joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400a7450
Capabilities:
Get geographical location

Disassembly:
jmp 0x1401b5170
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x38
call fcn.1401b4230
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1401b51c7
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x28]
call qword [section..00cfg]
mov r9d, dword [rsp + 0x58]
mov r8, qword [rsp + 0x50]
mov edx, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
call qword [rsp + 0x28]
jmp 0x1401b51e9
xor edx, edx
mov rcx, qword [rsp + 0x40]
call fcn.1400a8896
mov r9d, dword [rsp + 0x58]
mov r8, qword [rsp + 0x50]
mov edx, dword [rsp + 0x48]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
add rsp, 0x38
ret

Function at 0x1400a7568
Capabilities:
Convert ip address from string

Disassembly:
jmp 0x1400c8ea0
mov word [rsp + 0x18], r8w
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
mov rdi, rsp
mov ecx, 0x42
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x128]
mov byte [rbp + 4], 1
mov rax, qword [rbp + 0x100]
mov rcx, rax
call fcn.1400a9c73
mov ecx, 2
mov word [rax], cx
mov rax, qword [rbp + 0x100]
mov rcx, rax
call fcn.1400a9c73
add rax, 4
mov r8, rax
mov rdx, qword [rbp + 0x108]
mov ecx, 2
call qword [sym.imp.WS2_32.dll_inet_pton]
movzx ecx, word [rbp + 0x110]
call qword [sym.imp.WS2_32.dll_htons]
mov word [rbp + 0xd4], ax
mov rcx, qword [rbp + 0x100]
call fcn.1400a9c73
movzx ecx, word [rbp + 0xd4]
mov word [rax + 2], cx
mov rax, qword [rbp + 0x100]
mov rcx, rax
call fcn.1400a9c73
mov qword [rbp + 0xd8], rax
mov rcx, qword [rbp + 0x100]
call fcn.1400a9c73
mov r8d, sendto
mov rcx, qword [rbp + 0xd8]
mov rdx, rcx
mov rcx, qword [rax + 0x20]
call qword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x1400c8fb5
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
lea rcx, str.bind___failed_with_error__d_n
call fcn.1400a930e
mov rax, qword [rbp + 0x100]
mov rcx, rax
call fcn.1400a9c73
mov rcx, qword [rax + 0x20]
call qword [sym.imp.WS2_32.dll_closesocket]
mov byte [rbp + 4], 0
lea rcx, str.Bind_done_n
call fcn.1400a856c
mov al, 1
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret
Function at 0x1400a77d9
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x140195ff0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [0x1402590a0]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
jmp 0x14019603b
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0x20
jge 0x140196067
movsxd rax, dword [rsp + 0x20]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0x20
jae 0x140196056
jmp 0x14019605b
call fcn.1400a7702
mov rax, qword [rsp + 0x38]
mov byte [rsp + rax + 0x40], 0
jmp 0x140196031
mov rax, qword [rsp + 0x28]
movzx eax, byte [rax]
test eax, eax
je 0x1401960bc
mov rax, qword [rsp + 0x28]
movzx eax, byte [rax]
sar eax, 3
cdqe
mov rcx, qword [rsp + 0x28]
movzx ecx, byte [rcx]
and ecx, 7
mov edx, 1
shl edx, cl
mov ecx, edx
movzx eax, byte [rsp + rax + 0x40]
or eax, ecx
mov rcx, qword [rsp + 0x28]
movzx ecx, byte [rcx]
sar ecx, 3
movsxd rcx, ecx
mov byte [rsp + rcx + 0x40], al
mov rax, qword [rsp + 0x28]
inc rax
mov qword [rsp + 0x28], rax
jmp 0x140196067
mov dword [rsp + 0x20], 0
mov eax, 1
imul rax, rax, 0
movzx eax, byte [rsp + rax + 0x40]
or eax, 1
mov ecx, 1
imul rcx, rcx, 0
mov byte [rsp + rcx + 0x40], al
mov rax, qword [rsp + 0x30]
movzx eax, byte [rax]
sar eax, 3
cdqe
movzx eax, byte [rsp + rax + 0x40]
mov rcx, qword [rsp + 0x30]
movzx ecx, byte [rcx]
and ecx, 7
mov edx, 1
shl edx, cl
mov ecx, edx
and eax, ecx
test eax, eax
jne 0x140196127
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x30]
inc rax
mov qword [rsp + 0x30], rax
jmp 0x1401960e2
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400aabe1
add rsp, 0x78
ret
Function at 0x1400a7801
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x1401ed300
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [0x1402590a0]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x20], 0
jmp 0x1401ed34b
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0x20
jge 0x1401ed377
movsxd rax, dword [rsp + 0x20]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0x20
jae 0x1401ed366
jmp 0x1401ed36b
call fcn.1400a7702
mov rax, qword [rsp + 0x38]
mov byte [rsp + rax + 0x40], 0
jmp 0x1401ed341
mov rax, qword [rsp + 0x30]
movzx eax, byte [rax]
test eax, eax
je 0x1401ed3cc
mov rax, qword [rsp + 0x30]
movzx eax, byte [rax]
sar eax, 3
cdqe
mov rcx, qword [rsp + 0x30]
movzx ecx, byte [rcx]
and ecx, 7
mov edx, 1
shl edx, cl
mov ecx, edx
movzx eax, byte [rsp + rax + 0x40]
or eax, ecx
mov rcx, qword [rsp + 0x30]
movzx ecx, byte [rcx]
sar ecx, 3
movsxd rcx, ecx
mov byte [rsp + rcx + 0x40], al
mov rax, qword [rsp + 0x30]
inc rax
mov qword [rsp + 0x30], rax
jmp 0x1401ed377
mov rax, qword [rsp + 0x28]
movzx eax, byte [rax]
test eax, eax
je 0x1401ed41a
mov rax, qword [rsp + 0x28]
movzx eax, byte [rax]
sar eax, 3
cdqe
movzx eax, byte [rsp + rax + 0x40]
mov rcx, qword [rsp + 0x28]
movzx ecx, byte [rcx]
and ecx, 7
mov edx, 1
shl edx, cl
mov ecx, edx
and eax, ecx
test eax, eax
je 0x1401ed40b
mov rax, qword [rsp + 0x28]
jmp 0x1401ed41c
mov rax, qword [rsp + 0x28]
inc rax
mov qword [rsp + 0x28], rax
jmp 0x1401ed3cc
xor eax, eax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400aabe1
add rsp, 0x78
ret
Function at 0x1400a7eb9
Capabilities:
Clear file content

