joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49a630
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push r13
push r12
push rbx
sub rsp, 0x50
mov rbx, qword [sym.imp.libssp_0.dll___stack_chk_guard]
mov qword [rsp + 0x80], r8
lea r13, [rsp + 0x30]
mov r12, rcx
lea r8, [rsp + 0x80]
mov qword [rsp + 0x88], r9
mov rcx, r13
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x30], 0
mov rax, qword [rbx]
mov qword [rsp + 0x48], rax
xor eax, eax
mov rax, qword [0x005ab200]
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], rax
call fcn.00473660
mov r8, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x40]
test r8, r8
je 0x49a6ac
cmp byte [rdx + r8 - 1], 0xa
jne 0x49a6d0
mov rcx, r12
call fcn.0049a590
mov rcx, r13
call fcn.004727a0
mov rax, qword [rsp + 0x48]
xor rax, qword [rbx]
jne 0x49a72b
add rsp, 0x50
pop rbx
pop r12
pop r13
ret
mov rax, qword [rsp + 0x30]
test rax, rax
jne 0x49a720
mov edx, 1
mov rcx, r13
call fcn.004727c0
mov rdx, qword [rsp + 0x40]
mov r8, qword [rsp + 0x38]
lea rax, [r8 + 1]
mov qword [rsp + 0x38], rax
mov byte [rdx + r8], 0xa
mov rdx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x38]
mov byte [rdx + rax], 0
mov r8, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x40]
jmp 0x49a6ac
sub rax, r8
cmp rax, 1
jne 0x49a6f1
jmp 0x49a6da
call sub.libssp_0.dll___stack_chk_fail
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x49a740
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
xor edx, edx
mov r8d, ecx
xor ecx, ecx
jmp fcn.004b74f0

Function at 0x49a800
Capabilities:
Write file on windows

Disassembly:
push r13
push r12
push rsi
push rbx
sub rsp, 0x88
mov rsi, qword [sym.imp.libssp_0.dll___stack_chk_guard]
mov rbx, qword [fcn.005707a0]
mov rax, qword [rsi]
mov qword [rsp + 0x78], rax
xor eax, eax
mov r12, rcx
mov r13, rdx
mov ecx, 1
call rbx
cmp r12, rax
je 0x49a868
mov rcx, r12
call fcn.004ac610
test eax, eax
jne 0x49a909
mov rax, qword [rsp + 0x78]
xor rax, qword [rsi]
jne 0x49a904
add rsp, 0x88
pop rbx
pop rsi
pop r12
pop r13
ret
mov eax, dword [0x00573800]
test eax, eax
js 0x49a888
test eax, eax
je 0x49a837
mov rcx, r12
call sub.msvcrt.dll_ferror
test eax, eax
jne 0x49a837
jmp 0x49a847
lea rcx, str.GIT_FLUSH
call fcn.004ae0e0
mov rcx, rax
test rax, rax
je 0x49a8b8
call sub.msvcrt.dll_atoi
test eax, eax
sete al
movzx eax, al
mov dword [0x00573800], eax
jmp 0x49a872
mov ecx, 1
call rbx
mov rcx, rax
call sub.msvcrt.dll__fileno_1
lea rdx, [rsp + 0x20]
mov ecx, eax
call fcn.004b3ee0
test eax, eax
jne 0x49a8e6
movzx eax, word [rsp + 0x26]
and ax, 0xf000
cmp ax, 0x8000
je 0x49a8f5
mov dword [0x00573800], 0
jmp 0x49a837
mov dword [0x00573800], 1
jmp 0x49a876
call sub.libssp_0.dll___stack_chk_fail
call qword [sym.imp.msvcrt.dll__errno]
mov ecx, dword [rax]
call fcn.004608d0
mov rdx, r13
lea rcx, str.write_failure_on__s
call fcn.00494800
nop
nop word cs:[rax + rax]
Function at 0x49a930
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, qword [sym.imp.libssp_0.dll___stack_chk_guard]
mov qword [rsp + 0x50], r8
lea r8, [rsp + 0x50]
mov qword [rsp + 0x58], r9
mov qword [rsp + 0x20], r8
mov rax, qword [rbx]
mov qword [rsp + 0x28], rax
xor eax, eax
call sub.libintl_8.dll_libintl_vfprintf
test eax, eax
js 0x49a973
mov rax, qword [rsp + 0x28]
xor rax, qword [rbx]
jne 0x49a98c
add rsp, 0x30
pop rbx
ret
call qword [sym.imp.msvcrt.dll__errno]
mov ecx, dword [rax]
call fcn.004608d0
lea rcx, str.write_error
call fcn.00494800
call sub.libssp_0.dll___stack_chk_fail
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x49a9d0
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x28
call fcn.00499bd0
test rax, rax
js 0x49a9e3
add rsp, 0x28
ret
call qword [sym.imp.msvcrt.dll__errno]
mov ecx, dword [rax]
call fcn.004608d0
lea rcx, str.write_error
call fcn.00494800
nop
nop
nop
nop
Function at 0x49b1d0
Capabilities:
Write file on windows

