joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140139443
Capabilities:
Query environment variable

Disassembly:
jmp 0x14038e2b0
sub rsp, 0xb8
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.14038e0e0
lea rcx, [rsp + 0x40]
call fcn.14038e260
movzx eax, al
test eax, eax
jne 0x14038e2f8
mov qword [rsp + 0x70], 0
lea rcx, [rsp + 0x40]
call fcn.14038e110
mov rax, qword [rsp + 0x70]
jmp 0x14038e4c9
lea rcx, [rsp + 0x40]
call fcn.14038e230
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.14038e1d0
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x78]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x40]
call fcn.14038e230
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x68]
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.14013aed8
cdqe
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
jne 0x14038e39e
mov qword [rsp + 0x80], 0
lea rcx, [rsp + 0x40]
call fcn.14038e110
mov rax, qword [rsp + 0x80]
jmp 0x14038e4c9
mov r9d, 0x66
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, qword [rsp + 0x58]
call fcn.140138e30
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140138aca
lea rcx, [rsp + 0x48]
call fcn.1401381dd
movzx eax, al
test eax, eax
jne 0x14038e405
mov qword [rsp + 0x88], 0
lea rcx, [rsp + 0x48]
call fcn.14013634c
lea rcx, [rsp + 0x40]
call fcn.14038e110
mov rax, qword [rsp + 0x88]
jmp 0x14038e4c9
lea rcx, [rsp + 0x48]
call fcn.140139be1
mov qword [rsp + 0x90], rax
lea rcx, [rsp + 0x40]
call fcn.14038e230
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x68]
mov r8, qword [rsp + 0x98]
xor edx, edx
xor ecx, ecx
call fcn.14013aed8
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jne 0x14038e49b
mov qword [rsp + 0xa0], 0
lea rcx, [rsp + 0x48]
call fcn.14013634c
lea rcx, [rsp + 0x40]
call fcn.14038e110
mov rax, qword [rsp + 0xa0]
jmp 0x14038e4c9
lea rcx, [rsp + 0x48]
call fcn.140138a6b
mov qword [rsp + 0xa8], rax
lea rcx, [rsp + 0x48]
call fcn.14013634c
lea rcx, [rsp + 0x40]
call fcn.14038e110
mov rax, qword [rsp + 0xa8]
add rsp, 0xb8
ret

Function at 0x140139461
Capabilities:
Allocate thread local storage

Disassembly:
jmp 0x1402afe50
mov qword [rsp + 8], rcx
sub rsp, 0x48
call fcn.1402af820
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1402afe91
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x140556020]
jmp 0x1402afe97
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
add rsp, 0x48
ret
Function at 0x140139588
Capabilities:
Get geographical location

Disassembly:
jmp 0x140370fa0
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x58
call fcn.14036fed0
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x140371007
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
movabs r10, 0xe375262d7cd44270
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x40]
call qword [0x140556030]
jmp 0x140371029
xor edx, edx
mov rcx, qword [rsp + 0x60]
call fcn.14013811f
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
add rsp, 0x58
ret

Function at 0x1401395a6
Capabilities:
Terminate process

Disassembly:
jmp 0x14028b090
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x140139b23
Capabilities:
Print debug messages

Disassembly:
jmp 0x140398f40
mov qword [rsp + 8], rcx
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x30]
mov rax, qword [0x140450380]
xor rax, rbp
mov qword [rbp + 0x18], rax
cmp qword [rbp + 0x30], 0
jne 0x140398f66
jmp 0x140398fe3
mov rcx, qword [rbp + 0x30]
call fcn.140138890
inc rax
mov qword [rbp], rax
cmp qword [rbp], 0
jne 0x140398f7f
jmp 0x140398fe3
mov rax, qword [rbp]
shl rax, 1
mov rcx, rax
add rcx, 0xf
cmp rcx, rax
ja 0x140398f9c
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.140136658
sub rsp, rax
lea rax, [rsp + 0x30]
mov qword [rbp + 8], rax
mov rax, qword [rbp]
dec rax
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x30]
mov r8, qword [rbp]
mov rdx, qword [rbp + 8]
lea rcx, [rbp + 0x10]
call fcn.140136fe5
test eax, eax
jne 0x140398fe3
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rbp + 0x18]
xor rcx, rbp
call fcn.140138cb9
lea rsp, [rbp + 0x20]
pop rbp
ret
Function at 0x14013a19a
Capabilities:
Set environment variable

