joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140013540
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
movaps xmmword [rsp + 0x20], xmm7
mov rax, qword [0x1400d7060]
xor rax, rsp
mov qword [rsp], rax
movdqu xmm7, xmmword [rcx]
mov eax, 0xfffffffe
and rdx, rax
mov r9, rcx
cmp rdx, r8
jae 0x140013688
movaps xmmword [rsp + 0x30], xmm6
lea rcx, [rdx + 1]
shl rcx, 4
xorps xmm5, xmm5
xorps xmm6, xmm6
movaps xmmword [rsp + 0x10], xmm8
movdqa xmm8, xmmword [0x1400cb130]
add rcx, r9
pslldq xmm6, 8
psrldq xmm5, 8
nop
movdqu xmm4, xmmword [rcx - 0x20]
lea rcx, [rcx + 0x20]
movdqa xmm3, xmm4
movdqa xmm0, xmm4
pclmulqdq xmm0, xmm7, 1
pclmulqdq xmm3, xmm7, 0x10
pxor xmm3, xmm0
movdqa xmm1, xmm4
pclmulqdq xmm1, xmm7, 0
movdqa xmm0, xmm3
mov rax, rdx
pslldq xmm0, 8
add rdx, 2
pxor xmm1, xmm0
psrldq xmm3, 8
pshufd xmm0, xmm1, 0x4e
movdqa xmm2, xmm1
pclmulqdq xmm2, xmm8, 0
pxor xmm2, xmm0
shr rax, 1
pshufd xmm0, xmm2, 0x4e
movdqa xmm1, xmm2
pclmulqdq xmm1, xmm8, 0
pxor xmm1, xmm0
add rax, rax
pclmulqdq xmm4, xmm7, 0x11
pxor xmm4, xmm3
pxor xmm4, xmm1
movdqu xmmword [rcx - 0x30], xmm4
movdqu xmm3, xmmword [r9 + rax*8]
movdqa xmm0, xmm3
pclmulqdq xmm0, xmm3, 0
pxor xmm0, xmm6
movdqa xmm1, xmm0
pshufd xmm0, xmm0, 0x4e
pclmulqdq xmm1, xmm8, 0
pxor xmm1, xmm0
pshufd xmm0, xmm1, 0x4e
movdqa xmm2, xmm1
pclmulqdq xmm2, xmm8, 0
pxor xmm2, xmm0
pclmulqdq xmm3, xmm3, 0x11
pxor xmm3, xmm5
pxor xmm2, xmm3
movdqu xmmword [rcx - 0x20], xmm2
cmp rdx, r8
jb 0x1400135a0
movaps xmm8, xmmword [rsp + 0x10]
movaps xmm6, xmmword [rsp + 0x30]
mov rcx, qword [rsp]
xor rcx, rsp
call fcn.140025840
movaps xmm7, xmmword [rsp + 0x20]
add rsp, 0x48
ret
Function at 0x140014e50
Capabilities:
Encode data using xor
Encrypt data using aes via x86 extensions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x27]
sub rsp, 0xa0
mov rax, qword [0x1400d7060]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov rcx, qword [rbp + 0x77]
lea rax, [r8 + 0xf]
mov rbx, qword [rbp + 0x7f]
mov r14, r9
shr rax, 4
mov rdi, r8
mov rsi, rdx
cmp r8, 0xffffffffffffff1f
ja 0x14001500d
cmp r8, rax
jb 0x14001500d
mov edx, 0xfffffffe
cmp rax, rdx
jae 0x14001500d
movsd xmm1, qword [rcx]
lea rdx, [rbp - 0x49]
mov eax, dword [rcx + 8]
xorps xmm0, xmm0
mov rcx, rbx
movdqa xmmword [rbp - 0x49], xmm0
xor r9d, r9d
movsd qword [rbp - 0x29], xmm1
xor r8d, r8d
mov dword [rbp - 0x21], eax
call fcn.1400136a0
mov r9, rdi
lea rdx, [rbp - 0x49]
and r9, 0xfffffffffffffff0
mov r8, rsi
mov rcx, rbx
call fcn.1400136a0
mov r8, rdi
and r8d, 0xf
je 0x140014f2c
xorps xmm0, xmm0
lea rcx, [rbp - 9]
mov rdx, rdi
sub rdx, r8
add rdx, rsi
movups xmmword [rbp - 9], xmm0
call fcn.14006f710
mov r9d, reloc.WS2_32.dll_recv
lea r8, [rbp - 9]
lea rdx, [rbp - 0x49]
mov rcx, rbx
call fcn.1400136a0
lea rax, [rdi*8]
mov dword [rbp - 0x1d], 0x1000000
movq xmm1, rax
xor edi, edi
lea rax, [rbx + 0x10]
mov edx, reloc.WS2_32.dll_listen
movq xmm0, rdi
punpcklqdq xmm1, xmm0
movdqa xmm0, xmmword [rbp - 0x29]
pxor xmm0, xmmword [rbx]
pshufb xmm1, xmmword [0x1400cb160]