Disassembly:
jmp 0x1401ef840
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x88
mov r8d, 1
xor edx, edx
mov ecx, dword [rsp + 0x90]
call fcn.1400abab4
mov qword [rsp + 0x68], rax
cmp qword [rsp + 0x68], 0xffffffffffffffff
jne 0x1401ef87d
call fcn.1400a8c6f
mov eax, dword [rax]
jmp 0x1401efaa8
mov r8d, 2
xor edx, edx
mov ecx, dword [rsp + 0x90]
call fcn.1400abab4
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x60], 0xffffffffffffffff
jne 0x1401ef8aa
call fcn.1400a8c6f
mov eax, dword [rax]
jmp 0x1401efaa8
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x98]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jle 0x1401efa0c
mov dword [rsp + 0x20], 0x35
lea r9, str.minkernelcrtsucrt_src_appcrtlowiochsize.cpp
mov r8d, 2
mov edx, 1
mov ecx, 0x1000
call fcn.1400aa10a
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.1400a65c8
lea rcx, [rsp + 0x40]
call fcn.1400aa33f
movzx eax, al
test eax, eax
jne 0x1401ef939
call fcn.1400a8c6f
mov dword [rax], recvfrom
call fcn.1400a8c6f
mov eax, dword [rax]
mov dword [rsp + 0x50], eax
lea rcx, [rsp + 0x40]
call fcn.1400a7d6f
mov eax, dword [rsp + 0x50]
jmp 0x1401efaa8
mov edx, 0x8000
mov ecx, dword [rsp + 0x90]
call fcn.1400a7388
mov dword [rsp + 0x48], eax
cmp qword [rsp + 0x30], 0x1000
jl 0x1401ef963
mov dword [rsp + 0x3c], 0x1000
jmp 0x1401ef96b
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x3c], eax
mov eax, dword [rsp + 0x3c]
mov dword [rsp + 0x54], eax
lea rcx, [rsp + 0x40]
call fcn.1400aa727
mov r8d, dword [rsp + 0x54]
mov rdx, rax
mov ecx, dword [rsp + 0x90]
call fcn.1400a80cb
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 0xffffffff
jne 0x1401ef9cf
call fcn.1400aada3
cmp dword [rax], 5
jne 0x1401ef9b1
call fcn.1400a8c6f
mov dword [rax], recvfrom
call fcn.1400a8c6f
mov eax, dword [rax]
mov dword [rsp + 0x4c], eax
lea rcx, [rsp + 0x40]
call fcn.1400a7d6f
mov eax, dword [rsp + 0x4c]
jmp 0x1401efaa8
movsxd rax, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jg 0x1401ef94e
mov edx, dword [rsp + 0x48]
mov ecx, dword [rsp + 0x90]
call fcn.1400a7388
lea rcx, [rsp + 0x40]
call fcn.1400a7d6f
jmp 0x1401efa83
cmp qword [rsp + 0x30], 0
jge 0x1401efa83
xor r8d, r8d
mov rdx, qword [rsp + 0x98]
mov ecx, dword [rsp + 0x90]
call fcn.1400abab4
mov qword [rsp + 0x70], rax
cmp qword [rsp + 0x70], 0xffffffffffffffff
jne 0x1401efa41
call fcn.1400a8c6f
mov eax, dword [rax]
jmp 0x1401efaa8
mov ecx, dword [rsp + 0x90]
call fcn.1400a7f27
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1401efa83
call fcn.1400a8c6f
mov dword [rax], recvfrom
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x58], eax
call fcn.1400aada3
mov ecx, dword [rsp + 0x58]
mov dword [rax], ecx
call fcn.1400a8c6f
mov eax, dword [rax]
jmp 0x1401efaa8
xor r8d, r8d
mov rdx, qword [rsp + 0x68]
mov ecx, dword [rsp + 0x90]
call fcn.1400abab4
cmp rax, 0xffffffffffffffff
jne 0x1401efaa6
call fcn.1400a8c6f
mov eax, dword [rax]
jmp 0x1401efaa8
xor eax, eax
add rsp, 0x88
ret
Function at 0x1400a839b
Capabilities:
Print debug messages

