joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140062b40
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x1404b75f0]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x140062b6d
xor eax, eax
jmp 0x140062cb3
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x140062ba7
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x140062ba7
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x140062cb3
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x140062ca6
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x140062bea
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140062bf9
movsx ecx, dil
jmp 0x140062c4d
lea r8, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rsp + 0x51]
lea r8, [rsp + 0x78]
mov qword [rsp + 0x30], r8
lea r8, [rsp + 0x58]
mov qword [rsp + 0x28], r8
lea r8, [rsp + 0x48]
mov qword [rsp + 0x20], r8
lea r8, [rsp + 0x50]
call qword [rax + gethostname]
test eax, eax
je 0x140062c67
sub eax, 1
je 0x140062c67
cmp eax, 2
jne 0x140062ca6
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call fcn.14026ad10
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140062cab
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x140062c94
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call fcn.14026bc48
cmp rsi, rax
jne 0x140062ca6
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov eax, edi
jne 0x140062cab
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14025bc30
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret

Function at 0x1400664a0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x1400664fd
lea rbx, [0x140480830]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x1400664e4
cmp r10, 2
jb 0x1400664e4
cmp byte [r9], r8b
jne 0x1400664e4
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x1400664c0
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x14006653f
lea rbx, [0x140480830]
cmp r8b, 0x23
jne 0x140066523
cmp byte [r9], r8b
jne 0x140066523
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x140066510
mov rbx, qword [rsp + 8]
not eax
ret
Function at 0x140071570
Capabilities:
Hash data with crc32

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 8], rcx
push rdi
sub rsp, 0x20
mov rax, qword [0x1404c1aa0]
mov r8, rcx
mov rbx, qword [rax + 0x1c08]
add rbx, 0xc8
movzx eax, r8b
lea r8, [0x140480830]
movsxd rdx, dword [rbx]
mov r9, qword [rbx + 8]
mov edi, dword [r9 + rdx*4 - 4]
not edi
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 9]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 0xa]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 0xb]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 0xc]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 0xd]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 0xe]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 0xf]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
shr edi, 8
xor rcx, rax
xor edi, dword [r8 + rcx*4]
mov r8d, dword [rbx + 4]
not edi
cmp edx, r8d
jne 0x14007167e
lea ecx, [rdx + 1]
test r8d, r8d
je 0x140071664
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
add eax, r8d
jmp 0x140071669
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
mov edx, ecx
mov rcx, rbx
call fcn.1400786d0
mov edx, dword [rbx]
mov r9, qword [rbx + 8]
movsxd rax, edx
mov dword [r9 + rax*4], edi
inc dword [rbx]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140072070
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x1404b75f0]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x1404c1aa0]
mov edi, edx
cmp byte [rbx + 0x1f45], 0
jne 0x1400720d0
cmp byte [rbx + 0x1f46], 0
jne 0x1400720d0
mov r9d, dword [rbx + 0x2fe8]
lea r8, str.Tooltip__02d
mov edx, reloc.WS2_32.dll_recv
lea rcx, [rsp + 0x20]
call fcn.140066390
test dil, 1
je 0x1400721ee
jmp 0x140072158
movss xmm1, dword [rbx + 0x1614]
lea r8, str.Tooltip__02d
mov r9d, dword [rbx + 0x2fe8]
lea rcx, [rsp + 0x20]
movaps xmm0, xmm1
xor eax, eax
mulss xmm0, dword [0x14048aa74]
mulss xmm1, dword [0x14048aa68]
lea edx, [rax + 0x10]
addss xmm0, dword [rbx + 0x128]
addss xmm1, dword [rbx + 0x12c]
mov qword [rbx + 0x1cc0], rax
mov dword [rbx + 0x1cac], 1
movss dword [rbx + 0x1cb8], xmm0
movss dword [rbx + 0x1cbc], xmm1
movss xmm0, dword [rbx + 0x1670]
mulss xmm0, dword [0x14048aa00]
or dword [rbx + 0x1ca8], 0x41
movss dword [rbx + 0x1d08], xmm0
call fcn.140066390
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x1400721a8
lea r11, [0x140480830]
cmp r9b, 0x23
jne 0x14007218b
cmp byte [r8], r9b
jne 0x14007218b
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140072178
not ecx
call fcn.14006c2d0
test rax, rax
je 0x1400721ee
cmp byte [rax + 0x8e], 0
je 0x1400721ee
mov byte [rax + 0x95], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xac], 1
lea rcx, [rsp + 0x20]
inc dword [rbx + 0x2fe8]
mov edx, reloc.WS2_32.dll_recv
mov r9d, dword [rbx + 0x2fe8]
call fcn.140066390
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20c0347
call fcn.14006e9d0
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14025bc30
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x1400766c0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x3088], 0
lea rbx, [rcx + 0x3090]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x140076762
mov ecx, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test ecx, ecx
jns 0x140076716
mov eax, ecx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, ecx
mov rcx, rbx
test eax, eax
cmovg edx, eax
call fcn.140078460
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.140066a70
mov eax, dword [rbx]
lea rcx, [0x1404c1a98]
mov r9, qword [rdi + 0x3088]
test eax, eax
lea edx, [rax - 1]
mov rax, qword [rdi + 0x3098]
cmove edx, r14d
test rax, rax
movsxd r8, edx
mov edx, 1
cmovne rcx, rax
call fcn.14026bc48
mov r14, qword [rsp + 0x30]
jmp 0x14007676a
mov rcx, rbx
call fcn.140066a70
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x140076ab0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rbx, qword [0x1404c1aa0]
cmp byte [rbx + 0x3021], 0
jne 0x140076bd0
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x140076bc9
lea rdx, [0x1404879f0]
call fcn.140066550
mov rdi, rax
test rax, rax
je 0x140076bc9
mov rcx, rax
call fcn.14026cde0
mov ebp, eax
cmp eax, 0xffffffff
je 0x140076bc1
xor edx, edx
mov rcx, rdi
lea r8d, [rdx + 2]
call fcn.14026c5dc
test eax, eax
jne 0x140076bc1
mov rcx, rdi
call fcn.14026cde0
movsxd rsi, eax
cmp esi, 0xffffffff
je 0x140076bc1
xor r8d, r8d
mov edx, ebp
mov rcx, rdi
call fcn.14026c5dc
test eax, eax
jne 0x140076bc1
cmp rsi, 0xffffffffffffffff
je 0x140076bc1
mov rax, qword [0x1404c1aa0]
test rax, rax
je 0x140076b63
inc dword [rax + 0x3b4]
mov rcx, rsi
call fcn.1402762d4
mov rbp, rax
test rax, rax
je 0x140076bc1
mov r9, rdi
mov r8, rsi
mov edx, 1
mov rcx, rax
call fcn.14026c304
mov rcx, rdi
cmp rax, rsi
je 0x140076b95
call fcn.14026b20c
jmp 0x140076ba5
call fcn.14026b20c
mov rdx, rsi
mov rcx, rbp
call fcn.140076d70
mov rax, qword [0x1404c1aa0]
test rax, rax
je 0x140076bb7
dec dword [rax + 0x3b4]
mov rcx, rbp
call fcn.14026bed8
jmp 0x140076bc9
mov rcx, rdi
call fcn.14026b20c
mov byte [rbx + 0x3021], 1
movss xmm0, dword [rbx + 0x3024]
xorps xmm1, xmm1
comiss xmm0, xmm1
jbe 0x140076c5d
subss xmm0, dword [rbx + 0x18]
comiss xmm1, xmm0
movss dword [rbx + 0x3024], xmm0
jb 0x140076c5d
mov rdi, qword [rbx + 0x20]
xor ebp, ebp
test rdi, rdi
je 0x140076c50
mov rax, qword [0x1404c1aa0]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], rbp
mov dword [rax + 0x3024], ebp
call fcn.1400770d0
lea rdx, [0x1404879f4]
mov rcx, rdi
mov rsi, rax
call fcn.140066550
mov rdi, rax
test rax, rax
je 0x140076c57
mov r8, qword [rsp + 0x30]
lea edx, [rbp + 1]
mov r9, rax
mov rcx, rsi
call fcn.14026bc48
mov rcx, rdi
call fcn.14026b20c
jmp 0x140076c57
mov byte [rbx + 0x39c], 1
mov dword [rbx + 0x3024], ebp
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x140099bf0
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x110
movaps xmmword [r11 - 0x18], xmm6
movaps xmmword [r11 - 0x28], xmm7
movaps xmmword [r11 - 0x38], xmm8
mov rax, qword [0x1404b75f0]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov rbx, rcx
mov qword [r11 - 0x78], rcx
lea rdx, [rsp + 0x40]
call fcn.140099e40
mov r9, rax
cmp byte [rax + 0x56], 0
je 0x140099dd2
xor ecx, ecx
cmp dword [reloc.WS2_32.dll_accept], 2
jl 0x140099d9c
movdqa xmm5, xmmword [0x14048ab70]
movdqa xmm4, xmmword [0x14048b000]
mov eax, 5
movd xmm6, eax
movdqa xmm7, xmmword [0x14048aba0]
mov eax, Ordinal_33
movd xmm8, eax
movdqa xmm0, xmmword [str.9999999999999999]
movdqa xmmword [rsp + 0xb0], xmm0
mov rdx, r9
mov r8d, dword [rsp + 0xb0]
movd xmm2, ecx
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x14048ac00]
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx]
pxor xmm2, xmm0
movd dword [rdx], xmm2
lea eax, [rcx + 4]
movd xmm3, eax
pshufd xmm3, xmm3, 0
paddd xmm3, xmm5
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x14048ac00]
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx + 4]
pxor xmm2, xmm0
movd dword [rdx + 4], xmm2
add ecx, 8
lea rdx, [rdx + 8]
cmp ecx, 0x50
jl 0x140099c90
cmp ecx, 0x57
jge 0x140099dd2
movsxd r8, ecx
add r8, r9
mov eax, 0x8fb823ef
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 1
sub al, dl
movsx eax, al
imul edx, eax, 0x39
add dl, cl
xor byte [r8], dl
inc ecx
lea r8, [r8 + 1]
cmp ecx, 0x57
jl 0x140099da2
mov rdx, r9
lea rcx, [rsp + 0x20]
call fcn.1400631f0
nop
mov rcx, rax
call fcn.140063140
mov rdx, rax
lea rcx, [rsp + 0xb0]
call fcn.1400631f0
nop
lea rcx, [rsp + 0x20]
call fcn.140063190
mov rdx, rbx
lea rcx, [rsp + 0xb0]
call fcn.140063170
mov rcx, rax
lea rdx, str.__PAUSE_
call fcn.140063150
lea rcx, [rsp + 0xb0]
call fcn.140063140
mov rcx, rax
call fcn.14026b6cc
xor ecx, ecx
call fcn.140277750
int3
Function at 0x1400a04a0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x1404b75f0]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor ebp, ebp
mov rsi, rdx
mov edi, ebp
mov r14d, ecx
nop dword [rax + rax]
mov rcx, qword [0x1404c1ac0]
lea rax, [rsp + 0x3c]
mov r9d, 0x40
mov dword [rsp + 0x38], 4
lea ebx, [r14 + rdi]
mov qword [rsp + 0x20], rax
mov edx, ebx
mov rcx, qword [rcx + 8]
lea r8d, [r9 - 0x3f]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov rcx, qword [0x1404c1ac0]
lea r8, [rsp + 0x30]
movzx eax, byte [rsi]
mov r9d, 1
mov edx, ebx
mov byte [rsp + 0x30], al
mov qword [rsp + 0x20], rbp
mov rcx, qword [rcx + 8]
call qword [sym.imp.ntdll.dll_NtWriteVirtualMemory]
mov rcx, qword [0x1404c1ac0]
lea rax, [rsp + 0x38]
mov r9d, dword [rsp + 0x3c]
mov r8d, 1
mov edx, ebx
mov qword [rsp + 0x20], rax
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
inc edi
lea rsi, [rsi + 1]
cmp edi, 0xc
jb 0x1400a04d0
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14025bc30
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret

Function at 0x1400a0590
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x1404b75f0]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov ebx, ecx
lea rax, [rsp + 0x30]
mov rdi, rdx
mov qword [rsp + 0x20], rax
mov edx, ecx
mov r9d, 0x40
mov rcx, qword [0x1404c1ac0]
mov rsi, r8
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov rcx, qword [0x1404c1ac0]
mov r9d, esi
mov r8, rdi
mov qword [rsp + 0x20], 0
mov edx, ebx
mov rcx, qword [rcx + 8]
call qword [sym.imp.ntdll.dll_NtWriteVirtualMemory]
mov rcx, qword [0x1404c1ac0]
mov r8, rsi
mov r9d, dword [rsp + 0x30]
mov edx, ebx
mov qword [rsp + 0x20], 0
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14025bc30
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400e9230
Capabilities:
Convert ip address from string

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x88
mov rax, qword [0x1404b75f0]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov r13, qword [rcx]
mov ebp, r8d
mov rsi, rcx
lea r8, [rsp + 0x20]
mov ebx, 2
xor r14d, r14d
mov ecx, ebx
mov r15, r9
mov r12, qword [r13 + 0x11b0]
mov rdi, rdx
mov dword [r9], r14d
call qword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
jle 0x1400e929c
mov r9d, ebp
lea rdx, [rsp + 0x20]
mov r8, rdi
mov ecx, ebx
call fcn.140107ea0
jmp 0x1400e937a
mov ebx, reloc.WS2_32.dll_socket
lea r8, [rsp + 0x58]
mov ecx, ebx
mov rdx, rdi
call qword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
jle 0x1400e92cc
mov r9d, ebp
lea rdx, [rsp + 0x58]
mov r8, rdi
mov ecx, ebx
call fcn.140107ea0
jmp 0x1400e937a
mov ecx, dword [rsi + 0x440]
sub ecx, 1
je 0x1400e92f0
cmp ecx, 1
je 0x1400e92df
mov ebx, r14d
call fcn.1400e9d60
test al, al
mov eax, 2
cmove ebx, eax
jmp 0x1400e92f5
mov ebx, 2
cmp dword [rsi + 0xbc], 3
lea r8, [0x140487a94]
xorps xmm0, xmm0
lea rcx, [rsp + 0x68]
movups xmmword [rsp + 0x28], xmm0
setne r14b
mov dword [rsp + 0x2c], ebx
inc r14d
mov r9d, ebp
mov edx, ntohs
mov dword [rsp + 0x30], r14d
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
call fcn.1400f9210
lea rcx, [rsp + 0x58]
call fcn.1400e90c0
lea r9, [rsp + 0x28]
mov r8d, ebp
mov rdx, rdi
mov rcx, rsi
movups xmm0, xmmword [rax]
movups xmmword [r12], xmm0
call fcn.1400e99c0
test al, al
je 0x1400e9369
mov dword [r15], 1
jmp 0x1400e9378
lea rdx, str.getaddrinfo___thread_failed_to_start_n
mov rcx, r13
call fcn.1400f52d0
xor eax, eax
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14025bc30
add rsp, 0x88
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
jmp 0x1400e9230
Function at 0x1400f5210
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx + 0x718], 0
mov rsi, r9
mov rbp, r8
movsxd rbx, edx
mov rdi, rcx
je 0x1400f526e
mov dl, 1
call fcn.1400e4070
mov rax, qword [rdi + 0x670]
mov r9, rsi
mov r8, rbp
mov qword [rsp + 0x20], rax
mov edx, ebx
mov rcx, rdi
call qword [rdi + 0x718]
xor edx, edx
mov rcx, rdi
mov ebx, eax
call fcn.1400e4070
mov eax, ebx
jmp 0x1400f52b0
cmp ebx, 2
ja 0x1400f52ae
mov r9, qword [rdi + 0x668]
lea rdx, [0x1402a6010]
lea rcx, [rbx + rbx*2]
add rcx, rdx
mov edx, 2
lea r8d, [rdx - 1]
call fcn.14026bc48
mov r9, qword [rdi + 0x668]
mov r8d, 1
mov rdx, rsi
mov rcx, rbp
call fcn.14026bc48
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x1400f52d0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rdi
sub rsp, 0x160
mov rax, qword [0x1404b75f0]
xor rax, rsp
mov qword [rsp + 0x140], rax
cmp byte [rcx + 0xea6], 0
mov rdi, rcx
jne 0x1400f5313
cmp qword [rcx + 0x678], 0
je 0x1400f53f0
mov r8, rdx
mov qword [rsp + 0x158], rbx
mov edx, 0x100
lea r9, [rsp + 0x180]
lea rcx, [rsp + 0x30]
call fcn.1400f9320
lea rax, [rsp + 0x30]
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x1400f5341
mov rcx, qword [rdi + 0x678]
test rcx, rcx
je 0x1400f5388
cmp byte [rdi + 0x1528], 0
jne 0x1400f5388
lea rdx, [rsp + 0x30]
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rdx]
lea rdx, [rdx + 1]
mov byte [rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x1400f5370
mov byte [rdi + 0x1528], 1
cmp byte [rdi + 0xea6], 0
je 0x1400f53e8
mov byte [rsp + rbx + 0x30], 0xa
inc rbx
cmp rbx, 0x102
jae 0x1400f5441
cmp qword [rdi + 0x718], 0
mov byte [rsp + rbx + 0x30], 0
je 0x1400f5409
mov dl, 1
mov rcx, rdi
call fcn.1400e4070
mov rax, qword [rdi + 0x670]
lea r8, [rsp + 0x30]
mov r9, rbx
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, rdi
call qword [rdi + 0x718]
xor edx, edx
mov rcx, rdi
call fcn.1400e4070
mov rbx, qword [rsp + 0x158]
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14025bc30
add rsp, 0x160
pop rdi
ret
mov r9, qword [rdi + 0x668]
lea rcx, [0x1402a6010]
mov edx, 2
lea r8d, [rdx - 1]
call fcn.14026bc48
mov r9, qword [rdi + 0x668]
lea rcx, [rsp + 0x30]
mov r8d, 1
mov rdx, rbx
call fcn.14026bc48
jmp 0x1400f53e8
call fcn.14025c170
int3
Function at 0x1400f5450
Capabilities:
Write file on windows

Disassembly:
test rcx, rcx
je 0x1400f55b4
mov r11, rsp
mov qword [r11 + 0x10], rdx
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x20], r9
push rdi
sub rsp, 0x860
mov rax, qword [0x1404b75f0]
xor rax, rsp
mov qword [rsp + 0x840], rax
cmp byte [rcx + 0xea6], 0
mov rdi, rcx
je 0x1400f559c
mov r8, rdx
mov qword [r11 - 0x10], rbx
mov edx, 0x801
lea r9, [r11 + 0x18]
lea rcx, [rsp + 0x30]
call fcn.1400f9320
movsxd rcx, eax
mov rbx, 0xffffffffffffffff
cmp rcx, 0x801
jb 0x1400f5511
mov rcx, qword [rsp + 0x878]
mov rax, rbx
nop word [rax + rax]
cmp byte [rcx + rax + 1], 0
lea rax, [rax + 1]
jne 0x1400f54d0
cmp byte [rax + rcx - 1], 0xa
jne 0x1400f54f8
lea r8, str...._n
mov edx, 5
lea rcx, [rsp + 0x82c]
jmp 0x1400f550c
lea r8, [0x140487964]
mov edx, 4
lea rcx, [rsp + 0x82d]
call fcn.1400f9210
lea rax, [rsp + 0x30]
inc rbx
cmp byte [rax + rbx], 0
jne 0x1400f5516
cmp qword [rdi + 0x718], 0
je 0x1400f555e
mov dl, 1
mov rcx, rdi
call fcn.1400e4070
mov rax, qword [rdi + 0x670]
lea r8, [rsp + 0x30]
mov r9, rbx
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, rdi
call qword [rdi + 0x718]
xor edx, edx
mov rcx, rdi
call fcn.1400e4070
jmp 0x1400f5594
mov r9, qword [rdi + 0x668]
lea rcx, [0x1402a6010]
mov edx, 2
lea r8d, [rdx - 1]
call fcn.14026bc48
mov r9, qword [rdi + 0x668]
lea rcx, [rsp + 0x30]
mov r8d, 1
mov rdx, rbx
call fcn.14026bc48
mov rbx, qword [rsp + 0x858]
mov rcx, qword [rsp + 0x840]
xor rcx, rsp
call fcn.14025bc30
add rsp, 0x860
pop rdi
ret
Function at 0x1400f7c10
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
call fcn.140283338
cdqe
add rsp, 0x28
ret

Function at 0x1400f8ae0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp byte [0x1404bc7c0], 0
mov esi, r8d
mov rdi, qword [rsp + 0x68]
je 0x1400f8b8f
test rdi, rdi
je 0x1400f8b8f
mov eax, dword [0x1404bc7c4]
test eax, eax
jne 0x1400f8b87
mov r8d, dword [rsp + 0x60]
lea rsi, str.recv
mov r9, rsi
lea rcx, str.LIMIT__s:_d__s_reached_memlimit_n
mov rdx, rdi
call fcn.1400f8830
mov ecx, 2
call fcn.14026b928
mov r9d, dword [rsp + 0x60]
lea rdx, str.LIMIT__s:_d__s_reached_memlimit_n
mov rcx, rax
mov qword [rsp + 0x20], rsi
mov r8, rdi
call fcn.1400f91e0
mov rcx, qword [0x1404bc7b8]
call fcn.14026b120
call fcn.140278694
mov dword [rax], ntohs
mov eax, 0xffffffff
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
dec eax
mov dword [0x1404bc7c4], eax
call qword [sym.imp.WS2_32.dll_recv]
mov ebx, eax
test rdi, rdi
je 0x1400f8bb7
mov r8d, dword [rsp + 0x60]
lea rcx, str.RECV__s:_d_recv__lu____ld_n
mov r9d, esi
mov dword [rsp + 0x20], eax
mov rdx, rdi
call fcn.1400f8830
mov rsi, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x1400f8c30
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp byte [0x1404bc7c0], 0
mov esi, r8d
mov rdi, qword [rsp + 0x68]
je 0x1400f8cdf
test rdi, rdi
je 0x1400f8cdf
mov eax, dword [0x1404bc7c4]
test eax, eax
jne 0x1400f8cd7
mov r8d, dword [rsp + 0x60]
lea rsi, str.send
mov r9, rsi
lea rcx, str.LIMIT__s:_d__s_reached_memlimit_n
mov rdx, rdi
call fcn.1400f8830
mov ecx, 2
call fcn.14026b928
mov r9d, dword [rsp + 0x60]
lea rdx, str.LIMIT__s:_d__s_reached_memlimit_n
mov rcx, rax
mov qword [rsp + 0x20], rsi
mov r8, rdi
call fcn.1400f91e0
mov rcx, qword [0x1404bc7b8]
call fcn.14026b120
call fcn.140278694
mov dword [rax], ntohs
mov eax, 0xffffffff
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
dec eax
mov dword [0x1404bc7c4], eax
call qword [sym.imp.WS2_32.dll_send]
mov ebx, eax
test rdi, rdi
je 0x1400f8d07
mov r8d, dword [rsp + 0x60]
lea rcx, str.SEND__s:_d_send__lu____ld_n
mov r9d, esi
mov dword [rsp + 0x20], eax
mov rdx, rdi
call fcn.1400f8830
mov rsi, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret