joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400cb870
Capabilities:
Set socket configuration

Disassembly:
push rsi
sub rsp, 0x40
mov rax, qword [0x1402db040]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x34], 0x4020
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x2c], 4
mov eax, dword [0x140331510]
cmp eax, 2
je 0x1400cb936
mov rsi, rcx
test eax, eax
jne 0x1400cb8e4
mov ecx, 6
xor edx, edx
mov r8d, 2
mov r9d, 3
call fcn.1400c5090
test al, al
je 0x1400cb8da
mov dword [0x140331510], 2
jmp 0x1400cb936
mov dword [0x140331510], 1
lea rax, [rsp + 0x2c]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
mov rcx, rsi
mov edx, 0xffff
mov r8d, 0x1001
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x1400cb915
cmp dword [rsp + 0x30], 0x4020
jg 0x1400cb936
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x34]
mov rcx, rsi
mov edx, 0xffff
mov r8d, 0x1001
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
cmp rcx, qword [0x1402db040]
je 0x1400cb94d
call fcn.1401ac870
int3
add rsp, 0x40
pop rsi
ret
Function at 0x1400cc720
Capabilities:
Set socket configuration

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xc8
mov qword [rsp + 0x20], r9
mov rsi, r8
mov r12, rdx
mov rbx, rcx
mov rax, qword [0x1402db040]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rdi, qword [rcx]
lea r15, [rsp + 0x30]
mov r8d, Ordinal_145
mov rcx, r15
mov dl, 0xaa
call fcn.1401e5d50
test rsi, rsi
mov r14, rsi
cmove r14, r15
mov ebp, dword [r12 + 4]
mov dword [r14], ebp
xor r13d, r13d
cmp dword [rbx + 0x32c], 3
setne r13b
inc r13d
mov dword [r14 + 4], r13d
mov r15d, 0x11
cmp dword [rbx + 0x32c], 3
jne 0x1400cc7a6
mov r15d, dword [r12 + 0xc]
test rsi, rsi
mov rcx, rsi
lea rax, [rsp + 0x30]
cmove rcx, rax
mov dword [rcx + 8], r15d
mov eax, dword [r12 + 0x10]
mov r8d, Ordinal_133
cmp eax, 0x80
cmovb r8d, eax
mov dword [rcx + 0xc], r8d
add rcx, 0x10
mov rdx, qword [r12 + 0x20]
call fcn.1401e56b0
mov rax, qword [rdi + 0x738]
test rax, rax
je 0x1400cc871
test rdi, rdi
je 0x1400cc85c
mov rcx, qword [rdi + 0xd8]
test rcx, rcx
je 0x1400cc840
mov byte [rcx + 0x18a], 1
mov rax, qword [rdi + 0x738]
mov rcx, qword [rdi + 0x740]
xor edx, edx
mov r8, r14
call qword [0x1402cbd20]
mov rdx, qword [rsp + 0x20]
mov qword [rdx], rax
mov rcx, qword [rdi + 0xd8]
test rcx, rcx
je 0x1400cc84e
mov byte [rcx + 0x18a], 0
mov rax, qword [rdx]
jmp 0x1400cc887
mov rcx, qword [rdi + 0xd0]
test rcx, rcx
jne 0x1400cc800
jmp 0x1400cc80e
mov rcx, qword [rdi + 0xd0]
test rcx, rcx
jne 0x1400cc834
jmp 0x1400cc887
mov rcx, qword [0x740]
xor edx, edx
mov r8, r14
call qword [0x1402cbd20]
jmp 0x1400cc87f
mov ecx, ebp
mov edx, r13d
mov r8d, r15d
call qword [sym.imp.WS2_32.dll_socket]
mov rcx, qword [rsp + 0x20]
mov qword [rcx], rax
cmp rax, 0xffffffffffffffff
je 0x1400cc8d3
cmp dword [rbx + 0x32c], 5
jne 0x1400cc8b0
lea r8, [rsp + 0x2c]
mov dword [r8], 1
mov rcx, rax
mov edx, 0x8004667e
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov ecx, dword [rbx + 0x328]
xor eax, eax
test ecx, ecx
je 0x1400cc8d8
cmp dword [r14], 0x17
jne 0x1400cc8d8
test rsi, rsi
lea rdx, [rsp + 0x30]
cmovne rdx, rsi
mov dword [rdx + 0x28], ecx
jmp 0x1400cc8d8
mov eax, 7
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
cmp rcx, qword [0x1402db040]
je 0x1400cc8f2
call fcn.1401ac870
int3
add rsp, 0xc8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400d75c0
Capabilities:
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push rsi
sub rsp, 0x30
mov rsi, rcx
mov dword [rsp + 0x20], 0xf0000040
xor edx, edx
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x1400d7602
mov rcx, qword [rsi]
add rsi, 8
mov qword [rsp + 0x20], rsi
mov edx, 0x8003
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
nop
add rsp, 0x30
pop rsi
ret
Function at 0x1400db820
Capabilities:
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov rdi, r9
mov rsi, r8
mov rbx, rdx
mov r14, rcx
mov ebp, dword [rsp + 0xb0]
mov rax, qword [0x1402db040]
xor rax, rsp
mov qword [rsp + 0x50], rax
xor eax, eax
lea r15, [rsp + 0x48]
mov qword [r15], rax
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x3c], 0
mov dword [rsp + 0x38], 4
mov dword [rsp + 0x34], edi
mov rcx, r8
xor edx, edx
mov r8, r9
call fcn.1401e5d50
mov dword [rsp + 0x20], 0xf0000040
mov rcx, r15
xor edx, edx
xor r8d, r8d
mov r9d, ebp
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x1400db94e
mov edx, dword [rsp + 0xb8]
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x1400db92c
mov rcx, qword [rsp + 0x40]
mov rdx, r14
mov r8d, ebx
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x1400db92c
mov rcx, qword [rsp + 0x40]
mov dword [rsp + 0x20], 0
lea r8, [rsp + 0x3c]
lea r9, [rsp + 0x38]
mov edx, 4
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x1400db92c
mov eax, dword [rsp + 0x3c]
cmp rdi, rax
jb 0x1400db92c
mov rcx, qword [rsp + 0x40]
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x34]
mov edx, 2
mov r8, rsi
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1400db93c
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1400db94e
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
cmp rcx, qword [0x1402db040]
je 0x1400db965
call fcn.1401ac870
int3
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1400dce70
Capabilities:
Check for time delay via gettickcount
Check for time delay via queryperformancecounter
Move file

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x1402db040]
xor rax, rsp
mov qword [rsp + 0x30], rax
cmp byte [0x140331500], 1
je 0x1400dcec2
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
imul rbx, rcx, 0x10624dd3
shr rbx, 0x26
imul ecx, ebx, 0x3e8
sub eax, ecx
imul r14d, eax, 0x3e8
jmp 0x1400dcefe
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rbx, [rsp + 0x28]
mov qword [rbx], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rbx]
mov rcx, qword [0x140331508]
cqo
idiv rcx
mov rbx, rax
imul rax, rdx, 0xf4240
cqo
idiv rcx
mov r14, rax
mov rcx, rdi
mov rdx, rsi
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
je 0x1400dcf2d
xor eax, eax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
cmp rcx, qword [0x1402db040]
je 0x1400dcf53
call fcn.1401ac870
int3
movabs rbp, 0xffdf3b645a1cac09
movabs r12, 0xffbe76c8b4395813
mov r13d, 0x3e8
mov r15, qword [sym.imp.KERNEL32.dll_MoveFileExA]
jmp 0x1400dcfe9
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
imul rcx, rcx, 0x10624dd3
shr rcx, 0x26
imul edx, ecx, 0x3e8
sub eax, edx
imul edx, eax, 0x3e8
sub rcx, rbx
lea r8, [rcx + rbp]
mov eax, 1
cmp r8, r12
jb 0x1400dcf16
imul rcx, rcx, 0x3e8
sub edx, r14d
movsxd rdx, edx
imul rdx, rdx, 0x10624dd3
mov r8, rdx
shr r8, 0x3f
sar rdx, 0x26
add edx, r8d
movsxd rdx, edx
add rdx, rcx
cmp rdx, r13
ja 0x1400dcf16
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, rdi
mov rdx, rsi
mov r8d, 1
call r15
test eax, eax
jne 0x1400dcf14
cmp byte [0x140331500], 1
jne 0x1400dcf64
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x28]
mov r8, qword [0x140331508]
cqo
idiv r8
mov rcx, rax
imul rax, rdx, 0xf4240
cqo
idiv r8
mov rdx, rax
jmp 0x1400dcf85
Function at 0x1400e53f0
Capabilities:
Get socket status

Disassembly:
push rsi
sub rsp, 0x40
mov r10, qword [rsp + 0x70]
mov rax, qword [0x1402db040]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov eax, 0x7fffffff
cmp r10, 0x7fffffff
cmovl rax, r10
test rdx, rdx
je 0x1400e54e1
cmp dword [rdx], 0
je 0x1400e54e1
movabs r11, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x30], r11
xor r11d, r11d
test r10, r10
js 0x1400e54d4
mov esi, 0
je 0x1400e546b
mov r10d, eax
imul r11, r10, 0x10624dd3
shr r11, 0x26
imul r10d, r11d, 0x3e8
sub eax, r10d
imul esi, eax, 0x3e8
lea r10, [rsp + 0x30]
mov dword [r10], r11d
mov dword [r10 + 4], esi
xor eax, eax
test r9, r9
je 0x1400e5486
cmp dword [r9], 0
cmovne rax, r9
xor r9d, r9d
test r8, r8
je 0x1400e5496
cmp dword [r8], 0
cmovne r9, r8
xor r8d, r8d
test rdx, rdx
je 0x1400e54a5
cmp dword [rdx], 0
cmovne r8, rdx
inc ecx
mov qword [rsp + 0x20], r10
mov rdx, r8
mov r8, r9
mov r9, rax
call qword [sym.imp.WS2_32.dll_select]
mov esi, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
cmp rcx, qword [0x1402db040]
je 0x1400e54d9
call fcn.1401ac870
int3
xor r10d, r10d
jmp 0x1400e5477
mov eax, esi
add rsp, 0x40
pop rsi
ret
test r8, r8
je 0x1400e54f0
cmp dword [r8], 0
jne 0x1400e542b
test r9, r9
je 0x1400e54ff
cmp dword [r9], 0
jne 0x1400e542b
xor esi, esi
test eax, eax
je 0x1400e54bd
js 0x1400e5511
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400e54bd
mov ecx, 0x2726
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov esi, 0xffffffff
jmp 0x1400e54bd
Function at 0x1400e5b60
Capabilities:
Resolve dns

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x48
movaps xmmword [rsp + 0x30], xmm6
mov rsi, r9
mov rax, qword [0x1402db040]
xor rax, rsp
mov qword [rsp + 0x28], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r9, [rsp + 0x20]
mov qword [r9], rax
mov qword [rsi], 0
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov ebx, eax
test eax, eax
je 0x1400e5bc0
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
cmp rcx, qword [0x1402db040]
je 0x1400e5c02
call fcn.1401ac870
int3
mov r15, qword [rsp + 0x20]
test r15, r15
je 0x1400e5beb
xor r12d, r12d
xorps xmm6, xmm6
xor edi, edi
jmp 0x1400e5c26
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x1400e5be4
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
xor ebx, ebx
test rdi, rdi
jne 0x1400e5bfd
mov ebx, 0x2af9
mov ecx, 0x2af9
call qword [sym.imp.WS2_32.dll_WSASetLastError]
xor edi, edi
mov qword [rsi], rdi
jmp 0x1400e5ba9
mov eax, ebx
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov rbx, r12
mov r15, qword [r15 + 0x28]
mov r12, rbx
test r15, r15
je 0x1400e5bd4
mov eax, dword [r15 + 4]
cmp eax, 2
je 0x1400e5c3c
cmp eax, 0x17
jne 0x1400e5c17
mov r14d, 0x1c
jmp 0x1400e5c42
mov r14d, 0x10
cmp qword [r15 + 0x20], 0
je 0x1400e5c17
cmp qword [r15 + 0x10], r14
jb 0x1400e5c17
mov rax, qword [fcn.1400ab570]
mov ecx, 0x30
call qword [0x1402cbd20]
test rax, rax
je 0x1400e5d1c
mov rbx, rax
mov eax, dword [r15]
mov dword [rbx], eax
mov eax, dword [r15 + 4]
mov dword [rbx + 4], eax
mov eax, dword [r15 + 8]
mov dword [rbx + 8], eax
mov eax, dword [r15 + 0xc]
mov dword [rbx + 0xc], eax
mov dword [rbx + 0x10], r14d
movups xmmword [rbx + 0x18], xmm6
mov qword [rbx + 0x28], 0
mov rax, qword [fcn.1400ab570]
mov rcx, r14
call qword [0x1402cbd20]
mov qword [rbx + 0x20], rax
test rax, rax
je 0x1400e5d0c
mov rdx, qword [r15 + 0x20]
mov rcx, rax
mov r8, r14
call fcn.1401e56b0
mov rcx, qword [r15 + 0x18]
test rcx, rcx
je 0x1400e5ce1
lea r14, [rbx + 0x18]
mov rax, qword [fcn.1401c5220]
call qword [0x1402cbd20]
mov qword [r14], rax
test rax, rax
je 0x1400e5cfb
test rdi, rdi
cmove rdi, rbx
test r12, r12
je 0x1400e5c1a
mov qword [r12 + 0x28], rbx
jmp 0x1400e5c1a
mov rax, qword [fcn.140058110]
mov rcx, qword [rbx + 0x20]
call qword [0x1402cbd20]
mov rax, qword [fcn.140058110]
mov rcx, rbx
call qword [0x1402cbd20]
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x1400e5d2c
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
mov ebx, 8
test rdi, rdi
je 0x1400e5bfb
mov rax, qword [fcn.140058110]
mov rcx, qword [rdi + 0x20]
call qword [0x1402cbd20]
mov rax, qword [fcn.140058110]
mov rcx, qword [rdi + 0x18]
call qword [0x1402cbd20]
mov r14, qword [rdi + 0x28]
mov rax, qword [fcn.140058110]
mov rcx, rdi
call qword [0x1402cbd20]
mov rdi, r14
test r14, r14
jne 0x1400e5d3a
jmp 0x1400e5bfb
Function at 0x1400f0140
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov ebx, r8d
mov rsi, rcx
mov rax, qword [rcx]
lea ecx, [rbx - 0xd]
mov r9d, 0x9b0
cmp ecx, 2
ja 0x1400f016b
mov ecx, ecx
lea r8, [0x1402bf938]
mov r9, qword [r8 + rcx*8]
mov r8, qword [rax + 0x1e0]
lea rcx, [rsi + 0xa00]
mov r9, qword [rax + r9]
test dl, dl
jne 0x1400f01b1
mov edx, dword [rsi + 0xaac]
lea r10d, [rdx + 1]
mov dword [rsi + 0xaac], r10d
test r9, r9
je 0x1400f0212
test edx, edx
js 0x1400f01c0
xor r10d, r10d
mov r9, qword [r9 + 8]
cmp r10d, edx
jge 0x1400f01bb
inc r10d
test r9, r9
jne 0x1400f019e
jmp 0x1400f01bb
mov dword [rsi + 0xaac], 0
test r9, r9
je 0x1400f0212
mov rax, qword [r9]
xor edx, edx
cmp byte [rax], 0x2a
sete dl
lea r8, [rdx + rax]
mov dword [rsi + 0xab0], edx
lea rdx, [0x14029ecda]
call fcn.14010d4b0
test eax, eax
je 0x1400f01f1
mov edi, eax
mov eax, edi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
mov dword [rsi + 0xab8], ebx
xor edi, edi
jmp 0x1400f01e7
cmp dword [r8 + 0x10], 0
je 0x1400f0332
mov dword [rsi + 0xab8], 0
jmp 0x1400f01e7
xor edi, edi
cmp ebx, 0xd
je 0x1400f01fb
cmp ebx, 0xe
je 0x1400f0312
cmp ebx, 0xf
je 0x1400f01e7
cmp byte [rsi + 0xa92], 1
jne 0x1400f0279
cmp byte [rax + 0xf09], 0
jne 0x1400f0246
cmp dword [rax + 0x9f8], 0
je 0x1400f0323
mov r8, qword [rsi + 0xa88]
test r8, r8
je 0x1400f0323
lea rdx, str.MDTM__s
call fcn.14010d4b0
test eax, eax
jne 0x1400f01e5
mov dword [rsi + 0xab8], 0x12
jmp 0x1400f01e7
mov dword [rsi + 0xab0], 0
xor edx, edx
cmp dword [rax + 0xbac], 2
sete dl
mov dword [rsi + 0xab4], edx
cmp byte [rsi + 0x655], 1
jne 0x1400f02ce
mov r8, qword [rsi + 0xa70]
test r8, r8
je 0x1400f02ce
cmp dword [rsi + 0xa80], 0
je 0x1400f02c2
mov rdx, qword [rsi + 0xa78]
mov rdx, qword [rdx]
cmp byte [rdx], 0x2f
je 0x1400f02ce
mov dword [rsi + 0xa94], 0
jmp 0x1400f02ef
cmp dword [rsi + 0xa80], 0
je 0x1400f0230
mov dword [rsi + 0xa94], 1
mov rax, qword [rsi + 0xa78]
mov r8, qword [rax]
lea rdx, str.CWD__s
call fcn.14010d4b0
test eax, eax
jne 0x1400f01e5
mov dword [rsi + 0xab8], 0x10
jmp 0x1400f01e7
mov rcx, rsi
xor edx, edx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.1400f0870
mov rcx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.1400f0ac0
mov rdx, qword [rsi + 0xad0]
cmp rdx, 0xffffffffffffffff
je 0x1400f0384
mov ecx, dword [rax + 0xfa4]
and ecx, 0xffffffbf
xor r8d, r8d
xor r9d, r9d
test rdx, rdx
cmovns r8, rdx
setns r9b
shl r9d, 6
or r9d, ecx
mov qword [rax + 0xf78], r8
mov dword [rax + 0xfa4], r9d
mov rdx, qword [rsi + 0xad0]
mov rcx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.1400f06e0
mov r8, qword [rsi + 0xa88]
cmp byte [rax + 0xf24], 1
jne 0x1400f03b7
lea rdx, str.RETR__s
call fcn.14010d4b0
test eax, eax
jne 0x1400f01e5
mov dword [rsi + 0xab8], 0x20
jmp 0x1400f01e7
lea rdx, str.SIZE__s
call fcn.14010d4b0
test eax, eax
jne 0x1400f01e5
mov dword [rsi + 0xab8], 0x18
jmp 0x1400f01e7
Function at 0x1400f0ac0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov rax, qword [rcx]
mov rcx, qword [rax + 0x1e0]
cmp byte [rax + 0xf1c], 1
jne 0x1400f0b40
cmp qword [rsi + 0xa88], 0
je 0x1400f0b40
movzx edx, byte [rax + 0xf0b]
movsx r8d, byte [rsi + 0xaa8]
xor edx, 1
lea edx, [rdx*8 + 0x41]
cmp edx, r8d
je 0x1400f0b40
mov dword [rcx + 0x10], 1
mov bl, byte [rax + 0xf0b]
xor bl, 1
shl bl, 3
or bl, 0x41
cmp byte [rsi + 0xaa8], bl
jne 0x1400f0bc3
mov dword [rsi + 0xab8], 0x13
mov rax, qword [rsi]
mov rax, qword [rax + 0x1e0]
mov eax, dword [rax + 0x10]
jmp 0x1400f0b43
mov eax, dword [rcx + 0x10]
test eax, eax
je 0x1400f0b7e
lea rcx, [rsi + 0xa00]
cmp eax, 1
je 0x1400f0b8d
cmp qword [rsi + 0xa88], 0
je 0x1400f0b7e
lea rdx, str.REST__d
xor edi, edi
xor r8d, r8d
call fcn.14010d4b0
test eax, eax
jne 0x1400f0ba9
mov dword [rsi + 0xab8], 0x1a
jmp 0x1400f0bab
mov rcx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.1400f0bf0
mov r8, qword [rsi + 0xa88]
test r8, r8
je 0x1400f0b7e
lea rdx, str.SIZE__s
call fcn.14010d4b0
test eax, eax
je 0x1400f0bb5
mov edi, eax
mov eax, edi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
mov dword [rsi + 0xab8], 0x17
xor edi, edi
jmp 0x1400f0bab
movzx r8d, bl
lea rcx, [rsi + 0xa00]
lea rdx, str.TYPE__c
call fcn.14010d4b0
test eax, eax
jne 0x1400f0ba9
mov dword [rsi + 0xab8], 0x13
mov byte [rsi + 0xaa8], bl
jmp 0x1400f0bbf

Function at 0x1400f0bf0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov rax, qword [rcx]
mov rcx, qword [rax + 0x1e0]
cmp dword [rcx + 0x10], 0
je 0x1400f0c29
mov dword [rsi + 0xab8], 0xd
mov rcx, rsi
mov dl, 1
mov r8d, Ordinal_14
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.1400f0140
cmp byte [rax + 0xf0e], 1
jne 0x1400f0c42
mov rcx, rsi
xor edx, edx
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.1400f0d30
lea rcx, [rsi + 0xa00]
cmp byte [rax + 0xf11], 1
jne 0x1400f0c73
mov r8, qword [rsi + 0xa88]
test r8, r8
je 0x1400f0cdc
cmp byte [rax + 0xf1d], 1
jne 0x1400f0cd3
lea rdx, str.PRET_STOR__s
jmp 0x1400f0d08
mov al, byte [rsi + 0x666]
test al, al
jne 0x1400f0c8f
cmp byte [rsi + 0x65f], 1
jne 0x1400f0c8f
mov byte [rsi + 0x666], 1
mov al, 1
xor al, 1
movzx edi, al
lea rax, [rdi + rdi*4]
lea r8, str.EPSV
add r8, rax
lea rdx, [0x14029ecda]
call fcn.14010d4b0
test eax, eax
jne 0x1400f0d1d
mov dword [rsi + 0xaac], edi
mov dword [rsi + 0xab8], 0x1e
mov rcx, qword [rsi]
lea rdx, str.Connect_data_stream_passively_n
call fcn.1400c5520
jmp 0x1400f0d1b
lea rdx, str.PRET_RETR__s
jmp 0x1400f0d08
mov r8, qword [rax + 0xc08]
test r8, r8
jne 0x1400f0d01
lea rdx, str.NLST
lea r8, str.LIST
cmp byte [rax + 0xf0d], 0
cmovne r8, rdx
lea rdx, str.PRET__s
call fcn.14010d4b0
test eax, eax
jne 0x1400f0d1d
mov dword [rsi + 0xab8], 0x1d
xor eax, eax
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x1400f1ab0
Capabilities:
Get local ipv4 addresses
Get socket information
Set socket configuration

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0xb8
mov rsi, rcx
mov rax, qword [0x1402db040]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rdi, qword [rcx]
mov rbx, qword [rcx + 0x4c8]
movaps xmm0, xmmword [0x140299a90]
lea rdx, [rsp + 0x30]
movaps xmmword [rdx + 0x70], xmm0
movaps xmmword [rdx + 0x60], xmm0
movaps xmmword [rdx + 0x50], xmm0
movaps xmmword [rdx + 0x40], xmm0
movaps xmmword [rdx + 0x30], xmm0
movaps xmmword [rdx + 0x20], xmm0
movaps xmmword [rdx + 0x10], xmm0
movaps xmmword [rdx], xmm0
lea r8, [rsp + 0x28]
mov dword [r8], Ordinal_133
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x1400f1b67
mov rcx, rsi
mov rdx, rbx
call fcn.1400cb7a0
lea rdx, str.Error_accept__ing_server_connect
mov rcx, rdi
call fcn.1400c5820
mov ebx, 0x1e
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
cmp rcx, qword [0x1402db040]
je 0x1400f1b58
call fcn.1401ac870
int3
mov eax, ebx
add rsp, 0xb8
pop rbx
pop rdi
pop rsi
pop r14
ret
lea r8, [rsp + 0x28]
mov dword [r8], Ordinal_133
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_accept]
mov r14, rax
mov rcx, rsi
mov rdx, rbx
call fcn.1400cb7a0
cmp r14, 0xffffffffffffffff
je 0x1400f1b2a
lea rdx, str.Connection_accepted_from_server_n
mov rcx, rdi
call fcn.1400c5520
mov byte [rsi + 0x660], 0
mov qword [rsi + 0x4c8], r14
lea r8, [rsp + 0x2c]
mov dword [r8], 1
mov rcx, r14
mov edx, 0x8004667e
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov byte [rsi + 0xb2c], 1
mov rax, qword [rdi + 0x728]
xor ebx, ebx
test rax, rax
je 0x1400f1b3e
test rdi, rdi
je 0x1400f1c6e
mov rcx, qword [rdi + 0xd8]
test rcx, rcx
je 0x1400f1c95
mov byte [rcx + 0x18a], 1
mov rax, qword [rdi + 0x728]
mov rcx, qword [rdi + 0x730]
mov rdx, r14
mov r8d, 1
call qword [0x1402cbd20]
mov rcx, qword [rdi + 0xd8]
test rcx, rcx
je 0x1400f1c87
mov byte [rcx + 0x18a], 0
test eax, eax
je 0x1400f1b3e
mov rdx, qword [rsi + 0x4c8]
cmp rdx, 0xffffffffffffffff
je 0x1400f1c5d
mov rcx, rsi
call fcn.1400cb7a0
mov qword [rsi + 0x4c8], 0xffffffffffffffff
mov byte [rsi + 0x653], 0
mov ebx, Ordinal_46
jmp 0x1400f1b3e
mov rcx, qword [0x730]
mov rdx, r14
mov r8d, 1
call qword [0x1402cbd20]
jmp 0x1400f1c35
mov rcx, qword [rdi + 0xd0]
test rcx, rcx
jne 0x1400f1c2e
jmp 0x1400f1c35
mov rcx, qword [rdi + 0xd0]
test rcx, rcx
jne 0x1400f1bfe
jmp 0x1400f1c0c
Function at 0x1400f4520
Capabilities:
Send data
Send data on socket

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
cmp edx, 0x1f
jne 0x1400f46bf
mov rdi, rcx
mov rsi, qword [rcx]
mov rbx, qword [rsi + 0x1e0]
lea r12, [rbx + 0x1eb8]
mov word [rbx + 0x1cb8], 0xfaff
lea r14, [rbx + 0x1cbb]
mov qword [rbx + 0x1eb8], r14
mov byte [rbx + 0x1cba], 0x1f
movzx ecx, word [rbx + 0x1ca8]
mov r15, qword [sym.imp.WS2_32.dll_htons]
call r15
mov ebp, eax
movzx ecx, word [rbx + 0x1caa]
call r15
mov r9, qword [rbx + 0x1eb8]
cmp r9, r12
jae 0x1400f45a1
lea rcx, [r9 + 1]
mov qword [r12], rcx
mov byte [r9], bpl
mov r9, qword [r12]
cmp r9, r12
jae 0x1400f45b8
shr ebp, 8
lea rcx, [r9 + 1]
mov qword [r12], rcx
mov byte [r9], bpl
mov r9, qword [r12]
cmp r9, r12
jae 0x1400f45cc
lea rcx, [r9 + 1]
mov qword [r12], rcx
mov byte [r9], al
mov r9, qword [r12]
cmp r9, r12
jae 0x1400f45e3
shr eax, 8
lea rcx, [r9 + 1]
mov qword [r12], rcx
mov byte [r9], al
mov r9, qword [r12]
cmp r9, r12
jae 0x1400f45f8
lea rax, [r9 + 1]
mov qword [r12], rax
mov byte [r9], 0xff
mov r9, qword [r12]
lea r15, [rbx + 0x1cb8]
lea r8, [rbx + 0x1cba]
cmp r9, r12
jae 0x1400f461b
lea rax, [r9 + 1]
mov qword [r12], rax
mov byte [r9], 0xf0
mov r9, qword [r12]
mov qword [rbx + 0x1ec0], r9
mov qword [rbx + 0x1eb8], r15
sub r9, r15
add r9, 0xfffffffffffffffe
mov rcx, rsi
mov edx, 0x3e
call fcn.1400f46d0
mov rcx, qword [rdi + 0x4c0]
mov rdx, r15
mov r8d, 3
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x1400f4672
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rsi
mov r8d, eax
call fcn.1400c5820
mov r8d, 4
mov rcx, rdi
mov rdx, r14
call fcn.1400f4010
add rbx, 0x1cbf
mov rcx, qword [rdi + 0x4c0]
mov rdx, rbx
mov r8d, 2
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x1400f46bf
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rsi
mov r8d, eax
call fcn.1400c5820
nop
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret