joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140031a80
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x450
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rbx, rcx
xor eax, eax
mov qword [rcx + 8], rax
mov qword [rcx + 0x10], rax
lea rax, vtable.Win32xx::CRichEdit.0
mov qword [rcx], rax
lea rcx, str.riched32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rbx + 0x18], rax
test rax, rax
jne 0x140031b31
lea rdx, str.Failed_to_load_RICHED32.DLL
lea rcx, [rsp + 0x30]
call fcn.14002e0f0
lea rax, vtable.Win32xx::CNotSupportedException.0
mov qword [rsp + 0x30], rax
lea rcx, str._CNotSupportedException_thrown__n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rcx, str.Failed_to_load_RICHED32.DLL
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rcx, reloc.WS2_32.dll_ioctlsocket
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [rsp + 0x448], 0
je 0x140031b1f
lea rcx, [rsp + 0x246]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rdx, [0x14012e440]
lea rcx, [rsp + 0x30]
call fcn.14009d9d8
int3
lea rcx, str.riched20.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rbx + 0x20], rax
mov rax, rbx
add rsp, 0x450
pop rbx
ret

Function at 0x140031ef0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x1401310c8]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rbx, rcx
lea rax, [rsp + 0x50]
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
mov r9d, 1
lea rdx, str.SOFTWARESmartLoader_bdo
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor edi, edi
test eax, eax
jne 0x140031f98
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x5c]
lea rax, [rsp + 0x60]
mov dword [rsp + 0x60], edi
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.EulaAccepted
mov dword [rsp + 0x58], 4
mov dword [rsp + 0x5c], edi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140031f98
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rsp + 0x5c], 4
jne 0x140031f98
cmp dword [rsp + 0x60], 1
je 0x140032031
lea rcx, [rbx + 0x130]
xor edx, edx
mov rax, qword [rcx]
call qword [rax + 0x110]
test rax, rax
je 0x140032033
mov qword [rsp + 0x40], rdi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
lea rdx, str.SOFTWARESmartLoader_bdo
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov dword [rsp + 0x28], 3
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x20], edi
mov dword [rsp + 0x58], 1
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140032031
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x58]
mov dword [rsp + 0x28], 4
lea rdx, str.EulaAccepted
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1400784c0
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
Function at 0x140039200
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov byte [rcx + 0x10], 0
mov rcx, qword [rcx]
xor ebp, ebp
mov rsi, r9
mov rdi, rdx
test rcx, rcx
je 0x140039236
mov rax, qword [rcx]
lea edx, [rbp + 1]
call qword [rax]
mov qword [rbx], rbp
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140039253
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov qword [rbx + 8], rbp
lea r8, [0x14010ecf8]
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
test rax, rax
jne 0x140039272
xor al, al
jmp 0x1400392ac
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebp, eax
test eax, eax
je 0x14003926e
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
je 0x14003926e
mov r8d, ebp
mov rdx, rax
mov rcx, rbx
call fcn.1400392d0
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x14003e0b0
Capabilities:
Initialize winsock library

Disassembly:
sub rsp, 0x1d8
