joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400c6ab0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
xchg rbp, r11
mov qword [rsp + 0x10], r11
xchg r11, rbp
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x7bfe8f0a
sub eax, 0x7bfe7b3a
call fcn.140110640
sub rsp, rax
mov edi, edx
mov esi, ecx
call sub.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_
mov dword [rsp + 0x44], eax
mov r8d, 0x5f1c5f6
sub r8d, 0x5f1c5f5
mov dword [rsp + 0x13c4], 0x26a8840a
add dword [rsp + 0x13c4], 0xd9577bf5
nop dword [rax + rax]
mov r9d, eax
shr r9d, 0x18
shr r9d, 2
shr r9d, 2
shr r9d, 1
shr r9d, 1
xor r9d, eax
imul eax, r9d, 0x6c078965
add eax, r8d
mov dword [rsp + r8*4 + 0x44], eax
inc r8
cmp r8, 0x270
jb 0x1400c6b0d
mov ebp, 0x694fe508
add ebp, 0x16b01af8
mov dword [rsp + 0x40], 0x363ce0a1
sub dword [rsp + 0x40], 0x363cde31
cmp esi, ebp
pushf
mov qword [rsp + 0x2a], 0x360c5073
sub qword [rsp + 0x2a], 0x360c5053
popf
lea rax, [rsp + 0x40]
pushf
mov dword [rsp + 0x32], 0x820722a
add dword [rsp + 0x32], 0xf7df8dd5
popf
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x20]
lea eax, [rsi - 0x80000000]
lea ebx, [rsi + rbp]
cmovae ebx, eax
lea edx, [rdi + rbp]
cmp edi, ebp
lea eax, [rdi - 0x80000000]
cmovae edx, eax
sub edx, ebx
cmp edx, 0xffffffff
jne 0x1400c6bc9
call fcn.1400c6d80
jmp 0x1400c6bd0
inc edx
call fcn.1400c67b0
lea edx, [rbx + rax]
lea r11, [rsp + 0x13d0]
cmp edx, ebp
mov rbx, qword [r11 + 0x10]
lea eax, [rdx + rbp]
mov rbp, qword [r11 + 0x18]
lea ecx, [rdx - 0x80000000]
xchg r8, rsi
mov r8, qword [r11 + 0x20]
xchg rsi, r8
cmovae eax, ecx
mov rsp, r11
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x1400c6d80
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
xchg rbx, rdi
mov qword [rsp + 8], rdi
xchg rbx, rdi
xchg r8, rbp
mov qword [rsp + 0x10], r8
xchg r8, rbp
xchg rsi, r14
mov qword [rsp + 0x18], r14
xchg r14, rsi
mov qword [rsp + 0x20], rdi
push r9
mov qword [rsp], r14
mov rax, qword [rcx + 8]
xor r14d, r14d
mov esi, r14d
mov ebp, r14d
xchg rcx, rdi
mov rcx, rdi
xchg rdi, rcx
nop word [rax + rax]
lea ecx, [rax + 0xff]
shl esi, cl
add esi, esi
nop word [rax + rax]
mov r10, qword [rdi]
mov ecx, dword [r10]
cmp ecx, 0x270
jne 0x1400c6e48
lea rax, [r10 + 8]
mov r9d, ecx
nop word [rax + rax]
mov r8d, dword [rax - 4]
xor r8d, dword [rax]
lea rax, [rax + 4]
btr r8d, 0x1f
xor r8d, dword [rax - 8]
mov ecx, r8d
and cl, 1
neg cl
sbb edx, edx
shr r8d, 1
and edx, 0x9908b0df
xor edx, dword [rax + 0x62c]
xor edx, r8d
mov dword [rax + 0x9b8], edx
sub r9, 1
jne 0x1400c6e00
mov ecx, dword [r10]
jmp 0x1400c6f3f
cmp ecx, 0x4e0
jb 0x1400c6f3f
lea r11, [r10 + 0x9c4]
mov ebx, 0x53bb157e
sub ebx, 0x53bb149b
mov eax, dword [r11]
nop
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x1400c6e6a
lea r11, [r10 + 0xd50]
mov ebx, 0xeef842b
xor ebx, 0xeef85a7
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x1400c6ec4
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
mov ecx, r14d
mov dword [r10], r14d
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 4
shr ecx, 5
shr ecx, 1
shr ecx, 1
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 3
shl eax, 2
shl eax, 1
shl eax, 1
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 8
shl eax, 7
xor edx, eax
mov ecx, edx
shr ecx, 0xc
shr ecx, 4
shr ecx, 1
shr ecx, 1
xor ecx, edx
cmp ecx, dword [rdi + 0x10]
ja 0x1400c6ddc
mov rax, qword [rdi + 8]
or esi, ecx
add rbp, rax
cmp rbp, 0x20
jb 0x1400c6dcc
xchg r14, rbx
mov r14, qword [rsp + 0x10]
xchg rbx, r14
mov eax, esi
mov rsi, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x18]
xchg rdi, r11
mov r11, qword [rsp + 0x28]
xchg rdi, r11
push rdx
xchg qword [rsp + 8], r14
add rsp, 0x10
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x1400c7660
Capabilities:
Encode data using xor

Disassembly:
xchg r9, rbx
mov qword [rsp + 8], r9
xchg rbx, r9
push rdi
sub rsp, 0x20
mov eax, dword [rcx + 0x40]
mov rdi, rdx
xchg r15, rbx
mov r15, rcx
xchg r15, rbx
mov byte [rax + rcx], 0x28
add byte [rax + rcx], 0x58
lea r8d, [rax + 1]
cmp eax, 0x38
jae 0x1400c76c0
cmp r8d, 0x38
jae 0x1400c7724
mov ecx, r8d
mov eax, 0x7ab7330f
sub eax, 0x7ab732d7
sub eax, r8d
add rcx, rbx
mov r8d, eax
xor edx, edx
call sub.VCRUNTIME140.dll_memset
jmp 0x1400c7724
cmp r8d, 0x40
jae 0x1400c76e7
mov ecx, r8d
mov eax, 0x7a404733
xor eax, 0x7a404773
sub eax, r8d
add rcx, rbx
mov r8d, eax
xor edx, edx
call sub.VCRUNTIME140.dll_memset
xchg rdx, r15
mov r15, rbx
xchg rdx, r15
xchg rdx, rbx
mov rcx, rdx
xchg rbx, rdx
call fcn.1400c7930
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
xchg rbx, r10
movups xmmword [r10 + 0x10], xmm0
xchg rbx, r10
xchg r10, rbx
movups xmmword [r10 + 0x20], xmm0
xchg r10, rbx
xchg rbp, rax
mov qword [rbx + 0x30], rbp
xchg rbp, rax
mov eax, dword [rbx + 0x40]
xchg rdx, rbx
mov rbx, rdx
xchg rbx, rdx
shl eax, 2
shl eax, 1
add qword [rbx + 0x48], rax
mov rcx, qword [rbx + 0x48]
xchg rbx, rax
mov rbx, rcx
xchg rbx, rax
mov byte [rbx + 0x3f], cl
shr rax, 6
shr rax, 1
shr rax, 1
mov byte [rbx + 0x3e], al
xchg rcx, rax
mov rcx, rax
xchg rcx, rax
shr rax, 1
shr rax, 0xc
shr rax, 1
shr rax, 1
shr rax, 1
mov byte [rbx + 0x3d], al
mov rax, rcx
shr rax, 0x18
mov byte [rbx + 0x3c], al
xchg rbx, rax
mov rbx, rcx
xchg rbx, rax
shr rax, 0x18
shr rax, 4
shr rax, 3
shr rax, 1
mov byte [rbx + 0x3b], al
xchg rcx, rax
mov rcx, rax
xchg rcx, rax
shr rax, 4
shr rax, 0xa
shr rax, 0x15
shr rax, 1
shr rax, 3
shr rax, 1
mov byte [rbx + 0x3a], al
xchg rcx, rax
mov rcx, rax
xchg rcx, rax
shr rcx, 2
shr rcx, 0x18
shr rcx, 0x12
shr rcx, 7
shr rcx, 3
shr rcx, 1
shr rcx, 1
mov byte [rbx + 0x38], cl
xchg rbx, rcx
mov rbx, rcx
xchg rcx, rbx
shr rax, 0x18
shr rax, 0xd
shr rax, 1
shr rax, 1
shr rax, 2
shr rax, 5
shr rax, 1
shr rax, 1
mov byte [rbx + 0x39], al
call fcn.1400c7930
xor r8d, r8d
lea rdx, [rdi + 8]
nop dword [rax]
nop word [rax + rax]
mov eax, dword [rbx + 0x50]
lea rdx, [rdx + 1]
mov ecx, 0x3554ef04
