joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001ce80
Capabilities:
Create udp socket

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov eax, reloc.WS2_32.dll_socket
mov dword [rsp + 0x28], 0x80
test ecx, ecx
mov dword [rsp + 0x20], 0
mov edi, 2
cmovne edi, eax
xor r9d, r9d
lea edx, [rax - 0x16]
mov ecx, edi
xor r8d, r8d
call qword [sym.imp.WS2_32.dll_WSASocketW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x14001cef8
xor r8d, r8d
lea edx, [rax + 2]
mov ecx, edi
call qword [sym.imp.WS2_32.dll_socket]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x14001cee8
or rax, rax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
xor r8d, r8d
mov rcx, rax
lea edx, [r8 + 1]
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x14001d590
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
mov rsi, r9
mov ecx, 0x18
mov rdi, r8
mov rbp, rdx
call fcn.140056c44
mov rbx, rax
test rax, rax
je 0x14001d628
mov qword [rax], rsi
mov rax, qword [rsp + 0x60]
mov qword [rbx + 8], rax
mov eax, 0xffffffff
mov qword [rbx + 0x10], rbp
cmp rdi, rax
jbe 0x14001d5f9
call fcn.14005c18c
mov rcx, rbx
mov dword [rax], reloc.WS2_32.dll_shutdown
call fcn.140056c3c
xor eax, eax
jmp 0x14001d631
xor eax, eax
lea r8, [0x14001d540]
mov qword [rsp + 0x28], rax
mov r9, rbx
mov edx, edi
mov dword [rsp + 0x20], eax
xor ecx, ecx
call fcn.14005bff4
mov qword [r14], rax
cmp rax, 0xffffffffffffffff
jne 0x14001d62c
mov rcx, rbx
call fcn.140056c3c
xor eax, eax
jmp 0x14001d631
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x14001e3d0
Capabilities:
Get hostname

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rbp
mov rbp, rcx
add rcx, 0xc8
call fcn.1400232e0
nop
xor edi, edi
mov qword [rbp + 0x268], rdi
mov qword [rbp + 0x270], rdi
mov qword [rbp + 0x278], rdi
mov rax, qword [0x1400b6c30]
mov rcx, qword [rax + 0xb8]
sub rcx, qword [rax + 0xb0]
sar rcx, 3
mov dword [rbp + 0xc0], ecx
lea eax, [rcx + rcx*2]
movsxd rcx, eax
mov eax, 8
mul rcx
mov rsi, rax
mov rax, 0xffffffffffffffff
cmovo rsi, rax
mov rcx, rsi
call fcn.140052238
mov rbx, rax
test rax, rax
je 0x14001e471
mov r8, rsi
xor edx, edx
mov rcx, rax
call fcn.1400541f0
jmp 0x14001e474
mov rbx, rdi
mov qword [rbp + 0x98], rbx
xor eax, eax
mov qword [rbp + 0xa8], rax
mov qword [rbp + 0xb0], rax
mov qword [rbp + 0xb8], rax
xor edx, edx
mov r8d, 0x80
lea rcx, [rbp + 0x11]
call fcn.1400541f0
mov rax, qword [0x1400b6c30]
mov rdx, qword [rax + 0x10]
lea rcx, [rbp + 0x11]
test rdx, rdx
je 0x14001e4c4
mov r8d, 0x7f
call fcn.140056c70
jmp 0x14001e4cf
mov edx, 0x7f
call qword [sym.imp.WS2_32.dll_gethostname]
mov rcx, rbp
call fcn.1400204e0
mov rax, qword [0x1400b6c30]
mov rbx, qword [rax + 0xb0]
mov rax, qword [rax + 0xb8]
mov rsi, rax
sub rsi, rbx
add rsi, 7
shr rsi, 3
cmp rbx, rax
cmova rsi, rdi
test rsi, rsi
je 0x14001e52b
