joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140089ea0
Capabilities:
Set console window title

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x1401e7890]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rdi, rcx
cmp byte [rcx + 0x108], 0
je 0x140089f4e
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_AttachConsole]
test eax, eax
setne cl
mov byte [rdi + 0x109], cl
test eax, eax
jne 0x140089eec
call qword [sym.imp.KERNEL32.dll_AllocConsole]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rdi + 0x128], rax
test rax, rax
je 0x140089f4e
mov rcx, qword [rdi + 0x110]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
lea rdx, [rsp + 0x50]
mov rcx, qword [rdi + 0x128]
call qword [sym.imp.KERNEL32.dll_GetConsoleMode]
mov edx, dword [rsp + 0x50]
mov dword [rdi + 0x120], edx
and edx, 0xffffffbf
or edx, 0xc
mov dword [rsp + 0x50], edx
mov rcx, qword [rdi + 0x128]
call qword [sym.imp.KERNEL32.dll_SetConsoleMode]
mov rcx, rdi
call fcn.14008a220
cmp byte [rdi + 0x108], 0
je 0x140089fa0
lea rcx, [rdi + 8]
mov r9d, 0x40
lea r8d, [r9 - 0x36]
lea rdx, str.CONOUT_
call fcn.1400133e0
mov rcx, qword [rdi]
movsxd rcx, dword [rcx + 4]
xor r8d, r8d
add rcx, rdi
test rax, rax
je 0x140089f95
xor edx, edx
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::clear_int__bool____ptr64]
jmp 0x140089fa0
mov edx, 2
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
lea rbx, [rdi + 0x130]
lea rdx, [rdi + 0x240]
lea rcx, [rsp + 0x30]
call fcn.14000c760
nop
lea rdx, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rdx, qword [rsp + 0x30]
lea rcx, [rbx + 8]
mov r8d, reloc.WS2_32.dll_select
call fcn.140033c00
mov rcx, qword [rbx]
movsxd rcx, dword [rcx + 4]
xor r8d, r8d
add rcx, rbx
test rax, rax
je 0x140089ff5
xor edx, edx
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::clear_int__bool____ptr64]
jmp 0x14008a001
mov edx, 2
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
nop
lea rcx, [rsp + 0x30]
call fcn.140013a10
mov rbx, qword [rdi + 0x260]
mov ecx, 1
call fcn.140157168
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x28]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.14008dbb0
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x14008a06d
mov rdx, qword [rcx + 8]
test rdx, rdx
je 0x14008a063
mov eax, 0xffffffff
lock xadd dword [rdx + 0xc], eax
cmp eax, 1
jne 0x14008a05e
mov rax, qword [rdx]
mov rcx, rdx
call qword [rax + reloc.WS2_32.dll_htonl]
mov rcx, qword [rsp + 0x20]
mov edx, reloc.WS2_32.dll_recv
call fcn.1401575a0
mov rcx, qword [rdi + 0x260]
call fcn.1400a7860
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140156eb0
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
Function at 0x14008a860
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rax, qword [0x1401e7890]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rdi, rcx
mov qword [rsp + 0x20], rcx
mov r8d, dword [rcx]
mov r9d, r8d
shr r9d, 0x18
mov r10d, r8d
shr r10d, 0x10
mov r11d, r8d
shr r11d, 8
mov ecx, r8d
sub ecx, 1
je 0x14008a9b4
sub ecx, 0x63
je 0x14008a9a4
sub ecx, 0xc8
je 0x14008a994
cmp ecx, 0xc8
je 0x14008a984
movzx edx, r8b