xor ecx, 0x3554ef1c
lea rdi, [rdi + 1]
sub ecx, r8d
sub r8d, 0xfffffff8
shr eax, cl
mov byte [rdi - 1], al
mov eax, dword [rbx + 0x54]
shr eax, cl
mov byte [rdx - 5], al
mov eax, dword [rbx + 0x58]
shr eax, cl
mov byte [rdx - 1], al
mov eax, dword [rbx + 0x5c]
shr eax, cl
mov byte [rdx + 3], al
mov eax, dword [rbx + 0x60]
shr eax, cl
mov byte [rdx + 7], al
cmp r8d, 0x20
jb 0x1400c7816
xchg r9, rbx
mov r9, qword [rsp + 0x30]
xchg rbx, r9
add rsp, 0x20
push rbx
xchg qword [rsp + 8], rdi
add rsp, 0x10
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x140108230
Capabilities:
Get common file path

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x550
mov rsi, rcx
mov dword [rsp + 0x20], 0x114
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [rsp + 0x2c]
mov dword [rsi + 0xd8], eax
cmp eax, 0x1db1
jb 0x14010849d
xor edx, edx
lea rcx, [rsp + 0x140]
mov r8d, 0x410
call sub.VCRUNTIME140.dll_memset
mov edx, 0x104
lea rcx, [rsp + 0x140]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea rcx, [rsp + 0x140]
mov rax, 0xffffffffffffffff
nop dword [rax]
cmp word [rcx + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x1401082a0
cmp dword [rsi + 0xd8], 0x23f0
mov ecx, 0x5c
mov word [rsp + rax*2 + 0x140], cx
lea rcx, [0x140003b98]
jb 0x1401082db
lea rcx, [0x140003bb8]
call fcn.140f8a82f
nop
mov edx, 0x208
lea rcx, [rsp + 0x140]
mov r8, rax
mov rbx, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
mov rcx, rbx
call fcn.140f8a861
nop
xor edx, edx
lea rcx, [rsp + 0x140]
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
test rax, rax
je 0x14010849d
cmp dword [rsi + 0xd8], 0x23f0
lea rcx, [0x140003bc8]
movsxd rbx, dword [rax + 0x3c]
mov qword [rsp + 0x578], rbp
mov qword [rsp + 0x580], r14
jb 0x140108355
lea rcx, [0x140003be8]
call fcn.140f8a82f
nop
mov r8d, dword [rbx + rdi + 0x50]
lea rcx, [rsp + 0x570]
mov r9, rax
mov rdx, rdi
mov rbp, rax
call fcn.140107f40
mov rcx, rbp
mov r14, rax
call fcn.140f8a861
nop
test r14, r14
jne 0x14010841a
lea edx, [r14 + 1]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbp, rax
test rax, rax
je 0x1401083f2
lea rcx, [0x140003c00]
call fcn.140f8a82f
nop
mov r8d, 0x1000
lea rcx, [rsp + 0x570]
mov r9, rax
mov rdx, rbp
mov rbx, rax
call fcn.140107f40
mov rcx, rbx
mov rbp, rax
call fcn.140f8a861
nop
test rbp, rbp
je 0x1401083f2
movsxd rcx, dword [rbp + 2]
lea rbx, [rbp + 6]
add rbx, rcx
jmp 0x140108437
mov ecx, 0xc000001d
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov rbp, qword [rsp + 0x578]
mov r14, qword [rsp + 0x580]
add rsp, 0x550
pop rdi
pop rsi
pop rbx
ret
movsxd rbx, dword [r14 + 2]
xor eax, eax
cmp dword [rsi + 0xd8], 0x23f0
setb al
add rax, 6
add rax, r14
add rbx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
sub rbx, rdi
lea rcx, [0x140003c18]
cmp dword [rsi + 0xd8], 0x23f0
jb 0x140108461
lea rcx, [0x140003c28]
call fcn.140f8a82f
nop
mov rdx, rax
mov rcx, rsi
mov rdi, rax
call fcn.1401084b0
mov rcx, rdi
mov rsi, rax
call fcn.140f8a861