Disassembly:
jmp 0x1401c5320
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add rsp, 0x28
ret

Function at 0x1400a83aa
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x1401d671c
jmp fcn.1400a8c92

Function at 0x1400a86cf
Capabilities:
Initialize winsock library

Disassembly:
jmp 0x1400c88e0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x2b8
lea rbp, [rsp + 0x20]
mov rdi, rsp
mov ecx, 0xae
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x2d8]
mov rax, qword [0x1402590a0]
xor rax, rbp
mov qword [rbp + 0x280], rax
mov rax, qword [rbp + 0x2b0]
mov rcx, rax
call fcn.1400aa01f
lea rcx, str.Initialising_Winsock..._n
call fcn.1400a930e
lea rdx, [rbp + 0x10]
mov cx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x1400c8963
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
lea rcx, str.WSAStartup___failed_with_error__d_n
call fcn.1400a930e
xor ecx, ecx
call fcn.1400a84ef
lea rcx, str.Initialised._n
call fcn.1400a930e
xor r8d, r8d
mov edx, 2
mov ecx, 2
call qword [sym.imp.WS2_32.dll_socket]
mov qword [rbp + 0x278], rax
mov rax, qword [rbp + 0x2b0]
mov rcx, rax
call fcn.1400a9c73
mov rcx, qword [rbp + 0x278]
mov qword [rax + 0x20], rcx
cmp qword [rbp + 0x278], 0xffffffffffffffff
jne 0x1400c89c1
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
lea rcx, str.socket___failed_with_error__d_n
call fcn.1400a930e
lea rcx, str.Socket_created_n
call fcn.1400a930e
mov rax, qword [rbp + 0x2b0]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x1402060f0]
call fcn.1400a8030
mov rax, rdi
mov rcx, qword [rbp + 0x280]
xor rcx, rbp
call fcn.1400aabe1
lea rsp, [rbp + 0x298]
pop rdi
pop rbp
ret
Function at 0x1400a8959
Capabilities:
Hash data using fnv