movabs rax, 0xcbf29ce484222325
xor rdx, rax
movabs rcx, 0x100000001b3
imul rdx, rcx
movzx eax, r11b
xor rdx, rax
imul rdx, rcx
movzx eax, r10b
xor rdx, rax
imul rdx, rcx
mov eax, r9d
xor rdx, rax
imul rdx, rcx
mov rcx, qword [0x1401ee1f0]
and rcx, rdx
shl rcx, 4
add rcx, qword [0x1401ee1d8]
mov rax, qword [rcx + 8]
mov rdx, qword [0x1401ee1c8]
cmp rax, rdx
je 0x14008a944
mov rcx, qword [rcx]
cmp r8d, dword [rax + 0x10]
je 0x14008a946
cmp rax, rcx
je 0x14008a944
mov rax, qword [rax + 8]
cmp r8d, dword [rax + 0x10]
jne 0x14008a933
jmp 0x14008a946
xor eax, eax
test rax, rax
je 0x14008a960
cmp rax, rdx
je 0x14008a960
mov ebx, dword [rax + 0x14]
lea rcx, [rdi + 8]
call fcn.140013a80
mov eax, ebx
jmp 0x14008a9c2
mov rcx, rdi
call fcn.1400a31e0
mov ebx, 0x61
mov ecx, 0x1f
test al, al
cmovne ebx, ecx
lea rcx, [rdi + 8]
call fcn.140013a80
mov eax, ebx
jmp 0x14008a9c2
lea rcx, [rdi + 8]
call fcn.140013a80
mov eax, 0x5d
jmp 0x14008a9c2
lea rcx, [rdi + 8]
call fcn.140013a80
mov eax, 0x5e
jmp 0x14008a9c2
lea rcx, [rdi + 8]
call fcn.140013a80
mov eax, 0x20
jmp 0x14008a9c2
lea rcx, [rdi + 8]
call fcn.140013a80
mov eax, 0x5b
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140156eb0
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x140096a20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, dword [rcx + 0x10]
mov r10d, ecx
and r10d, 7
je 0x140096a54
cmp ecx, r10d
jge 0x140096a42
mov rcx, rbx
call fcn.140096220
mov eax, dword [rbx + 0x14]
mov ecx, r10d
shr eax, cl
sub dword [rbx + 0x10], r10d
mov ecx, dword [rbx + 0x10]
mov dword [rbx + 0x14], eax
xor r8d, r8d
mov eax, ecx
test ecx, ecx
jle 0x140096a8e
mov ecx, dword [rbx + 0x14]
lea rdx, [rsp + 0x30]
movzx r9d, cl
nop dword [rax]
shr ecx, 8
inc r8d
mov byte [rdx], r9b
lea rdx, [rdx + 1]
sub eax, 8
mov dword [rbx + 0x14], ecx
movzx r9d, cl
test eax, eax
jg 0x140096a70
mov dword [rbx + 0x10], eax
test eax, eax
jns 0x140096ab6
mov rax, qword gs:[0x58]
mov edx, 0x30
mov rcx, qword [rax]
lea rax, str.zlib_corrupt
mov qword [rdx + rcx], rax
xor eax, eax
add rsp, 0x20
pop rbx
ret
movsxd rcx, r8d
cmp rcx, 4
jge 0x140096ae5
mov r8, qword [rbx + 8]
mov rax, qword [rbx]
cmp rax, r8
jb 0x140096acf
xor dl, dl
jmp 0x140096ad8
movzx edx, byte [rax]
inc rax
mov qword [rbx], rax
mov byte [rsp + rcx + 0x30], dl
inc rcx
cmp rcx, 4
jl 0x140096ac6
movzx eax, byte [rsp + 0x30]
movzx r8d, byte [rsp + 0x31]
movzx ecx, byte [rsp + 0x33]
shl r8d, 8
add r8d, eax
shl ecx, 8
movzx eax, byte [rsp + 0x32]
add ecx, eax
mov eax, r8d
xor eax, 0xffff
cmp ecx, eax
jne 0x140096a92
mov rcx, qword [rbx]
mov qword [rsp + 0x38], rdi
mov edi, r8d
add rcx, rdi
cmp rcx, qword [rbx + 8]
jbe 0x140096b4f
mov rax, qword gs:[0x58]
mov edx, 0x30
mov rcx, qword [rax]
lea rax, str.read_past_buffer
mov qword [rdx + rcx], rax
mov rdi, qword [rsp + 0x38]
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov rdx, qword [rbx + 0x18]
lea rax, [r8 + rdx]
cmp rax, qword [rbx + 0x28]
jbe 0x140096b69
mov rcx, rbx
call fcn.140096370
test eax, eax
je 0x140096b42
mov rdx, qword [rbx]
mov r8, rdi
mov rcx, qword [rbx + 0x18]
call sub.VCRUNTIME140.dll_memcpy
