joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14016d8c0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0x60
mov rbx, rdx
mov rsi, rcx
cmp byte [rcx + 0x40], 0
je 0x14016d9f0
lea rcx, [rsp + 0x40]
call fcn.14013a730
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x20], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x30], xmm1
mov rcx, qword [rbx + 0x108]
test rcx, rcx
je 0x14016da9a
lea rdx, [rsp + 0x90]
call fcn.140137140
test rax, rax
je 0x14016da9a
mov r8d, dword [rax]
movzx edx, r8b
movabs r13, 0xcbf29ce484222325
xor rdx, r13
movabs r12, 0x100000001b3
imul rdx, r12
mov eax, r8d
shr eax, 8
movzx ecx, al
xor rdx, rcx
imul rdx, r12
mov eax, r8d
shr eax, 0x10
movzx ecx, al
xor rdx, rcx
imul rdx, r12
mov eax, r8d
shr rax, 0x18
xor rdx, rax
imul rdx, r12
and rdx, qword [rsi + 0x30]
mov r15, qword [rsi + 0x18]
add rdx, rdx
mov rbx, qword [r15 + rdx*8]
mov rbp, qword [rsi + 8]
cmp rbx, rbp
je 0x14016d9f0
mov rax, qword [r15 + rdx*8 + 8]
cmp dword [rbx + 0x10], r8d
je 0x14016d9ae
nop word [rax + rax]
cmp rbx, rax
je 0x14016d9f0
mov rbx, qword [rbx]
cmp dword [rbx + 0x10], r8d
jne 0x14016d9a0
mov rdi, qword [rbx]
cmp rbx, rax
je 0x14016d9c7
mov rcx, rdi
cmp r8d, dword [rdi + 0x10]
jne 0x14016d9c7
mov rdi, qword [rdi]
cmp rcx, rax
jne 0x14016d9b6
cmp rbx, rdi
je 0x14016d9f0
nop dword [rax]
lea rcx, [rbx + 0x14]
mov r8d, 0x20
lea rdx, [rsp + 0x20]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14016da0b
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x14016d9d0
xor al, al
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r13
pop r12
pop rdi
pop rsi
ret
movzx ecx, byte [rbx + 0x10]
xor rcx, r13
imul rcx, r12
movzx eax, byte [rbx + 0x11]
xor rcx, rax
imul rcx, r12
movzx eax, byte [rbx + 0x12]
xor rcx, rax
imul rcx, r12
movzx eax, byte [rbx + 0x13]
xor rcx, rax
imul rcx, r12
and rcx, qword [rsi + 0x30]
add rcx, rcx
mov rax, qword [r15 + rcx*8]
cmp qword [r15 + rcx*8 + 8], rbx
jne 0x14016da64
cmp rax, rbx
jne 0x14016da59
mov qword [r15 + rcx*8], rbp
mov qword [r15 + rcx*8 + 8], rbp
jmp 0x14016da70
mov rbp, qword [rbx + 8]
mov qword [r15 + rcx*8 + 8], rbp
jmp 0x14016da70
cmp rax, rbx
jne 0x14016da70
mov rax, qword [rbx]
mov qword [r15 + rcx*8], rax
mov rcx, qword [rbx]
dec qword [rsi + 0x10]
mov rax, qword [rbx + 8]
mov qword [rax], rcx
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
mov edx, 0x38
mov rcx, rbx
call fcn.1401daefc
mov al, 1
jmp 0x14016d9f2
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x20]
call fcn.1400102c0
nop
mov rcx, rax
call fcn.14000f8f0
int3
Function at 0x14017c690
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x18
jmp fcn.140170180

Function at 0x14017c6a0
Capabilities:
Encode data using xor

Disassembly:
mov rax, r8
mov r9, rdx
mov r8, rcx
mov edx, eax
mov rcx, r9
jmp fcn.140170170

Function at 0x14017c850
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movdqu xmm3, xmmword [rcx + 0x10]
movdqu xmm0, xmmword [rcx]
movdqu xmmword [rdx + 0x10], xmm3
movdqa xmm2, xmm0
movdqu xmmword [rdx], xmm0
pslldq xmm2, 4
movdqa xmm1, xmm2
pslldq xmm2, 4
pxor xmm1, xmm0
movdqa xmm4, xmm2
pxor xmm4, xmm1
pslldq xmm2, 4