Disassembly:
jmp 0x140390410
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x38]
mov rdx, qword [rax]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
add rsp, 0x28
ret
Function at 0x14013a69a
Capabilities:
Parse pe header

Disassembly:
jmp 0x14028d3a0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14028d3c0
xor al, al
jmp 0x14028d441
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14028d3d3
xor al, al
jmp 0x14028d441
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14028d3fd
xor al, al
jmp 0x14028d441
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x14028d411
xor al, al
jmp 0x14028d441
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x14028d423
xor al, al
jmp 0x14028d441
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14028d43f
xor al, al
jmp 0x14028d441
mov al, 1
add rsp, 0x38
ret

Function at 0x14013aad2
Capabilities:
Initialize winsock library

Disassembly:
jmp 0x140182730
push rbp
push rdi
sub rsp, 0x3d8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x8a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140450380]
xor rax, rbp
mov qword [rbp + 0x398], rax
lea rcx, reloc.WS2_32.dll_accept
call fcn.14013ce09
lea rax, str.conf_packet_athena.conf
mov qword [rbp + 8], rax
mov dword [rbp + 0x24], 0x1000
mov eax, 2
mov word [rbp + 0x204], ax
lea rdx, [rbp + 0x50]
movzx ecx, word [rbp + 0x204]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x1401827b1
lea rcx, str.socket_init:_WinSock_not_available__n
call fcn.14013884f
jmp 0x1401828bb
movzx eax, word [rbp + 0x50]
and rax, 0xff
movzx eax, al
cmp eax, 2
jne 0x1401827d8
movzx eax, word [rbp + 0x50]
shr rax, 8
and rax, 0xff
movzx eax, al
test eax, eax
je 0x1401827e9
lea rcx, str.socket_init:_WinSock_version_mismatch__2.0_or_compatible_required___n
call fcn.14013884f
jmp 0x1401828bb
mov edx, reloc.WS2_32.dll_recv
lea rcx, [0x14046b290]
call fcn.14013cdfa
mov dword [0x14046b284], eax
mov dword [0x14047b2d0], 0
lea rcx, str.Server_uses_e_1_37mselecte_0m_as_event_dispatcher_n
call fcn.14013b8ab
mov r8d, 0x200
xor edx, edx
lea rcx, [0x1404872e0]
call fcn.14013adde
mov rcx, qword [rbp + 8]
call fcn.140139164
xor ecx, ecx
call fcn.140182ae0
mov qword [0x14046b288], rax
lea r9, [0x14013be41]
lea r8, [0x140135f5a]
lea rdx, [0x14013a3bb]
xor ecx, ecx
call fcn.14017f3e0
mov r8d, 0x80000
xor edx, edx
lea rcx, [0x14048f910]
call fcn.14013adde
lea rdx, str.connect_check_clear
lea rcx, [0x14017eea0]
call fcn.14013776f
call fcn.14013bb8a
add rax, 0x3e8
mov dword [rsp + 0x20], 0x493e0
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x14017eea0]
mov rcx, rax
call fcn.14013cfee
mov edx, dword [rbp + 0x24]
lea rcx, str.Server_supports_up_to_e_1_37m_ue_0m_concurrent_connections._n
call fcn.14013b8ab
lea rcx, [rbp - 0x30]
lea rdx, reloc.WS2_32.dll_accept
call fcn.14013b80b
mov rcx, qword [rbp + 0x398]
xor rcx, rbp
call fcn.140138cb9
lea rsp, [rbp + 0x3a8]
pop rdi
pop rbp
ret
Function at 0x14013b2e3
Capabilities:
Terminate process