nop
test rsi, rsi
jne 0x140108494
mov ecx, 0xc0000139
jmp 0x1401083f7
lea rax, [rsi + rbx]
jmp 0x1401083ff
xor eax, eax
add rsp, 0x550
pop rdi
pop rsi
pop rbx
ret
Function at 0x140110c9c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140110ce6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140110ce6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140110ce6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140110ce6
cmp dword [rcx + 0x84], 0xe
jbe 0x140110ce6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140110ce8
xor al, al
add rsp, 0x28
ret

Function at 0x14013d570
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x50
mov r12, r9
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
test r8, r8
jne 0x14013d59d
xor al, al
jmp 0x14013d6ff
mov rax, qword [0x14015c6c0]
lea rcx, [rsp]
xor r11d, r11d
mov qword [rcx], rax
mov rax, qword [0x14015c6c8]
mov qword [rsp + 0x60], rbp
mov qword [rcx + 8], rax
mov rax, qword [0x14015c6d0]
mov rdx, r11
mov qword [rcx + 0x10], rax
mov rax, qword [0x14015c6d8]
mov qword [rcx + 0x18], rax
mov rax, qword [0x14015c6e0]
mov qword [rcx + 0x20], rax
mov rax, qword [0x14015c6e8]
mov qword [rcx + 0x28], rax
mov rax, qword [0x14015c6f0]
mov qword [rcx + 0x30], rax
mov rax, qword [0x14015c6f8]
mov qword [rcx + 0x38], rax
movzx eax, byte [0x14015c700]
mov byte [rcx + 0x40], al
mov rax, qword [r9]
mov rcx, r8
lea rbp, [r8 + rax]
test rbx, rbx
je 0x14013d6f1
add r8, 4
nop word [rax + rax]
movzx r9d, byte [rdx + rdi]
inc rdx
shl r9d, 0x10
cmp rdx, rbx
jne 0x14013d649
mov r11d, 2
jmp 0x14013d66d
movzx eax, byte [rdx + rdi]
inc rdx
shl eax, 8
or r9d, eax
cmp rdx, rbx
jne 0x14013d663
mov r11d, 1
jmp 0x14013d66d
movzx eax, byte [rdx + rdi]
or r9d, eax
inc rdx
mov r10d, r9d
and r9d, 0x3f
cmp r8, rbp
ja 0x14013d715
mov rax, r10
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx], al
mov rax, r10
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx + 1], al
cmp r11, 1
jbe 0x14013d6b2
mov byte [rcx + 2], 0x3d
add rcx, 3
add r8, 3
jmp 0x14013d6ca
shr r10, 6
add rcx, 3
and r10d, 0x3f
add r8, 3
movzx eax, byte [rsp + r10]
mov byte [rcx - 1], al
test r11, r11
je 0x14013d6da
mov byte [rcx], 0x3d
inc rcx
inc r8
jmp 0x14013d6e8
movzx eax, byte [rsp + r9]
inc rcx
inc r8
mov byte [rcx - 1], al
cmp rdx, rbx
jb 0x14013d630
sub rcx, rsi
mov al, 1
mov qword [r12], rcx
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r12
ret
xor al, al
jmp 0x14013d6fa

Function at 0x140ddb43c
Capabilities:
Execute syscall

Disassembly:
syscall
ret
mov r10, rcx
jmp 0x140cbe6c0
Function at 0x28e381830
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call dbg.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call dbg.__acrt_iob_func
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sym.vfprintf
call sym.abort
nop
nop word [rax + rax]
Function at 0x28e3818a0
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rdi, dword [0x28e3b8074]
mov r12, rcx
mov rsi, rdx
mov rbx, r8
test edi, edi
jle 0x28e381a50
mov rax, qword [0x28e3b8078]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp r12, rdx
jb 0x28e3818ec
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x28e381977
add ecx, 1
add rax, 0x28
cmp ecx, edi
jne 0x28e3818d0
mov rcx, r12
call dbg.__mingw_GetSectionForAddress
mov rbp, rax
test rax, rax
je 0x28e381aad
mov rax, qword [0x28e3b8078]
lea rdi, [rdi + rdi*4]
shl rdi, 3
add rax, rdi
mov qword [rax + 0x20], rbp
mov dword [rax], 0
call dbg._GetPEImageBase
mov ecx, dword [rbp + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x28e3b8078]
mov qword [rax + rdi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x28e381a92
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x28e381970
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x28e381a00
add dword [0x28e3b8074], 1
cmp ebx, 8
jae 0x28e3819a8
test bl, 4
jne 0x28e381a60
test ebx, ebx
je 0x28e381999
movzx eax, byte [rsi]
mov byte [r12], al
test bl, 2
jne 0x28e381a80
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rax, qword [rsi]
lea rcx, [r12 + 8]
and rcx, 0xfffffffffffffff8
mov qword [r12], rax
mov eax, ebx
mov rdx, qword [rsi + rax - 8]
mov qword [r12 + rax - 8], rdx
sub r12, rcx
add ebx, r12d
sub rsi, r12
and ebx, 0xfffffff8
cmp ebx, 8
jb 0x28e381999
and ebx, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov r8, qword [rsi + rdx]
mov qword [rcx + rdx], r8
cmp eax, ebx
jb 0x28e3819da
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 4
mov eax, 0x40
cmovne r8d, eax
add rdi, qword [0x28e3b8078]
mov qword [rdi + 8], rcx
mov r9, rdi
mov qword [rdi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x28e381970
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call dbg.__report_error
xor edi, edi
jmp 0x28e3818f7
mov eax, dword [rsi]
mov ebx, ebx
mov dword [r12], eax
mov eax, dword [rsi + rbx - 4]
mov dword [r12 + rbx - 4], eax
jmp 0x28e381999
mov ebx, ebx
movzx eax, word [rsi + rbx - 2]
mov word [r12 + rbx - 2], ax
jmp 0x28e381999
mov rax, qword [0x28e3b8078]
mov edx, dword [rbp + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rdi + 0x18]
call dbg.__report_error
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call dbg.__report_error
nop
nop dword [rax]
Function at 0x28e381db0
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x28e3b80a0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x28e3b8080]
test rbx, rbx
je 0x28e381e04
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x28e381dfb
test r12, r12
je 0x28e381dfb
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x28e381de0
lea rcx, [0x28e3b80a0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x28e382030
Capabilities:
Parse pe header

Disassembly:
cmp word [rcx], 0x5a4d
jne 0x28e382040
jmp sym._ValidateImageBase.part.0
xor eax, eax
ret

Function at 0x28e382050
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x28e382095
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
nop dword [rax]
mov r8d, dword [rax + 0xc]
mov rcx, r8
cmp r8, rdx
ja 0x28e38208c
add ecx, dword [rax + 8]
cmp rcx, rdx
ja 0x28e382097
add rax, 0x28
cmp rax, r9
jne 0x28e382078
xor eax, eax
ret

Function at 0x28e382140
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r10, qword [0x28e3b51e0]
xor r8d, r8d
cmp word [r10], 0x5a4d
mov r9, rcx
jne 0x28e3821b9
mov rcx, r10
call sym._ValidateImageBase.part.0
test eax, eax
je 0x28e3821b9
movsxd rax, dword [r10 + 0x3c]
mov rcx, r9
sub rcx, r10
add r10, rax
movzx eax, word [r10 + 0x14]
lea r8, [r10 + rax + 0x18]
movzx eax, word [r10 + 6]
test eax, eax
je 0x28e3821b6
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [r8 + rax*8 + 0x28]
nop dword [rax]
mov edx, dword [r8 + 0xc]
mov rax, rdx
cmp rcx, rdx
jb 0x28e3821ad
add eax, dword [r8 + 8]
cmp rcx, rax
jb 0x28e3821b9
add r8, 0x28
cmp r8, r9
jne 0x28e382198
xor r8d, r8d
mov rax, r8
add rsp, 0x28
ret

Function at 0x28e3822a0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x28e3b51e0]
xor eax, eax
cmp word [r9], 0x5a4d
mov r8, rcx
jne 0x28e38230f
mov rcx, r9
call sym._ValidateImageBase.part.0
test eax, eax
je 0x28e38230f
movsxd rax, dword [r9 + 0x3c]
mov rcx, r8
sub rcx, r9
add r9, rax
movzx eax, word [r9 + 0x14]
movzx edx, word [r9 + 6]
lea rax, [r9 + rax + 0x18]
test edx, edx
je 0x28e38230d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x28e382304
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x28e382318
add rax, 0x28
cmp rax, r9
jne 0x28e3822f0
xor eax, eax
add rsp, 0x28
ret
mov eax, dword [rax + 0x24]
not eax
shr eax, 0x1f
add rsp, 0x28
ret
Function at 0x28e382330
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r11, qword [0x28e3b51e0]
xor r9d, r9d
cmp word [r11], 0x5a4d
mov r8d, ecx
jne 0x28e3823a8
mov rcx, r11
call sym._ValidateImageBase.part.0
test eax, eax
je 0x28e3823a8
movsxd rcx, dword [r11 + 0x3c]
add rcx, r11
mov eax, dword [rcx + 0x90]
test eax, eax
je 0x28e3823a8
movzx edx, word [rcx + 0x14]
lea rdx, [rcx + rdx + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x28e3823a8
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r10, [rdx + rcx*8 + 0x28]
nop dword [rax + rax]
mov r9d, dword [rdx + 0xc]
mov rcx, r9
cmp rax, r9
jb 0x28e38239c
add ecx, dword [rdx + 8]
cmp rax, rcx
jb 0x28e3823b0
add rdx, 0x28
cmp rdx, r10
jne 0x28e382388
xor r9d, r9d
mov rax, r9
add rsp, 0x28
ret
add rax, r11
jmp 0x28e3823c0
sub r8d, 1
add rax, 0x14
mov ecx, dword [rax + 4]
test ecx, ecx
jne 0x28e3823ce
mov edx, dword [rax + 0xc]
test edx, edx
je 0x28e3823a5
test r8d, r8d
jg 0x28e3823b8
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
add rsp, 0x28
ret
Function at 0x180002940
Capabilities:
Initialize winsock library

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x200
movzx ebx, dx
mov rdi, rcx
lea rdx, [rsp + 0x60]
mov ecx, 0x202
mov rbp, r9
mov rsi, r8
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x180002a46
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
movzx eax, bx
mov dword [rsp + 0x38], 2
mov dword [rsp + 0x3c], reloc.WS2_32.dll_recvfrom
mov dword [rsp + 0x34], eax
mov rax, qword [0x180058448]
test rax, rax
jne 0x1800029cc
xor ecx, ecx
call fcn.180003120
mov qword [0x180058448], rax
lea r9, [rsp + 0x28]
lea r8, [rsp + 0x30]
xor edx, edx
mov rcx, rdi
call rax
mov ecx, eax
mov edi, eax
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov rbx, qword [rsp + 0x28]
test edi, edi
jne 0x180002a1e
mov ecx, dword [rbx + 4]
cmp ecx, 2
je 0x1800029ff
cmp ecx, 0x17
je 0x180002a12
jmp 0x180002a1e
mov rax, qword [rbx + 0x20]
mov ecx, dword [rax + 4]
mov dword [rsp + 0x20], ecx
mov rax, qword [rsp + 0x20]
mov qword [rsi], rax
mov rax, qword [rbx + 0x20]
movups xmm0, xmmword [rax + 8]
movups xmmword [rbp], xmm0
mov rax, qword [0x180058450]
test rax, rax
jne 0x180002a39
lea ecx, [rax + 2]
call fcn.180003120
mov qword [0x180058450], rax
mov rcx, rbx
call rax
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, edi
lea r11, [rsp + 0x200]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x180003120
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
sub rsp, 0x270
cmp dword [0x180058440], 0
lea rax, [0x180002bb0]
lea rbx, str.getaddrinfo
mov qword [rsp + 0x28], rax
lea rax, str.getnameinfo
movzx ebp, cx
mov qword [rsp + 0x30], rax
lea rax, [0x180002eb0]
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x38], rax
lea rax, str.freeaddrinfo
mov qword [rsp + 0x40], rax
lea rax, [fcn.180002b60]
mov qword [rsp + 0x48], rax
jne 0x1800032da
lea rcx, [rsp + 0x160]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x1800032d0
lea r8, [rsp + 0x160]
lea rcx, [rsp + 0x50]
mov edx, 0x10c
mov qword [rsp + 0x280], rsi
call fcn.18002a73c
lea r8, str.ws2_32
lea rcx, [rsp + 0x50]
mov edx, 0x10c
call fcn.18002a7a0
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x180003202
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x180003262
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea r8, [rsp + 0x160]
lea rcx, [rsp + 0x50]
mov edx, 0x10c
call fcn.18002a73c
lea r8, str.wship6
lea rcx, [rsp + 0x50]
mov edx, 0x10c
call fcn.18002a7a0
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x1800032c8
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x180003262
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x1800032c8
mov qword [rsp + 0x288], rdi
lea rbx, [rsp + 0x28]
xor edi, edi
mov rdx, qword [rbx - 8]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx], rax
test rax, rax
je 0x1800032b7
inc edi
add rbx, 0x10
cmp edi, 3
jl 0x180003271
mov rax, qword [rsp + 0x28]
mov qword [0x1800510d8], rax
mov rax, qword [rsp + 0x38]
mov qword [0x1800510e8], rax
mov rax, qword [rsp + 0x48]
mov qword [fcn.180002b60], rax
jmp 0x1800032c0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rdi, qword [rsp + 0x288]
mov rsi, qword [rsp + 0x280]
mov dword [0x180058440], 1
mov rbx, qword [rsp + 0x290]
movzx eax, bp
lea rcx, str.getaddrinfo
add rax, rax
mov rax, qword [rcx + rax*8 + 8]
add rsp, 0x270
pop rbp
ret