pxor xmm4, xmm2
aeskeygenassist xmm0, xmm3, 1
pshufd xmm1, xmm0, 0xff
pxor xmm4, xmm1
movdqa xmm1, xmm3
pslldq xmm1, 4
movdqa xmm0, xmm1
movdqu xmmword [rdx + 0x20], xmm4
pslldq xmm1, 4
pxor xmm0, xmm3
movdqa xmm2, xmm1
pslldq xmm1, 4
pxor xmm2, xmm0
pxor xmm2, xmm1
aeskeygenassist xmm0, xmm4, 0
pshufd xmm1, xmm0, 0xaa
pxor xmm2, xmm1
movdqa xmm1, xmm4
pslldq xmm1, 4
movdqa xmm0, xmm1
movdqu xmmword [rdx + 0x30], xmm2
pslldq xmm1, 4
pxor xmm0, xmm4
movdqa xmm3, xmm1
pslldq xmm1, 4
pxor xmm3, xmm0
pxor xmm3, xmm1
aeskeygenassist xmm0, xmm2, 2
pshufd xmm1, xmm0, 0xff
pxor xmm3, xmm1
movdqa xmm1, xmm2
pslldq xmm1, 4
movdqa xmm0, xmm1
movdqu xmmword [rdx + 0x40], xmm3
pxor xmm0, xmm2
pslldq xmm1, 4
movdqa xmm2, xmm1
pslldq xmm1, 4
pxor xmm2, xmm0
pxor xmm2, xmm1
aeskeygenassist xmm0, xmm3, 0
pshufd xmm1, xmm0, 0xaa
pxor xmm2, xmm1
movdqa xmm1, xmm3
pslldq xmm1, 4
movdqa xmm0, xmm1
movdqu xmmword [rdx + 0x50], xmm2
pslldq xmm1, 4
pxor xmm0, xmm3
movdqa xmm3, xmm1
pslldq xmm1, 4
pxor xmm3, xmm0
pxor xmm3, xmm1
aeskeygenassist xmm0, xmm2, 4
pshufd xmm1, xmm0, 0xff
pxor xmm3, xmm1
movdqa xmm1, xmm2
pslldq xmm1, 4
movdqa xmm0, xmm1
movdqu xmmword [rdx + 0x60], xmm3
pxor xmm0, xmm2
pslldq xmm1, 4
movdqa xmm2, xmm1
pslldq xmm1, 4
pxor xmm2, xmm0
pxor xmm2, xmm1
aeskeygenassist xmm0, xmm3, 0
pshufd xmm1, xmm0, 0xaa
pxor xmm2, xmm1
movdqa xmm1, xmm3
movdqu xmmword [rdx + 0x70], xmm2
pslldq xmm1, 4
movdqa xmm0, xmm1
pslldq xmm1, 4
movdqa xmm4, xmm1
pxor xmm0, xmm3
pslldq xmm1, 4
pxor xmm4, xmm0
pxor xmm4, xmm1
aeskeygenassist xmm0, xmm2, 8
pshufd xmm1, xmm0, 0xff
pxor xmm4, xmm1
movdqa xmm1, xmm2
pslldq xmm1, 4
movdqa xmm0, xmm1
movdqu xmmword [rdx + 0x80], xmm4
pxor xmm0, xmm2
pslldq xmm1, 4
movdqa xmm3, xmm1
pslldq xmm1, 4
pxor xmm3, xmm0
pxor xmm3, xmm1
aeskeygenassist xmm0, xmm4, 0
pshufd xmm1, xmm0, 0xaa
pxor xmm3, xmm1
movdqa xmm1, xmm4
pslldq xmm1, 4
movdqa xmm0, xmm1
movdqu xmmword [rdx + 0x90], xmm3
pslldq xmm1, 4
pxor xmm0, xmm4
movdqa xmm2, xmm1
pslldq xmm1, 4
pxor xmm2, xmm0
pxor xmm2, xmm1
aeskeygenassist xmm0, xmm3, 0x10
pshufd xmm1, xmm0, 0xff
pxor xmm2, xmm1
movdqu xmmword [rdx + 0xa0], xmm2
ret
Function at 0x1401ae110
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0x100
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
mov rcx, qword [rcx]
call fcn.1401ad1c0
test al, al
jne 0x1401ae2c8
mov dword [rbp - 0x61], edi
mov qword [rbp - 0x59], rsi
xor esi, esi
mov dword [rbp + 0x67], esi
mov qword [rbp + 7], rsi
mov qword [rsp + 0x30], rsi
lea rax, [rbp - 0x11]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x67]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8d, [rsi + 1]
lea rdx, [rbp - 0x61]
mov rcx, qword [rbx + 8]
call qword [sym.imp.WS2_32.dll_WSARecv]
test eax, eax
je 0x1401ae18e
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
jne 0x1401ae2ef
mov rcx, qword [rbx]
call fcn.1401acfa0
mov qword [rbp + 0xf], rax
mov byte [rbp + 0x17], sil
lea rax, [rbp - 0x11]
mov qword [rbx + 0x10], rax
mov rcx, qword [rbx]
call fcn.1401acfa0
lea rdx, [rax + 0x70]
lea rcx, vtable.std::_Func_impl_no_alloc_class__lambda_ba592e99b77cc87b7eb140194ef6b88a___void___.0