nop word [rax + rax]
aesenc xmm0, xmmword [rax]
lea rax, [rax + 0x10]
sub rdx, 1
jne 0x140014f70
aesenclast xmm0, xmmword [rbx + 0xe0]
lea r9d, [rdx + 0x10]
movdqa xmmword [rbp - 0x19], xmm0
lea rdx, [rbp - 0x49]
movdqa xmmword [rbp + 7], xmm1
lea r8, [rbp + 7]
mov rcx, rbx
call fcn.1400136a0
movdqa xmm0, xmmword [rbp - 0x49]
lea rax, [rbp - 0x19]
pshufb xmm0, xmmword [0x1400cb160]
pxor xmm0, xmmword [rbp - 0x19]
movdqa xmmword [rbp - 0x19], xmm0
mov qword [rbp - 0x31], r14
mov qword [rbp - 0x39], rax
mov dword [rbp - 0x59], edi
nop dword [rax]
mov rax, qword [rbp - 0x39]
movzx edx, byte [rax + rdi]
mov rax, qword [rbp - 0x31]
movzx ecx, byte [rax + rdi]
inc rdi
mov eax, dword [rbp - 0x59]
xor ecx, edx
or eax, ecx
mov dword [rbp - 0x59], eax
cmp rdi, r9
jl 0x140014fd0
mov edx, dword [rbp - 0x59]
lea rdi, [rbp - 0x19]
dec edx
mov rcx, r9
shr edx, 8
and edx, 1
xor eax, eax
rep stosb byte [rdi], al
lea eax, [rdx - 1]
jmp 0x140015012
mov eax, 0xffffffff
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.140025840
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x140015040
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
sub rsp, 0xb0
mov rax, qword [0x1400d7060]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov rbp, qword [rsp + 0xf0]
mov rsi, rcx
mov rcx, qword [rsp + 0x108]
mov rbx, r9
mov r11, qword [rsp + 0x110]
mov r10, r8
test rsi, rsi
jne 0x1400150a0
mov qword [rsp + 0x38], r11
mov r9, rbp
mov r8, rbx
mov qword [rsp + 0x30], rcx
mov rdx, r10
call fcn.140014e50
jmp 0x1400151b1
lea rax, [r9 + 0xf]
shr rax, 4
cmp rbx, 0xffffffffffffff1f
ja 0x1400151d0
cmp rbx, rax
jb 0x1400151d0
mov edx, 0xfffffffe
cmp rax, rdx
jae 0x1400151d0
mov eax, dword [rcx + 8]
lea r8, [rsp + 0x90]
movsd xmm1, qword [rcx]
lea rdx, [rsp + 0x70]
mov dword [rsp + 0x88], eax
xorps xmm0, xmm0
lea rax, [rsp + 0x80]
mov qword [rsp + 0xd8], rdi
mov qword [rsp + 0x40], rax
xor edi, edi
mov qword [rsp + 0x38], rdi
mov r9, rsi
mov qword [rsp + 0x30], rdi
mov rcx, r11
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], r10
movdqa xmmword [rsp + 0x70], xmm0
movsd qword [rsp + 0x80], xmm1
mov dword [rsp + 0x8c], 0x2000000
call fcn.140013e60
mov qword [rsp + 0x60], rbp
lea rax, [rsp + 0x90]
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x50], edi
mov rax, qword [rsp + 0x58]
movzx edx, byte [rax + rdi]
mov rax, qword [rsp + 0x60]
movzx r8d, byte [rax + rdi]
inc rdi
mov eax, dword [rsp + 0x50]
xor r8d, edx
or eax, r8d
mov dword [rsp + 0x50], eax
cmp rdi, 0x10
jl 0x140015150
mov eax, dword [rsp + 0x50]
dec eax
bt eax, 8
jb 0x1400151cc
xor eax, eax
lea rdi, [rsp + 0x90]
mov ecx, reloc.WS2_32.dll_recv
mov r8, rbx
rep stosb byte [rdi], al
mov rcx, rsi
xor edx, edx
call fcn.14006fde0
mov eax, 0xffffffff
mov rdi, qword [rsp + 0xd8]
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.140025840
add rsp, 0xb0
pop rsi
pop rbp
pop rbx
ret
xor eax, eax
jmp 0x1400151a9
mov eax, 0xffffffff
jmp 0x1400151b1
Function at 0x1400151e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x260
mov rax, qword [0x1400d7060]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rbp, qword [rsp + 0x2b0]
mov r11, r9
mov r14, qword [rsp + 0x2c8]
mov rbx, rdx
mov rsi, rcx
prefetcht1 byte [rcx]
prefetcht1 byte [r9]
xor r15d, r15d
prefetcht1 byte [r15]
mov rcx, qword [rsp + 0x2d0]
lea rdx, [rsp + 0x50]
call fcn.140013170
movdqa xmm2, xmmword [rsp + 0x50]
lea rax, [rsp + 0x60]
xorps xmm0, xmm0
mov ecx, reloc.WS2_32.dll_listen
pxor xmm2, xmm0
nop word [rax + rax]
aesenc xmm2, xmmword [rax]
lea rax, [rax + 0x10]
sub rcx, 1
jne 0x140015260
aesenclast xmm2, xmmword [rsp + 0x130]
pshufb xmm2, xmmword [0x1400cb160]
lea edx, [rcx + 2]
lea r8d, [rcx + 0xe]
lea rcx, [rsp + 0x140]
xorps xmm0, xmm0
xorps xmm4, xmm4
movdqa xmm1, xmm2
psrldq xmm4, 8
psrlq xmm1, 0x3f
psubq xmm0, xmm1
pshufd xmm5, xmm0, 0xff
movdqa xmm0, xmm2
pand xmm5, xmmword [0x1400cb1a0]
pslldq xmm0, 8
psrlq xmm0, 0x3f
psllq xmm2, 1
por xmm0, xmm2
pxor xmm5, xmm0
xorps xmm0, xmm0
movdqa xmm1, xmm5
pslldq xmm0, 8
pclmulqdq xmm1, xmm5, 0
pxor xmm1, xmm0
movdqa xmmword [rsp + 0x140], xmm5
pshufd xmm0, xmm1, 0x4e
movdqa xmm3, xmm1
pclmulqdq xmm3, xmmword [0x1400cb130], 0
pxor xmm3, xmm0
pclmulqdq xmm5, xmm5, 0x11
movdqa xmm1, xmm3
pshufd xmm0, xmm3, 0x4e
pclmulqdq xmm1, xmmword [0x1400cb130], 0
pxor xmm1, xmm0
pxor xmm5, xmm4
pxor xmm5, xmm1
movdqa xmmword [rsp + 0x150], xmm5
call fcn.140013540
lea r10d, [r8 - 0xf]
lea rdi, [rbp - 0x10]
cmp rbp, 0x10
jb 0x140015374
lea rcx, [rsp + 0x50]
mov r9, rdi
mov qword [rsp + 0x40], rcx
lea rax, [rbp - 0x10]
add rax, r11
mov qword [rsp + 0x38], r14
mov rcx, rsi
mov qword [rsp + 0x20], rax
mov r8, r11
call fcn.140015040
mov r10d, eax
test rbx, rbx
je 0x140015383
test r10d, r10d
cmovne rdi, r15
mov qword [rbx], rdi
xor eax, eax
lea rdi, [rsp + 0x50]
mov ecx, 0x200
rep stosb byte [rdi], al
mov eax, r10d
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140025840
mov rbx, qword [rsp + 0x2a0]
add rsp, 0x260
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14001f5b0
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
push r14
sub rsp, 0x10
mov rax, qword [0x1400d7060]
xor rax, rsp
mov qword [rsp + 8], rax
xor r8d, r8d
lea r14, [0x1400c2630]
mov dword [rsp], r8d
mov r9, rcx
mov word [r11 - 0x14], r8w
xor eax, eax
movzx r10d, byte [r11 - 0x13]
movzx r11d, r8b
movzx ebx, byte [rsp + 3]
movzx edi, byte [rsp + 2]
movzx esi, byte [rsp + 1]
movzx ebp, byte [rsp]
nop dword [rax]
movzx edx, byte [r9 + rax]
movzx ecx, dl
xor cl, byte [rax + r14]
or cl, bpl
movzx ebp, cl
movzx ecx, dl
xor cl, byte [rax + r14 + 0x20]
or cl, sil
movzx esi, cl
movzx ecx, dl
xor cl, byte [rax + r14 + 0x40]
or cl, dil
movzx edi, cl
movzx ecx, dl
xor cl, byte [rax + r14 + 0x60]
or cl, bl
movzx ebx, cl
movzx ecx, dl
xor cl, byte [rax + r14 + 0x80]
or cl, r11b
movzx r11d, cl
movzx ecx, dl
xor cl, byte [rax + r14 + 0xa0]
xor dl, byte [rax + r14 + 0xc0]
or cl, r10b
or dl, r8b
movzx r10d, cl
inc rax
movzx r8d, dl
cmp rax, 0x1f
jb 0x14001f610
movzx ecx, byte [rax + r9]
movzx r9d, byte [rax + r14 + 0xc0]
and cl, 0x7f
movzx r8d, cl
movzx ecx, dl
xor r9d, r8d
movzx edx, byte [rax + r14 + 0xa0]
or r9d, ecx
xor edx, r8d
dec r9d
or edx, r10d
dec edx
or r9d, edx
movzx edx, byte [rax + r14 + 0x80]
xor edx, r8d
or edx, r11d
dec edx
or r9d, edx
movzx edx, byte [rax + r14]
xor edx, r8d
or edx, ebp
dec edx
or r9d, edx
movzx edx, byte [rax + r14 + 0x20]
xor edx, r8d
or edx, esi
dec edx
or r9d, edx
movzx edx, byte [rax + r14 + 0x40]
movzx eax, byte [rax + r14 + 0x60]
xor edx, r8d
xor eax, r8d
or edx, edi
or eax, ebx
dec edx
dec eax
or r9d, edx
or eax, r9d
shr eax, 8
and eax, 1
mov rcx, qword [rsp + 8]
xor rcx, rsp
call fcn.140025840
mov rbx, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
add rsp, 0x10
pop r14
ret
Function at 0x1400241b4
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0x90
mov rax, qword [0x1400d7060]
xor rax, rsp
mov qword [rbp + 0x3f], rax
mov edi, 0xffff
xor r14d, r14d
movzx esi, dx
mov rbx, rcx
cmp di, dx
jne 0x1400241f8
movzx eax, r14w
jmp 0x14002432e
mov rax, qword [rcx + 0x40]
mov r8, qword [rax]
test r8, r8
je 0x140024234
mov rax, qword [rcx + 0x58]
movsxd r9, dword [rax]
lea rdx, [r8 + r9*2]
cmp r8, rdx
jae 0x140024234
lea ecx, [r9 - 1]
mov dword [rax], ecx
movzx eax, si
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 2]
mov qword [rdx], rcx
mov word [r8], si
jmp 0x14002432e
cmp qword [rcx + 0x80], r14
je 0x14002432b
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x140024272
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub rdx, rcx
mov rax, qword [rbx + 0x38]
sar rdx, 1
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x14002429b
movzx ecx, si
mov rdx, qword [rbx + 0x80]
call fcn.1400782b0
cmp ax, di
je 0x14002432b
movzx edi, si
jmp 0x14002432b
lea r8, [rbp + 0xf]
mov word [rbp + 7], si
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rbp + 9]
lea r8, [rbp + 0x3f]
mov qword [rsp + 0x30], r8
lea r8, [rbp + 0x1f]
mov rax, qword [rax + 0x38]
mov qword [rsp + 0x28], r8
lea r8, [rbp + 0x17]
mov qword [rsp + 0x20], r8
lea r8, [rbp + 7]
call qword [0x14009d6c0]
test eax, eax
je 0x1400242f0
sub eax, 1
je 0x1400242f0
cmp eax, 2
jne 0x14002432b
movzx ecx, word [rbp + 7]
jmp 0x14002427e
mov r14, qword [rbp + 0xf]
lea rax, [rbp + 0x1f]
sub r14, rax
je 0x14002431a
mov r9, qword [rbx + 0x80]
lea rcx, [rbp + 0x1f]
mov r8, r14
mov edx, 1
call fcn.140074f54
cmp r14, rax
jne 0x14002432b
lea rax, [rbp + 7]
mov byte [rbx + 0x72], 1
cmp qword [rbp + 0x17], rax
movzx eax, si
jne 0x14002432e
movzx eax, di
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.140025840
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x14002dce0
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
lea rsi, [rcx + rdx]
mov rbx, rcx
mov edi, 0x1505
cmp rcx, rsi
jae 0x14002da2b
movzx ecx, byte [rbx]
call fcn.14003b4f0
imul rdi, rdi, 0x21
movsx rcx, al
inc rbx
xor rdi, rcx
cmp rbx, rsi
jb 0x14002da10
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
movzx eax, dil
add rsp, 0x20
pop rdi
ret
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x14002dd16
call fcn.14002e060
test al, al
jne 0x14002dd16
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.14002dfb0
mov rdx, qword [rsp + 0x30]
mov rcx, rax
add rsp, 0x20
pop rbx
jmp 0x14002d9f0
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x140037d20
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx + 0x718], 0
mov rsi, r9
mov rbp, r8
movsxd rbx, edx
mov rdi, rcx
je 0x140037d7e
mov dl, 1
call fcn.140029ea0
mov rax, qword [rdi + 0x670]
mov r9, rsi
mov r8, rbp
mov qword [rsp + 0x20], rax
mov edx, ebx
mov rcx, rdi
call qword [rdi + 0x718]
xor edx, edx
mov rcx, rdi
mov ebx, eax
call fcn.140029ea0
mov eax, ebx
jmp 0x140037dc3
cmp ebx, 2
ja 0x140037dc1
lfence
mov r9, qword [rdi + 0x668]
lea rdx, [0x1400a0548]
lea rcx, [rbx + rbx*2]
add rcx, rdx
mov edx, 2
lea r8d, [rdx - 1]
call fcn.140074f54
mov r9, qword [rdi + 0x668]
mov r8d, 1
mov rdx, rsi
mov rcx, rbp
call fcn.140074f54
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x140038090
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, r9
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recv]
movsxd rcx, eax
cmp rcx, 0xffffffffffffffff
jne 0x1400380cb
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, gethostname
mov edx, 0x51
cmp eax, 0x2733
cmove ecx, edx
mov eax, ecx
add rsp, 0x20
pop rbx
ret
mov qword [rbx], rcx
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x1400381f0
Capabilities:
Send data
Send data on socket

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0xb0
mov rax, qword [0x1400d7060]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov r14, qword [rsp + 0x100]
mov rsi, r9
movsxd rax, edx
mov rdi, r8
mov r15, rcx
mov rbx, qword [rcx + rax*8 + 0x258]
call fcn.140038800
xor r9d, r9d
mov r8d, esi
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_send]
movsxd rdi, eax
mov dword [r14], 0
cmp rdi, 0xffffffffffffffff
jne 0x1400382a2
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, eax
cmp eax, 0x2733
jne 0x14003826e
mov dword [r14], 0x51
xor eax, eax
jmp 0x1400382a5
mov r8d, Ordinal_133
lea rdx, [rsp + 0x20]
mov ecx, ebx
call fcn.140061080
mov rcx, qword [r15]
lea rdx, str.Send_failure:__s
mov r8, rax
call fcn.140037de0
mov rcx, qword [r15]
mov dword [rcx + 0x1140], ebx
mov dword [r14], gethostname
mov rax, rdi
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.140025840
add rsp, 0xb0
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x140038800
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
movsxd rcx, edx
mov rax, qword [rsi + 0x430]
lea rbx, [rcx + 0x15]
shl rbx, 5
add rbx, rsi
mov rdi, qword [rbx + 8]
sub rdi, qword [rbx + 0x10]
test byte [rax + 0x7c], 3
je 0x1400388f4
lea rax, [0x140038110]
cmp qword [rsi + rcx*8 + 0x280], rax
jne 0x1400388f4
cmp qword [rbx], 0
je 0x14003885d
test rdi, rdi
je 0x1400388f4
mov rdx, 0xffffffffffffffff
mov qword [rsp + 0x30], rbp
mov rbp, qword [rsi + rcx*8 + 0x258]
xor r9d, r9d
mov rcx, rbp
mov r8, rdx
call fcn.14003b130
cmp eax, 0xffffffff
je 0x1400388ef
test al, 1
je 0x1400388ef
mov rax, qword [rbx]
test rax, rax
jne 0x1400388c4
mov rax, qword [rsi]
mov ecx, dword [rax + 0xb68]
add ecx, ecx
movsxd rcx, ecx
mov qword [rbx + 8], rcx
call qword [str.__a_]
mov rdi, qword [rbx + 8]
mov qword [rbx], rax
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0
test rax, rax
je 0x1400388e7
mov rdx, qword [rbx + 0x10]
xor r9d, r9d
add rdx, rax
mov r8d, edi
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_recv]
movsxd rcx, eax
test eax, eax
jle 0x1400388ef
add qword [rbx + 0x10], rcx
jmp 0x1400388ef
mov qword [rbx + 8], 0
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140038ab0
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub rsp, 0x28
cmp byte [rcx + 0x2f0], 0
je 0x140038acd
call fcn.1400324d0
test eax, eax
jne 0x140038af3
xor al, al
add rsp, 0x28
ret
mov rcx, qword [rcx + 0x258]
cmp rcx, 0xffffffffffffffff
je 0x140038ac6
mov r9d, 2
lea rdx, [rsp + 0x30]
lea r8d, [r9 - 1]
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
je 0x140038ac6
mov al, 1
add rsp, 0x28
ret
Function at 0x140039500
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x1c0
mov rax, qword [0x1400d7060]
xor rax, rsp
mov qword [rsp + 0x1b0], rax
cmp dword [rcx + 0xbc], 3
mov rdi, rdx
mov rbx, rcx
jne 0x14003973f
cmp byte [rcx + 0x3ed], 0
mov qword [rsp + 0x1e0], rsi
jne 0x14003972f
cmp byte [rcx + 0x408], 0
jne 0x14003972f
mov rsi, qword [rcx]
lea r8, [rsp + 0x20]
mov rcx, rdi
mov dword [rsp + 0x20], Ordinal_133
lea rdx, [rsp + 0xb0]
call qword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
je 0x1400395b0
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r8d, Ordinal_133
lea rdx, [rsp + 0x130]
mov ecx, eax
mov ebx, eax
call fcn.140061080
mov r9, rax
lea rdx, str.getpeername___failed_with_errno__d:__s
mov r8d, ebx
mov rcx, rsi
call fcn.140037de0
jmp 0x140039737
xorps xmm0, xmm0
mov dword [rsp + 0x24], Ordinal_133
lea r8, [rsp + 0x24]
mov rcx, rdi
lea rdx, [rsp + 0x30]
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x90], xmm0
movups xmmword [rsp + 0xa0], xmm0
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x14003963a
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r8d, Ordinal_133
lea rdx, [rsp + 0x130]
mov ecx, eax
mov ebx, eax
call fcn.140061080
mov r9, rax
lea rdx, str.getsockname___failed_with_errno__d:__s
mov r8d, ebx
mov rcx, rsi
call fcn.140037de0
jmp 0x140039737
mov edx, dword [rsp + 0x20]
lea rdi, [rbx + 0x18e]
mov r8, rdi
lea r9, [rbx + 0x1bc]
lea rcx, [rsp + 0xb0]
call fcn.140038910
test al, al
jne 0x14003969e
call fcn.140077b04
mov ebx, dword [rax]
call fcn.140077b04
mov r8d, Ordinal_133
lea rdx, [rsp + 0x130]
mov ecx, ebx
mov rdi, rax
call fcn.140061080
mov r8d, dword [rdi]
lea rdx, str.ssrem_inet_ntop___failed_with_errno__d:__s
mov r9, rax
mov rcx, rsi
call fcn.140037de0
jmp 0x140039737
movups xmm0, xmmword [rdi]
mov eax, dword [rdi + 0x28]
lea r9, [rbx + 0x1f0]
movups xmm1, xmmword [rdi + 0x10]
mov edx, dword [rsp + 0x24]
lea r8, [rbx + 0x1c0]
movups xmmword [rbx + 0x88], xmm0
lea rcx, [rsp + 0x30]
movsd xmm0, qword [rdi + 0x20]
movups xmmword [rbx + 0x98], xmm1
movsd qword [rbx + 0xa8], xmm0
mov dword [rbx + 0xb0], eax
movzx eax, word [rdi + 0x2c]
mov word [rbx + 0xb4], ax
call fcn.140038910
test al, al
jne 0x14003972f
call fcn.140077b04
mov ebx, dword [rax]
call fcn.140077b04
mov r8d, Ordinal_133
lea rdx, [rsp + 0x130]
mov ecx, ebx
mov rdi, rax
call fcn.140061080
mov r8d, dword [rdi]
lea rdx, str.ssloc_inet_ntop___failed_with_errno__d:__s
mov r9, rax
mov rcx, rsi
call fcn.140037de0
jmp 0x140039737
mov rcx, rbx
call fcn.140039120
mov rsi, qword [rsp + 0x1e0]
mov rcx, qword [rsp + 0x1b0]
xor rcx, rsp
call fcn.140025840
mov rbx, qword [rsp + 0x1e8]
add rsp, 0x1c0
pop rdi
ret
Function at 0x14003a100
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x1400d7060]
xor rax, rsp
mov qword [rsp + 0x68], rax
xor esi, esi
mov dword [rsp + 0x20], 4
mov eax, esi
lea r9, [rsp + 0x50]
cmp byte [rcx + 0xebc], al
mov rdi, rdx
mov rbx, rcx
mov edx, 0xffff
setne al
lea r8d, [rsi + 8]
mov rcx, rdi
mov dword [rsp + 0x50], eax
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x14003a16f
mov r8, rdi
lea rdx, str.Failed_to_set_SO_KEEPALIVE_on_fd__d_n
mov rcx, rbx
call fcn.140037ef0
jmp 0x14003a1fe
mov ecx, dword [rbx + 0xe1c]
mov dword [rsp + 0x58], 1
call fcn.14003a4a0
imul ecx, eax, 0x3e8
mov dword [rsp + 0x50], ecx
mov dword [rsp + 0x5c], ecx
mov ecx, dword [rbx + 0xe20]
call fcn.14003a4a0
imul ecx, eax, 0x3e8
lea r8, [rsp + 0x58]
mov qword [rsp + 0x40], rsi
lea rax, [rsp + 0x54]
mov qword [rsp + 0x38], rsi
mov r9d, ntohl
mov qword [rsp + 0x30], rax
mov edx, 0x98000004
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x50], ecx
mov dword [rsp + 0x60], ecx
mov rcx, rdi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
je 0x14003a1fe
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r8d, edi
lea rdx, str.Failed_to_set_SIO_KEEPALIVE_VALS_on_fd__d:__d_n
mov r9d, eax
mov rcx, rbx
call fcn.140037ef0
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140025840
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x14003a220
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0xd0
mov rax, qword [0x1400d7060]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rbx, qword [rcx]
lea r9, [rsp + 0x30]
mov rax, rdx
mov dword [rsp + 0x30], 1
mov edx, 6
mov dword [rsp + 0x20], 4
mov rcx, rax
lea r8d, [rdx - 5]
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x14003a298
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r8d, Ordinal_133
lea rdx, [rsp + 0x40]
mov ecx, eax
call fcn.140061080
mov r8, rax
lea rdx, str.Could_not_set_TCP_NODELAY:__s_n
mov rcx, rbx
call fcn.140037ef0
jmp 0x14003a2a7
lea rdx, str.TCP_NODELAY_set_n
mov rcx, rbx
call fcn.140037ef0
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.140025840
add rsp, 0xd0
pop rbx
ret

Function at 0x14003a460
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov edi, ecx
mov rbx, rdx
mov rcx, r8
call fcn.14003a4e0
mov r8d, eax
mov rdx, rbx
mov ecx, edi
call fcn.14008b074
mov rbx, qword [rsp + 0x30]
cdqe
add rsp, 0x20
pop rdi
ret