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rsi, qword [sym.imp.libssp_0.dll___stack_chk_guard]
mov rax, qword [rsi]
mov qword [rsp + 0x38], rax
xor eax, eax
mov rax, qword [0x005ab200]
mov ebx, ecx
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], rax
mov eax, ecx
and eax, 0x440
cmp eax, 0x440
je 0x49b328
mov edi, ecx
lea r12, [rsp + 0x20]
and edi, 0x400
test cl, 0x40
jne 0x49b2d0
test edi, edi
jne 0x49b30a
test bl, 0x80
je 0x49b260
cmp qword [rsp + 0x28], 0
jne 0x49b350
mov r8d, 0x1a
lea rdx, str.space_before_tab_in_indent
mov rcx, r12
call fcn.00472fb0
test bh, 1
je 0x49b286
cmp qword [rsp + 0x28], 0
jne 0x49b370
mov r8d, 0x12
lea rdx, str.indent_with_spaces
mov rcx, r12
call fcn.00472fb0
and bh, 8
je 0x49b2ac
cmp qword [rsp + 0x28], 0
jne 0x49b390
mov r8d, 0xd
lea rdx, [0x0058d860]
mov rcx, r12
call fcn.00472fb0
xor edx, edx
mov rcx, r12
call fcn.004728a0
mov rdi, qword [rsp + 0x38]
xor rdi, qword [rsi]
jne 0x49b3aa
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop r12
ret
mov r8d, 0x13
lea rdx, str.trailing_whitespace
mov rcx, r12
call fcn.00472fb0
test edi, edi
je 0x49b23a
cmp qword [rsp + 0x28], 0
je 0x49b30a
mov r8d, 2
lea rdx, [0x0058d819]
mov rcx, r12
call fcn.00472fb0
mov r8d, 0x15
lea rdx, str.new_blank_line_at_EOF
mov rcx, r12
call fcn.00472fb0
jmp 0x49b23a
lea r12, [rsp + 0x20]
mov r8d, 0x13
lea rdx, str.trailing_whitespace
mov rcx, r12
call fcn.00472fb0
jmp 0x49b23a
mov r8d, 2
lea rdx, [0x0058d819]
mov rcx, r12
call fcn.00472fb0
jmp 0x49b24b
mov r8d, 2
lea rdx, [0x0058d819]
mov rcx, r12
call fcn.00472fb0
jmp 0x49b271
mov r8d, 2
lea rdx, [0x0058d819]
mov rcx, r12
call fcn.00472fb0
jmp 0x49b297
call sub.libssp_0.dll___stack_chk_fail
nop
Function at 0x4ab520
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x28
mov ecx, 2
call qword [fcn.005707a0]
mov r8d, 0x2b
mov edx, 1
lea rcx, str.fatal:_not_enough_memory_for_initialization
mov r9, rax
call sub.msvcrt.dll_fwrite
mov r8d, pe_nt_image_headers64
mov edx, 0xdc4
lea rcx, str.compat_mingw.c
call fcn.00480ea0
mov ecx, eax
call sub.msvcrt.dll_exit
nop
nop dword [rax + rax]

Function at 0x4ab570
Capabilities:
Initialize winsock library
Query environment variable
Set environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x250
mov rsi, qword [sym.imp.libssp_0.dll___stack_chk_guard]
xor ebx, ebx
mov rax, qword [rsi]
mov qword [rsp + 0x248], rax
xor eax, eax
lea rdi, [rsp + 0x40]
test r8d, r8d
mov r12, rcx
setne bl
mov r14d, edx
mov r13d, r8d
mov r15d, r9d
mov r8d, 0x104
mov rdx, rdi
add ebx, 3
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
sub eax, 1
cmp eax, 0x102
jbe 0x4ab5f0
mov rax, qword [rsp + 0x248]
xor rax, qword [rsi]
jne 0x4ab726
add rsp, 0x250
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
ret
xor edx, edx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rdx, [0x0058fba4]
mov rcx, rdi
call sub.msvcrt.dll_wcscmp
test eax, eax
je 0x4ab6e0
cmp r14d, 0xfffffff4
je 0x4ab680
mov eax, dword [rsp + 0x2b0]
xor r9d, r9d
xor r8d, r8d
mov edx, r15d
mov qword [rsp + 0x30], 0
mov rcx, rdi
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x4ab5cb
mov edx, 0x8000
mov rcx, rax
call qword [sym.imp.msvcrt.dll__open_osfhandle]
mov rdx, r12
mov ecx, r14d
mov r15d, eax
call qword [sym.imp.KERNEL32.dll_SetStdHandle]
mov ecx, r15d
mov edx, r13d
call fcn.004b4db0
mov ecx, r15d
call sub.msvcrt.dll__close
jmp 0x4ab5cb
lea rdx, str.2_1
mov rcx, rdi
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x4ab618
mov rbx, qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, 0xfffffff5
call rbx
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x4ab709
mov edx, 0x8000
mov rcx, rax
call qword [sym.imp.msvcrt.dll__open_osfhandle]
mov rdx, r12
mov ecx, 0xfffffff4
mov r14d, eax
call qword [sym.imp.KERNEL32.dll_SetStdHandle]
mov edx, r13d
mov ecx, r14d
call fcn.004b4db0
jmp 0x4ab5cb
mov ecx, r13d
call sub.msvcrt.dll__close
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
cmp rax, 0xffffffffffffffff
je 0x4ab5cb
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4ab5cb
mov ecx, r13d
call sub.msvcrt.dll__close
mov ecx, 0xfffffff4
call rbx
mov rcx, rax
cmp rax, 0xffffffffffffffff
jne 0x4ab6fe
jmp 0x4ab5cb
call sub.libssp_0.dll___stack_chk_fail
nop
nop dword [rax]
Function at 0x4ab730
Capabilities:
Initialize winsock library

Disassembly:
push rbx
sub rsp, 0x1c0
mov rbx, qword [sym.imp.libssp_0.dll___stack_chk_guard]
mov rax, qword [rbx]
mov qword [rsp + 0x1b8], rax
xor eax, eax
mov eax, dword [0x005ee6c0]
test eax, eax
je 0x4ab770
mov rax, qword [rsp + 0x1b8]
xor rax, qword [rbx]
jne 0x4ab79c
add rsp, 0x1c0
pop rbx
ret
lea rdx, [rsp + 0x20]
mov ecx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x4ab7a1
mov rcx, qword [sym.imp.WS2_32.dll_WSACleanup]
call fcn.00401560
mov dword [0x005ee6c0], 1
jmp 0x4ab756
call sub.libssp_0.dll___stack_chk_fail
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rcx, str.unable_to_initialize_winsock_subsystem__error__d
mov edx, eax
call fcn.00494770
nop
nop word cs:[rax + rax]
Function at 0x4ac000
Capabilities:
Delete file

Disassembly:
push r14
mov eax, 0x2090
push r13
push r12
push rsi
push rbx
call fcn.0056fc10
sub rsp, rax
mov rsi, qword [sym.imp.libssp_0.dll___stack_chk_guard]
mov rax, qword [rsi]
mov qword [rsp + 0x2088], rax
xor eax, eax
mov r12, rcx
mov rcx, rdx
mov r13, rdx
call sub.msvcrt.dll_wcslen
movzx ecx, word [r12]
mov rbx, rax
cmp cx, 0x2f
je 0x4ac094
cmp cx, 0x5c
je 0x4ac094
mov edx, 0x103
call sub.msvcrt.dll_iswctype
test eax, eax
je 0x4ac066
cmp word [r12 + 2], 0x3a
je 0x4ac1e0
test rbx, rbx
je 0x4ac094
nop dword [rax + rax]
movzx eax, word [r13 + rbx*2 - 2]
lea r14, [rbx + rbx]
cmp ax, 0x2f
je 0x4ac170
cmp ax, 0x5c
je 0x4ac170
sub rbx, 1
jne 0x4ac070
mov rcx, r12
mov qword [rsp + 0x30], 0
xor r9d, r9d
mov r8d, 7
xor edx, edx
mov dword [rsp + 0x28], 0x2000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x4ac148
lea rdx, [rsp + 0x40]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
je 0x4ac1b0
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
test byte [rsp + 0x40], 0x10
jne 0x4ac120
mov rdx, qword [rsp + 0x2088]
xor rdx, qword [rsi]
jne 0x4ac22a
add rsp, 0x2090
pop rbx
pop rsi
pop r12
pop r13
pop r14
ret
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x4ac148
mov r8d, dword [0x005765d8]
mov rdx, r12
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CreateSymbolicLinkW]
test al, al
jne 0x4ac220
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
call qword [sym.imp.msvcrt.dll__errno]
mov ecx, r12d
mov rbx, rax
call fcn.004abd60
mov dword [rbx], eax
xor eax, eax
jmp 0x4ac0f5
mov rcx, r12
call sub.msvcrt.dll_wcslen
lea rax, [rbx + rax + 1]
cmp rax, 0x1000
ja 0x4ac200
lea rbx, [rsp + 0x80]
mov r8, r14
mov rdx, r13
mov rcx, rbx
call sub.msvcrt.dll_memcpy
lea rcx, [rbx + r14]
mov rdx, r12
call sub.msvcrt.dll_wcscpy
mov rcx, rbx
jmp 0x4ac097
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
call qword [sym.imp.msvcrt.dll__errno]
mov ecx, r12d
mov rbx, rax
call fcn.004abd60
mov rcx, r14
mov dword [rbx], eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x4ac0f5
movzx eax, word [r12 + 4]
cmp ax, 0x2f
je 0x4ac094
cmp ax, 0x5c
jne 0x4ac066
jmp 0x4ac094
mov r8, r13
mov rdx, r12
lea rcx, str.Could_not_make__S_relative_to__S__too_large_
call fcn.00494950
mov eax, 1
jmp 0x4ac0f5
mov eax, 2
jmp 0x4ac0f5
call sub.libssp_0.dll___stack_chk_fail
nop
Function at 0x4ac230
Capabilities:
Get file attributes

Disassembly:
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x005ee9c0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r12, qword [0x005ee9e8]
test r12, r12
je 0x4ac2bf
lea rbx, [0x005ee9e8]
mov rsi, qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov rdi, rbx
jmp 0x4ac287
mov rax, qword [r12]
mov rcx, r12
mov qword [rbx], rax
call fcn.004c9260
mov r12, qword [rbx]
test r12, r12
je 0x4ac2bf
mov r13, qword [r12 + 8]
mov r14, qword [r12 + 0x10]
mov rcx, r13
call rsi
and eax, 0x410
cmp eax, 0x400
jne 0x4ac270
mov rdx, r13
mov rcx, r14
call fcn.004ac000
mov r13d, eax
test eax, eax
jne 0x4ac2e0
mov rbx, r12
mov r12, qword [rbx]
test r12, r12
jne 0x4ac287
lea rcx, [0x005ee9c0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, qword [r12]
mov rcx, r12
mov qword [rbx], rax
call fcn.004c9260
cmp r13d, 2
cmove rbx, rdi
jmp 0x4ac27f

Function at 0x4ac300
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push r12
push rbx
sub rsp, 0x28
mov ebx, edx
mov r12, rcx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
mov edx, eax
or ecx, 2
and edx, 0xfffffffd
test ebx, ebx
cmovne edx, ecx
cmp edx, eax
je 0x4ac332
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x4ac340
xor eax, eax
add rsp, 0x28
pop rbx
pop r12
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
call qword [sym.imp.msvcrt.dll__errno]
mov ecx, r12d
mov rbx, rax
call fcn.004abd60
mov dword [rbx], eax
mov eax, 0xffffffff
jmp 0x4ac334

Function at 0x4ac7f0
Capabilities:
Create pipe

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, qword [sym.imp.libssp_0.dll___stack_chk_guard]
mov rax, qword [rbx]
mov qword [rsp + 0x28], rax
xor eax, eax
mov rsi, rcx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov ecx, dword [rsp + 0x24]
mov eax, dword [rsp + 0x20]
movabs rdx, 0xd6bf94d5e57a42bd
shl rcx, 0x20
add rcx, rax
movabs rax, 0xfe624e212ac18000
add rcx, rax
mov rax, rcx
imul rdx
mov rax, rcx
sar rax, 0x3f
add rdx, rcx
sar rdx, 0x17
sub rdx, rax
mov dword [rsi], edx
imul rdx, rdx, 0x989680
sub rcx, rdx
movabs rdx, 0x6666666666666667
mov rax, rcx
sar rcx, 0x3f
imul rdx
sar rdx, 2
sub rdx, rcx
mov rax, qword [rsp + 0x28]
xor rax, qword [rbx]
mov dword [rsi + 4], edx
jne 0x4ac88f
xor eax, eax
add rsp, 0x38
pop rbx
pop rsi
ret
call sub.libssp_0.dll___stack_chk_fail
nop
nop word cs:[rax + rax]
Function at 0x4ac8a0
Capabilities:
Create pipe

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rsi, qword [sym.imp.libssp_0.dll___stack_chk_guard]
xor r8d, r8d
mov r9d, 0x2000
mov rax, qword [rsi]
mov qword [rsp + 0x38], rax
xor eax, eax
mov rbx, rcx
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x4ac920
movsxd rcx, dword [rsp + 0x20]
mov rdi, qword [sym.imp.msvcrt.dll__open_osfhandle]
mov edx, pe_nt_image_headers64
call rdi
mov dword [rbx], eax
test eax, eax
js 0x4ac943
movsxd rcx, dword [rsp + 0x28]
mov edx, pe_nt_image_headers64
call rdi
mov dword [rbx + 4], eax
test eax, eax
js 0x4ac95f
xor eax, eax
mov rdi, qword [rsp + 0x38]
xor rdi, qword [rsi]
jne 0x4ac978
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop r12
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
call qword [sym.imp.msvcrt.dll__errno]
mov ecx, r12d
mov rbx, rax
call fcn.004abd60
mov dword [rbx], eax
mov eax, 0xffffffff
jmp 0x4ac908
mov rcx, qword [rsp + 0x20]
mov rbx, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rbx
mov rcx, qword [rsp + 0x28]
call rbx
mov eax, 0xffffffff
jmp 0x4ac908
mov ecx, dword [rbx]
call sub.msvcrt.dll__close
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0xffffffff
jmp 0x4ac908
call sub.libssp_0.dll___stack_chk_fail
nop
nop
Function at 0x4ac980
Capabilities:
Create thread

Disassembly:
push r14
push r13
push r12
push rsi
push rbx
sub rsp, 0x50
mov rsi, qword [sym.imp.libssp_0.dll___stack_chk_guard]
mov rax, qword [rsi]
mov qword [rsp + 0x48], rax
xor eax, eax
test rcx, rcx
mov rbx, rcx
setg al
cmp edx, 0xf
jne 0x4ac9af
test al, al
jne 0x4aca00
test edx, edx
jne 0x4acaa0
test al, al
je 0x4acaa0
mov ecx, 0x400
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rcx, rax
test rax, rax
je 0x4acaa0
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r12d, r12d
mov rax, qword [rsp + 0x48]
xor rax, qword [rsi]
jne 0x4acc17
mov eax, r12d
add rsp, 0x50
pop rbx
pop rsi
pop r12
pop r13
pop r14
ret
mov r8d, ecx
mov r12, qword [sym.imp.KERNEL32.dll_OpenProcess]
xor edx, edx
mov ecx, 0x43b
call r12
mov r13, rax
test rax, rax
je 0x4aca48
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x4aca3c
cmp dword [rsp + 0x40], 0x103
je 0x4acac0
xor r12d, r12d
jmp 0x4ac9e2
mov r8d, ebx
xor edx, edx
mov ecx, 1
call r12
mov r13, rax
test rax, rax
je 0x4acbf0
mov rcx, r13
call fcn.004ab7c0
mov r12d, eax
test eax, eax
je 0x4ac9e2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, eax
call qword [sym.imp.msvcrt.dll__errno]
mov ecx, r14d
mov rbx, rax
call fcn.004abd60
mov rcx, r13
mov dword [rbx], eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4ac9e2
call qword [sym.imp.msvcrt.dll__errno]
mov r12d, 0xffffffff
mov dword [rax], 0x16
jmp 0x4ac9e2
mov eax, dword [0x005ee8f0]
test eax, eax
je 0x4acb80
mov rax, qword [0x005ee8e8]
test rax, rax
je 0x4aca61
mov eax, dword [0x005764e0]
cmp eax, 0xffffffff
je 0x4acbbc
cmp eax, 0xfffffffe
je 0x4aca61
lea rbx, [rsp + 0x44]
mov rcx, r13
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x4aca61
mov eax, dword [0x005764e0]
cmp dword [rsp + 0x44], eax
jne 0x4aca61
mov rcx, r13
mov qword [rsp + 0x30], rbx
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x28], 0
mov r9, qword [0x005ee8e8]
mov qword [rsp + 0x20], 0x8f
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rcx, rax
test rax, rax
je 0x4aca61
mov rbx, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rbx
mov edx, 0x2710
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x4aca61
mov rcx, r13
call rbx
jmp 0x4aca3c
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
test rax, rax
je 0x4acc1c
lea rdx, str.ExitProcess
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x005ee8f0], 1
mov qword [0x005ee8e8], rax
jmp 0x4acad5
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [0x005764e0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x4acbe1
mov eax, dword [0x005764e0]
jmp 0x4acaed
mov dword [0x005764e0], 0xfffffffe
jmp 0x4aca61
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
call qword [sym.imp.msvcrt.dll__errno]
mov ecx, r12d
mov r12d, 0xffffffff
mov rbx, rax
call fcn.004abd60
mov dword [rbx], eax
jmp 0x4ac9e2
call sub.libssp_0.dll___stack_chk_fail
lea rcx, str.BUG:_cannot_find_kernel32
call fcn.00494770
nop
nop dword [rax]
Function at 0x4acc30
Capabilities:
Get hostname

Disassembly:
push r13
push r12
sub rsp, 0x28
mov r12, rcx
mov r13d, edx
call fcn.004ab730
mov rcx, r12
mov edx, r13d
call qword [sym.imp.WS2_32.dll_gethostname]
mov r12d, eax
test eax, eax
js 0x4acc68
mov eax, r12d
add rsp, 0x28
pop r12
pop r13
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r13d, 5
sub eax, 0x2714
cmp eax, 0x3e
jbe 0x4acc98
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], r13d
mov eax, r12d
add rsp, 0x28
pop r12
pop r13
ret
lea rdx, [0x005910c0]
movzx r13d, byte [rdx + rax]
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], r13d
jmp 0x4acc87

Function at 0x4acd20
Capabilities:
Resolve dns

Disassembly:
push r13
push r12
push rsi
push rbx
sub rsp, 0x28
mov r12, rcx
mov r13, rdx
mov rbx, r8
mov rsi, r9
call fcn.004ab730
mov rcx, r12
mov r9, rsi
mov r8, rbx
mov rdx, r13
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov r12d, eax
test eax, eax
js 0x4acd68
mov eax, r12d
add rsp, 0x28
pop rbx
pop rsi
pop r12
pop r13
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, 5
sub eax, 0x2714
cmp eax, 0x3e
jbe 0x4acd98
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], ebx
mov eax, r12d
add rsp, 0x28
pop rbx
pop rsi
pop r12
pop r13
ret
lea rdx, [0x005910c0]
movzx ebx, byte [rdx + rax]
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], ebx
jmp 0x4acd85

Function at 0x4ace70
Capabilities:
Connect socket

Disassembly:
push r12
push rbx
sub rsp, 0x28
mov r12, rdx
mov rbx, r8
call qword [sym.imp.msvcrt.dll__get_osfhandle]
mov rdx, r12
mov r8d, ebx
mov rcx, rax
call qword [sym.imp.WS2_32.dll_connect]
mov r12d, eax
test eax, eax
js 0x4acea8
mov eax, r12d
add rsp, 0x28
pop rbx
pop r12
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, 5
sub eax, 0x2714
cmp eax, 0x3e
jbe 0x4aced0
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], ebx
mov eax, r12d
add rsp, 0x28
pop rbx
pop r12
ret
lea rdx, [0x005910c0]
movzx ebx, byte [rdx + rax]
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], ebx
jmp 0x4acec5

Function at 0x4acf70
Capabilities:
Set socket configuration

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x30
mov r12d, edx
mov ebx, r8d
mov rsi, r9
call qword [sym.imp.msvcrt.dll__get_osfhandle]
mov edx, r12d
mov r9, rsi
mov r8d, ebx
mov rcx, rax
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x20], eax
call qword [sym.imp.WS2_32.dll_setsockopt]
mov r12d, eax
test eax, eax
js 0x4acfb8
mov eax, r12d
add rsp, 0x30
pop rbx
pop rsi
pop r12
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, 5
sub eax, 0x2714
cmp eax, 0x3e
jbe 0x4acfe8
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], ebx
mov eax, r12d
add rsp, 0x30
pop rbx
pop rsi
pop r12
ret
lea rdx, [0x005910c0]
movzx ebx, byte [rdx + rax]
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], ebx
jmp 0x4acfd5
Function at 0x4ad1b0
Capabilities:
Get system information on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rbx, qword [sym.imp.libssp_0.dll___stack_chk_guard]
mov rax, qword [rbx]
mov qword [rsp + 0x58], rax
xor eax, eax
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x48]
mov rdx, qword [rsp + 0x58]
xor rdx, qword [rbx]
jne 0x4ad1e5
add rsp, 0x60
pop rbx
ret
call sub.libssp_0.dll___stack_chk_fail
nop
nop dword [rax + rax]

Function at 0x4ad1f0
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
test r8, r8
jne 0x4ad390
mov eax, dword [rdx + 8]
test eax, eax
je 0x4ad238
cmp eax, dword [rbx]
je 0x4ad300
call qword [sym.imp.msvcrt.dll__errno]
lea rcx, str.setitimer:_it_interval_must_be_zero_or_eq_it_value
mov dword [rax], 0x16
call fcn.00494950
mov eax, 0xffffffff
add rsp, 0x30
pop rbx
ret
mov r8d, dword [rdx + 0xc]
test r8d, r8d
jne 0x4ad208
cmp qword [0x005ee9a0], 0
je 0x4ad253
call fcn.004ab460
mov eax, dword [rbx + 8]
mov edx, dword [rbx]
mov r8d, dword [rbx + 4]
mov ecx, edx
or ecx, r8d
je 0x4ad358
imul ecx, edx, 0x3e8
movsxd rdx, r8d
sar r8d, 0x1f
imul rdx, rdx, 0x10624dd3
sar rdx, 0x26
sub edx, r8d
add edx, ecx
mov dword [0x005ee99c], edx
test eax, eax
je 0x4ad320
xor ecx, ecx
mov eax, dword [0x005ede30]
mov dword [0x005ee998], ecx
test eax, eax
je 0x4ad338
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [0x005ee9a8], rax
test rax, rax
je 0x4ad3cc
mov qword [rsp + 0x28], 0
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
lea r8, [0x004ad600]
call qword [sym.imp.msvcrt.dll__beginthreadex]
mov qword [0x005ee9a0], rax
test rax, rax
je 0x4ad36b
xor eax, eax
add rsp, 0x30
pop rbx
ret
mov ecx, dword [rbx + 4]
cmp dword [rbx + 0xc], ecx
jne 0x4ad210
cmp qword [0x005ee9a0], 0
jne 0x4ad24b
jmp 0x4ad253
mov edx, dword [rbx + 0xc]
test edx, edx
jne 0x4ad28f
mov ecx, 1
jmp 0x4ad291
lea rcx, [fcn.004ab460]
call fcn.00401560
mov dword [0x005ede30], 1
jmp 0x4ad2a5
test eax, eax
je 0x4ad3b2
mov dword [0x005ee99c], 0
jmp 0x4ad291
call qword [sym.imp.msvcrt.dll__errno]
lea rcx, str.cannot_start_timer_thread
mov dword [rax], 0xc
call fcn.00494950
or eax, 0xffffffff
jmp 0x4ad22d
call qword [sym.imp.msvcrt.dll__errno]
lea rcx, str.setitimer_param_3___NULL_not_implemented
mov dword [rax], 0x16
call fcn.00494950
mov eax, 0xffffffff
jmp 0x4ad22d
mov ecx, dword [rbx + 0xc]
test ecx, ecx
je 0x4ad2f6
mov dword [0x005ee99c], 0
jmp 0x4ad28f
call qword [sym.imp.msvcrt.dll__errno]
lea rcx, str.cannot_allocate_resources_for_timer
mov dword [rax], 0xc
call fcn.00494950
or eax, 0xffffffff
jmp 0x4ad22d