mov qword [rbp - 0x51], rcx
mov qword [rbp - 0x49], rbx
lea rcx, [rbp - 0x51]
mov qword [rbp - 0x19], rcx
lea rcx, [rbp - 0x51]
call fcn.14019bce0
mov rcx, qword [rbp - 0x19]
test rcx, rcx
je 0x1401ae1eb
mov rax, qword [rcx]
lea rdx, [rbp - 0x51]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
mov rcx, qword [rbx]
call fcn.1401accb0
mov rcx, qword [rbx]
call fcn.1401acfa0
lea rdi, [rax + 0x70]
mov rcx, qword [rdi + 0x38]
test rcx, rcx
je 0x1401ae218
mov rax, qword [rcx]
cmp rcx, rdi
setne dl
call qword [rax + 0x20]
mov qword [rdi + 0x38], rsi
mov qword [rbx + 0x10], rsi
lea rax, [rbp + 0x67]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rbp + 0x7f]
lea rdx, [rbp - 0x11]
mov rcx, qword [rbx + 8]
call qword [sym.imp.WS2_32.dll_WSAGetOverlappedResult]
cmp eax, 1
je 0x1401ae24e
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e3
jne 0x1401ae28b
jmp 0x1401ae264
mov eax, dword [rbp + 0x7f]
mov rbx, qword [rsp + 0x128]
add rsp, 0x100
pop rdi
pop rsi
pop rbp
ret
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x79], xmm0
mov qword [rbp - 0x69], rax
lea rcx, [rbp - 0x79]
call fcn.140192c20
lea rdx, [0x1402c8ca8]
lea rcx, [rbp - 0x79]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
mov edx, eax
lea rcx, [rbp - 0x51]
call fcn.1401b0020
nop
mov r8, rax
lea rdx, str.TcpConnection::read__WSAGetOverlappedResult_failed_
lea rcx, [rbp + 0x1f]
call fcn.1400d9df0
nop
mov rdx, rax
lea rcx, [rbp - 0x79]
call fcn.1400102e0
lea rdx, [0x1402c83a0]
lea rcx, [rbp - 0x79]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x79], xmm0
mov qword [rbp - 0x69], rax
lea rcx, [rbp - 0x79]
call fcn.140192c20
lea rdx, [0x1402c8ca8]
lea rcx, [rbp - 0x79]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
mov edx, eax
lea rcx, [rbp + 0x1f]
call fcn.1401b0020
nop
mov r8, rax
lea rdx, str.TcpConnection::read__WSARecv_failed_
lea rcx, [rbp - 0x51]
call fcn.1400d9df0
nop
mov rdx, rax
lea rcx, [rbp - 0x79]
call fcn.1400102e0
lea rdx, [0x1402c83a0]
lea rcx, [rbp - 0x79]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x1401af3b0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister
Resolve dns

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x1340]
mov eax, 0x1440
call fcn.1401db830
sub rsp, rax
mov rdi, r8
mov rsi, rdx
mov rcx, qword [rcx]
call fcn.1401ad1c0
test al, al
jne 0x1401af576
movdqa xmm0, xmmword [0x140280640]
movdqu xmmword [rsp + 0x38], xmm0
xor ebx, ebx
mov qword [rsp + 0x48], rbx
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rbx
cmp qword [rdi + 0x18], 0x10
jb 0x1401af418
mov rdi, qword [rdi]
lea r9, [rbp + 0x1350]
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
jne 0x1401af536
mov rax, qword [rbp + 0x1350]
test rax, rax
je 0x1401af44f
inc rbx
mov rax, qword [rax + 0x28]
test rax, rax
jne 0x1401af443
call sub.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_
mov r8d, 0xffffffff
mov dword [rbp + 0x1334], r8d
mov dword [rbp - 0x4c], eax
mov edx, 1
nop dword [rax]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [rbp + rdx*4 - 0x4c], eax
inc rdx
cmp rdx, 0x270
jb 0x1401af470
mov dword [rbp - 0x50], 0x270
lea rax, [rbp - 0x50]
mov qword [rsp + 0x20], rax
mov ecx, 0x40
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
dec rcx
shr rax, 1
cmp rax, r8
ja 0x1401af4b0
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x20]
test rbx, rbx
jne 0x1401af4d6
call fcn.1400637b0
jmp 0x1401af4de
mov rdx, rbx
call fcn.140062e60
mov rbx, qword [rbp + 0x1350]
test rax, rax
je 0x1401af4fa
nop word [rax + rax]
mov rbx, qword [rbx + 0x28]
sub rax, 1
jne 0x1401af4f0
mov rax, qword [rbx + 0x20]
mov ecx, dword [rax + 4]
call qword [sym.imp.WS2_32.dll_ntohl]
mov edx, eax
mov rcx, rsi
call fcn.1401af1a0
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
mov rax, rsi
lea r11, [rsp + 0x1440]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
mov edx, eax
lea rcx, [rsp + 0x68]
call fcn.1401b0020
nop
mov r8, rax
lea rdx, str.Ipv4Resolver::resolve__getaddrinfo_failed_
lea rcx, [rbp - 0x78]
call fcn.1400d9df0
nop
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.1400102e0
lea rdx, [0x1402c83a0]
lea rcx, [rsp + 0x20]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x20]
call fcn.140192c20
lea rdx, [0x1402c8ca8]
lea rcx, [rsp + 0x20]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x1401c2890
Capabilities:
Initialize winsock library

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x1f0
movzx ebx, dl
mov rdi, rcx
mov eax, 1
lock xadd dword [0x1402f2308], eax
inc eax
cmp eax, 1
jne 0x1401c28cb
lea ecx, [rax + 1]
lea rdx, [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_WSAStartup]
xchg dword [0x1402f230c], eax
test bl, bl
je 0x1401c296f
xor ebx, ebx
lock xadd dword [0x1402f230c], ebx
test ebx, ebx
je 0x1401c296f
movabs rcx, 0x4d54ee85da812030
mov qword [rsp + 0x200], rsi
add rcx, qword [0x1402e3470]
lea rsi, [0x1402e3468]
mov dword [rsp + 0x3c], 0
cmp rcx, 1
jbe 0x1401c2924
mov rax, qword [0x1402e3468]
mov edx, ebx
mov rcx, rsi
call qword [rax + 0x30]
jmp 0x1401c2926
mov al, 1
lea rcx, str.C:local_vcpkginstalledx64_windowsinclude_boost_asio_detail_impl_winsock_init.ipp
movzx eax, al
add rax, 2
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x40], rsi
lea rcx, str.throw_on_error
mov rsi, qword [rsp + 0x200]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], 0x48
mov dword [rsp + 0x34], 0x1a
test al, 1
jne 0x1401c2983
mov rbx, qword [rsp + 0x208]
mov rax, rdi
add rsp, 0x1f0
pop rdi
ret
lea r8, [rsp + 0x20]
lea rdx, str.winsock
lea rcx, [rsp + 0x38]
call fcn.1401ccdc0
int3
Function at 0x1401cf920
Capabilities:
Terminate thread

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [rcx + 0x10]
lea rdx, [rsp + 0x20]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rax, qword [rcx + 8]
mov rbx, rcx
mov r9d, 0xffffffff
mov qword [rsp + 0x28], rax
lea ecx, [r8 + 2]
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
lock xadd dword [0x1402f2300], eax
mov rcx, qword [rbx + 8]
test eax, eax
je 0x1401cf97d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
add rsp, 0x30
pop rbx
ret
mov rdx, rcx
xor r8d, r8d
lea rcx, [fcn.1400067a0]
call qword [sym.imp.KERNEL32.dll_QueueUserAPC]
mov rcx, qword [rbx + 8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
add rsp, 0x30
pop rbx
ret
Function at 0x1401d8820
Capabilities:
Get local ipv4 addresses
Get socket information
Resolve dns
Send data
Send data on socket
Send http request
Send http request with host header

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x8c0
movzx edi, dx
mov r14, r8
mov r8d, dword [rsp + 0x910]
movzx edx, di
mov r15, r9
mov dword [r9], 0
mov rbp, rcx
call fcn.1401d93f0
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x1401d8869
xor eax, eax
jmp 0x1401d89b4
mov qword [rsp + 0x8e0], rbx
mov rbx, qword [rsp + 0x900]
test rbx, rbx
je 0x1401d890f
lea r8, [rsp + 0x8f8]
mov dword [rsp + 0x8f8], 0x80
lea rdx, [rsp + 0x40]
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jns 0x1401d88b6
lea rcx, str.getsockname
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_perror]
jmp 0x1401d890f
mov r9d, dword [rsp + 0x908]
lea rcx, [rsp + 0x40]
mov edx, dword [rsp + 0x8f8]
mov r8, rbx
mov dword [rsp + 0x30], 0xa
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.WS2_32.dll_getnameinfo]
mov ebx, eax
test eax, eax
je 0x1401d890f
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8d, ebx
lea rdx, str.getnameinfo___failed_:__d_n
mov rcx, rax
call fcn.1401693b0
mov dword [rsp + 0x30], edi
lea rax, [0x14028231c]
mov qword [rsp + 0x28], rbp
lea r8, str.GET__s_HTTP__s_r_nHost:__s:_d_r_nConnection:_Close_r_nUser_Agent:_Windows__UPnP_1.1__MiniUPnPc_2.2.2_r_n_r_n
mov r9, r14
mov qword [rsp + 0x20], rax
mov edx, 0x800
lea rcx, [rsp + 0xc0]
call fcn.1401c0260
mov edi, eax
cmp eax, 0x800
jae 0x1401d89da
xor ebx, ebx
test eax, eax
jle 0x1401d898a
nop dword [rax]
nop word [rax + rax]
mov r8d, edi
movsxd rax, ebx
lea rdx, [rsp + 0xc0]
sub r8d, ebx
add rdx, rax
xor r9d, r9d
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
js 0x1401d89cd
add ebx, eax
cmp ebx, edi
jl 0x1401d8960
mov r8, qword [rsp + 0x918]
mov rdx, r15
mov rcx, rsi
call fcn.1401d8140
mov rcx, rsi
mov rbx, rax
call qword [sym.imp.WS2_32.dll_closesocket]
mov rax, rbx
mov rbx, qword [rsp + 0x8e0]
lea r11, [rsp + 0x8c0]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
lea rcx, str.send
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_perror]
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
jmp 0x1401d89ac
Function at 0x1401d8d90
Capabilities:
Send data
Send data on socket
Send http request
Send http request with host header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r14
sub rsp, 0x260
mov rsi, qword [rsp + 0x2a8]
mov rbx, 0xffffffffffffffff
mov rdi, rbx
mov rbp, r8
mov r14, rdx
mov r12, rcx
inc rdi
cmp byte [rsi + rdi], 0
jne 0x1401d8dc6
mov byte [rsp + 0x50], 0
cmp r9w, 0x50
je 0x1401d8df5
movzx r9d, r9w
lea r8, str.:_hu
mov edx, 8
lea rcx, [rsp + 0x50]
call fcn.1401c0260
mov rax, qword [rsp + 0x2a0]
lea r8, str.POST__s_HTTP__s_r_nHost:__s_s_r_nUser_Agent:_Windows__UPnP_1.1__MiniUPnPc_2.2.2_r_nContent_Length:__d_r_nContent_Type:_text_xml_r_nSOAPAction:___s__r_nConnection:_Close_r_nCache_Control:_no_cache_r_nPragma:_no_cache_r_n_r_n
mov rcx, qword [rsp + 0x2b0]
mov r9, r14
mov qword [rsp + 0x40], rax
mov edx, 0x200
mov dword [rsp + 0x38], edi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x60]
call fcn.1401c0260
movsxd r14, eax
cmp r14d, 0x200
jae 0x1401d8ede
mov qword [rsp + 0x280], r15
lea r15d, [r14 + rdi]
movsxd rcx, r15d
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbp, rax
test rax, rax
je 0x1401d8ed6
mov r8, r14
lea rdx, [rsp + 0x60]
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
movsxd r8, edi
lea rcx, [r14 + rbp]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
xor r9d, r9d
mov r8d, r15d
mov rdx, rbp
mov rcx, r12
call qword [sym.imp.WS2_32.dll_send]
mov edi, eax
test eax, eax
jns 0x1401d8ecb
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, 2
mov ebx, eax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r9d, ebx
lea r8, str.send
mov rcx, rax
lea rdx, str.Socket_error:__s___d_n
call fcn.1401693b0
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ebx, edi
mov r15, qword [rsp + 0x280]
lea r11, [rsp + 0x260]
mov eax, ebx
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r12
pop rdi
ret
Function at 0x1401d9990
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x250
mov rsi, rdx
mov qword [rsp + 0x48], rcx
mov eax, 0x10624dd3
mov dword [rsp + 0x40], 1
imul r9d
mov edi, r8d
mov rbx, rcx
sar edx, 6
xor r8d, r8d
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x3e8
mov dword [rsp + 0x30], edx
lea rdx, [rsp + 0x40]
sub r9d, eax
imul eax, r9d, 0x3e8
xor r9d, r9d
lea ecx, [r9 + 0x40]
mov dword [rsp + 0x34], eax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_select]
test eax, eax
jns 0x1401d9a38
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, 2
mov ebx, eax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r9d, ebx
lea r8, str.select
mov rcx, rax
lea rdx, str.Socket_error:__s___d_n
call fcn.1401693b0
mov eax, 0xffffffff
jmp 0x1401d9a97
jne 0x1401d9a3e
xor eax, eax
jmp 0x1401d9a97
xor r9d, r9d
mov r8d, edi
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_recv]
mov edi, eax
test eax, eax
jns 0x1401d9a82
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, 2
mov ebx, eax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r9d, ebx
lea r8, str.recv
mov rcx, rax
lea rdx, str.Socket_error:__s___d_n
call fcn.1401693b0
mov rax, qword [rsp + 0x280]
test rax, rax
je 0x1401d9a95
mov dword [rax], 0
mov eax, edi
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x1401dbfc0
Capabilities:
Accept command line arguments

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x70
xor ebx, ebx
mov dword [rsp + 0x90], ebx
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x90]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [rsp + 0xa8], rax
mov rdi, rax
test rax, rax
jne 0x1401dc006
lea rax, [rbx - 1]
add rsp, 0x70
pop r15
pop rdi
pop rbx
ret
mov eax, dword [rsp + 0x90]
mov r15, 0xffffffffffffffff
inc eax
mov qword [rsp + 0x60], rsi
movsxd rcx, eax
mov eax, 8
mul rcx
mov qword [rsp + 0x48], r14
cmovo rax, r15
mov rcx, rax
call fcn.1401db59c
mov r14, rax
mov qword [rsp + 0xa0], rax
mov eax, dword [rsp + 0x90]
test eax, eax
je 0x1401dc0ff
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x58], r12
mov r12, r14
mov qword [rsp + 0x50], r13
mov r13, rdi
sub r13, r14
mov r14d, ebx
nop dword [rax]
mov rbp, qword [r12 + r13]
mov r9d, r15d
mov qword [rsp + 0x38], rbx
mov r8, rbp
mov qword [rsp + 0x30], rbx
xor edx, edx
mov dword [rsp + 0x28], ebx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rdi, eax
mov rcx, rdi
call fcn.1401db59c
mov qword [rsp + 0x38], rbx
mov r9d, r15d
mov qword [rsp + 0x30], rbx
mov r8, rbp
mov dword [rsp + 0x28], edi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov qword [r12], rsi
lea r12, [r12 + 8]
mov eax, dword [rsp + 0x90]
inc r14d
cmp r14d, eax
jne 0x1401dc070
mov r14, qword [rsp + 0xa0]
mov rdi, qword [rsp + 0xa8]
mov r13, qword [rsp + 0x50]
mov r12, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x68]
cdqe
mov rcx, rdi
mov qword [r14 + rax*8], rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [rsp + 0x90]
mov rdx, r14
call fcn.14004aab0
mov esi, eax
cmp dword [rsp + 0x90], ebx
je 0x1401dc14c
mov rdi, r14
nop dword [rax + rax]
mov rcx, qword [rdi]
test rcx, rcx
je 0x1401dc14c
call fcn.1401daefc
inc ebx
add rdi, 8
cmp ebx, dword [rsp + 0x90]
jne 0x1401dc130
mov rcx, r14
call fcn.1401daefc
mov r14, qword [rsp + 0x48]
mov eax, esi
mov rsi, qword [rsp + 0x60]
add rsp, 0x70
pop r15
pop rdi
pop rbx
ret
jmp 0x1401dbfc0
Function at 0x1401dc170
Capabilities:
Accept command line arguments

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x70
xor ebx, ebx
mov dword [rsp + 0x90], ebx
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x90]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [rsp + 0xa8], rax
mov rdi, rax
test rax, rax
jne 0x1401dc006
lea rax, [rbx - 1]
add rsp, 0x70
pop r15
pop rdi
pop rbx
ret
mov eax, dword [rsp + 0x90]
mov r15, 0xffffffffffffffff
inc eax
mov qword [rsp + 0x60], rsi
movsxd rcx, eax
mov eax, 8
mul rcx
mov qword [rsp + 0x48], r14
cmovo rax, r15
mov rcx, rax
call fcn.1401db59c
mov r14, rax
mov qword [rsp + 0xa0], rax
mov eax, dword [rsp + 0x90]
test eax, eax
je 0x1401dc0ff
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x58], r12
mov r12, r14
mov qword [rsp + 0x50], r13
mov r13, rdi
sub r13, r14
mov r14d, ebx
nop dword [rax]
mov rbp, qword [r12 + r13]
mov r9d, r15d
mov qword [rsp + 0x38], rbx
mov r8, rbp
mov qword [rsp + 0x30], rbx
xor edx, edx
mov dword [rsp + 0x28], ebx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rdi, eax
mov rcx, rdi
call fcn.1401db59c
mov qword [rsp + 0x38], rbx
mov r9d, r15d
mov qword [rsp + 0x30], rbx
mov r8, rbp
mov dword [rsp + 0x28], edi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov qword [r12], rsi
lea r12, [r12 + 8]
mov eax, dword [rsp + 0x90]
inc r14d
cmp r14d, eax
jne 0x1401dc070
mov r14, qword [rsp + 0xa0]
mov rdi, qword [rsp + 0xa8]
mov r13, qword [rsp + 0x50]
mov r12, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x68]
cdqe
mov rcx, rdi
mov qword [r14 + rax*8], rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [rsp + 0x90]
mov rdx, r14
call fcn.14004aab0
mov esi, eax
cmp dword [rsp + 0x90], ebx
je 0x1401dc14c
mov rdi, r14
nop dword [rax + rax]
mov rcx, qword [rdi]
test rcx, rcx
je 0x1401dc14c
call fcn.1401daefc
inc ebx
add rdi, 8
cmp ebx, dword [rsp + 0x90]
jne 0x1401dc130
mov rcx, r14
call fcn.1401daefc
mov r14, qword [rsp + 0x48]
mov eax, esi
mov rsi, qword [rsp + 0x60]
add rsp, 0x70
pop r15
pop rdi
pop rbx
ret
jmp 0x1401dbfc0