add qword [rbx], rdi
mov eax, 1
add qword [rbx + 0x18], rdi
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
Function at 0x1400b1e90
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 8], rcx
mov eax, 0x21d8
call fcn.140157d40
sub rsp, rax
mov rax, qword [0x1401e7890]
xor rax, rsp
mov qword [rsp + 0x21c0], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x24]
mov r8d, 0x2000
lea rdx, [rsp + 0xb0]
mov rcx, qword [rsp + 0x28]
call sub.KERNEL32.dll_K32EnumProcessModules
test eax, eax
je 0x1400b1ff9
mov dword [rsp + 0x20], 0
jmp 0x1400b1ef8
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
movsxd rax, dword [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x24]
xor edx, edx
mov eax, ecx
mov ecx, 8
div rcx
mov rcx, qword [rsp + 0x30]
cmp rcx, rax
jae 0x1400b1ff9
movsxd rax, dword [rsp + 0x20]
mov r9d, 0x104
lea r8, [rsp + 0x20b0]
mov rdx, qword [rsp + rax*8 + 0xb0]
mov rcx, qword [rsp + 0x28]
call sub.KERNEL32.dll_K32GetModuleFileNameExA
test eax, eax
je 0x1400b1ff4
lea rdx, [rsp + 0x20b0]
lea rcx, [rsp + 0x90]
call fcn.14000d2d0
nop
movsxd rax, dword [rsp + 0x20]
mov r9d, Ordinal_27
lea r8, [rsp + 0x58]
mov rdx, qword [rsp + rax*8 + 0xb0]
mov rcx, qword [rsp + 0x28]
call sub.KERNEL32.dll_K32GetModuleInformation
test eax, eax
je 0x1400b1fe7
lea rcx, [rsp + 0x48]
call fcn.1400b5410
nop
mov eax, dword [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x40], rax
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x70]
call fcn.1400b50b0
mov r9, rax
lea r8, [rsp + 0x90]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x21e0]
call fcn.1400b5010
nop
lea rcx, [rsp + 0x48]
call fcn.1400b5860
nop
lea rcx, [rsp + 0x90]
call fcn.140011e70
jmp 0x1400b1eee
mov rcx, qword [rsp + 0x21c0]
xor rcx, rsp
call fcn.140156eb0
add rsp, 0x21d8
ret
Function at 0x1400c5cd0
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov dword [rsp + 0x30], 4
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
mov r8d, 0x1008
mov edx, 0xffff
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x1400c5d24
cmp dword [rsp + 0x34], 1
jne 0x1400c5d24
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_send]
add rsp, 0x48
ret

Function at 0x1400cb9a0
Capabilities:
Hash data using djb2

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], 0x1505
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x50], rax
jae 0x1400cba2a
mov rax, qword [rsp + 0x28]
shl rax, 5
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x50]
movzx eax, byte [rax]
mov byte [rsp + 0x20], al
movzx ecx, byte [rsp + 0x20]
call fcn.1400e8e70
movsx rax, al
mov rcx, qword [rsp + 0x28]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x50]
inc rax
mov qword [rsp + 0x50], rax
jmp 0x1400cb9cc
xor edx, edx
mov rax, qword [rsp + 0x28]
mov ecx, 0x100
div rcx
mov rax, rdx
add rsp, 0x48
ret

Function at 0x1400e5a70
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x28
mov rcx, qword [rsp + 0x40]
call fcn.1400e5900
mov r8d, eax
mov rdx, qword [rsp + 0x38]
mov ecx, dword [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__read]
cdqe
add rsp, 0x28
ret
Function at 0x1400e5f60
Capabilities:
Initialize winsock library

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x208
mov rax, qword [0x1401e7890]
xor rax, rsp
mov qword [rsp + 0x1f0], rax
mov eax, dword [rsp + 0x210]
and eax, 2
test eax, eax
je 0x1400e6018
mov eax, 0x202
mov word [rsp + 0x30], ax
lea rdx, [rsp + 0x50]
movzx ecx, word [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 0
je 0x1400e5fbe
mov eax, 2
jmp 0x1400e60be
movzx eax, word [rsp + 0x50]
and rax, 0xff
movzx eax, al
movzx ecx, word [rsp + 0x30]
and rcx, 0xff
movzx ecx, cl
cmp eax, ecx
jne 0x1400e6008
movzx eax, word [rsp + 0x50]
shr rax, 8
and rax, 0xff
movzx eax, al
movzx ecx, word [rsp + 0x30]
shr rcx, 8
and rcx, 0xff
movzx ecx, cl
cmp eax, ecx
je 0x1400e6018
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 2
jmp 0x1400e60be
call fcn.14013e4f0
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
je 0x1400e6031
mov eax, dword [rsp + 0x34]
jmp 0x1400e60be
lea rcx, str.iphlpapi.dll
call fcn.1400e6140
mov qword [0x1401ebcd8], rax
cmp qword [0x1401ebcd8], 0
je 0x1400e607b
lea rdx, str.if_nametoindex
mov rcx, qword [0x1401ebcd8]
call qword [0x140161340]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
je 0x1400e607b
mov rax, qword [rsp + 0x40]
mov qword [0x1401ebcd0], rax
mov dword [rsp + 0x20], 3
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov ecx, 6
call fcn.14013e120
movzx eax, al
test eax, eax
je 0x1400e60a8
mov byte [0x1401ee630], 1
jmp 0x1400e60af
mov byte [0x1401ee630], 0
lea rcx, [0x1401ee638]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xor eax, eax
mov rcx, qword [rsp + 0x1f0]
xor rcx, rsp
call fcn.140156eb0
add rsp, 0x208
ret
Function at 0x1400e6140
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
jne 0x1400e617c
xor eax, eax
jmp 0x1400e631d
lea rdx, str.LoadLibraryExW
mov rcx, qword [rsp + 0x40]
call qword [0x140161340]
mov qword [rsp + 0x30], rax
lea rdx, [0x1401dcb90]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcspbrk]
test rax, rax
je 0x1400e61e9
cmp qword [rsp + 0x30], 0
je 0x1400e61ca
mov r8d, 8
xor edx, edx
mov rcx, qword [rsp + 0x70]
call qword [rsp + 0x30]
mov qword [rsp + 0x48], rax
jmp 0x1400e61da
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x38], rax
jmp 0x1400e6318
cmp qword [rsp + 0x30], 0
je 0x1400e6223
lea rdx, str.AddDllDirectory
mov rcx, qword [rsp + 0x40]
call qword [0x140161340]
test rax, rax
je 0x1400e6223
mov r8d, 0x800
xor edx, edx
mov rcx, qword [rsp + 0x70]
call qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
jmp 0x1400e6318
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x1400e6318
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
mov qword [rsp + 0x58], rax
mov eax, dword [rsp + 0x20]
inc eax
mov eax, eax
add rax, qword [rsp + 0x58]
shl rax, 1
mov rcx, rax
call qword [fcn.1401581f8]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1400e630d
mov edx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x1400e630d
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
mov rcx, qword [rsp + 0x28]
lea rax, [rcx + rax*2]
lea rdx, [0x1401dcb7c]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
mov rcx, qword [rsp + 0x28]
lea rax, [rcx + rax*2]
mov rdx, qword [rsp + 0x70]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy]
cmp qword [rsp + 0x30], 0
je 0x1400e62f3
mov r8d, 8
xor edx, edx
mov rcx, qword [rsp + 0x28]
call qword [rsp + 0x30]
mov qword [rsp + 0x50], rax
jmp 0x1400e6303
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x28]
call qword [fcn.1401581f2]
mov rax, qword [rsp + 0x38]
add rsp, 0x68
ret
Function at 0x1400f02f0
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x54]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x4004747b
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.WS2_32.dll_WSAIoctl]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jne 0x1400f036b
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x54]
mov r8d, 0x1001
mov edx, 0xffff
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.WS2_32.dll_setsockopt]
add rsp, 0x68
ret

Function at 0x1400f19b0
Capabilities:
Convert ip address from string

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
lea r8, [rsp + 0x20]
mov rdx, qword [rsp + 0x40]
mov ecx, 2
call qword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
jle 0x1400f19d6
mov al, 1
jmp 0x1400f19d8
xor al, al
add rsp, 0x38
ret
Function at 0x1400f3510
Capabilities:
Convert ip address from string

Disassembly:
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x68
mov rax, qword [0x1401e7890]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x30], reloc.WS2_32.dll_recv
mov rcx, qword [rsp + 0x78]
call fcn.140158210
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0x70]
and eax, 0xffff
mov word [rsp + 0x28], ax
mov r8d, reloc.WS2_32.dll_recv
xor edx, edx
lea rcx, [rsp + 0x48]
call sub.VCRUNTIME140.dll_memset
mov eax, 2
mov word [rsp + 0x48], ax
movzx ecx, word [rsp + 0x28]
call qword [sym.imp.WS2_32.dll_htons]
mov word [rsp + 0x4a], ax
lea r8, [rsp + 0x38]
lea rdx, [0x1401dd6f0]
mov ecx, 2
call qword [sym.imp.WS2_32.dll_inet_pton]
cmp eax, 1
jge 0x1400f35a1
xor eax, eax
jmp 0x1400f3688
mov r8d, 4
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x4c]
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x40]
lea rax, [rax + rcx + 0x31]
mov edx, 1
mov rcx, rax
call qword [0x1401d9028]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1400f35e7
xor eax, eax
jmp 0x1400f3688
mov rax, qword [rsp + 0x20]
mov dword [rax], 0
mov rax, qword [rsp + 0x20]
mov dword [rax + 4], 2
mov rax, qword [rsp + 0x20]
mov dword [rax + 8], 1
mov rax, qword [rsp + 0x20]
mov dword [rax + 0xc], 6
mov rax, qword [rsp + 0x20]
mov ecx, dword [rsp + 0x30]
mov dword [rax + 0x10], ecx
mov rax, qword [rsp + 0x20]
add rax, 0x30
mov rcx, qword [rsp + 0x20]
mov qword [rcx + 0x20], rax
mov r8, qword [rsp + 0x30]
lea rdx, [rsp + 0x48]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rax + 0x20]
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + 0x20]
add rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
mov qword [rcx + 0x18], rax
mov rdx, qword [rsp + 0x78]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rax + 0x18]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcpy
mov rax, qword [rsp + 0x20]
mov qword [rax + 0x28], 0
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140156eb0
add rsp, 0x68
ret
Function at 0x1400f65e0
Capabilities:
Check for software breakpoints

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [rsp + 0x50]
add rax, 0xe8
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
mov ecx, dword [rcx + 0x60]
mov dword [rax + 0x1370], ecx
mov rax, qword [rsp + 0x58]
movzx eax, byte [rax + 0x70c]
mov rcx, qword [rsp + 0x50]
mov dword [rcx + 0x1378], eax
mov rax, qword [rsp + 0x50]
movzx eax, byte [rax + 0x1161]
test eax, eax
je 0x1400f6654
mov rax, qword [rsp + 0x50]
movzx eax, byte [rax + 0x1161]
mov rcx, qword [rsp + 0x58]
movzx ecx, byte [rcx + 0x70c]
cmp eax, ecx
jle 0x1400f666b
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
movzx ecx, byte [rcx + 0x70c]
mov byte [rax + 0x1161], cl
mov rax, qword [rsp + 0x50]
cmp qword [rax + 0x1170], 0
je 0x1400f66a4
mov rax, qword [rsp + 0x50]
movzx eax, byte [rax + 0x1208]
test eax, eax
jne 0x1400f66a4
mov rax, qword [rsp + 0x30]
cmp dword [rax + 0x60], 0x1a0
jne 0x1400f66a4
mov rax, qword [rsp + 0x30]
mov byte [rax + 0xdd], 1
mov rax, qword [rsp + 0x58]
movzx eax, byte [rax + 0x70c]
cmp eax, 0xa
jne 0x1400f66d7
lea rdx, str.HTTP_1.0__assume_close_after_body
mov rcx, qword [rsp + 0x50]
call fcn.1400e21d0
mov edx, 1
mov rcx, qword [rsp + 0x58]
call fcn.1400e33d0
jmp 0x1400f673f
mov rax, qword [rsp + 0x58]
movzx eax, byte [rax + 0x70c]
cmp eax, 0x14
je 0x1400f66fe
mov rax, qword [rsp + 0x30]
cmp dword [rax + 0x7c], 2
jne 0x1400f6718
mov rax, qword [rsp + 0x30]
cmp dword [rax + 0x60], 0x65
jne 0x1400f6718
xor eax, eax
test eax, eax
jne 0x1400f66fe
mov rax, qword [rsp + 0x58]
mov rax, qword [rax + 0x6d0]
mov dword [rax], 2
jmp 0x1400f673f
mov rax, qword [rsp + 0x58]
movzx eax, byte [rax + 0x70c]
cmp eax, 0xb
jl 0x1400f673f
mov rax, qword [rsp + 0x58]
movzx eax, byte [rax + 0x2ce]
test eax, eax
jne 0x1400f673f
xor eax, eax
test eax, eax
jne 0x1400f6739
mov rax, qword [rsp + 0x30]
cmp dword [rax + 0x60], 0x64
jl 0x1400f6762
mov rax, qword [rsp + 0x30]
cmp dword [rax + 0x60], 0xc8
jge 0x1400f6762
mov dword [rsp + 0x20], 1
jmp 0x1400f676a
mov dword [rsp + 0x20], 0
cmp dword [rsp + 0x20], 0
jne 0x1400f677b
mov dword [rsp + 0x24], 0
jmp 0x1400f6783
mov dword [rsp + 0x24], 1
mov rax, qword [rsp + 0x30]
movzx ecx, byte [rsp + 0x24]
mov byte [rax + 0xde], cl
mov rax, qword [rsp + 0x30]
mov eax, dword [rax + 0x60]
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0xcc
je 0x1400f67d1
cmp dword [rsp + 0x28], 0x130
je 0x1400f67b5
jmp 0x1400f67f6
mov rax, qword [rsp + 0x50]
movzx eax, byte [rax + 0x528]
test eax, eax
je 0x1400f67d1
mov rax, qword [rsp + 0x50]
mov byte [rax + 0x1454], 1
mov rax, qword [rsp + 0x30]
mov qword [rax], 0
mov rax, qword [rsp + 0x30]
mov qword [rax + 8], 0
mov rax, qword [rsp + 0x30]
mov byte [rax + 0xde], 1
xor eax, eax
add rsp, 0x48
ret
Function at 0x1401025c0
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
cmp qword [rsp + 0x78], 0
je 0x1401025ea
mov rax, qword [rsp + 0x78]
cmp dword [rax], 0
jne 0x14010262c
cmp qword [rsp + 0x80], 0
je 0x140102602
mov rax, qword [rsp + 0x80]
cmp dword [rax], 0
jne 0x14010262c
cmp qword [rsp + 0x88], 0
je 0x14010261a
mov rax, qword [rsp + 0x88]
cmp dword [rax], 0
jne 0x14010262c
mov rcx, qword [rsp + 0x90]
call fcn.140102540
jmp 0x1401026f1
mov rdx, qword [rsp + 0x90]
lea rcx, [rsp + 0x50]
call fcn.1401483d0
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x88], 0
je 0x14010266a
mov rax, qword [rsp + 0x88]
cmp dword [rax], 0
je 0x14010266a
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x30], rax
jmp 0x140102673
mov qword [rsp + 0x30], 0
cmp qword [rsp + 0x80], 0
je 0x14010269a
mov rax, qword [rsp + 0x80]
cmp dword [rax], 0
je 0x14010269a
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x38], rax
jmp 0x1401026a3
mov qword [rsp + 0x38], 0
cmp qword [rsp + 0x78], 0
je 0x1401026c1
mov rax, qword [rsp + 0x78]
cmp dword [rax], 0
je 0x1401026c1
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x40], rax
jmp 0x1401026ca
mov qword [rsp + 0x40], 0
mov eax, dword [rsp + 0x70]
inc eax
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x20], rcx
mov r9, qword [rsp + 0x30]
mov r8, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x40]
mov ecx, eax
call qword [sym.imp.WS2_32.dll_select]
add rsp, 0x68
ret
Function at 0x140103e90
Capabilities:
Move file

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0xa8
mov rax, qword [0x1401e7890]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov dword [rsp + 0x30], 0x3e8
lea rcx, [rsp + 0x60]
call fcn.1400cc970
lea rcx, [rsp + 0x80]
mov rdi, rcx
mov rsi, rax
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
mov rcx, qword [rsp + 0xc0]
call fcn.140102b30
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0xc8]
call fcn.140102b30
mov qword [rsp + 0x28], rax
mov r8d, 1
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x140103f63
cmp qword [rsp + 0x20], 0
je 0x140103f36
mov rcx, qword [rsp + 0x20]
call qword [0x140161d60]
mov qword [rsp + 0x20], 0
xor eax, eax
test eax, eax
jne 0x140103f1a
cmp qword [rsp + 0x28], 0
je 0x140103f58
mov rcx, qword [rsp + 0x28]
call qword [0x140161d60]
mov qword [rsp + 0x28], 0
xor eax, eax
test eax, eax
jne 0x140103f3c
jmp 0x14010401c
lea rax, [rsp + 0x40]
lea rcx, [rsp + 0x80]
mov rdi, rax
mov rsi, rcx
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x70]
call fcn.1400cc970
lea rcx, [rsp + 0x50]
mov rdi, rcx
mov rsi, rax
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call fcn.1400cca50
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jl 0x140103fc1
movsxd rax, dword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
jle 0x14010400c
cmp qword [rsp + 0x20], 0
je 0x140103fdd
mov rcx, qword [rsp + 0x20]
call qword [0x140161d60]
mov qword [rsp + 0x20], 0
xor eax, eax
test eax, eax
jne 0x140103fc1
cmp qword [rsp + 0x28], 0
je 0x140103fff
mov rcx, qword [rsp + 0x28]
call qword [0x140161d60]
mov qword [rsp + 0x28], 0
xor eax, eax
test eax, eax
jne 0x140103fe3
mov eax, 1
jmp 0x14010401e
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140103f00
xor eax, eax
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140156eb0
add rsp, 0xa8
pop rdi
pop rsi
ret