc]
mov word [rbp + 0x130c], ax
mov al, byte [0x14030b3fe]
mov byte [rbp + 0x130e], al
and qword [rcx], 0
and qword [rcx + 0x10], 0
mov qword [rcx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rcx], 0
mov dword [rsp + 0x20], 1
call fcn.140061fa8
mov edx, eax
or dword [rbp + 0x12c4], 0xffffffff
mov dword [rsp + 0x44], eax
mov ecx, 1
mov r8d, 0x270
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, ecx
mov dword [rsp + rcx*4 + 0x44], edx
inc rcx
cmp rcx, r8
jb 0x14003a9a9
mov dword [rsp + 0x40], r8d
and dword [rsp + 0x28], 0
mov dword [rsp + 0x2c], 0x3d
test edi, edi
jle 0x14003aa2c
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x28]
call fcn.14004bbbc
movsxd rcx, eax
mov r9b, byte [rbp + rcx + 0x12d0]
mov rcx, qword [rbx + 0x10]
cmp rcx, qword [rbx + 0x18]
jae 0x14003aa1e
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x14003aa13
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x14003aa26
mov rcx, rbx
call fcn.14004cb24
sub rdi, 1
jne 0x14003a9da
mov rax, rbx
mov rcx, qword [rbp + 0x1310]
xor rcx, rsp
call fcn.14005e190
lea r11, [rsp + 0x1420]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x14003ad14
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push rbx
mov eax, 0x13d0
call fcn.14019e730
sub rsp, rax
mov rax, qword [0x14031f010]
xor rax, rsp
mov qword [rsp + 0x13c0], rax
mov ebx, edx
call fcn.140061fa8
or dword [rsp + 0x13b4], 0xffffffff
mov edx, 0x270
mov dword [rsp + 0x34], eax
mov r8d, 1
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, r8d
mov dword [rsp + r8*4 + 0x34], eax
inc r8
cmp r8, rdx
jb 0x14003ad53
mov dword [rsp + 0x30], edx
lea rcx, [rsp + 0x20]
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x20], 5
mov dword [rsp + 0x24], ebx
call fcn.14004bbbc
mov rcx, qword [rsp + 0x13c0]
xor rcx, rsp
call fcn.14005e190
add rsp, 0x13d0
pop rbx
ret
Function at 0x14004732c
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rdi, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140047351
xor eax, eax
jmp 0x14004744e
cmp qword [rcx + 0x68], 0
je 0x140047362
call fcn.140048048
jmp 0x14004744e
mov rax, qword [rcx + 0x38]
mov rbp, rdi
mov rdx, qword [rax]
test rdx, rdx
je 0x140047379
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14004737b
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x1400473b0
cmp rax, rdi
mov rbx, rdi
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call fcn.14012dc80
mov rax, qword [rsi + 0x50]
sub rbp, rbx
add r14, rbx
mov r8, rbp
sub dword [rax], ebx
mov rcx, qword [rsi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x140047448
mov r9, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r9], rax
jne 0x1400473eb
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r9], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
mov r15d, 0xfff
mov rbx, r8
cmp r8, r15
jbe 0x140047423
mov r9, qword [rsi + 0x80]
mov r8, r15
mov edx, 1
mov rcx, r14
call fcn.140146250
sub rbp, rax
add r14, rax
mov rbx, rbp
cmp rax, r15
jne 0x14004745f
cmp rbp, r15
ja 0x1400473f9
mov r8, rbx
test rbx, rbx
je 0x140047448
mov r9, qword [rsi + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, r14
call fcn.140146250
mov r8, rbx
sub r8, rax
sub rdi, r8
mov rax, rdi
mov rbx, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
sub rdi, rbp
jmp 0x14004744b
Function at 0x140047824
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x14031f010]
xor rax, rsp
mov qword [rbp - 8], rax
or edi, 0xffffffff
mov esi, edx
mov rbx, rcx
cmp edx, edi
jne 0x14004785d
xor eax, eax
jmp 0x14004797f
mov rax, qword [rcx + 0x40]
cmp qword [rax], 0
je 0x140047897
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
mov rcx, r8
add rcx, qword [rax]
cmp qword [rax], rcx
jae 0x140047897
lea ecx, [r8 - 1]
mov eax, esi
mov dword [rdx], ecx
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], sil
jmp 0x14004797f
cmp qword [rbx + 0x80], 0
je 0x14004797d
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x1400478d2
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x1400478f5
movsx ecx, sil
mov rdx, qword [rbx + 0x80]
call fcn.140151720
cmp eax, edi
cmovne edi, esi
jmp 0x14004797d
lea r8, [rbp - 0x40]
mov byte [rbp - 0x30], sil
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rbp - 0x2f]
lea r8, [rbp - 8]
mov qword [rsp + 0x30], r8
lea r8, [rbp - 0x28]
mov qword [rsp + 0x28], r8
lea r8, [rbp - 0x38]
mov qword [rsp + 0x20], r8
lea r8, [rbp - 0x30]
call qword [rax + gethostname]
test eax, eax
je 0x140047943
sub eax, 1
je 0x140047943
cmp eax, 2
jne 0x14004797d
movsx ecx, byte [rbp - 0x30]
jmp 0x1400478df
mov r14, qword [rbp - 0x40]
lea rax, [rbp - 0x28]
sub r14, rax
je 0x14004796d
mov r9, qword [rbx + 0x80]
lea rcx, [rbp - 0x28]
mov r8, r14
mov edx, 1
call fcn.140138d30
cmp r14, rax
jne 0x14004797d
lea rax, [rbp - 0x30]
mov byte [rbx + 0x71], 1
cmp qword [rbp - 0x38], rax
mov eax, esi
jne 0x14004797f
mov eax, edi
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14005e190
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x140049618
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x14031f010]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140049687
cmp byte [rcx + 0x71], 0
je 0x140049687
mov rax, qword [rcx]
or edx, 0xffffffff
call qword [rax + Ordinal_26]
cmp eax, 0xffffffff
je 0x1400496db
mov rcx, qword [rbx + 0x68]
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], r8
lea rdx, [rbx + 0x74]
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
mov rax, qword [rcx]
call qword [rax + 0x40]
test eax, eax
je 0x1400496a1
sub eax, 1
je 0x1400496a5
cmp eax, 2
jne 0x1400496db
mov byte [rbx + 0x71], 0
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14005e190
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x1400496d2
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call fcn.140138d30
cmp rdi, rax
jne 0x1400496db
cmp byte [rbx + 0x71], 0
sete al
jmp 0x140049689
xor al, al
jmp 0x140049689

Function at 0x14005a1f4
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov rbx, rcx
mov esi, 0x7fffffff
mov ebp, 0x9908b0df
mov r9, qword [rbx]
mov r8d, dword [r9]
cmp r8d, 0x270
jne 0x14005a264
lea r8, [r9 + 8]
mov r10d, 0x270
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
and edx, esi
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, ebp
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x14005a229
mov r8d, dword [r9]
jmp 0x14005a332
cmp r8d, 0x4e0
jb 0x14005a332
lea r10, [r9 + 0x9c4]
mov r11d, 0xe3
mov eax, dword [r10]
lea r8, [r10 + 4]
mov edx, dword [r8]
xor edx, eax
and edx, esi
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, ebp
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 - 0x9c0], ecx
lea r10, [r8]
sub r11, 1
jne 0x14005a281
lea r10, [r9 + 0xd50]
mov r11d, 0x18c
mov eax, dword [r10]
mov edx, eax
lea r8, [r10 + 4]
xor edx, dword [r8]
and edx, esi
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, ebp
xor ecx, dword [r10 - 0xd4c]
xor ecx, edx
mov dword [r10 - 0x9c0], ecx
lea r10, [r8]
sub r11, 1
jne 0x14005a2c6
mov edx, dword [r9 + 0x1380]
xor edx, dword [r9 + 4]
and edx, esi
xor edx, dword [r9 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, ebp
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
and dword [r9], 0
xor r8d, r8d
mov eax, r8d
mov edx, dword [r9 + rax*4 + 4]
mov ecx, edx
lea eax, [r8 + 1]
shr ecx, 0xb
mov dword [r9], eax
mov eax, dword [r9 + 0x1384]
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
cmp eax, dword [rbx + 0x10]
ja 0x14005a210
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
ret
Function at 0x1400795f0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
lea r9, [rdx + rdx]
movabs r8, 0xcbf29ce484222325
xor edx, edx
test r9, r9
je 0x140063622
movzx eax, byte [rdx + rcx]
movabs r10, 0x100000001b3
xor r8, rax
inc rdx
imul r8, r10
cmp rdx, r9
jb 0x140063605
mov rax, r8
ret
sub r8, rdx
mov rcx, rdx
sar r8, 1
mov rdx, r8
jmp 0x1400635f0
Function at 0x140091230
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x70
lea rdi, [rsp + 0x30]
mov ecx, reloc.WS2_32.dll_recv
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x80]
mov dword [rsp + 0x54], 4
lea rax, [rsp + 0x54]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
mov r8d, 0x1008
mov edx, 0xffff
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x1400912a4
cmp dword [rsp + 0x34], 1
jne 0x1400912a4
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.WS2_32.dll_send]
mov rcx, rsp
lea rdx, reloc.XINPUT1_3.dll_Ordinal_2
call fcn.14019e780
add rsp, 0x70
pop rdi
ret

Function at 0x140097480
Capabilities:
Hash data using djb2

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0x1505
mov rax, qword [rsp + 0x20]
cmp qword [rsp + 0x50], rax
jae 0x14009750b
mov rax, qword [rsp + 0x28]
shl rax, 5
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x50]
movzx eax, byte [rax]
mov byte [rsp + 0x30], al
mov rax, qword [rsp + 0x50]
inc rax
mov qword [rsp + 0x50], rax
movzx ecx, byte [rsp + 0x30]
call fcn.1400b9af0
movsx rax, al
mov rcx, qword [rsp + 0x28]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
jmp 0x1400974ad
xor edx, edx
mov rax, qword [rsp + 0x28]
mov ecx, 0x100
div rcx
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x1400af540
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov rax, qword [rsp + 0x50]
movzx eax, byte [rax + 0xaa8]
test eax, eax
je 0x1400af64a
mov rax, qword [rsp + 0x50]
cmp qword [rax + 0x260], 0
je 0x1400af5d5
mov rcx, qword [rsp + 0x50]
call fcn.14008f1f0
mov byte [rsp + 0x30], al
mov dl, 1
mov rcx, qword [rsp + 0x50]
call fcn.14008f180
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 0x1d8]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x68]
mov r8, qword [rsp + 0x60]
mov edx, dword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x50]
call qword [rax + 0x260]
movzx edx, byte [rsp + 0x30]
mov rcx, qword [rsp + 0x50]
call fcn.14008f180
jmp 0x1400af64a
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
je 0x1400af5f4
cmp dword [rsp + 0x34], 1
je 0x1400af5f4
cmp dword [rsp + 0x34], 2
je 0x1400af5f4
jmp 0x1400af64a
movsxd rax, dword [rsp + 0x58]
imul rax, rax, 3
lea rcx, [0x1401ad8b0]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x50]
mov r9, qword [rcx + 0x1d0]
mov r8d, 1
mov edx, 2
mov rcx, rax
call fcn.140138d30
mov rax, qword [rsp + 0x50]
mov r9, qword [rax + 0x1d0]
mov r8d, 1
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
call fcn.140138d30
add rsp, 0x40
pop rdi
ret

Function at 0x1400b30a0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x20
mov rcx, qword [rsp + 0x40]
call fcn.1400b2f00
mov r8d, eax
mov rdx, qword [rsp + 0x38]
mov ecx, dword [rsp + 0x30]
call fcn.140174fb0
cdqe
add rsp, 0x20
pop rdi
ret
Function at 0x1400b3610
Capabilities:
Initialize winsock library

Disassembly:
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x220
lea rdi, [rsp + 0x30]
mov ecx, 0x7c
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x230]
mov rax, qword [0x14031f010]
xor rax, rsp
mov qword [rsp + 0x210], rax
mov eax, dword [rsp + 0x230]
and eax, 2
test eax, eax
je 0x1400b36e7
mov eax, 0x202
mov word [rsp + 0x30], ax
lea rdx, [rsp + 0x50]
movzx ecx, word [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [rsp + 0x1f4], eax
cmp dword [rsp + 0x1f4], 0
je 0x1400b368d
mov eax, 2
jmp 0x1400b379f
movzx eax, word [rsp + 0x50]
and rax, 0xff
movzx eax, al
movzx ecx, word [rsp + 0x30]
and rcx, 0xff
movzx ecx, cl
cmp eax, ecx
jne 0x1400b36d7
movzx eax, word [rsp + 0x50]
shr rax, 8
and rax, 0xff
movzx eax, al
movzx ecx, word [rsp + 0x30]
shr rcx, 8
and rcx, 0xff
movzx ecx, cl
cmp eax, ecx
je 0x1400b36e7
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 2
jmp 0x1400b379f
call fcn.140114160
mov dword [rsp + 0x1f8], eax
cmp dword [rsp + 0x1f8], 0
je 0x1400b3709
mov eax, dword [rsp + 0x1f8]
jmp 0x1400b379f
lea rcx, str.iphlpapi.dll
call fcn.1400b3840
mov qword [0x140334fb8], rax
cmp qword [0x140334fb8], 0
je 0x1400b375c
lea rdx, str.if_nametoindex
mov rcx, qword [0x140334fb8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x200], rax
cmp qword [rsp + 0x200], 0
je 0x1400b375c
mov rax, qword [rsp + 0x200]
mov qword [0x140334fb0], rax
mov dword [rsp + 0x20], 3
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov ecx, 6
call fcn.140113cb0
movzx eax, al
test eax, eax
je 0x1400b3789
mov byte [0x140339d7c], 1
jmp 0x1400b3790
mov byte [0x140339d7c], 0
lea rcx, [0x140339d80]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xor eax, eax
mov rdi, rax
mov rcx, rsp
lea rdx, reloc.WS2_32.dll_accept
call fcn.14019e780
mov rax, rdi
mov rcx, qword [rsp + 0x210]
xor rcx, rsp
call fcn.14005e190
add rsp, 0x220
pop rdi
ret
Function at 0x1400b3840
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x60
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x1400b387d
xor eax, eax
jmp 0x1400b3a19
lea rdx, str.LoadLibraryExA
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x28], rax
lea rdx, [0x140322c34]
mov rcx, qword [rsp + 0x70]
call fcn.14016e190
test rax, rax
je 0x1400b38e9
cmp qword [rsp + 0x28], 0
je 0x1400b38ca
mov r8d, 8
xor edx, edx
mov rcx, qword [rsp + 0x70]
call qword [rsp + Ordinal_41]
mov qword [rsp + 0x50], rax
jmp 0x1400b38da
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
jmp 0x1400b3a14
cmp qword [rsp + 0x28], 0
je 0x1400b3923
lea rdx, str.AddDllDirectory
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400b3923
mov r8d, 0x800
xor edx, edx
mov rcx, qword [rsp + 0x70]
call qword [rsp + Ordinal_41]
mov qword [rsp + 0x20], rax
jmp 0x1400b3a14
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 0
je 0x1400b3a14
mov rcx, qword [rsp + 0x70]
call fcn.14016dac0
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0x38]
inc eax
mov eax, eax
add rax, qword [rsp + 0x40]
mov rcx, rax
call qword [fcn.14014f710]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x1400b3a09
mov edx, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x1400b3a09
mov rcx, qword [rsp + 0x48]
call fcn.14016dac0
mov rcx, qword [rsp + 0x48]
add rcx, rax
mov rax, rcx
lea rdx, [0x140322c58]
mov rcx, rax
call fcn.14016deb0
mov rcx, qword [rsp + 0x48]
call fcn.14016dac0
mov rcx, qword [rsp + 0x48]
add rcx, rax
mov rax, rcx
mov rdx, qword [rsp + 0x70]
mov rcx, rax
call fcn.14016deb0
cmp qword [rsp + 0x28], 0
je 0x1400b39ef
mov r8d, 8
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [rsp + Ordinal_41]
mov qword [rsp + 0x58], rax
jmp 0x1400b39ff
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x48]
call qword [fcn.140145870]
mov rax, qword [rsp + 0x20]
add rsp, 0x60
pop rdi
ret
Function at 0x1400be770
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xa0
lea rdi, [rsp + 0x50]
mov ecx, reloc.WS2_32.dll_sendto
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0xb0]
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x84]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x64]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x4004747b
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.WS2_32.dll_WSAIoctl]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jne 0x1400be811
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x64]
mov r8d, 0x1001
mov edx, 0xffff
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rcx, rsp
lea rdx, reloc.XINPUT1_3.dll_Ordinal_2
call fcn.14019e780
add rsp, 0xa0
pop rdi
ret