Disassembly:
jmp 0x1402b1210
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov ecx, reloc.WS2_32.dll_socket
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x1402b123e
mov ecx, 5
int 0x29
mov r8d, 1
mov edx, 0xc0000417
mov ecx, 2
call fcn.14013c4e5
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000417
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x14013bedc
Capabilities:
Set current directory

Disassembly:
jmp 0x140398ea0
mov qword [rsp + 8], rcx
sub rsp, 0x68
lea rcx, [rsp + 0x30]
call fcn.140137dff
call fcn.140139358
mov r8d, eax
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x70]
call fcn.140137909
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x140398eed
mov dword [rsp + 0x24], 0
lea rcx, [rsp + 0x30]
call fcn.14013869c
mov eax, dword [rsp + 0x24]
jmp 0x140398f12
lea rcx, [rsp + 0x30]
call fcn.140137c92
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov dword [rsp + 0x28], eax
lea rcx, [rsp + 0x30]
call fcn.14013869c
mov eax, dword [rsp + 0x28]
add rsp, 0x68
ret
Function at 0x14013c580
Capabilities:
Print debug messages

Disassembly:
jmp 0x140364370
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add rsp, 0x28
ret
Function at 0x14013c797
Capabilities:
Set thread local storage value

Disassembly:
jmp 0x1402aff90
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.1402af8e0
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1402affd9
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x140556020]
jmp 0x1402affe8
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
add rsp, 0x48
ret

Function at 0x14013c93b
Capabilities:
Set environment variable

Disassembly:
jmp 0x140398d50
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xb8
lea rcx, [rsp + 0x78]
call fcn.140137dff
lea rcx, [rsp + 0x48]
call fcn.140137dff
call fcn.140139358
mov r8d, eax
lea rdx, [rsp + 0x78]
mov rcx, qword [rsp + 0xc0]
call fcn.140137909
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x140398dbf
mov dword [rsp + 0x24], 0
lea rcx, [rsp + 0x48]
call fcn.14013869c
lea rcx, [rsp + 0x78]
call fcn.14013869c
mov eax, dword [rsp + 0x24]
jmp 0x140398e50
call fcn.140139358
mov r8d, eax
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0xc8]
call fcn.140137909
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
je 0x140398e06
mov dword [rsp + 0x2c], 0
lea rcx, [rsp + 0x48]
call fcn.14013869c
lea rcx, [rsp + 0x78]
call fcn.14013869c
mov eax, dword [rsp + 0x2c]
jmp 0x140398e50
lea rcx, [rsp + 0x48]
call fcn.140137c92
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x78]
call fcn.140137c92
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0x48]
call fcn.14013869c
lea rcx, [rsp + 0x78]
call fcn.14013869c
mov eax, dword [rsp + 0x30]
add rsp, 0xb8
ret
Function at 0x14013c990
Capabilities:
Reference sql statements

Disassembly:
jmp 0x140175a50
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0x148
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, reloc.WS2_32.dll_shutdown
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x168]
lea rcx, reloc.WS2_32.dll_accept
call fcn.14013ce09
mov dword [rbp + 4], 0
movzx eax, byte [0x140455528]
test eax, eax
jne 0x140175aa3
xor eax, eax
jmp 0x140175b6f
xor edx, edx
mov ecx, dword [rbp + 0x130]
call fcn.14013b202
mov qword [rbp + 0xf8], rax
lea rcx, [0x1404554c0]
call fcn.140135b22
mov qword [rbp + 0x100], rax
mov rax, qword [0x140455520]
mov qword [rbp + 0x108], rax
mov eax, dword [rbp + 0x138]
mov dword [rsp + 0x20], eax
mov r9, qword [rbp + 0xf8]
mov r8, qword [rbp + 0x100]
lea rdx, str.SELECT_count___FROM___s__WHERE__ip____s_AND___rcode___0_OR__rcode___1__AND__time____NOW_____INTERVAL__d_MINUTE
mov rcx, qword [rbp + 0x108]
call fcn.1401388d6
cmp eax, 0xffffffff
jne 0x140175b27
mov eax, dword [0x140450088]
add eax, 8
mov r8d, eax
lea rdx, str.C:UsershagonDesktop_rAthena20240420_rAthena_srcloginloginlog.cpp
mov rcx, qword [0x140455520]
call fcn.140138520
mov rcx, qword [0x140455520]
call fcn.140136072
test eax, eax
jne 0x140175b6c
xor r9d, r9d
lea r8, [rbp + 0x28]
xor edx, edx
mov rcx, qword [0x140455520]
call fcn.140136bd5
mov r8d, 0xa
xor edx, edx
mov rcx, qword [rbp + 0x28]
call fcn.1401369a5
mov dword [rbp + 4], eax
mov rcx, qword [0x140455520]
call fcn.140135aff
mov eax, dword [rbp + 4]
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, reloc.WS2_32.dll_accept
call fcn.14013b80b
mov rax, rdi
lea rsp, [rbp + 0x118]
pop rdi
pop rbp
ret
Function at 0x14013cd87
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x140186eb0
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0x130
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, setsockopt
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x158]
mov rax, qword [0x140450380]
xor rax, rbp
mov qword [rbp + 0x108], rax
lea rcx, reloc.WS2_32.dll_accept
call fcn.14013ce09
lea rax, [rbp + 8]
lea rcx, str.0123456789abcdef
mov rdi, rax
mov rsi, rcx
mov ecx, setsockopt
rep movsb byte [rdi], byte [rsi]
mov qword [rbp + 0x38], 0
jmp 0x140186f31
mov rax, qword [rbp + 0x38]
inc rax
mov qword [rbp + 0x38], rax
mov rax, qword [rbp + 0x140]
cmp qword [rbp + 0x38], rax
jae 0x140186fb8
mov rax, qword [rbp + 0x138]
movzx eax, byte [rax]
and eax, 0xf0
sar eax, 4
cdqe
mov rcx, qword [rbp + 0x130]
movzx eax, byte [rbp + rax + 8]
mov byte [rcx], al
mov rax, qword [rbp + 0x130]
inc rax
mov qword [rbp + 0x130], rax
mov rax, qword [rbp + 0x138]
movzx eax, byte [rax]
and eax, 0xf
sar eax, 0
cdqe
mov rcx, qword [rbp + 0x130]
movzx eax, byte [rbp + rax + 8]
mov byte [rcx], al
mov rax, qword [rbp + 0x130]
inc rax
mov qword [rbp + 0x130], rax
mov rax, qword [rbp + 0x138]
inc rax
mov qword [rbp + 0x138], rax
jmp 0x140186f26
mov rax, qword [rbp + 0x130]
mov byte [rax], 0
mov al, 1
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, reloc.WS2_32.dll_accept
call fcn.14013b80b
mov rax, rdi
mov rcx, qword [rbp + 0x108]
xor rcx, rbp
call fcn.140138cb9
lea rsp, [rbp + 0x110]
pop rdi
pop rsi
pop rbp
ret
Function at 0x14013cdfa
Capabilities:
Get hostname
Resolve dns

Disassembly:
jmp 0x140182550
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x268
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x62
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x288]
mov rax, qword [0x140450380]
xor rax, rbp
mov qword [rbp + 0x238], rax
lea rcx, reloc.WS2_32.dll_accept
call fcn.14013ce09
mov dword [rbp + 4], 0
cmp qword [rbp + 0x260], 0
je 0x1401825b7
cmp dword [rbp + 0x268], 0
jg 0x1401825be
xor eax, eax
jmp 0x14018269b
mov edx, 0xff
lea rcx, [rbp + 0x30]
call qword [sym.imp.WS2_32.dll_gethostname]
cmp eax, 0xffffffff
jne 0x1401825ea
lea rcx, str.socket_getips:_No_hostname_defined__n
call fcn.14013884f
xor eax, eax
jmp 0x14018269b
lea rcx, [rbp + 0x30]
call qword [sym.imp.WS2_32.dll_gethostbyname]
mov qword [rbp + 0x168], rax
cmp qword [rbp + 0x168], 0
jne 0x140182618
lea rcx, str.socket_getips:_Cannot_resolve_our_own_hostname_to_an_IP_address_n
call fcn.14013884f
xor eax, eax
jmp 0x14018269b
mov rax, qword [rbp + 0x168]
mov rax, qword [rax + 0x18]
mov qword [rbp + 0x148], rax
jmp 0x140182634
mov eax, dword [rbp + 4]
inc eax
mov dword [rbp + 4], eax
mov eax, dword [rbp + 0x268]
cmp dword [rbp + 4], eax
jge 0x140182678
movsxd rax, dword [rbp + 4]
mov rcx, qword [rbp + 0x148]
cmp qword [rcx + rax*8], 0
je 0x140182678
movsxd rax, dword [rbp + 4]
mov rcx, qword [rbp + 0x148]
mov rax, qword [rcx + rax*8]
mov ecx, dword [rax]
call qword [sym.imp.WS2_32.dll_ntohl]
movsxd rcx, dword [rbp + 4]
mov rdx, qword [rbp + 0x260]
mov dword [rdx + rcx*4], eax
jmp 0x14018262c
cmp dword [rbp + 4], 0
jne 0x140182698
movsxd rax, dword [rbp + 4]
mov rcx, qword [rbp + 0x260]
mov dword [rcx + rax*4], 0x7f000001
mov eax, dword [rbp + 4]
inc eax
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, reloc.WS2_32.dll_accept
call fcn.14013b80b
mov rax, rdi
mov rcx, qword [rbp + 0x238]
xor rcx, rbp
call fcn.140138cb9
lea rsp, [rbp + 0x248]
pop rdi
pop rbp
ret

Function at 0x14013d070
Capabilities:
Resolve dns

Disassembly:
jmp 0x140180070
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rcx, reloc.WS2_32.dll_accept
call fcn.14013ce09
mov rcx, qword [rbp + 0x100]
call qword [sym.imp.WS2_32.dll_gethostbyname]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
je 0x1401800cc
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rbp + 8]
mov rcx, qword [rcx + 0x18]
mov rax, qword [rax + rcx]
mov ecx, dword [rax]
call qword [sym.imp.WS2_32.dll_ntohl]
mov dword [rbp + 0xd4], eax
jmp 0x1401800d6
mov dword [rbp + 0xd4], 0
mov eax, dword [rbp + 0xd4]
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret
Function at 0x14013d52f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x14036ea30
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x98
mov rax, qword [0x140450380]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov dword [rsp + 0x28], 0
jmp 0x14036ea6c
mov eax, dword [rsp + 0x28]
inc eax
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0x20
jge 0x14036ea98
movsxd rax, dword [rsp + 0x28]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0x20
jae 0x14036ea87
jmp 0x14036ea8c
call fcn.14013aa64
mov rax, qword [rsp + 0x48]
mov byte [rsp + rax + 0x68], 0
jmp 0x14036ea62
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
movzx eax, byte [rax]
and eax, 7
mov ecx, 1
mov dword [rsp + 0x40], ecx
movzx ecx, al
mov eax, dword [rsp + 0x40]
shl eax, cl
mov rcx, qword [rsp + 0x30]
movzx ecx, byte [rcx]
sar ecx, 3
movsxd rcx, ecx
movzx ecx, byte [rsp + rcx + 0x68]
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x30]
movzx ecx, byte [rcx]
sar ecx, 3
movsxd rcx, ecx
mov byte [rsp + rcx + 0x68], al
mov rax, qword [rsp + 0x30]
movzx eax, byte [rax]
mov dword [rsp + 0x44], eax
mov rax, qword [rsp + 0x30]
inc rax
mov qword [rsp + 0x30], rax
cmp dword [rsp + 0x44], 0
jne 0x14036eaa5
cmp qword [rsp + 0xa0], 0
je 0x14036eb25
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x50], rax
jmp 0x14036eb35
mov rax, qword [rsp + 0xb0]
mov rax, qword [rax]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea rax, [rsp + 0x20]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov rax, qword [rax]
movzx eax, byte [rax]
sar eax, 3
cdqe
movzx eax, byte [rsp + rax + 0x68]
mov rcx, qword [rsp + 0x38]
mov rcx, qword [rcx]
movzx ecx, byte [rcx]
and ecx, 7
mov edx, 1
shl edx, cl
mov ecx, edx
and eax, ecx
test eax, eax
je 0x14036eb96
mov rax, qword [rsp + 0x20]
movsx eax, byte [rax]
test eax, eax
je 0x14036eb96
mov rax, qword [rsp + 0x20]
inc rax
mov qword [rsp + 0x20], rax
jmp 0x14036eb49
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x58], rax
jmp 0x14036ebaf
mov rax, qword [rsp + 0x20]
inc rax
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
movsx eax, byte [rax]
test eax, eax
je 0x14036ec06
mov rax, qword [rsp + 0x38]
mov rax, qword [rax]
movzx eax, byte [rax]
sar eax, 3
cdqe
movzx eax, byte [rsp + rax + 0x68]
mov rcx, qword [rsp + 0x38]
mov rcx, qword [rcx]
movzx ecx, byte [rcx]
and ecx, 7
mov edx, 1
shl edx, cl
mov ecx, edx
and eax, ecx
test eax, eax
je 0x14036ec04
mov rax, qword [rsp + 0x20]
mov byte [rax], 0
mov rax, qword [rsp + 0x20]
inc rax
mov qword [rsp + 0x20], rax
jmp 0x14036ec06
jmp 0x14036eba2
mov rax, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x20]
mov qword [rax], rcx
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x20], rax
je 0x14036ec2e
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x60], rax
jmp 0x14036ec37
mov qword [rsp + 0x60], 0
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140138cb9
add rsp, 0x98
ret
Function at 0x1403805d0
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1498
call fcn.140136658
sub rsp, rax
mov rax, qword [0x140450380]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov eax, dword [rsp + 0x14b8]
sar eax, 6
cdqe
lea rcx, [0x140534470]
mov edx, dword [rsp + 0x14b8]
and edx, 0x3f
movsxd rdx, edx
imul rdx, rdx, 0x48
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + rdx + 0x28]
mov qword [rsp + 0x60], rax
mov eax, dword [rsp + 0x14c8]
mov rcx, qword [rsp + 0x14c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x68]
mov rdi, rax
xor eax, eax
mov ecx, reloc.WS2_32.dll_inet_ntoa
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x14c0]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rax
jae 0x1403807c2
lea rax, [rsp + 0x147f]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x38], rax
jae 0x140380716
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rax
jae 0x140380716
mov rax, qword [rsp + 0x48]
movzx eax, byte [rax]
mov byte [rsp + 0x31], al
mov rax, qword [rsp + 0x48]
inc rax
mov qword [rsp + 0x48], rax
movzx eax, byte [rsp + 0x31]
mov byte [rsp + 0x30], al
movsx eax, byte [rsp + 0x30]
cmp eax, 0xa
jne 0x1403806fb
mov eax, dword [rsp + 0x70]
inc eax
mov dword [rsp + 0x70], eax
mov rax, qword [rsp + 0x38]
mov byte [rax], reloc.WS2_32.dll_listen
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx ecx, byte [rsp + 0x30]
mov byte [rax], cl
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
jmp 0x140380698
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
mov r8d, dword [rsp + 0x40]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140380782
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x68], eax
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, reloc.WS2_32.dll_inet_ntoa
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x1403807e1
mov eax, dword [rsp + 0x44]
mov ecx, dword [rsp + 0x6c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6c], eax
mov eax, dword [rsp + 0x40]
cmp dword [rsp + 0x44], eax
jae 0x1403807bd
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, reloc.WS2_32.dll_inet_ntoa
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x1403807e1
jmp 0x14038066e
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, reloc.WS2_32.dll_inet_ntoa
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.140138cb9
add rsp, 0x1498
pop rdi
pop rsi
ret