nop word [rax + rax]
mov rdx, qword [rbx]
lea rcx, [rbp + 0x268]
call fcn.140021c90
lea rbx, [rbx + 8]
inc rdi
cmp rdi, rsi
jne 0x14001e510
mov rax, rbp
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x1400324c0
Capabilities:
Parse credit card information

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor al, al
mov rbx, rcx
cmp dword [rcx + 0x7c], 0xffffffff
je 0x140032727
nop dword [rax]
mov ecx, dword [rbx + 0x7c]
cmp ecx, 0x7c
je 0x140032727
cmp ecx, 0x29
jne 0x14003250b
cmp dword [rbx + 0x1c], 0
jne 0x140032727
test dword [rbx + 0x80], 0x10000000
je 0x140032732
cmp ecx, 0x2e
jne 0x14003256c
lea rcx, [rbx + 0x40]
mov edx, 5
call fcn.140035cb0
mov rcx, qword [rbx]
mov rax, qword [rbx + 0x10]
cmp rcx, rax
je 0x14003255f
cmp byte [rcx], 0x5c
jne 0x14003255c
inc rcx
cmp rcx, rax
je 0x14003255c
mov edx, dword [rbx + 0x80]
test dl, 8
jne 0x14003254b
movzx eax, byte [rcx]
sub al, 0x28
cmp al, 1
jbe 0x140032559
test dl, 0x10
jne 0x14003255c
movzx eax, byte [rcx]
sub al, 0x7b
test al, 0xfd
jne 0x14003255c
mov qword [rbx], rcx
inc qword [rbx]
mov rcx, rbx
call fcn.140036a30
jmp 0x140032713
cmp ecx, 0x5c
jne 0x14003262a
mov rcx, qword [rbx]
mov rax, qword [rbx + 0x10]
cmp rcx, rax
je 0x1400325b6
cmp byte [rcx], 0x5c
jne 0x1400325b3
inc rcx
cmp rcx, rax
je 0x1400325b3
mov edx, dword [rbx + 0x80]
test dl, 8
jne 0x1400325a2
movzx eax, byte [rcx]
sub al, 0x28
cmp al, 1
jbe 0x1400325b0
test dl, 0x10
jne 0x1400325b3
movzx eax, byte [rcx]
sub al, 0x7b
test al, 0xfd
jne 0x1400325b3
mov qword [rbx], rcx
inc qword [rbx]
mov rcx, rbx
call fcn.140036a30
mov eax, dword [rbx + 0x80]
and eax, 0x80
je 0x1400325ec
cmp byte [rbx + 0x78], 0x62
jne 0x1400325ec
lea rcx, [rbx + 0x40]
mov edx, 4
call fcn.140035cb0
mov rcx, rbx
call fcn.140035d40
jmp 0x14003271b
test eax, eax
je 0x14003261d
cmp byte [rbx + 0x78], 0x42
jne 0x14003261d
lea rcx, [rbx + 0x40]
mov edx, 4
call fcn.140035cb0
mov rax, qword [rbx + 0x48]
mov rcx, rbx
xor dword [rax + 0xc], 1
add rax, 0xc
call fcn.140035d40
jmp 0x14003271b
mov rcx, rbx
call fcn.1400327e0
jmp 0x140032713
cmp ecx, 0x5b
jne 0x140032655
mov rcx, rbx
call fcn.140035d40
mov rcx, rbx
call fcn.140032ef0
mov edx, 0x5d
mov rcx, rbx
lea r8d, [rdx - 0x59]
call fcn.140034d90
jmp 0x140032713
cmp ecx, 0x28
jne 0x14003268c
mov rcx, rbx
call fcn.140035d40
mov rcx, rbx
call fcn.140036d40
mov edx, 0x29
mov rcx, rbx
movzx edi, al
lea r8d, [rdx - 0x24]
call fcn.140034d90
test dil, dil
je 0x14003271b
jmp 0x140032713
cmp ecx, 0x5e
jne 0x1400326a9
lea rcx, [rbx + 0x40]
mov edx, 2
call fcn.140035cb0
mov rcx, rbx
call fcn.140035d40
jmp 0x14003271b
cmp ecx, 0x24
jne 0x1400326c6
lea rcx, [rbx + 0x40]
mov edx, 3
call fcn.140035cb0
mov rcx, rbx
call fcn.140035d40
jmp 0x14003271b
lea eax, [rcx - 0x2a]
cmp eax, 1
jbe 0x140032753
cmp ecx, 0x3f
je 0x140032753
cmp ecx, 0x7b
je 0x140032753
cmp ecx, 0x7d
jne 0x1400326ed
test dword [rbx + 0x80], 0x10000000
je 0x14003273d
cmp ecx, 0x5d
jne 0x1400326fe
test dword [rbx + 0x80], 0x10000000
je 0x140032748
movzx edx, byte [rbx + 0x78]
lea rcx, [rbx + 0x40]
call fcn.1400319d0
mov rcx, rbx
call fcn.140035d40
mov rcx, rbx
call fcn.140035ea0
cmp dword [rbx + 0x7c], 0xffffffff
mov al, 1
jne 0x1400324e0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov ecx, 5
call fcn.14004edbc
int3
mov ecx, 6
call fcn.14004edbc
int3
mov ecx, 4
call fcn.14004edbc
int3
mov ecx, 0xa
call fcn.14004edbc
int3
Function at 0x140037ac0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x140037af4
movabs r10, 0x100000001b3
nop
movzx ecx, byte [r9 + rdx]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x140037ae0
ret

Function at 0x14003a010
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
xor ebx, ebx
mov r14, r8
mov esi, ebx
mov rdi, rdx
mov rbp, rcx
nop word [rax + rax]
mov rax, qword [rdi + 0x20]
shl ebx, 4
movsx ecx, byte [rax]
add ebx, ecx
lea eax, [rcx - 0x30]
cmp al, 9
ja 0x14003a058
add ebx, 0xffffffd0
jmp 0x14003a082
lea eax, [rcx - 0x41]
cmp al, 5
ja 0x14003a064
add ebx, 0xffffffc9
jmp 0x14003a082
sub cl, 0x61
cmp cl, 5
ja 0x14003a071
add ebx, 0xffffffa9
jmp 0x14003a082
mov dword [rbp + 0x30], 8
mov qword [rbp + 0x38], r14
cmp dword [rbp + 0x30], 0
jne 0x14003a0f0
mov rax, qword [rdi + 0x20]
cmp rax, qword [rdi + 0x18]
jae 0x14003a095
inc rax
mov qword [rdi + 0x20], rax
jmp 0x14003a0e1
cmp byte [rdi + 0x38], 0
jne 0x14003a0e1
mov rax, qword [rdi + 0x28]
mov edx, 1
mov r9, qword [rdi]
mov r8, qword [rdi + 0x10]
mov rcx, qword [rdi + 8]
add qword [rdi + 0x30], rax
call fcn.14005b720
mov rdx, qword [rdi + 8]
mov qword [rdi + 0x28], rax
mov qword [rdi + 0x20], rdx
lea rcx, [rdx - 1]
add rcx, rax
mov qword [rdi + 0x18], rcx
cmp rax, qword [rdi + 0x10]
jae 0x14003a0e1
mov byte [rdx + rax], 0
inc qword [rdi + 0x18]
mov byte [rdi + 0x38], 1
inc esi
cmp esi, 4
jl 0x14003a040
mov eax, ebx
jmp 0x14003a0f2
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x14003b460
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
movabs rdi, 0x100002600
nop word [rax + rax]
mov rcx, qword [rbx + 0x20]
movzx eax, byte [rcx]
cmp al, 0x20
ja 0x14003b4f3
movsx rax, al
bt rdi, rax
jae 0x14003b4f3
cmp rcx, qword [rbx + 0x18]
jae 0x14003b4a5
lea rax, [rcx + 1]
mov qword [rbx + 0x20], rax
jmp 0x14003b480
cmp byte [rbx + 0x38], 0
jne 0x14003b480
mov rax, qword [rbx + 0x28]
mov edx, 1
mov r9, qword [rbx]
mov r8, qword [rbx + 0x10]
mov rcx, qword [rbx + 8]
add qword [rbx + 0x30], rax
call fcn.14005b720
mov rdx, qword [rbx + 8]
mov qword [rbx + 0x28], rax
mov qword [rbx + 0x20], rdx
lea rcx, [rdx - 1]
add rcx, rax
mov qword [rbx + 0x18], rcx
cmp rax, qword [rbx + 0x10]
jae 0x14003b480
mov byte [rdx + rax], 0
inc qword [rbx + 0x18]