mov rax, qword [0x1401310c8]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov ecx, 0x202
lea rdx, [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x14003e10e
movzx eax, word [rsp + 0x20]
cmp al, 2
jne 0x14003e108
shr ax, 8
cmp al, 2
jne 0x14003e108
xor eax, eax
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.1400784c0
add rsp, 0x1d8
ret
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 2
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.1400784c0
add rsp, 0x1d8
ret
Function at 0x1400459d0
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor edi, edi
lea rax, [rcx + rdx]
mov rbp, rax
mov rbx, rcx
sub rbp, rcx
mov esi, 0x1505
cmp rcx, rax
cmova rbp, rdi
test rbp, rbp
je 0x140045773
movzx ecx, byte [rbx]
call fcn.1400531e0
imul rsi, rsi, 0x21
movsx rcx, al
lea rbx, [rbx + 1]
xor rsi, rcx
inc rdi
cmp rdi, rbp
jb 0x140045754
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
movzx eax, sil
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x140045a06
call fcn.140045dd0
test al, al
jne 0x140045a06
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.140045d20
mov rdx, qword [rsp + 0x30]
mov rcx, rax
add rsp, 0x20
pop rbx
jmp 0x140045720
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x140047120
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp dword [rcx + 4], 2
mov rax, rdx
je 0x14004712c
xor eax, eax
ret
mov rdx, qword [rcx + 0x20]
mov r9, r8
add rdx, 4
mov r8, rax
mov ecx, 2
jmp fcn.14005eab0
Function at 0x14004f5f0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx + 0x2b8], 0
mov rsi, r9
mov rbp, r8
movsxd rbx, edx
mov rdi, rcx
je 0x14004f64e
mov dl, 1
call fcn.140041990
mov rax, qword [rdi + 0x208]
mov r9, rsi
mov r8, rbp
mov qword [rsp + 0x20], rax
mov edx, ebx
mov rcx, rdi
call qword [rdi + 0x2b8]
xor edx, edx
mov rcx, rdi
mov ebx, eax
call fcn.140041990
mov eax, ebx
jmp 0x14004f690
cmp ebx, 2
ja 0x14004f68e
mov r9, qword [rdi + 0x200]
lea rdx, [0x1400ef9e8]
lea rcx, [rbx + rbx*2]
add rcx, rdx
mov edx, 2
lea r8d, [rdx - 1]
call fcn.1400a3bc0
mov r9, qword [rdi + 0x200]
mov r8d, 1
mov rdx, rsi
mov rcx, rbp
call fcn.1400a3bc0
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x14004f9a0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, r9
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recv]
movsxd rcx, eax
cmp rcx, 0xffffffffffffffff
jne 0x14004f9db
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, gethostname
mov edx, 0x51
cmp eax, 0x2733
cmove ecx, edx
mov eax, ecx
add rsp, 0x20
pop rbx
ret
mov qword [rbx], rcx
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x14004fae0
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
movsxd rax, edx
mov rdi, r9
mov rsi, r8
mov r14, rcx
mov rbx, qword [rcx + rax*8 + 0x238]
call fcn.140050110
xor r9d, r9d
mov r8d, edi
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_send]
mov rsi, qword [rsp + 0x50]
movsxd rdi, eax
mov dword [rsi], 0
cmp rdi, 0xffffffffffffffff
jne 0x14004fb78
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, eax
cmp eax, 0x2733
jne 0x14004fb4d
mov dword [rsi], 0x51
xor eax, eax
jmp 0x14004fb7b
mov edx, ebx
mov rcx, r14
call fcn.14003e130
mov rcx, qword [r14]
lea rdx, str.Send_failure:__s
mov r8, rax
call fcn.14004f6b0
mov rcx, qword [r14]
mov dword [rcx + 0x4cc4], ebx
mov dword [rsi], gethostname
mov rax, rdi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x140050110
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
movsxd rcx, edx
mov rax, qword [rsi + 0x3c8]
lea rbx, [rcx + 0x14]
mov rbp, qword [rsi + rcx*8 + 0x238]
shl rbx, 5
add rbx, rsi
mov rdi, qword [rbx + 8]
sub rdi, qword [rbx + 0x10]
test byte [rax + 0x7c], 3
je 0x1400501ec
lea rax, [0x14004fa20]
cmp qword [rsi + rcx*8 + 0x260], rax
jne 0x1400501ec
cmp qword [rbx], 0
je 0x140050176
test rdi, rdi
je 0x1400501ec
or r8, 0xffffffffffffffff
xor r9d, r9d
or rdx, r8
mov rcx, rbp
call fcn.14004f230
cmp eax, 0xffffffff
je 0x1400501ec
test al, 1
je 0x1400501ec
cmp qword [rbx], 0
jne 0x1400501cb
mov rax, qword [rsi]
mov ecx, dword [rax + 0x708]
add ecx, ecx
movsxd rcx, ecx
mov qword [rbx + 8], rcx
call qword [section..data]
mov rdi, qword [rbx + 8]
xor ecx, ecx
mov qword [rbx], rax
mov qword [rbx + 0x10], rcx
mov qword [rbx + 0x18], rcx
test rax, rax
jne 0x1400501cb
mov qword [rbx + 8], rcx
jmp 0x1400501ec
mov rdx, qword [rbx]
xor r9d, r9d
add rdx, qword [rbx + 0x10]
mov r8d, edi
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_recv]
movsxd rcx, eax
test eax, eax
jle 0x1400501ec
add qword [rbx + 0x10], rcx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140050310
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub rsp, 0x28
cmp byte [rcx + 0x2c0], 0
je 0x140050324
xor al, al
add rsp, 0x28
ret
mov rcx, qword [rcx + 0x238]
cmp rcx, 0xffffffffffffffff
je 0x14005031d
mov r9d, 2
lea rdx, [rsp + 0x30]
lea r8d, [r9 - 1]
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
setne al
add rsp, 0x28
ret

Function at 0x140050c40
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rbx, qword [rcx]
lea r9, [rsp + 0x40]
mov rax, rdx
mov dword [rsp + 0x40], 1
mov edx, 6
mov dword [rsp + 0x20], 4
mov rdi, rcx
mov rcx, rax
lea r8d, [rdx - 5]
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x140050cab
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
mov rcx, rdi
call fcn.14003e130
mov r8, rax
lea rdx, str.Could_not_set_TCP_NODELAY:__s_n
mov rcx, rbx
call fcn.14004f7b0
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
lea rdx, str.TCP_NODELAY_set_n
mov rcx, rbx
call fcn.14004f7b0
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x140050de0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rbx
push rbp
push rsi
sub rsp, 0x140
mov rax, qword [0x1401310c8]
xor rax, rsp
mov qword [rsp + 0x130], rax
cmp dword [rcx + 0xbc], 2
mov rbx, rdx
mov rbp, qword [rcx]
mov rsi, rcx
je 0x140050fc9
cmp byte [rcx + 0x382], 0
mov qword [rsp + 0x170], rdi
jne 0x140050fb9
cmp byte [rcx + 0x39e], 0
jne 0x140050fb9
lea r8, [rsp + 0x20]
mov dword [rsp + 0x20], pe_nt_image_headers64
lea rdx, [rsp + 0xb0]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
je 0x140050e83
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
mov rcx, rsi
mov ebx, eax
call fcn.14003e130
mov r9, rax
lea rdx, str.getpeername___failed_with_errno__d:__s
mov r8d, ebx
mov rcx, rbp
call fcn.14004f6b0
jmp 0x140050fc1
xor edx, edx
mov dword [rsp + 0x20], pe_nt_image_headers64
mov r8d, pe_nt_image_headers64
lea rcx, [rsp + 0x30]
call fcn.14009cd20
lea r8, [rsp + 0x20]
mov rcx, rbx
lea rdx, [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x140050ee0
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
mov rcx, rsi
mov ebx, eax
call fcn.14003e130
mov r9, rax
lea rdx, str.getsockname___failed_with_errno__d:__s
mov r8d, ebx
mov rcx, rbp
call fcn.14004f6b0
jmp 0x140050fc1
lea rbx, [rsi + 0x186]
mov rdx, rbx
lea r8, [rsi + 0x1b4]
lea rcx, [rsp + 0xb0]
call fcn.1400504f0
test al, al
jne 0x140050f36
call fcn.14009eab4
mov rbx, rax
call fcn.14009eab4
mov edx, dword [rbx]
mov rcx, rsi
mov rdi, rax
call fcn.14003e130
mov r8d, dword [rdi]
lea rdx, str.ssrem_inet_ntop___failed_with_errno__d:__s
mov r9, rax
mov rcx, rbp
call fcn.14004f6b0
jmp 0x140050fc1
movups xmm0, xmmword [rbx]
mov eax, dword [rbx + 0x28]
lea r8, [rsi + 0x1e8]
movups xmm1, xmmword [rbx + 0x10]
lea rdx, [rsi + 0x1b8]
movups xmmword [rsi + 0x88], xmm0
lea rcx, [rsp + 0x30]
movsd xmm0, qword [rbx + 0x20]
movups xmmword [rsi + 0x98], xmm1
movsd qword [rsi + 0xa8], xmm0
mov dword [rsi + 0xb0], eax
movzx eax, word [rbx + 0x2c]
mov word [rsi + 0xb4], ax
call fcn.1400504f0
test al, al
jne 0x140050fb9
call fcn.14009eab4
mov rbx, rax
call fcn.14009eab4
mov edx, dword [rbx]
mov rcx, rsi
mov rdi, rax
call fcn.14003e130
mov r8d, dword [rdi]
lea rdx, str.ssloc_inet_ntop___failed_with_errno__d:__s
mov r9, rax
mov rcx, rbp
call fcn.14004f6b0
jmp 0x140050fc1
mov rcx, rsi
call fcn.1400509a0
mov rdi, qword [rsp + 0x170]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1400784c0
add rsp, 0x140
pop rsi
pop rbp
pop rbx
ret
Function at 0x140051710
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x1401310c8]
xor rax, rsp
mov qword [rsp + 0x68], rax
xor esi, esi
mov dword [rsp + 0x20], 4
mov eax, esi
lea r9, [rsp + 0x50]
cmp byte [rcx + 0x9bc], al
mov rdi, rdx
mov rbx, rcx
mov edx, 0xffff
setne al
lea r8d, [rsi + 8]
mov rcx, rdi
mov dword [rsp + 0x50], eax
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x14005177f
mov r8, rdi
lea rdx, str.Failed_to_set_SO_KEEPALIVE_on_fd__d_n
mov rcx, rbx
call fcn.14004f7b0
jmp 0x14005180e
mov ecx, dword [rbx + 0x9c0]
mov dword [rsp + 0x58], 1
call fcn.1400519f0
imul ecx, eax, 0x3e8
mov dword [rsp + 0x50], ecx
mov dword [rsp + 0x5c], ecx
mov ecx, dword [rbx + 0x9c4]
call fcn.1400519f0
imul ecx, eax, 0x3e8
lea r8, [rsp + 0x58]
mov qword [rsp + 0x40], rsi
lea rax, [rsp + 0x54]
mov qword [rsp + 0x38], rsi
mov r9d, listen
mov qword [rsp + 0x30], rax
mov edx, 0x98000004
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x50], ecx
mov dword [rsp + 0x60], ecx
mov rcx, rdi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
je 0x14005180e
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r8d, edi
lea rdx, str.Failed_to_set_SIO_KEEPALIVE_VALS_on_fd__d:__d_n
mov r9d, eax
mov rcx, rbx
call fcn.14004f7b0
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1400784c0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x1400519b0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov edi, ecx
mov rbx, rdx
mov rcx, r8
call fcn.140051a00
mov r8d, eax
mov rdx, rbx
mov ecx, edi
call fcn.1400aeb1c
mov rbx, qword [rsp + 0x30]
cdqe
add rsp, 0x20
pop rdi
ret
Function at 0x14005e430
Capabilities:
Resolve dns

Disassembly:
push rbp
push rsi
push r12
push r14
push r15
sub rsp, 0x20
xor r12d, r12d
mov r15, r9
mov qword [r9], r12
mov esi, r12d
lea r9, [rsp + 0x68]
mov r14d, r12d
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov ebp, eax
test eax, eax
jne 0x14005e5a8
mov qword [rsp + 0x50], rbx
mov rbx, qword [rsp + 0x68]
test rbx, rbx
je 0x14005e591
mov qword [rsp + 0x58], rdi
nop dword [rax]
cmp dword [rbx + 4], 2
jne 0x14005e528
cmp qword [rbx + 0x20], r12
je 0x14005e528
cmp qword [rbx + 0x10], 0x10
jb 0x14005e528
mov ecx, Ordinal_50
call qword [section..data]
mov rdi, rax
test rax, rax
je 0x14005e561
mov ecx, dword [rbx]
mov dword [rax], ecx
mov ecx, dword [rbx + 4]
mov dword [rax + 4], ecx
mov ecx, dword [rbx + 8]
mov dword [rax + 8], ecx
mov ecx, dword [rbx + 0xc]
mov dword [rax + 0xc], ecx
mov ecx, reloc.WS2_32.dll_recv
mov dword [rax + reloc.WS2_32.dll_recv], 0x10
mov qword [rax + 0x20], r12
mov qword [rax + 0x18], r12
mov qword [rax + 0x28], r12
call qword [section..data]
mov qword [rdi + 0x20], rax
test rax, rax
je 0x14005e551
mov rcx, qword [rbx + 0x20]
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x14005e515
call qword [case.0x140046016.0]
mov qword [rdi + 0x18], rax
test rax, rax
je 0x14005e537
test rsi, rsi
cmove rsi, rdi
test r14, r14
je 0x14005e525
mov qword [r14 + 0x28], rdi
mov r14, rdi
mov rbx, qword [rbx + 0x28]
test rbx, rbx
jne 0x14005e480
jmp 0x14005e566
mov rcx, qword [rdi + 0x20]
mov ebp, 8
call qword [fcn.14009e748]
mov rcx, rdi
call qword [fcn.14009e748]
jmp 0x14005e566
mov rcx, rdi
mov ebp, 8
call qword [fcn.14009e748]
jmp 0x14005e566
mov ebp, 8
mov rcx, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x58]
test rcx, rcx
je 0x14005e57b
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
test ebp, ebp
je 0x14005e58c
mov rcx, rsi
call fcn.14005e3e0
mov rsi, r12
jmp 0x14005e59e
test rsi, rsi
jne 0x14005e59e
mov ebp, 0x2af9
mov ecx, ebp
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov rbx, qword [rsp + 0x50]
mov eax, ebp
mov qword [r15], rsi
add rsp, 0x20
pop r15
pop r14
pop r12
pop rsi
pop rbp
ret
Function at 0x14005eab0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x28
mov rax, r8
mov r10, rdx
cmp ecx, 2
je 0x14005ead1
call fcn.14009eab4
mov dword [rax], 0x273f
xor eax, eax
add rsp, 0x28
ret
mov r8, r9
mov rdx, rax
mov rcx, r10
add rsp, 0x28
jmp 0x14005eaf0
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x1401310c8]
xor rax, rsp
mov qword [rsp + 0x50], rax
movzx eax, byte [rcx + 3]
mov rbx, rdx
movzx edx, byte [rcx + 2]
mov rdi, r8
movzx r10d, byte [rcx + 1]
lea r8, str._d._d._d._d
movzx r9d, byte [rcx]
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], edx
mov edx, reloc.WS2_32.dll_recv
mov byte [rsp + 0x40], 0
mov dword [rsp + 0x20], r10d
call fcn.140051ea0
lea rcx, [rsp + 0x40]
or rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x14005eb51
test rax, rax
je 0x14005eb94
cmp rax, rdi
jae 0x14005eb94
lea rax, [rsp + 0x40]
mov r8, rbx
sub r8, rax
lea rcx, [rsp + 0x40]
nop dword [rax]
nop dword [rax + rax]
movzx edx, byte [rcx]
mov byte [r8 + rcx], dl
lea rcx, [rcx + 1]
test dl, dl
jne 0x14005eb80
mov rax, rbx
jmp 0x14005eba1
call fcn.14009eab4
mov dword [rax], Ordinal_32
xor eax, eax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400784c0
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret

Function at 0x140062160
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x1401310c8]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbp, qword [rcx + 0x240]
lea r8, [rsp + 0x20]
mov rsi, qword [rcx]
lea rdx, [rsp + 0x28]
mov rdi, rcx
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
mov rcx, rbp
or rbx, 0xffffffffffffffff
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x1400621d1
lea r8, [rsp + 0x20]
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
lea rdx, [rsp + 0x28]
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_accept]
mov rbx, rax
mov rdx, rbp
mov rcx, rdi
call fcn.140050210
mov rcx, rsi
cmp rbx, 0xffffffffffffffff
jne 0x1400621f6
lea rdx, str.Error_accept__ing_server_connect
call fcn.14004f6b0
lea eax, [rbx + 0x1f]
jmp 0x14006226f
lea rdx, str.Connection_accepted_from_server_n
call fcn.14004f7b0
mov byte [rdi + 0x38c], 0
mov edx, 1
mov rcx, rbx
mov qword [rdi + 0x240], rbx
call fcn.1400716d0
mov byte [rdi + 0x259], 1
cmp qword [rsi + 0x2c8], 0
je 0x14006226d
mov dl, 1
mov rcx, rsi
call fcn.140041990
mov rcx, qword [rsi + 0x2d0]
mov r8d, 1
mov rdx, rbx
call qword [rsi + 0x2c8]
xor edx, edx
mov rcx, rsi
mov ebx, eax
call fcn.140041990
test ebx, ebx
je 0x14006226d
mov rcx, rdi
call fcn.140062750
mov eax, Ordinal_46
jmp 0x14006226f
xor eax, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400784c0
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x140063350
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [rcx + 0x6ba], 0
lea r9, [rcx + 0x628]
mov rbx, rcx
jne 0x1400633fc
xor edx, edx
mov dword [r9 + 0xb4], edx
mov rax, qword [rcx]
mov ecx, edx
cmp dword [rax + 0x734], 2
sete cl
mov dword [r9 + 0xb8], ecx
mov rax, qword [rbx]
cmp dword [rax + 0x730], 2
jne 0x1400633a1
cmp dword [r9 + 0x94], edx
je 0x1400633f9
cmp byte [rbx + 0x382], dl
je 0x1400633bb
mov r8, qword [r9 + 0x70]
test r8, r8
je 0x1400633bb
mov dword [r9 + 0x94], edx
jmp 0x1400633d6
cmp dword [r9 + 0x80], edx
je 0x1400633f9
mov r8, qword [r9 + 0x78]
mov dword [r9 + 0x94], 1
mov r8, qword [r8]
lea rdx, str.CWD__s
mov rcx, r9
call fcn.140074840
test eax, eax
jne 0x140063406
lea edx, [rax + 0x10]
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.140062740
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.1400637d0
add rsp, 0x20
pop rbx
ret

Function at 0x1400637d0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx]
mov rbx, rcx
add rcx, 0x628
cmp byte [rax + 0x749], 0
jne 0x1400637f5
cmp dword [rax + 0x598], 0
je 0x140063821
mov r8, qword [rcx + 0x88]
test r8, r8
je 0x140063821
lea rdx, str.MDTM__s
call fcn.140074840
test eax, eax
jne 0x14006382e
lea edx, [rax + 0x12]
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.140062740
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.140064880
add rsp, 0x20
pop rbx
ret

Function at 0x140063f90
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, qword [rcx]
lea eax, [rdx - 0xc8]
mov ebx, dword [rcx + 0x6d8]
mov rdi, rcx
cmp eax, 0x64
jb 0x140064011
test ebx, ebx
jne 0x140063fcf
lea rdx, str.disabling_EPRT_usage_n
mov rcx, rsi
call fcn.14004f7b0
mov byte [rdi + 0x395], bl
inc ebx
cmp ebx, 2
jne 0x140063ff8
lea rdx, str.Failed_to_do_PORT
mov rcx, rsi
call fcn.14004f6b0
lea eax, [rbx + 0x1c]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov edx, ebx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x140064c40
lea rdx, str.Connect_data_stream_actively_n
mov rcx, rsi
call fcn.14004f7b0
xor edx, edx
mov rcx, rdi
call fcn.140062740
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.1400628b0
Function at 0x140064350
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx]
mov rbx, rcx
mov rdx, qword [rax + 0x1f8]
cmp dword [rdx + 0x18], 0
je 0x14006439d
cmp qword [rcx + 0x6b0], 0
je 0x14006439d
add rcx, 0x628
lea rdx, str.REST__d
xor r8d, r8d
call fcn.140074840
test eax, eax
jne 0x1400643a7
lea edx, [rax + 0x1a]
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.140062740
add rsp, 0x20
pop rbx
jmp fcn.140064040
add rsp, 0x20
pop rbx
ret

Function at 0x140064650
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
add rcx, 0x628
mov rax, qword [rbx]
mov rdx, qword [rax + 0x1f8]
cmp dword [rdx + 0x18], 1
jne 0x14006469c
mov r8, qword [rcx + 0x88]
test r8, r8
je 0x14006469c
lea rdx, str.SIZE__s
call fcn.140074840
test eax, eax
jne 0x1400646a9
lea edx, [rax + 0x17]
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.140062740
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.140064350
add rsp, 0x20
pop rbx
ret

Function at 0x140064880
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub rsp, 0x28
mov r10, qword [rcx]
mov r9, rcx
cmp byte [r10 + 0x758], 0
je 0x1400648d7
cmp qword [rcx + 0x6b0], 0
je 0x1400648d7
movzx edx, byte [r10 + 0x74b]
call fcn.140062b00
test eax, eax
je 0x1400648d7
mov rax, qword [r10 + 0x1f8]
mov r8d, reloc.WS2_32.dll_send
mov rcx, r9
mov dword [rax + 0x18], 1
movzx edx, byte [r10 + 0x74b]
add rsp, 0x28
jmp fcn.140062a70
mov rcx, r9
add rsp, 0x28
jmp fcn.140064650