joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003b6a0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 0x2b], al
je 0x14003b6c3
lea edx, [rax - 8]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x2a
jb 0x14003b6b0
mov byte [rcx + 0x2b], 0
lea r8, [rcx + 0x2a]
mov rdx, rcx
mov rcx, rbx
call fcn.14003cb90
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x14003b6e0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x11], 0
je 0x14003b703
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 8]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x10
jb 0x14003b6f0
mov byte [rcx + 0x11], 0
ret

Function at 0x14003b710
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 0x11], al
je 0x14003b733
lea edx, [rax - 8]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x10
jb 0x14003b720
mov byte [rcx + 0x11], 0
lea r8, [rcx + 0x10]
mov rdx, rcx
mov rcx, rbx
call fcn.14003cb90
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x14003b750
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 0xb], al
je 0x14003b773
lea edx, [rax - 8]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xa
jb 0x14003b760
mov byte [rcx + 0xb], 0
lea r8, [rcx + 0xa]
mov rdx, rcx
mov rcx, rbx
call fcn.14003cb90
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x14003b790
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 9], 0
je 0x14003b7b3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 8]
xor byte [rax + rcx], dl
inc rax
cmp rax, 8
jb 0x14003b7a0
mov byte [rcx + 9], 0
ret

Function at 0x14003b7c0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 9], al
je 0x14003b7e3
lea edx, [rax - 8]
xor byte [rax + rcx], dl
inc rax
cmp rax, 8
jb 0x14003b7d0
mov byte [rcx + 9], 0
lea r8, [rcx + 8]
mov rdx, rcx
mov rcx, rbx
call fcn.14003cb90
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x14003b800
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 0xc], al
je 0x14003b823
lea edx, [rax - 8]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xb
jb 0x14003b810
mov byte [rcx + 0xc], 0
lea r8, [rcx + 0xb]
mov rdx, rcx
mov rcx, rbx
call fcn.14003cb90
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x14003b840
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 0x12], al
je 0x14003b863
lea edx, [rax - 8]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x11
jb 0x14003b850
mov byte [rcx + 0x12], 0
lea r8, [rcx + 0x11]
mov rdx, rcx
mov rcx, rbx
call fcn.14003cb90
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x14003b880
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 0x16], al
je 0x14003b8a3
lea edx, [rax - 8]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x15
jb 0x14003b890
mov byte [rcx + 0x16], 0
lea r8, [rcx + 0x15]
mov rdx, rcx
mov rcx, rbx
call fcn.14003cb90
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x14003b8c0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 0x14], al
je 0x14003b8e3
lea edx, [rax - 8]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x13
jb 0x14003b8d0
mov byte [rcx + 0x14], 0
lea r8, [rcx + 0x13]
mov rdx, rcx
mov rcx, rbx
call fcn.14003cb90
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x14003b900
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 0x13], al
je 0x14003b923
lea edx, [rax - 8]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x12
jb 0x14003b910
mov byte [rcx + 0x13], 0
lea r8, [rcx + 0x12]
mov rdx, rcx
mov rcx, rbx
call fcn.14003cb90
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x14003ba80
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xe], 0
je 0x14003baa3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 8]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xd
jb 0x14003ba90
mov byte [rcx + 0xe], 0
ret

Function at 0x14003bab0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 0xe], al
je 0x14003bad3
lea edx, [rax - 8]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xd
jb 0x14003bac0
mov byte [rcx + 0xe], 0
lea r8, [rcx + 0xd]
mov rdx, rcx
mov rcx, rbx
call fcn.14003cb90
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x14003d1d0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rbx, rdx
mov rdi, rcx
mov ecx, 8
call fcn.14003dce8
mov qword [rax], rbx
mov qword [rsp + 0x40], rax
lea rbx, [rdi + 8]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x14003d680]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rdi], rax
test rax, rax
je 0x14003d22a
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov dword [rbx], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3

Function at 0x14003d240
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x30
mov rbx, rcx
mov ecx, 8
call fcn.14003dce8
lea rcx, [0x140032e20]
mov qword [rax], rcx
mov qword [rsp + 0x48], rax
lea rdi, [rbx + 8]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x14003d680]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbx], rax
test rax, rax
je 0x14003d2a3
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov dword [rdi], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x14003d4f0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x14003d551
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x14003d510
mov ecx, dword [r9]
jmp 0x14003d638
cmp ecx, 0x4e0
jb 0x14003d638
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, r11d
lea r10, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x630]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x14003d570
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop dword [rax + rax]
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, r11d
lea r10, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 - 0xd50]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x14003d5c0
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret

Function at 0x14003e2f4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14003e33e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14003e33e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14003e33e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14003e33e
cmp dword [rcx + 0x84], 0xe
jbe 0x14003e33e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14003e340
xor al, al
add rsp, 0x28
ret
Function at 0x1400024d0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push r14
push r15
sub rsp, 0x68
mov rax, qword [0x14002e008]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov r14, rdx
mov rbx, rcx
mov rdx, rcx
mov r15, r8
lea rcx, str.Reading_data_from__s_n
call fcn.140002440
xor eax, eax
lea rdx, [0x14001dbf4]
mov qword [r15], rax
mov rcx, rbx
mov qword [r14], rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov rbp, rax
test rax, rax
jne 0x14000254a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ecx, dword [rax]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_strerror]
mov rdx, rbx
lea rcx, str.read_file:_cannot_open__s:__s_n
mov r8, rax
call fcn.1400023a0
lea eax, [rbp - 1]
jmp 0x14000261e
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fileno]
mov ecx, eax
lea rdx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__fstat64i32]
test eax, eax
jns 0x14000258b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ecx, dword [rax]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_strerror]
mov rdx, rax
lea rcx, str.read_file:_fstat:__s_n
call fcn.1400023a0
mov eax, 0xffffffff
jmp 0x14000261e
mov qword [rsp + 0xa8], rsi
movsxd rsi, dword [rsp + 0x34]
mov rcx, rsi
mov qword [rsp + 0x60], rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
jne 0x1400025c8
lea rcx, str.ERROR:_Out_of_memory_n
call fcn.1400023a0
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
lea eax, [rdi - 1]
jmp 0x140002611
mov r9, rbp
mov r8, rsi
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbp
mov rbx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
cmp rbx, rsi
je 0x140002609
lea rcx, str.ERROR:_Unable_to_read_entire_file_n
call fcn.1400023a0
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov eax, 0xffffffff
jmp 0x140002611
mov qword [r15], rsi
xor eax, eax
mov qword [r14], rdi
mov rsi, qword [rsp + 0xa8]
mov rdi, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14001bfa0
add rsp, 0x68
pop r15
pop r14
pop rbp
pop rbx
ret
Function at 0x1400026e0
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
sub rsp, 0x20
mov rbp, rcx
test rcx, rcx
je 0x140002898
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x14000288b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 0x11
je 0x14000288b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 2
jne 0x140002898
mov qword [rsp + 0x30], rbx
mov rcx, rbp
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], r14
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
lea r14, [0x14002ec20]
mov rsi, 0xffffffffffffffff
mov rdi, rax
test rax, rax
je 0x1400027bb
mov rbx, rsi
inc rbx
cmp byte [rax + rbx], 0
jne 0x140002755
cmp rbx, 0x104
jb 0x140002781
mov r8d, reloc.WS2_32.dll_socket
lea rdx, [0x14001da00]
lea rcx, str.len_sizeof_buffer_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
test rbx, rbx
je 0x1400027bb
movzx eax, byte [rbx + rdi - 1]
cmp al, 0x2f
je 0x140002793
cmp al, 0x5c
jne 0x140002796
dec rbx
test rbx, rbx
je 0x1400027bb
nop dword [rax + rax]
movzx eax, byte [rdi + rbx - 1]
cmp al, 0x2f
je 0x140002841
cmp al, 0x5c
je 0x140002841
sub rbx, 1
jne 0x1400027a0
mov eax, 0x2e
mov word [0x14002ec20], ax
cmp byte [0x14002ec20], 0x2e
jne 0x1400027d9
cmp byte [0x14002ec21], 0
je 0x14000280b
mov r9, rbp
mov rax, r14
sub r9, r14
movzx r8d, byte [rax]
movzx edx, byte [rax + r9]
sub r8d, edx
jne 0x1400027f7
inc rax
test edx, edx
jne 0x1400027e2
test r8d, r8d
je 0x14000280b
mov edx, 0x1ed
mov rcx, r14
call fcn.1400026e0
mov esi, eax
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test esi, esi
jne 0x140002825
mov edx, 0x1ed
mov rcx, rbp
call fcn.1400026e0
mov rdi, qword [rsp + 0x38]
mov eax, esi
mov rbx, qword [rsp + 0x30]
mov r14, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret
test rbx, rbx
je 0x1400027bb
cmp rbx, 1
jne 0x140002869
movzx eax, byte [rdi]
cmp al, 0x2f
je 0x14000285f
cmp al, 0x5c
jne 0x1400027bb
mov eax, 0x2f
jmp 0x1400027c0
lea r8, [rbx - 1]
mov rdx, rdi
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
cmp rbx, 0x104
jae 0x1400028aa
mov byte [rbx + r14], 0
jmp 0x1400027c7
xor eax, eax
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret
mov rbp, qword [rsp + 0x48]
mov rax, 0xffffffffffffffff
add rsp, 0x20
pop rsi
ret
call fcn.14001c0cc
int3
Function at 0x140002b50
Capabilities:
Query environment variable

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rdi
push r14
sub rsp, 0x50
test rcx, rcx
mov qword [r11 - 0x18], 0
lea rax, [0x14001e10c]
mov edx, 0x2f
mov qword [r11 - 0x30], rax
lea r14, str.tmp_
lea rax, str.TEMP
cmovne r14, rcx
mov qword [r11 - 0x28], rax
lea rdi, str.TMPDIR
lea rax, str.TEMPDIR
mov qword [r11 - 0x38], rdi
mov rcx, r14
mov qword [r11 - 0x20], rax
call qword [sym.imp.VCRUNTIME140.dll_strchr]
test rax, rax
jne 0x140002d05
lea edx, [rax + 0x5c]
mov rcx, r14
call qword [sym.imp.VCRUNTIME140.dll_strchr]
test rax, rax
jne 0x140002d05
xor ebx, ebx
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov rdi, rax
test rax, rax
jne 0x140002bf1
mov rdi, qword [rsp + rbx*8 + 0x28]
inc rbx
test rdi, rdi
jne 0x140002bd1
jmp 0x140002c03
mov edx, 2
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__access]
test eax, eax
je 0x140002c0a
lea rdi, str.C:WINDOWSTEMP
mov edx, 2
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__access]
test eax, eax
jne 0x140002d05
mov rax, 0xffffffffffffffff
mov rbx, rax
nop word [rax + rax]
inc rbx
cmp byte [rdi + rbx], 0
jne 0x140002c30
cmp rbx, 1
jb 0x140002d05
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], rsi
mov rsi, rax
inc rsi
cmp byte [r14 + rsi], 0
jne 0x140002c50
lea rcx, [rsi + rbx]
add rcx, 8
cmovb rcx, rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r8, rbx
mov rdx, rdi
mov rcx, rax
mov rbp, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
movzx eax, byte [rbx + rdi - 1]
cmp al, 0x2f
je 0x140002c92
cmp al, 0x5c
je 0x140002c92
mov byte [rbx + rbp], 0x5c
inc rbx
lea rcx, [rbx + rbp]
mov r8, rsi
mov rdx, r14
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov eax, dword [str.XXXXXX]
lea rcx, [rsi + rbx]
mov dword [rcx + rbp], eax
movzx eax, word [0x14001e100]
mov word [rcx + rbp + 4], ax
movzx eax, byte [0x14001e102]
mov byte [rcx + rbp + 6], al
mov rcx, rbp
call fcn.1400028b0
mov rsi, qword [rsp + 0x68]
mov ebx, eax
test eax, eax
jns 0x140002ce4
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor ebp, ebp
mov ecx, ebx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__close]
mov rax, rbp
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r14
ret
mov rbx, qword [rsp + 0x70]
xor eax, eax
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r14
ret
Function at 0x140003dc0
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov r14d, r8d
mov rsi, rdx
mov r15, rcx
xor ebx, ebx
call qword [sym.imp.libcurl.dll_curl_easy_init]
mov rdi, rax
test rax, rax
jne 0x140003e00
lea rcx, str.ERROR:_could_not_initialize_CURL_n
call fcn.1400023a0
lea eax, [rbx - 1]
jmp 0x140003f46
lea rdx, [0x14001df94]
mov qword [rsp + 0x40], rbp
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov rbp, rax
test rax, rax
jne 0x140003e34
mov rdx, rsi
lea rcx, str.ERROR:_cannot_open__s_for_writing_n
call fcn.1400023a0
lea eax, [rbp - 1]
jmp 0x140003f41
cmp dword [0x14002eae0], ebx
mov dword [0x14002eb0c], ebx
je 0x140003e54
mov edx, 0x29
mov rcx, rdi
lea r8d, [rdx - 0x28]
call qword [sym.imp.libcurl.dll_curl_easy_setopt]
xor r8d, r8d
mov rcx, rdi
lea edx, [r8 + 0x40]
call qword [sym.imp.libcurl.dll_curl_easy_setopt]
xor r8d, r8d
mov edx, 0x4e2b
mov rcx, rdi
call qword [sym.imp.libcurl.dll_curl_easy_setopt]
mov r8, rbp
mov edx, 0x2711
mov rcx, rdi
call qword [sym.imp.libcurl.dll_curl_easy_setopt]
test r14d, r14d
jle 0x140003ea0
lea r8, [0x140003d60]
mov edx, 0x4e58
mov rcx, rdi
call qword [sym.imp.libcurl.dll_curl_easy_setopt]
mov r8d, ebx
test r14d, r14d
mov edx, 0x2b
mov rcx, rdi
setle r8b
call qword [sym.imp.libcurl.dll_curl_easy_setopt]
lea r8, str.InetURL_1.0
mov edx, 0x2722
mov rcx, rdi
call qword [sym.imp.libcurl.dll_curl_easy_setopt]
mov edx, reloc.WS2_32.dll_gethostbyname
mov rcx, rdi
lea r8d, [rdx - 0x33]
call qword [sym.imp.libcurl.dll_curl_easy_setopt]
mov r8, r15
mov edx, 0x2712
mov rcx, rdi
call qword [sym.imp.libcurl.dll_curl_easy_setopt]
mov rcx, rdi
call qword [sym.imp.libcurl.dll_curl_easy_perform]
mov rcx, rdi
call qword [sym.imp.libcurl.dll_curl_easy_cleanup]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
xor edx, edx
mov rcx, rbp
lea r8d, [rdx + 1]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fseeki64]
mov rcx, rbp
movsxd rdi, eax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rdi, rdi
je 0x140003f31
cmp rdi, 0xffffffffffffffff
jne 0x140003f3f
mov rcx, rsi
mov ebx, 0xffffffff
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov eax, ebx
mov rbp, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x140018950
Capabilities:
Connect socket
Initialize winsock library
Resolve dns
Set socket configuration
Terminate process

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0x200
mov rax, qword [0x14002e008]
xor rax, rsp
mov qword [rsp + 0x1f0], rax
cmp dword [0x14002ee44], 0
movzx r14d, dx
mov rdi, rcx
mov dword [rsp + 0x30], 1
jne 0x1400189ca
mov ecx, 0x202
lea rdx, [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x1400189c0
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.WSAStartup_failed__n
call fcn.140005930
mov ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [0x14002ee44], 1
test rdi, rdi
jne 0x1400189e3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], socket
lea eax, [rdi - 1]
jmp 0x140018b5e
mov rcx, rdi
mov qword [rsp + 0x230], rbp
call qword [sym.imp.WS2_32.dll_gethostbyname]
mov rbp, rax
test rax, rax
jne 0x140018a2f
cmp dword [0x14002eb08], 2
jl 0x140018a63
lea ecx, [rax + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r9, rdi
lea r8, str.socket_connect
mov rcx, rax
lea rdx, str._s:_unknown_host__s_n
call fcn.140005930
lea eax, [rbp - 1]
jmp 0x140018b56
mov rax, qword [rax + 0x18]
cmp qword [rax], 0
jne 0x140018a6d
cmp dword [0x14002eb08], 2
jl 0x140018a63
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea r8, str.socket_connect
lea rdx, str._s:_gethostbyname_returned_NULL_address__n
call fcn.140005930
mov eax, 0xffffffff
jmp 0x140018b56
mov edx, 1
mov qword [rsp + 0x238], rsi
mov ebx, 2
mov ecx, ebx
lea r8d, [rdx + 5]
call qword [sym.imp.WS2_32.dll_socket]
mov rsi, rax
test eax, eax
jns 0x140018aa7
lea rcx, str.socket__
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_perror]
lea eax, [rbx - 3]
jmp 0x140018b4e
movsxd rdi, esi
lea r9, [rsp + 0x30]
mov rcx, rdi
mov dword [rsp + 0x20], 4
mov edx, 0xffff
mov r8d, 4
call qword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x140018aed
lea rcx, str.setsockopt__
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_perror]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
mov eax, 0xffffffff
jmp 0x140018b4e
mov qword [rsp + 0x40], 0
movzx ecx, r14w
mov word [rsp + 0x38], bx
mov rax, qword [rbp + 0x18]
mov rdx, qword [rax]
mov eax, dword [rdx]
mov dword [rsp + 0x3c], eax
call qword [sym.imp.WS2_32.dll_htons]
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rsp + 0x38]
mov rcx, rdi
mov word [rsp + 0x3a], ax
call qword [sym.imp.WS2_32.dll_connect]
test eax, eax
jns 0x140018b4c
lea rcx, str.connect
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_perror]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
mov eax, 0xfffffffe
jmp 0x140018b4e
mov eax, esi
mov rsi, qword [rsp + 0x238]
mov rbp, qword [rsp + 0x230]
mov rcx, qword [rsp + 0x1f0]
xor rcx, rsp
call fcn.14001bfa0
add rsp, 0x200
pop r14
pop rdi
pop rbx
ret
Function at 0x140018b80
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x260
mov rax, qword [0x14002e008]
xor rax, rsp
mov qword [rsp + 0x250], rax
movsxd rdi, ecx
mov r14, rdx
test ecx, ecx
jg 0x140018be3
cmp dword [0x14002eb08], 2
jl 0x140018bd7
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8d, edi
lea rdx, str.ERROR:_invalid_fd_in_check_fd__d_n
mov rcx, rax
call fcn.140005930
mov ebx, 0xffffffff
mov eax, ebx
jmp 0x140018d39
mov qword [rsp + 0x48], rdi
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x34], 0x186a0
lea rax, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x40]
lea ecx, [rdi + 1]
call qword [sym.imp.WS2_32.dll_select]
mov ebx, eax
test eax, eax
jns 0x140018c8c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ecx, dword [rax]
cmp ecx, 4
jne 0x140018c5d
cmp dword [0x14002eb08], 2
jl 0x140018c00
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea r8, str.socket_check_fd
lea rdx, str._s:_EINTR_n
call fcn.140005930
jmp 0x140018c00
cmp ecx, 0xb
jne 0x140018c97
cmp dword [0x14002eb08], 2
jl 0x140018c8c
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea r8, str.socket_check_fd
lea rdx, str._s:_EAGAIN_n
call fcn.140005930
test ebx, ebx
jg 0x140018ce2
mov eax, ebx
jmp 0x140018d39
cmp dword [0x14002eb08], 2
jl 0x140018bd7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ecx, dword [rax]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_strerror]
mov ecx, 2
mov rbx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r9, rbx
lea r8, str.socket_check_fd
mov rcx, rax
lea rdx, str._s:_select_failed:__s_n
call fcn.140005930
mov ebx, 0xffffffff
mov eax, ebx
jmp 0x140018d39
xor r9d, r9d
mov r8d, 0x100000
mov rdx, r14
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
jne 0x140018d2d
cmp dword [0x14002eb08], 3
jl 0x140018d26
lea ecx, [rax + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r9d, edi
lea r8, str.socket_receive_timeout
mov rcx, rax
lea rdx, str._s:_fd_d_recv_returned_0_n
call fcn.140005930
mov eax, 0xfffffff5
jmp 0x140018d39
jns 0x140018d39
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov eax, dword [rax]
neg eax
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.14001bfa0
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret