joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140173c70
Capabilities:
Get common file path

Disassembly:
push rdi
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rsi
mov rbx, r9
mov r14d, edx
mov r15, rcx
mov ecx, 0x458
call fcn.1401aed4c
mov rsi, rax
mov qword [rsp + 0x28], rax
xor ebp, ebp
mov qword [rax], rbp
mov rdi, 0xffffffffffffffff
mov dword [rax + 8], edi
mov dword [rax + 0x23c], edi
mov qword [rax + 0x240], rbp
mov qword [rax + 0x248], rbp
test rbx, rbx
je 0x140173d0e
mov rcx, rdi
nop dword [rax + rax]
inc rcx
cmp byte [rbx + rcx], bpl
jne 0x140173ce0
inc rcx
call fcn.1401af66c
mov qword [rsi + 0x240], rax
sub rax, rbx
nop dword [rax + rax]
movzx ecx, byte [rbx]
mov byte [rax + rbx], cl
lea rbx, [rbx + 1]
test cl, cl
jne 0x140173d00
cmp qword [rsi], 0
jne 0x140173dbc
cmp dword [rsi + 8], 0xffffffff
jne 0x140173dbc
lea rbx, [rsi + 0x250]
mov rdx, rbx
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
nop word [rax + rax]
lea rdi, [rdi + 1]
cmp word [rbx + rdi*2], 0
jne 0x140173d40
movzx eax, word [rsi + rdi*2 + 0x24e]
cmp ax, 0x5c
je 0x140173d75
cmp ax, 0x2f
je 0x140173d75
sub rbx, 2
lea rbx, [rbx + 2]
cmp word [rbx], 0
jne 0x140173d63
mov eax, dword [0x1403ff894]
mov dword [rbx], eax
mov ecx, 0x30
call fcn.1401aed4c
mov word [rax], 0x100
mov byte [rax + 0x18], 0
mov qword [rax + 0x20], r15
mov dword [rax + 0x28], r14d
mov dword [rax + 0x2c], ebp
mov dword [rax + 0x14], ebp
mov rcx, rax
call fcn.140172280
mov qword [rsi], rax
test rax, rax
jne 0x140173dc1
mov dword [0x1404929e0], 0x200
mov rcx, rsi
call fcn.140173e10
xor eax, eax
jmp 0x140173deb
mov ebp, 0x1000000
mov dword [0x1404929e0], ebp
test ebp, ebp
je 0x140173dd7
mov rcx, rsi
call fcn.140173e10
xor eax, eax
jmp 0x140173deb
mov ecx, reloc.WS2_32.dll_recv
call fcn.1401aed4c
mov dword [rax], 1
mov qword [rax + 8], rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x140180c00
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov rdx, qword [rcx + 0x300]
test rdx, rdx
je 0x140180c19
mov rax, qword [rdx]
mov rcx, rdx
jmp qword [rax + 0x148]
cmp byte [rcx + 0xbf], 0
jne 0x140180c36
mov rax, qword [rcx + 0x30]
test rax, rax
je 0x140180c36
mov rdx, rcx
mov rcx, rax
jmp fcn.14014ed20
ret
Function at 0x140183750
Capabilities:
Create process on windows
Query environment variable