mov byte [rbx + 0x38], 1
jmp 0x14003b480
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14003bc60
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
add qword [rcx + 0x20], 0xfffffffffffffff0
mov rbx, rcx
mov rax, qword [rcx + 0x20]
cmp qword [rax], 0
je 0x14003bcda
test byte [rcx + 0x48], 1
jne 0x14003bcda
mov rdi, qword [rcx]
mov r8, qword [rdi + 0x18]
cmp r8, qword [rdi + 0x10]
jb 0x14003bcb0
mov rcx, qword [rdi + 8]
cmp r8, rcx
je 0x14003bcb0
mov r9, qword [rdi]
sub r8, rcx
mov edx, 1
call fcn.14005ba28
mov rax, qword [rdi + 8]
mov qword [rdi + 0x18], rax
mov rax, qword [rdi + 0x18]
mov byte [rax], 0xa
inc qword [rdi + 0x18]
mov r8, qword [rbx + 0x20]
sub r8, qword [rbx + 0x18]
mov eax, dword [rbx + 0x44]
movzx edx, byte [rbx + 0x40]
mov rcx, qword [rbx]
shr r8, 4
imul r8, rax
call fcn.14003c150
mov rdi, qword [rbx]
mov r8, qword [rdi + 0x18]
cmp r8, qword [rdi + 0x10]
jb 0x14003bd08
mov rcx, qword [rdi + 8]
cmp r8, rcx
je 0x14003bd08
mov r9, qword [rdi]
sub r8, rcx
mov edx, 1
call fcn.14005ba28
mov rax, qword [rdi + 8]
mov qword [rdi + 0x18], rax
mov rax, qword [rdi + 0x18]
mov byte [rax], 0x5d
inc qword [rdi + 0x18]
mov rax, qword [rbx + 0x18]
cmp qword [rbx + 0x20], rax
jne 0x14003bd45
mov rbx, qword [rbx]
mov r8, qword [rbx + 0x18]
mov rcx, qword [rbx + 8]
cmp r8, rcx
je 0x14003bd45
mov r9, qword [rbx]
sub r8, rcx
mov edx, 1
call fcn.14005ba28
mov rax, qword [rbx + 8]
mov qword [rbx + 0x18], rax
mov al, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14003bd60
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
add qword [rcx + 0x20], 0xfffffffffffffff0
mov rbx, rcx
mov rax, qword [rcx + 0x20]
cmp qword [rax], 0
je 0x14003bdd4
mov rdi, qword [rcx]
mov r8, qword [rdi + 0x18]
cmp r8, qword [rdi + 0x10]
jb 0x14003bdaa
mov rcx, qword [rdi + 8]
cmp r8, rcx
je 0x14003bdaa
mov r9, qword [rdi]
sub r8, rcx
mov edx, 1
call fcn.14005ba28
mov rax, qword [rdi + 8]
mov qword [rdi + 0x18], rax
mov rax, qword [rdi + 0x18]
mov byte [rax], 0xa
inc qword [rdi + 0x18]
mov r8, qword [rbx + 0x20]
sub r8, qword [rbx + 0x18]
mov eax, dword [rbx + 0x44]
movzx edx, byte [rbx + 0x40]
mov rcx, qword [rbx]
shr r8, 4
imul r8, rax
call fcn.14003c150
mov rdi, qword [rbx]
mov r8, qword [rdi + 0x18]
cmp r8, qword [rdi + 0x10]
jb 0x14003be02
mov rcx, qword [rdi + 8]
cmp r8, rcx
je 0x14003be02
mov r9, qword [rdi]
sub r8, rcx
mov edx, 1
call fcn.14005ba28
mov rax, qword [rdi + 8]
mov qword [rdi + 0x18], rax
mov rax, qword [rdi + 0x18]
mov byte [rax], 0x7d
inc qword [rdi + 0x18]
mov rax, qword [rbx + 0x18]
cmp qword [rbx + 0x20], rax
jne 0x14003be3f
mov rbx, qword [rbx]
mov r8, qword [rbx + 0x18]
mov rcx, qword [rbx + 8]
cmp r8, rcx
je 0x14003be3f
mov r9, qword [rbx]
sub r8, rcx
mov edx, 1
call fcn.14005ba28
mov rax, qword [rbx + 8]
mov qword [rbx + 0x18], rax
mov al, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14003bff0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
mov edx, 6
call fcn.14003c020
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x14003c950
push rbp
push rdi
push r15
sub rsp, 0x50
mov rax, qword [0x1400af210]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rax, rdx
mov r15, rcx
lea rdx, [rsp + 0x20]
test rax, rax
jns 0x14003c988
not rax
mov byte [rsp + 0x20], 0x2d
inc rax
lea rdx, [rsp + 0x21]
mov rcx, rax
call fcn.140022080
xor edx, edx
lea rcx, [rsp + 0x20]
mov rbp, rax
lea rdi, [rsp + 0x20]
sub rbp, rcx
lea rcx, [rsp + 0x20]
cmp rcx, rax
cmova rbp, rdx
test rbp, rbp
je 0x14003ca2a
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], r14
lea r14, [rsp + 0x20]
neg r14
nop dword [rax]
mov rbx, qword [r15]
movzx esi, byte [rdi]
mov r8, qword [rbx + 0x18]
cmp r8, qword [rbx + 0x10]
jb 0x14003ca01
mov rcx, qword [rbx + 8]
cmp r8, rcx
je 0x14003ca01
mov r9, qword [rbx]
sub r8, rcx
mov edx, 1
call fcn.14005ba28
mov rax, qword [rbx + 8]
mov qword [rbx + 0x18], rax
mov rax, qword [rbx + 0x18]
inc rdi
mov byte [rax], sil
lea rax, [r14 + rdi]
inc qword [rbx + 0x18]
cmp rax, rbp
jne 0x14003c9d0
mov r14, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x80]
mov al, 1
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140052350
add rsp, 0x50
pop r15
pop rdi
pop rbp
ret

Function at 0x14003c0f0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov r8, qword [rcx + 0x18]
movzx edi, dl
mov rbx, rcx
cmp r8, qword [rcx + 0x10]
jb 0x14003c12b
mov rcx, qword [rcx + 8]
cmp r8, rcx
je 0x14003c12b
mov r9, qword [rbx]
sub r8, rcx
mov edx, 1
call fcn.14005ba28
mov rax, qword [rbx + 8]
mov qword [rbx + 0x18], rax
mov rax, qword [rbx + 0x18]
mov byte [rax], dil
inc qword [rbx + 0x18]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14003c150
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov qword [rsp + 0x38], rdi
mov rsi, r8
mov rdi, qword [rcx + 0x10]
movzx r14d, dl
sub rdi, qword [rcx + 0x18]
mov rbx, rcx
cmp r8, rdi
jbe 0x14003c1dc
mov qword [rsp + 0x30], rbp
movsx ebp, dl
nop dword [rax]
nop dword [rax + rax]
mov rcx, qword [rbx + 0x18]
mov r8, rdi
mov edx, ebp
call fcn.1400541f0
add qword [rbx + 0x18], rdi
mov r8, qword [rbx + 0x18]
mov rcx, qword [rbx + 8]
cmp r8, rcx
je 0x14003c1c7
mov r9, qword [rbx]
sub r8, rcx
mov edx, 1
call fcn.14005ba28
mov rax, qword [rbx + 8]
mov qword [rbx + 0x18], rax
sub rsi, rdi
mov rdi, qword [rbx + 0x10]
sub rdi, qword [rbx + 0x18]
cmp rsi, rdi
ja 0x14003c190
mov rbp, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
test rsi, rsi
je 0x14003c1fa
mov rcx, qword [rbx + 0x18]
mov r8, rsi
movsx edx, r14b
call fcn.1400541f0
add qword [rbx + 0x18], rsi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x14003c210
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx + 0x20]
mov rbx, rcx
cmp rax, qword [rcx + 0x18]
jae 0x14003c230
inc rax
mov qword [rcx + 0x20], rax
add rsp, 0x20
pop rbx
ret
cmp byte [rcx + 0x38], 0
jne 0x14003c27c
mov rax, qword [rcx + 0x28]
mov edx, 1
add qword [rcx + 0x30], rax
mov r9, qword [rcx]
mov r8, qword [rcx + 0x10]
mov rcx, qword [rcx + 8]
call fcn.14005b720
mov rdx, qword [rbx + 8]
mov qword [rbx + 0x28], rax
mov qword [rbx + 0x20], rdx
lea rcx, [rdx - 1]
add rcx, rax
mov qword [rbx + 0x18], rcx
cmp rax, qword [rbx + 0x10]
jae 0x14003c27c
mov byte [rdx + rax], 0
inc qword [rbx + 0x18]
mov byte [rbx + 0x38], 1
add rsp, 0x20
pop rbx
ret

Function at 0x14003c320
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov edx, 4
mov rdi, rcx
call fcn.14003c020
mov rax, qword [rdi + 0x20]
add rax, 0x10
cmp rax, qword [rdi + 0x28]
jbe 0x14003c353
mov edx, 1
lea rcx, [rdi + 8]
call fcn.14001e290
mov rcx, qword [rdi + 0x20]
lea rax, [rcx + 0x10]
mov qword [rdi + 0x20], rax
test rcx, rcx
je 0x14003c36f
mov qword [rcx], 0
mov byte [rcx + 8], 1
mov rbx, qword [rdi]
mov r8, qword [rbx + 0x18]
cmp r8, qword [rbx + 0x10]
jb 0x14003c39d
mov rcx, qword [rbx + 8]
cmp r8, rcx
je 0x14003c39d
mov r9, qword [rbx]
sub r8, rcx
mov edx, 1
call fcn.14005ba28
mov rax, qword [rbx + 8]
mov qword [rbx + 0x18], rax
mov rax, qword [rbx + 0x18]
mov byte [rax], 0x5b
mov al, 1
inc qword [rbx + 0x18]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x14003c3c0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov edx, 3
mov rdi, rcx
call fcn.14003c020
mov rax, qword [rdi + 0x20]
add rax, 0x10
cmp rax, qword [rdi + 0x28]
jbe 0x14003c3f3
mov edx, 1
lea rcx, [rdi + 8]
call fcn.14001e290
mov rcx, qword [rdi + 0x20]
lea rax, [rcx + 0x10]
mov qword [rdi + 0x20], rax
test rcx, rcx
je 0x14003c40f
mov qword [rcx], 0
mov byte [rcx + 8], 0
mov rbx, qword [rdi]
mov r8, qword [rbx + 0x18]
cmp r8, qword [rbx + 0x10]
jb 0x14003c43d
mov rcx, qword [rbx + 8]
cmp r8, rcx
je 0x14003c43d
mov r9, qword [rbx]
sub r8, rcx
mov edx, 1
call fcn.14005ba28
mov rax, qword [rbx + 8]
mov qword [rbx + 0x18], rax
mov rax, qword [rbx + 0x18]
mov byte [rax], 0x7b
mov al, 1
inc qword [rbx + 0x18]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x14003c550
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rdx
mov ebx, r8d
mov edx, 5
mov rsi, rcx
call fcn.14003c020
mov r8d, ebx
mov rdx, rdi
mov rcx, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.14003cc50
Function at 0x14003c590
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
mov edx, 6
call fcn.14003c020
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x14003cef0
push rbp
push rdi
push r15
sub rsp, 0x50
mov rax, qword [0x1400af210]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rax, rdx
mov r15, rcx
mov rcx, rax
lea rdx, [rsp + 0x20]
call fcn.140022080
xor edx, edx
lea rcx, [rsp + 0x20]
mov rbp, rax
lea rdi, [rsp + 0x20]
sub rbp, rcx
lea rcx, [rsp + 0x20]
cmp rcx, rax
cmova rbp, rdx
test rbp, rbp
je 0x14003cfba
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], r14
lea r14, [rsp + 0x20]
neg r14
nop dword [rax + rax]
mov rbx, qword [r15]
movzx esi, byte [rdi]
mov r8, qword [rbx + 0x18]
cmp r8, qword [rbx + 0x10]
jb 0x14003cf91
mov rcx, qword [rbx + 8]
cmp r8, rcx
je 0x14003cf91
mov r9, qword [rbx]
sub r8, rcx
mov edx, 1
call fcn.14005ba28
mov rax, qword [rbx + 8]
mov qword [rbx + 0x18], rax
mov rax, qword [rbx + 0x18]
inc rdi
mov byte [rax], sil
lea rax, [r14 + rdi]
inc qword [rbx + 0x18]
cmp rax, rbp
jne 0x14003cf60
mov r14, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x80]
mov al, 1
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140052350
add rsp, 0x50
pop r15
pop rdi
pop rbp
ret
Function at 0x14003c5c0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, qword [rcx]
mov rbx, rcx
mov r8, qword [rdi + 0x18]
test dl, dl
je 0x14003c681
cmp r8, qword [rdi + 0x10]
jb 0x14003c603
mov rcx, qword [rdi + 8]
cmp r8, rcx
je 0x14003c603
mov r9, qword [rdi]
sub r8, rcx
mov edx, 1
call fcn.14005ba28
mov rax, qword [rdi + 8]
mov qword [rdi + 0x18], rax
mov rax, qword [rdi + 0x18]
mov byte [rax], reloc.WS2_32.dll_WSACleanup
inc qword [rdi + 0x18]
mov rdi, qword [rbx]
mov r8, qword [rdi + 0x18]
cmp r8, qword [rdi + 0x10]
jb 0x14003c63c
mov rcx, qword [rdi + 8]
cmp r8, rcx
je 0x14003c63c
mov r9, qword [rdi]
sub r8, rcx
mov edx, 1
call fcn.14005ba28
mov rax, qword [rdi + 8]
mov qword [rdi + 0x18], rax
mov rax, qword [rdi + 0x18]
mov byte [rax], WSACleanup
inc qword [rdi + 0x18]
mov rdi, qword [rbx]
mov r8, qword [rdi + 0x18]
cmp r8, qword [rdi + 0x10]
jb 0x14003c675
mov rcx, qword [rdi + 8]
cmp r8, rcx
je 0x14003c675
mov r9, qword [rdi]
sub r8, rcx
mov edx, 1
call fcn.14005ba28
mov rax, qword [rdi + 8]
mov qword [rdi + 0x18], rax
mov rax, qword [rdi + 0x18]
mov byte [rax], 0x75
jmp 0x14003c75a
cmp r8, qword [rdi + 0x10]
jb 0x14003c6a8
mov rcx, qword [rdi + 8]
cmp r8, rcx
je 0x14003c6a8
mov r9, qword [rdi]
sub r8, rcx
mov edx, 1
call fcn.14005ba28
mov rax, qword [rdi + 8]
mov qword [rdi + 0x18], rax
mov rax, qword [rdi + 0x18]
mov byte [rax], 0x66
inc qword [rdi + 0x18]
mov rdi, qword [rbx]
mov r8, qword [rdi + 0x18]
cmp r8, qword [rdi + 0x10]
jb 0x14003c6e1
mov rcx, qword [rdi + 8]
cmp r8, rcx
je 0x14003c6e1
mov r9, qword [rdi]
sub r8, rcx
mov edx, 1
call fcn.14005ba28
mov rax, qword [rdi + 8]
mov qword [rdi + 0x18], rax
mov rax, qword [rdi + 0x18]
mov byte [rax], 0x61
inc qword [rdi + 0x18]
mov rdi, qword [rbx]
mov r8, qword [rdi + 0x18]
cmp r8, qword [rdi + 0x10]
jb 0x14003c71a
mov rcx, qword [rdi + 8]
cmp r8, rcx
je 0x14003c71a
mov r9, qword [rdi]
sub r8, rcx
mov edx, 1
call fcn.14005ba28
mov rax, qword [rdi + 8]
mov qword [rdi + 0x18], rax
mov rax, qword [rdi + 0x18]
mov byte [rax], 0x6c
inc qword [rdi + 0x18]
mov rdi, qword [rbx]
mov r8, qword [rdi + 0x18]
cmp r8, qword [rdi + 0x10]
jb 0x14003c753
mov rcx, qword [rdi + 8]
cmp r8, rcx
je 0x14003c753
mov r9, qword [rdi]
sub r8, rcx
mov edx, 1
call fcn.14005ba28
mov rax, qword [rdi + 8]
mov qword [rdi + 0x18], rax
mov rax, qword [rdi + 0x18]
mov byte [rax], reloc.WS2_32.dll_WSAStartup
inc qword [rdi + 0x18]
mov rbx, qword [rbx]
mov r8, qword [rbx + 0x18]
cmp r8, qword [rbx + 0x10]
jb 0x14003c78c
mov rcx, qword [rbx + 8]
cmp r8, rcx
je 0x14003c78c
mov r9, qword [rbx]
sub r8, rcx
mov edx, 1
call fcn.14005ba28
mov rax, qword [rbx + 8]
mov qword [rbx + 0x18], rax
mov rax, qword [rbx + 0x18]
mov byte [rax], 0x65
mov al, 1
inc qword [rbx + 0x18]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14003c7b0
Capabilities:
Write file on windows

Disassembly:
push r15
sub rsp, 0x80
mov rax, qword [0x1400af210]
xor rax, rsp
mov qword [rsp + 0x50], rax
movsd qword [rsp + 0x20], xmm1
mov r15, rcx
mov rax, qword [rsp + 0x20]
movabs rcx, 0x7ff0000000000000
and rax, rcx
movaps xmm0, xmm1
cmp rax, rcx
jne 0x14003c7f2
xor al, al
jmp 0x14003c936
mov qword [rsp + 0xa0], rbx
movabs rcx, 0x7fffffffffffffff
movsd qword [rsp + 0x20], xmm0
lea rbx, [rsp + 0x30]
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x68], rdi
mov edi, dword [r15 + 0x38]
test rcx, rax
jne 0x14003c84f
movabs rcx, 0x8000000000000000
test rcx, rax
je 0x14003c840
mov byte [rsp + 0x30], 0x2d
lea rbx, [rsp + 0x31]
mov word [rbx], 0x2e30
lea rax, [rbx + 3]
mov byte [rbx + 2], 0x30
jmp 0x14003c88f
xorps xmm1, xmm1
comisd xmm1, xmm0
jbe 0x14003c869
xorps xmm0, xmmword [0x1400771e0]
lea rbx, [rsp + 0x31]
mov byte [rsp + 0x30], 0x2d
lea r9, [rsp + 0x28]
mov rdx, rbx
lea r8, [rsp + 0x20]
call fcn.14001ef00
mov r8d, dword [rsp + 0x28]
mov r9d, edi
mov edx, dword [rsp + 0x20]
mov rcx, rbx
call fcn.14001f1c0
xor edx, edx
lea rcx, [rsp + 0x30]
mov rsi, rax
lea rdi, [rsp + 0x30]
sub rsi, rcx
lea rcx, [rsp + 0x30]
cmp rcx, rax
cmova rsi, rdx
test rsi, rsi
je 0x14003c922
mov qword [rsp + 0x78], rbp
mov qword [rsp + 0x60], r14
lea r14, [rsp + 0x30]
neg r14
nop dword [rax]
nop dword [rax + rax]
mov rbx, qword [r15]
movzx ebp, byte [rdi]
mov r8, qword [rbx + 0x18]
cmp r8, qword [rbx + 0x10]
jb 0x14003c901
mov rcx, qword [rbx + 8]
cmp r8, rcx
je 0x14003c901
mov r9, qword [rbx]
sub r8, rcx
mov edx, 1
call fcn.14005ba28
mov rax, qword [rbx + 8]
mov qword [rbx + 0x18], rax
mov rax, qword [rbx + 0x18]
inc rdi
mov byte [rax], bpl
lea rax, [r14 + rdi]
inc qword [rbx + 0x18]
cmp rax, rsi
jne 0x14003c8d0
mov r14, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x68]
mov al, 1
mov rsi, qword [rsp + 0x70]
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140052350
add rsp, 0x80
pop r15
ret