Disassembly:
jmp 0x1400f6a50
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
movabs rax, 0xcbf29ce484222325
mov qword [rsp + 0x10], rax
movabs rax, 0x100000001b3
mov qword [rsp + 0x18], rax
movabs rax, 0xcbf29ce484222325
mov qword [rsp], rax
mov qword [rsp + 8], 0
jmp 0x1400f6aa2
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
mov rax, qword [rsp + 0x38]
cmp qword [rsp + 8], rax
jae 0x1400f6aea
mov rax, qword [rsp + 8]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
movzx eax, byte [rax]
mov rcx, qword [rsp]
xor rcx, rax
mov rax, rcx
mov qword [rsp], rax
movabs rax, 0x100000001b3
mov rcx, qword [rsp]
imul rcx, rax
mov rax, rcx
mov qword [rsp], rax
jmp 0x1400f6a95
mov rax, qword [rsp]
add rsp, 0x28
ret

Function at 0x1400a8a3a
Capabilities:
Parse pe header

Disassembly:
jmp 0x140123750
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140123770
xor al, al
jmp 0x1401237f1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140123783
xor al, al
jmp 0x1401237f1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x1401237ad
xor al, al
jmp 0x1401237f1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x1401237c1
xor al, al
jmp 0x1401237f1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x1401237d3
xor al, al
jmp 0x1401237f1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x1401237ef
xor al, al
jmp 0x1401237f1
mov al, 1
add rsp, 0x38
ret

Function at 0x1400a8c33
Capabilities:
Encode data using xor

Disassembly:
jmp 0x14017f840
mov rax, rcx
neg rcx
test rax, 7
je 0x14017f85d
nop
mov dl, byte [rax]
inc rax
test dl, dl
je 0x14017f8b8
test al, 7
jne 0x14017f850
movabs r8, 0x7efefefefefefeff
movabs r11, 0x8101010101010100
mov rdx, qword [rax]
mov r9, r8
add rax, 8
add r9, rdx
not rdx
xor rdx, r9
and rdx, r11
je 0x14017f871
mov rdx, qword [rax - 8]
test dl, dl
je 0x14017f8e2
test dh, dh
je 0x14017f8dc
shr rdx, 0x10
test dl, dl
je 0x14017f8d6
test dh, dh
je 0x14017f8d0
shr rdx, 0x10
test dl, dl
je 0x14017f8ca
test dh, dh
je 0x14017f8c4
shr edx, 0x10
test dl, dl
je 0x14017f8be
test dh, dh
jne 0x14017f871
lea rax, [rcx + rax - 1]
ret
lea rax, [rcx + rax - 2]
ret
lea rax, [rcx + rax - 3]
ret
lea rax, [rcx + rax - 4]
ret
lea rax, [rcx + rax - 5]
ret
lea rax, [rcx + rax - 6]
ret
lea rax, [rcx + rax - 7]
ret
lea rax, [rcx + rax - 8]
ret
Function at 0x1400a8e81
Capabilities:
Terminate process

Disassembly:
jmp 0x14013e390
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov ecx, reloc.WS2_32.dll_socket
call fcn.1400a8067
test eax, eax
je 0x14013e3bd
mov ecx, 5
int 0x29
mov r8d, 1
mov edx, 0xc0000417
mov ecx, 2
call fcn.1400a701d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000417
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x1400a948f
Capabilities:
Terminate process

Disassembly:
jmp 0x1401228f0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x1400a958e
Capabilities:
Allocate thread local storage

Disassembly:
jmp 0x14012c300
mov qword [rsp + 8], rcx
sub rsp, 0x38
call fcn.14012bab0
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x14012c33a
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x28]
call fcn.1400a86a7
mov rcx, qword [rsp + 0x40]
call qword [rsp + 0x28]
jmp 0x14012c340
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
add rsp, 0x38
ret

Function at 0x1400a98fe
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
jmp 0x1400c9070
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1a8
lea rbp, [rsp + 0x30]
mov rdi, rsp
mov ecx, 0x6a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1c8]
mov rax, qword [0x1402590a0]
xor rax, rbp
mov qword [rbp + 0x160], rax
mov dword [rbp + 4], 0
mov dword [rbp + 0x24], 1
mov rax, qword [rbp + 0x190]
mov rcx, rax
call fcn.1400a9c73
lea r8, [rbp + 0x24]
mov edx, 0x8004667e
mov rcx, qword [rax + 0x20]
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov dword [rbp + 0x44], eax
cmp dword [rbp + 0x44], 0xffffffff
jne 0x1400c9107
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
lea rcx, str.ioctlsocket___failed_with_error__d_n
call fcn.1400a930e
jmp 0x1400c91a0
mov dword [rbp + 0x64], sendto
mov rax, qword [rbp + 0x190]
mov rcx, rax
call fcn.1400a9c73
add rax, 0x10
mov qword [rbp + 0x158], rax
mov rcx, qword [rbp + 0x190]
call fcn.1400a9c73
lea rcx, [rbp + 0x64]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x158]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov r8d, dword [rbp + 0x1a0]
mov rdx, qword [rbp + 0x198]
mov rcx, qword [rax + 0x20]
call qword [sym.imp.WS2_32.dll_recvfrom]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0xffffffff
jne 0x1400c91a0
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [rbp + 0x84], eax
cmp dword [rbp + 0x84], 0x2733
je 0x1400c9199
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
lea rcx, str.recvfrom___failed_with_error__d_n
call fcn.1400a930e
mov dword [rbp + 4], 0
mov eax, dword [rbp + 4]
mov edi, eax
lea rcx, [rbp - 0x30]
lea rdx, reloc.WS2_32.dll_bind
call fcn.1400a8030
mov eax, edi
mov rcx, qword [rbp + 0x160]
xor rcx, rbp
call fcn.1400aabe1
lea rsp, [rbp + 0x178]
pop rdi
pop rbp
ret
Function at 0x1400a9d04
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x1401b4ed0
mov dword [rsp + 8], ecx
sub rsp, 0x38
call fcn.1401b4030
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1401b4f09
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x28]
call qword [section..00cfg]
mov ecx, dword [rsp + 0x40]
call qword [rsp + 0x28]
jmp 0x1401b4f13
mov ecx, dword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x38
ret

Function at 0x1400aa0e2
Capabilities:
Set thread local storage value

Disassembly:
jmp 0x1401b4f30
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x38
call fcn.1401b4070
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1401b4f73
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x28]
call qword [section..00cfg]
mov rdx, qword [rsp + 0x48]
mov ecx, dword [rsp + 0x40]
call qword [rsp + 0x28]
jmp 0x1401b4f82
mov rdx, qword [rsp + 0x48]
mov ecx, dword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
add rsp, 0x38
ret
Function at 0x1400aa2ea
Capabilities:
Allocate thread local storage

Disassembly:
jmp 0x1401b4e10
mov qword [rsp + 8], rcx
sub rsp, 0x38
call fcn.1401b3fb0
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1401b4e4b
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x28]
call qword [section..00cfg]
mov rcx, qword [rsp + 0x40]
call qword [rsp + 0x28]
jmp 0x1401b4e51
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
add rsp, 0x38
ret
Function at 0x1400ab93d
Capabilities:
Convert ip address from string
Send data
Send data on socket

Disassembly:
jmp 0x1400c9230
mov qword [rsp + 0x20], r9
mov word [rsp + 0x18], r8w
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x118
lea rbp, [rsp + 0x30]
mov rdi, rsp
mov ecx, 0x46
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x138]
mov rax, qword [rbp + 0x100]
mov rcx, rax
call fcn.1400a9c73
mov ecx, 2
mov word [rax + 0x10], cx
mov rax, qword [rbp + 0x100]
mov rcx, rax
call fcn.1400a9c73
add rax, 0x14
mov r8, rax
mov rdx, qword [rbp + 0x108]
mov ecx, 2
call qword [sym.imp.WS2_32.dll_inet_pton]
movzx ecx, word [rbp + 0x110]
call qword [sym.imp.WS2_32.dll_htons]
mov word [rbp + 0xd4], ax
mov rcx, qword [rbp + 0x100]
call fcn.1400a9c73
movzx ecx, word [rbp + 0xd4]
mov word [rax + 0x12], cx
mov rax, qword [rbp + 0x100]
mov rcx, rax
call fcn.1400a9c73
add rax, 0x10
mov qword [rbp + 0xd8], rax
mov rcx, qword [rbp + 0x100]
call fcn.1400a9c73
mov dword [rsp + 0x28], sendto
mov rcx, qword [rbp + 0xd8]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov r8d, dword [rbp + 0x120]
mov rdx, qword [rbp + 0x118]
mov rcx, qword [rax + 0x20]
call qword [sym.imp.WS2_32.dll_sendto]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0xffffffff
jne 0x1400c934e
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
lea rcx, str.sendto___failed_with_error__d_n
call fcn.1400a930e
mov dword [rbp + 4], 0
mov eax, dword [rbp + 4]
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret
Function at 0x1401c4d60
Capabilities:
Create thread

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x88
call fcn.1400a8f94
mov byte [rsp + 0x30], al
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1401c4db4
cmp qword [rsp + 0x90], 0
je 0x1401c4da1
lea rcx, [rsp + 0x90]
call fcn.1400a839b
movzx eax, byte [rsp + 0x30]
test eax, eax
je 0x1401c4db4
mov eax, 4
jmp 0x1401c4f42
call fcn.1400a6825
movzx eax, al
test eax, eax
jne 0x1401c4de5
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1401c4dd4
mov dword [rsp + 0x34], 4
jmp 0x1401c4ddc
mov dword [rsp + 0x34], 3
mov eax, dword [rsp + 0x34]
jmp 0x1401c4f42
movzx eax, byte [rsp + 0x30]
test eax, eax
je 0x1401c4ed1
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x68], rax
mov eax, dword [rsp + 0xa0]
mov dword [rsp + 0x70], eax
mov dword [rsp + 0x74], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x60]
lea r8, [0x1401c5280]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.1400a9dea
lea rcx, [rsp + 0x38]
call fcn.1400a85ad
movzx eax, al
test eax, eax
jne 0x1401c4e7f
mov dword [rsp + 0x4c], 0
lea rcx, [rsp + 0x38]
call fcn.1400aa0b0
mov eax, dword [rsp + 0x4c]
jmp 0x1401c4f42
lea rcx, [rsp + 0x38]
call fcn.1400a720c
xor r8d, r8d
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
test eax, eax
je 0x1401c4eb9
mov dword [rsp + 0x44], 0
lea rcx, [rsp + 0x38]
call fcn.1400aa0b0
mov eax, dword [rsp + 0x44]
jmp 0x1401c4f42
mov eax, dword [rsp + 0x74]
mov dword [rsp + 0x40], eax
lea rcx, [rsp + 0x38]
call fcn.1400aa0b0
mov eax, dword [rsp + 0x40]
jmp 0x1401c4f42
call fcn.1400aabf0
movzx eax, al
test eax, eax
jne 0x1401c4f16
mov eax, dword [rsp + 0xa0]
bts eax, 0x15
mov dword [rsp + 0x48], eax
mov qword [rsp + 0x50], 0
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x98]
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x50]
call fcn.1400a81cf
jmp 0x1401c4f42
call fcn.1400a79af
mov qword [rsp + 0x58], rax
lea r9, [rsp + 0xa0]
lea r8, [rsp + 0x98]
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x58]
call fcn.1400a7194
add rsp, 0x88
ret
Function at 0x140799058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1407991df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140799089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14079906f
add dl, dl
jne 0x140799096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407990f6
xor eax, eax
add dl, dl
jne 0x1407990a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407991ad
add dl, dl
jne 0x1407990b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407990c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407990d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407990dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1407990ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14079907e
mov eax, 1
add dl, dl
jne 0x140799106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140799113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1407990fb
sub eax, ebx
mov ebx, 1
jne 0x14079914c
mov ecx, 1
add dl, dl
jne 0x14079912e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14079913b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140799123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14079907e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140799168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140799175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14079915d
cmp eax, 0x7d00
jae 0x14079919b
cmp eax, 0x500
jb 0x140799196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14079907e
cmp eax, 0x7f
ja 0x14079919e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14079907e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1407991d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14079907e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20