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0x90
mov qword [rbp - 1], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov rax, qword [0x14047b0a0]
xor rax, rsp
mov qword [rbp + 0x47], rax
xor esi, esi
mov edi, esi
mov dword [rbp - 9], esi
xor r8d, r8d
xor edx, edx
lea rcx, str.CommonProgramW6432
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ebx, eax
mov qword [rbp + 0x17], rsi
mov qword [rbp + 0x1f], 7
mov word [rbp + 7], si
test eax, eax
je 0x140183902
mov edx, ebx
xor r8d, r8d
lea rcx, [rbp + 7]
call fcn.140088be0
lea rdx, [rbp + 7]
cmp qword [rbp + 0x1f], 8
cmovae rdx, qword [rbp + 7]
mov r8d, ebx
lea rcx, str.CommonProgramW6432
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov rdx, qword [rbp + 0x17]
test rdx, rdx
je 0x140183902
lea rax, [rbp + 7]
mov rcx, qword [rbp + 7]
mov r9, qword [rbp + 0x1f]
cmp r9, 8
cmovae rax, rcx
cmp word [rax + rdx*2 - 2], si
jne 0x140183873
movdqa xmm0, xmmword [0x140415690]
movdqu xmmword [rbp + 0x37], xmm0
mov word [rbp + 0x27], si
lea r8, [rdx - 1]
cmp rdx, r8
cmovb r8, rdx
lea rdx, [rbp + 7]
cmp r9, 8
cmovae rdx, rcx
lea rcx, [rbp + 0x27]
call fcn.14007ece0
lea edi, [rsi + 1]
lea rcx, [rbp + 7]
call fcn.14007ec70
movups xmm0, xmmword [rbp + 0x27]
movups xmmword [rbp + 7], xmm0
movups xmm1, xmmword [rbp + 0x37]
movups xmmword [rbp + 0x17], xmm1
movdqa xmm0, xmmword [0x140415690]
movdqu xmmword [rbp + 0x37], xmm0
mov word [rbp + 0x27], si
lea rcx, [rbp + 0x27]
call fcn.14007ec70
mov rdx, qword [rbp + 0x17]
movdqa xmm0, xmmword [0x140415690]
movdqu xmmword [rbp + 0x37], xmm0
mov word [rbp + 0x27], si
or edi, 2
mov dword [rbp - 9], edi
add rdx, 0x20
lea rcx, [rbp + 0x27]
call fcn.1400829d0
lea rdx, [rbp + 7]
cmp qword [rbp + 0x1f], 8
cmovae rdx, qword [rbp + 7]
mov r8, qword [rbp + 0x17]
lea rcx, [rbp + 0x27]
call fcn.14007e3d0
mov r8d, 0x20
lea rdx, str.microsoft_sharedinkTabTip.exe
lea rcx, [rbp + 0x27]
call fcn.14007e3d0
lea rcx, [rbp + 7]
call fcn.14007ec70
movups xmm0, xmmword [rbp + 0x27]
movups xmmword [rbp + 7], xmm0
movups xmm1, xmmword [rbp + 0x37]
movups xmmword [rbp + 0x17], xmm1
movdqa xmm0, xmmword [0x140415690]
movdqu xmmword [rbp + 0x37], xmm0
mov word [rbp + 0x27], si
lea rcx, [rbp + 0x27]
call fcn.14007ec70
cmp qword [rbp + 0x17], 0
jne 0x140183918
mov r8d, 0x3e
lea rdx, str.C:Program_FilesCommon_Filesmicrosoft_sharedinkTabTip.exe
lea rcx, [rbp + 7]
call fcn.14007ece0
lea r8, [rbp + 7]
cmp qword [rbp + 0x1f], 8
cmovae r8, qword [rbp + 7]
mov dword [rsp + 0x28], 0xa
mov qword [rsp + 0x20], rsi
xor r9d, r9d
lea rdx, [0x1403ff888]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
lea rcx, [rbp + 7]
call fcn.14007ec70
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1401aed20
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x1401b8bb0
Capabilities:
Set thread local storage value

Disassembly:
mov eax, Ordinal_41
call fcn.1401afbb0
sub rsp, rax
mov ecx, dword [rcx]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
add rsp, 0x28
ret
Function at 0x1401cc0d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
mov eax, 0x20
call fcn.1401afbb0
sub rsp, rax
mov rbx, rcx
mov rsi, rdx
mov rcx, rdx
call fcn.1401ca6b0
test eax, eax
je 0x1401cc10f
xor edx, edx
mov rcx, rbx
call fcn.1401cab60
mov eax, 1
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret
mov qword [rsp + 0x30], rbp
mov ebp, dword [rsi + 8]
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], r14
mov r14, qword [rsi]
lea eax, [rbp - 1]
movsxd rdi, eax
xor eax, eax
mov rcx, qword [r14 + rdi*8]
cmp rcx, 1
sete al
sub ebp, eax
cmp rsi, rbx
je 0x1401cc157
mov edx, ebp
mov rcx, rbx
call fcn.1401cb0c0
test rax, rax
je 0x1401cc1bd
mov eax, dword [rsi + 0x10]
mov dword [rbx + 0x10], eax
mov rcx, qword [r14 + rdi*8]
mov rax, qword [rbx]
mov rdx, rcx
xor rdx, 1
inc rdx
neg rdx
shl rdx, 0x3f
lea r8, [rax + rdi*8]
shr rcx, 1
je 0x1401cc177
mov qword [r8], rcx
test rdi, rdi
jle 0x1401cc1ae
sub r14, rax
nop
mov rcx, qword [r14 + r8 - 8]
lea r8, [r8 - 8]
mov rax, rcx
dec rdi
shr rax, 1
or rax, rdx
mov rdx, rcx
xor rdx, 1
mov qword [r8], rax
inc rdx
neg rdx
shl rdx, 0x3f
test rdi, rdi
jg 0x1401cc180
mov dword [rbx + 8], ebp
test ebp, ebp
jne 0x1401cc1b8
mov dword [rbx + 0x10], ebp
mov eax, 1
mov rdi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
mov r14, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret

Function at 0x1401d1600
Capabilities:
Get thread local storage value

Disassembly:
mov eax, Ordinal_41
call fcn.1401afbb0
sub rsp, rax
lea rcx, [0x140490ec8]
add rsp, 0x28
jmp fcn.1401b8a10
Function at 0x1401fd9a0
Capabilities:
Resolve dns

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
mov eax, 0x60
call fcn.1401afbb0
sub rsp, rax
xor ebx, ebx
mov edi, r9d
mov r14d, r8d
mov rsi, rdx
mov rbp, rcx
cmp r9d, 0x17
ja 0x1401fda8c
mov eax, 0x800005
bt eax, r9d
jae 0x1401fda8c
call fcn.1401fd730
cmp eax, 1
jne 0x1401fdaac
mov eax, dword [rsp + 0x90]
xorps xmm0, xmm0
mov dword [rsp + 0x30], ebx
xorps xmm1, xmm1
mov dword [rsp + 0x34], edi
mov ecx, ebx
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x3c], ebx
movdqu xmmword [rsp + 0x40], xmm0
movdqu xmmword [rsp + 0x50], xmm1
cmp r14d, 1
jne 0x1401fda30
or ecx, r14d
mov dword [rsp + 0x30], ecx
mov r9, qword [rsp + 0x98]
lea r8, [rsp + 0x30]
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov edi, eax
test eax, eax
je 0x1401fda85
mov edx, Ordinal_145
mov dword [rsp + 0x20], 0x2c0
lea r9, str.crypto_bio_b_addr.c
lea ecx, [rdx - 0x6f]
lea r8d, [rcx - 0x1e]
call fcn.1401b3390
mov ecx, edi
call fcn.1401fdf80
mov rdx, rax
mov ecx, 1
call fcn.1401b25a0
jmp 0x1401fdaac
mov ebx, 1
jmp 0x1401fdaac
mov edx, Ordinal_145
mov dword [rsp + 0x20], 0x293
lea r9, str.crypto_bio_b_addr.c
lea ecx, [rdx - 0x6f]
lea r8d, [rdx - 0xc]
call fcn.1401b3390
lea r11, [rsp + 0x60]
mov eax, ebx
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret

Function at 0x140201ee0
Capabilities:
Encode data using xor

Disassembly:
mov eax, gethostname
call fcn.1401afbb0
sub rsp, rax
mov r10, rdx
mov dword [rsp + 0x40], reloc.WS2_32.dll_recv
add rdx, 0xf
lea rax, [r8 + 0xf]
mov r11, rcx
cmp r10, rax
ja 0x140201f10
xor r9d, r9d
cmp rdx, r8
jae 0x140201f29
movdqu xmm1, xmmword [r10]
movdqu xmm0, xmmword [r8]
pxor xmm1, xmm0
movdqu xmmword [r10], xmm1
mov r9d, reloc.WS2_32.dll_recv
cmp r9, 0x10
jae 0x140201f51
sub r8, r10
lea rax, [r9 + r10]
mov edx, reloc.WS2_32.dll_recv
sub rdx, r9
nop
movzx ecx, byte [r8 + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x140201f40
mov rcx, qword [r11 + 8]
lea r8, [rsp + 0x40]
mov r9, r10
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
mov rdx, r10
call fcn.14021a7b0
test eax, eax
je 0x140201f82
cmp dword [rsp + 0x40], 0x10
jne 0x140201f82
mov eax, 1
add rsp, 0x38
ret
xor eax, eax
add rsp, 0x38
ret

Function at 0x140202130
Capabilities:
Encode data using xor

Disassembly:
mov r10, rcx
test rdx, rdx
je 0x1402021b8
test r8, r8
je 0x1402021b8
mov rax, qword [rcx + 0x18]
cmp r8, rax
mov r9, rax
cmovb r9, r8
test r9, r9
je 0x140202176
add rcx, 0x20
mov r11, rdx
sub r11, r10
nop
movzx eax, byte [r11 + rcx - 0x20]
xor byte [rcx], al
lea rcx, [rcx + 1]
sub r9, 1
jne 0x140202160
mov rax, qword [r10 + 0x18]
cmp r8, rax
jbe 0x1402021b8
sub r8, rax
mov eax, reloc.WS2_32.dll_recv
cmp r8, rax
cmova r8, rax
xor ecx, ecx
test r8, r8
je 0x1402021b8
nop dword [rax]
nop word [rax + rax]
mov rax, qword [r10 + 0x18]
add rax, rcx
movzx eax, byte [rax + rdx]
xor byte [r10 + rcx + 0x40], al
inc rcx
cmp rcx, r8
jb 0x1402021a0
ret
Function at 0x14024cf40
Capabilities:
Encode data using xor

Disassembly:
mov eax, gethostname
call fcn.1401afbb0
sub rsp, rax
cmp dword [rsp + 0x68], 0
je 0x14024cf69
lea rax, [0x14024b5b0]
mov qword [rsp + 0x68], rax
add rsp, 0x38
jmp fcn.140244790
lea rax, [0x14024a770]
mov qword [rsp + 0x68], rax
add rsp, 0x38
jmp fcn.1402444e0

Function at 0x140253459
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x14025364a
push rbx
mov eax, reloc.WLDAP32.dll_Ordinal_208
call fcn.1401afbb0
sub rsp, rax
mov rax, qword [0x14047b0a0]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xe8], rbp
mov rbx, rdx
mov qword [rsp + 0xf0], rsi
lea rbp, [r8 - 1]
mov qword [rsp + 0xf8], rdi
mov qword [rsp + 0xc8], r14
lea r14, [rcx + 0xc]
shr rbp, 3
mov qword [rsp + 0xc0], r15
inc rbp
lea r15, [rcx + 0x14]
nop word [rax + rax]
movzx eax, byte [rbx + 1]
mov rcx, r14
movzx edi, byte [rbx]
movzx esi, byte [rbx + 4]
lea rbx, [rbx + 8]
shl eax, 8
or edi, eax
movzx eax, byte [rbx - 6]
shl eax, 0x10
or edi, eax
movzx eax, byte [rbx - 5]
shl eax, 0x18
or edi, eax
movzx eax, byte [rbx - 3]
shl eax, 8
or esi, eax
mov dword [rsp + 0x20], edi
movzx eax, byte [rbx - 2]
shl eax, 0x10
or esi, eax
mov dword [rsp + 0x28], edi
movzx eax, byte [rbx - 1]
and byte [r14], 0xdf
and byte [r15], 0xbf
or byte [r14], 0x40
or byte [r15], 0x20
shl eax, 0x18
or esi, eax
mov dword [rsp + 0x24], esi
mov dword [rsp + 0x2c], esi
call fcn.14023c4d0
lea rdx, [rsp + 0x30]
mov rcx, r14
call fcn.14023be70
mov r8d, 1
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x28]
call fcn.140238bb0
mov rcx, r15
call fcn.14023c4d0
lea rdx, [rsp + 0x30]
mov rcx, r15
call fcn.14023be70
mov r8d, 1
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
call fcn.140238bb0
mov r8d, dword [rsp + 0x20]
mov edx, dword [rsp + 0x24]
xor r8d, edi
xor edi, dword [rsp + 0x28]
xor edx, esi
xor esi, dword [rsp + 0x2c]
mov eax, edi
mov byte [r14], dil
shr eax, 8
mov byte [r14 + 1], al
mov eax, edi
shr eax, 0x10
mov byte [r14 + 2], al
mov eax, edx
shr eax, 8
shr edi, 0x18
mov byte [r14 + 3], dil
mov byte [r14 + 4], dl
mov byte [r14 + 5], al
mov eax, edx
shr eax, 0x10
mov byte [r14 + 6], al
mov eax, r8d
shr eax, 8
shr edx, 0x18
mov byte [r14 + 7], dl
mov byte [r15], r8b
mov byte [r15 + 1], al
mov eax, r8d
shr eax, 0x10
mov byte [r15 + 2], al
shr r8d, 0x18
mov byte [r15 + 3], r8b
mov byte [r15 + 4], sil
mov eax, esi
shr eax, 8
mov byte [r15 + 5], al
mov eax, esi
shr eax, 0x10
shr esi, 0x18
mov byte [r15 + 6], al
mov byte [r15 + 7], sil
sub rbp, 1
jne 0x1402534c0
mov r15, qword [rsp + 0xc0]
mov r14, qword [rsp + 0xc8]
mov rdi, qword [rsp + 0xf8]
mov rsi, qword [rsp + 0xf0]
mov rbp, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1401aed20
add rsp, 0xd0
pop rbx
ret
Function at 0x140291600
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov r14, rcx
mov ebx, 1
mov edx, ebx
xor ecx, ecx
xor ebp, ebp
call qword [fcn.1402e51d4]
mov rdi, rax
test rax, rax
je 0x14029167d
nop word [rax + rax]
mov r8d, ebx
mov rdx, rdi
mov rcx, r14
mov rbp, rdi
mov esi, ebx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov ebx, eax
test eax, eax
je 0x1402916a8
cmp ebx, esi
je 0x1402916a8
cmp ebx, 0x8000
ja 0x1402916a8
cmp ebx, esi
jb 0x1402916a3
mov edx, ebx
mov rcx, rdi
call qword [fcn.1402e51d4]
mov rdi, rax
test rax, rax
jne 0x140291640
mov rcx, rbp
call qword [fcn.1402e51e4]
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov rax, rdi
jmp 0x140291688
mov rcx, rdi
jmp 0x140291680
jmp 0x140291600

Function at 0x1402916b0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov r14, rcx
mov ebx, 1
mov edx, ebx
xor ecx, ecx
xor ebp, ebp
call qword [fcn.1402e51d4]
mov rdi, rax
test rax, rax
je 0x14029167d
nop word [rax + rax]
mov r8d, ebx
mov rdx, rdi
mov rcx, r14
mov rbp, rdi
mov esi, ebx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov ebx, eax
test eax, eax
je 0x1402916a8
cmp ebx, esi
je 0x1402916a8
cmp ebx, 0x8000
ja 0x1402916a8
cmp ebx, esi
jb 0x1402916a3
mov edx, ebx
mov rcx, rdi
call qword [fcn.1402e51d4]
mov rdi, rax
test rax, rax
jne 0x140291640
mov rcx, rbp
call qword [fcn.1402e51e4]
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov rax, rdi
jmp 0x140291688
mov rcx, rdi
jmp 0x140291680
jmp 0x140291600

Function at 0x140294400
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor edi, edi
lea rax, [rcx + rdx]
mov rbp, rax
mov rbx, rcx
sub rbp, rcx
mov esi, 0x1505
cmp rcx, rax
cmova rbp, rdi
test rbp, rbp
je 0x140294083
movzx ecx, byte [rbx]
call fcn.1402928b0
imul rsi, rsi, 0x21
movsx rcx, al
lea rbx, [rbx + 1]
xor rsi, rcx
inc rdi
cmp rdi, rbp
jb 0x140294064
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
movzx eax, sil
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x140294436
call fcn.1402a9930
test al, al
jne 0x140294436
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.1402946d0
mov rdx, qword [rsp + 0x30]
mov rcx, rax
add rsp, 0x20
pop rbx
jmp 0x140294030
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x14029df30
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov edi, ecx
mov rbx, rdx
mov rcx, r8
call fcn.140276f80
mov r8d, eax
mov rdx, rbx
mov ecx, edi
call fcn.140300acc
mov rbx, qword [rsp + 0x30]
cdqe
add rsp, 0x20
pop rdi
ret
Function at 0x1402a5d70
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp byte [rcx + 0xb36], 0
mov rsi, r9
mov rbp, r8
movsxd rbx, edx
mov rdi, rcx
je 0x1402a5e17
cmp qword [rcx + 0x278], 0
je 0x1402a5dd7
mov dl, 1
call fcn.1402a1920
mov rax, qword [rdi + 0x1d8]
mov r9, rsi
mov r8, rbp
mov qword [rsp + 0x20], rax
mov edx, ebx
mov rcx, rdi
call qword [rdi + 0x278]
xor edx, edx
mov rcx, rdi
mov ebx, eax
call fcn.1402a1920
mov eax, ebx
jmp 0x1402a5e19
cmp ebx, 2
ja 0x1402a5e17
mov r9, qword [rdi + 0x1d0]
lea rdx, [0x1403d3e30]
lea rcx, [rbx + rbx*2]
add rcx, rdx
mov edx, 2
lea r8d, [rdx - 1]
call fcn.1402f8ad8
mov r9, qword [rdi + 0x1d0]
mov r8d, 1
mov rdx, rsi
mov rcx, rbp
call fcn.1402f8ad8
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x1402a6030
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, r9
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recv]
movsxd rcx, eax
cmp rcx, 0xffffffffffffffff
jne 0x1402a6072
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, gethostname
mov qword [rbx], 0
cmp eax, 0x2733
mov edx, 0x51
cmove ecx, edx
mov eax, ecx
add rsp, 0x20
pop rbx
ret
mov qword [rbx], rcx
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x1402a61a0
Capabilities:
Send data
Send data on socket

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x130
mov rax, qword [0x14047b0a0]
xor rax, rsp
mov qword [rsp + 0x120], rax
mov rbx, qword [rsp + 0x180]
mov rdi, r8
movsxd r8, edx
mov rsi, r9
mov rdx, qword [rcx + 0x18]
mov rbp, rcx
mov r14, qword [rdx + r8*8 + 0x1e8]
call fcn.1402a6680
test eax, eax
je 0x1402a61f8
mov dword [rbx], reloc.WLDAP32.dll_Ordinal_27
mov rax, 0xffffffffffffffff
jmp 0x1402a6265
xor r9d, r9d
mov r8d, esi
mov rdx, rdi
mov rcx, r14
call qword [sym.imp.WS2_32.dll_send]
movsxd rdi, eax
mov dword [rbx], 0
cmp rdi, 0xffffffffffffffff
jne 0x1402a6262
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
cmp eax, 0x2733
jne 0x1402a6232
xor edi, edi
mov dword [rbx], 0x51
jmp 0x1402a6262
mov r8d, 0x100
lea rdx, [rsp + 0x20]
mov ecx, esi
call fcn.1402a8a20
mov r8, rax
lea rdx, str.Send_failure:__s
mov rcx, rbp
call fcn.1402a5e30
mov dword [rbp + 0xdec], esi
mov dword [rbx], gethostname
mov rax, rdi
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.1401aed20
add rsp, 0x130
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1402a6680
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
movsxd r9, r8d
lea rbx, [rdx + 0x230]
mov rax, r9
mov rbp, rcx
shl rax, 5
add rbx, rax
mov rax, qword [rdx + 0x418]
mov rdi, qword [rbx + 8]
sub rdi, qword [rbx + 0x10]
test byte [rax + 0x84], 3
je 0x1402a6782
lea rax, [0x1402a60c0]
cmp qword [rdx + r9*8 + 0x210], rax
jne 0x1402a6782
cmp qword [rbx], 0
je 0x1402a66eb
test rdi, rdi
je 0x1402a6782
mov rsi, qword [rdx + r9*8 + 0x1e8]
mov rdx, 0xffffffffffffffff
mov r8, rdx
xor r9d, r9d
mov rcx, rsi
call fcn.1402c8da0
cmp eax, 0xffffffff
je 0x1402a6782
test al, 1
je 0x1402a6782
mov rcx, qword [rbx]
test rcx, rcx
jne 0x1402a6757
mov eax, dword [rbp + 0x734]
add eax, eax
movsxd rcx, eax
mov qword [rbx + 8], rcx
call qword [fcn.1402e51dc]
mov qword [rbx], rax
mov rcx, rax
test rax, rax
jne 0x1402a673e
lea eax, [rcx + 0x1b]
jmp 0x1402a6784
mov rdi, qword [rbx + 8]
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0
test rcx, rcx
je 0x1402a677a
mov rdx, qword [rbx + 0x10]
xor r9d, r9d
add rdx, rcx
mov r8d, edi
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_recv]
movsxd rcx, eax
test eax, eax
jle 0x1402a6782
add qword [rbx + 0x10], rcx
jmp 0x1402a6782
mov qword [rbx + 8], 0
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1402a6990
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub rsp, 0x28
cmp byte [rcx + 0x280], 0
je 0x1402a69ad
call fcn.14029d030
test eax, eax
jne 0x1402a69d3
xor al, al
add rsp, 0x28
ret
mov rcx, qword [rcx + 0x1e8]
cmp rcx, 0xffffffffffffffff
je 0x1402a69a6
mov r9d, 2
lea rdx, [rsp + 0x30]
lea r8d, [r9 - 1]
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
je 0x1402a69a6
mov al, 1
add rsp, 0x28
ret

Function at 0x1402a6bf0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x1c8
mov rax, qword [0x14047b0a0]
xor rax, rsp
mov qword [rsp + 0x1b0], rax
mov rdi, r8
mov dword [rsp + 0x20], Ordinal_133
mov rbx, rdx
mov rsi, rcx
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, Ordinal_133
mov rbp, r9
call fcn.1402dd440
lea r8, [rsp + 0x20]
mov rcx, rbx
lea rdx, [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x1402a6c74
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r8d, 0x100
lea rdx, [rsp + 0xb0]
mov ecx, eax
mov ebx, eax
call fcn.1402a8a20
mov r8d, ebx
lea rdx, str.getsockname___failed_with_errno__d:__s
jmp 0x1402a6cba
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x30]
mov r9, rbp
mov r8, rdi
call fcn.1402a67a0
test al, al
jne 0x1402a6cc5
call fcn.1402e4994
mov ebx, dword [rax]
call fcn.1402e4994
mov r8d, 0x100
lea rdx, [rsp + 0xb0]
mov ecx, ebx
mov rdi, rax
call fcn.1402a8a20
mov r8d, dword [rdi]
lea rdx, str.ssloc_inet_ntop___failed_with_errno__d:__s
mov r9, rax
mov rcx, rsi
call fcn.1402a5e30
mov rcx, qword [rsp + 0x1b0]
xor rcx, rsp
call fcn.1401aed20
add rsp, 0x1c8
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1402a81d0
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x14047b0a0]
xor rax, rsp
mov qword [rsp + 0x68], rax
xor esi, esi
mov dword [rsp + 0x20], 4
mov eax, esi
lea r9, [rsp + 0x50]
cmp byte [rcx + 0xb43], al
mov rdi, rdx
mov rbx, rcx
mov edx, 0xffff
setne al
lea r8d, [rsi + 8]
mov rcx, rdi
mov dword [rsp + 0x50], eax
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x1402a823f
mov r8, rdi
lea rdx, str.Failed_to_set_SO_KEEPALIVE_on_fd__d
mov rcx, rbx
call fcn.1402a5f10
jmp 0x1402a82ce
mov ecx, dword [rbx + 0xaa4]
mov dword [rsp + 0x58], 1
call fcn.14029df70
imul ecx, eax, 0x3e8
mov dword [rsp + 0x50], ecx
mov dword [rsp + 0x5c], ecx
mov ecx, dword [rbx + 0xaa8]
call fcn.14029df70
imul ecx, eax, 0x3e8
lea r8, [rsp + 0x58]
mov qword [rsp + 0x40], rsi
lea rax, [rsp + 0x54]
mov qword [rsp + 0x38], rsi
mov r9d, recv
mov qword [rsp + 0x30], rax
mov edx, 0x98000004
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x50], ecx
mov dword [rsp + 0x60], ecx
mov rcx, rdi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
je 0x1402a82ce
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r8d, edi
lea rdx, str.Failed_to_set_SIO_KEEPALIVE_VALS_on_fd__d:__d
mov r9d, eax
mov rcx, rbx
call fcn.1402a5f10
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1401aed20
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x1402a82f0
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x150
mov rax, qword [0x14047b0a0]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rax, rdx
mov dword [rsp + 0x30], 1
mov edx, 6
mov dword [rsp + 0x20], 4
mov rbx, rcx
lea r9, [rsp + 0x30]
mov rcx, rax
lea r8d, [rdx - 5]
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x1402a8366
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r8d, 0x100
lea rdx, [rsp + 0x40]
mov ecx, eax
call fcn.1402a8a20
mov r8, rax
lea rdx, str.Could_not_set_TCP_NODELAY:__s
mov rcx, rbx
call fcn.1402a5f10
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1401aed20
add rsp, 0x150
pop rbx
ret