joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400e3890
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push r12
sub rsp, 0x30
xor esi, esi
cmp r8d, 0x40
mov ebx, r8d
mov r12, rdx
mov rbp, rcx
jb 0x1400e3a49
mov rcx, rbx
mov qword [rsp + 0x50], rdi
call fcn.1400ce030
xor r8d, r8d
xor edx, edx
mov rcx, rbp
mov rdi, rax
call fcn.1400da3f0
test eax, eax
je 0x1400e3a18
lea r9, [rsp + 0x60]
mov r8d, ebx
mov rdx, rdi
mov rcx, rbp
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400e39e7
cmp dword [rsp + 0x60], ebx
jne 0x1400e39b6
lea r10, [rdi + 3]
lea r9, str.ReFS
lea r8d, [rsi + 4]
mov rdx, r10
sub r9, r10
nop
nop
nop
movzx eax, byte [r9 + rdx]
movzx ecx, byte [rdx]
sub ecx, eax
jne 0x1400e3984
add rdx, 1
sub r8d, 1
jne 0x1400e3920
mov rdx, qword [rdi + 0x38]
mov qword [r12], rdx
movzx ecx, byte [rdi + 0x28]
movzx eax, byte [rdi + 0x29]
mov r9d, dword [rdi + 0x24]
mov r8d, dword [rdi + 0x20]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
lea rcx, str.serial_number__I64x__sector_size__u__sectors_per_cluster__u__version__u._u_n
call fcn.1400b35e0
mov rcx, rdi
mov esi, 1
call fcn.1400ce0b0
mov rdi, qword [rsp + 0x50]
mov eax, esi
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop r12
pop rsi
pop rbp
ret
lea rcx, str.bad_ReFS_signature:__t_n
mov r8d, 4
mov rdx, r10
call fcn.1400b35e0
mov rcx, rdi
call fcn.1400ce0b0
mov rdi, qword [rsp + 0x50]
mov eax, esi
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop r12
pop rsi
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.failed_to_read_all_refs_boot_record__u_n
mov edx, eax
call fcn.1400b35e0
mov rcx, rdi
call fcn.1400ce0b0
mov rdi, qword [rsp + 0x50]
mov eax, esi
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop r12
pop rsi
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.failed_to_read_refs_boot_record__u_n
mov edx, eax
call fcn.1400b35e0
mov rcx, rdi
call fcn.1400ce0b0
mov rdi, qword [rsp + 0x50]
mov eax, esi
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop r12
pop rsi
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.failed_to_set_file_pointer_to_refs_boot_record__u_n
mov edx, eax
call fcn.1400b35e0
mov rcx, rdi
call fcn.1400ce0b0
mov rdi, qword [rsp + 0x50]
mov eax, esi
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop r12
pop rsi
pop rbp
ret
lea rcx, str.bad_refs_sector_size__u_n
mov edx, ebx
call fcn.1400b35e0
mov rbx, qword [rsp + 0x58]
mov eax, esi
add rsp, 0x30
pop r12
pop rsi
pop rbp
ret
Function at 0x1400e8080
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rdi, rcx
add rcx, 0xa8
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [rdi + 0x120]
lea rcx, [rdi + 0xa8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rbx, rbx
je 0x1400e81c2
mov qword [rsp + 0x48], rbp
xor ebp, ebp
cmp dword [rbx + 0x10], ebp
je 0x1400e8137
cmp dword [rdi + 0x70], ebp
je 0x1400e80fa
mov rcx, qword [rdi]
lea rdx, [rdi + 8]
lea r8, [rsp + 0x40]
xor r9d, r9d
mov dword [rdi + 0x70], ebp
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
je 0x1400e818f
mov ecx, dword [rsp + 0x40]
add qword [rbx + 8], rcx
sub dword [rbx + 0x10], ecx
jmp 0x1400e8132
mov rcx, qword [rdi]
mov dword [rdi + 0x18], ebp
mov dword [rdi + 0x1c], ebp
mov r8d, dword [rbx + 0x10]
mov rdx, qword [rbx + 8]
lea rax, [rdi + 8]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400e81d2
mov edx, dword [rsp + 0x40]
add qword [rbx + 8], rdx
sub dword [rbx + 0x10], edx
cmp dword [rbx + 0x10], ebp
jne 0x1400e80c8
lea rcx, [rdi + 0xa8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r11, qword [rbx]
lea rcx, [rdi + 0xa8]
mov qword [rdi + 0x120], r11
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, rbx
call fcn.1400ce0b0
lea rcx, [rdi + 0xa8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [rdi + 0x120]
lea rcx, [rdi + 0xa8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rbx, rbx
jne 0x1400e80c3
jmp 0x1400e81bd
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e4
je 0x1400e81df
mov rcx, qword [rdi + 0xa0]
xor r8d, r8d
lea edx, [r8 + 3]
call qword [rdi + 0x98]
mov rcx, qword [rdi + 0x80]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x1400e819c
mov dword [rdi + 0x70], 1
jmp 0x1400e81bd
Function at 0x1400e81f0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
sub rsp, 0x30
mov rbx, rcx
xor esi, esi
mov qword [rsp + 0x48], rdi
cmp dword [rbx + 0x6c], esi
jne 0x1400e82e7
cmp dword [rbx + 0x68], esi
je 0x1400e827e
mov rdx, qword [rbx + 0x50]
mov rcx, rbx
mov dword [rbx + 0x68], esi
call fcn.1400e7560
test eax, eax
je 0x1400e823b
mov rcx, qword [rbx + 0x50]
call fcn.1400ce0b0
mov qword [rbx + 0x50], rsi
mov qword [rbx + 0x58], rsi
jmp 0x1400e82e7
lea rcx, [rbx + 0xa8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp qword [rbx + 0x48], rsi
jne 0x1400e8351
mov rax, qword [rbx + 0x50]
lea rcx, [rbx + 0xa8]
mov qword [rbx + 0x58], rsi
mov qword [rbx + 0x48], rax
mov qword [rbx + 0x50], rsi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rbx + 0x90]
call qword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x1400e82e7
cmp qword [rbx + 0x58], rsi
je 0x1400e82d8
mov eax, dword [rbx + 0x64]
cmp eax, 8
jb 0x1400e83a2
cmp eax, 0x800000
ja 0x1400e83a2
mov rcx, qword [rbx + 0x50]
test rcx, rcx
je 0x1400e82a9
call fcn.1400ce0b0
mov ecx, dword [rbx + 0x64]
call fcn.1400ce030
mov ecx, dword [rbx + 0x64]
mov qword [rbx + 0x50], rax
mov dword [rax], ecx
mov rax, qword [rbx + 0x50]
add rax, 4
mov dword [rbx + 0x68], 1
mov qword [rbx + 0x58], rax
mov eax, dword [rbx + 0x64]
sub eax, 4
mov dword [rbx + 0x6c], eax
jmp 0x1400e82e7
lea rax, [rbx + 0x64]
mov dword [rbx + 0x6c], 4
mov qword [rbx + 0x58], rax
cmp dword [rbx + 0x60], esi
je 0x1400e8318
mov rcx, qword [rbx]
lea rdx, [rbx + 0x28]
lea r8, [rsp + 0x40]
xor r9d, r9d
mov dword [rbx + 0x60], esi
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
je 0x1400e8371
mov ecx, dword [rsp + 0x40]
add qword [rbx + 0x58], rcx
sub dword [rbx + 0x6c], ecx
jmp 0x1400e8204
mov r8d, dword [rbx + 0x6c]
mov rdx, qword [rbx + 0x58]
mov rcx, qword [rbx]
lea rax, [rbx + 0x28]
lea r9, [rsp + 0x40]
mov dword [rbx + 0x38], esi
mov qword [rsp + 0x20], rax
mov dword [rbx + 0x3c], esi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400e8395
mov ecx, dword [rsp + 0x40]
add qword [rbx + 0x58], rcx
sub dword [rbx + 0x6c], ecx
jmp 0x1400e8204
mov rcx, qword [rbx + 0x50]
call fcn.1400ce0b0
lea rcx, [rbx + 0xa8]
mov qword [rbx + 0x50], rsi
mov qword [rbx + 0x58], rsi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x1400e83a2
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e4
jne 0x1400e83a2
mov dword [rbx + 0x60], 1
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rsi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x1400e837e
mov rcx, qword [rbx + 0xa0]
xor r8d, r8d
lea edx, [r8 + 3]
call qword [rbx + 0x98]
mov rcx, qword [rbx + 0x80]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rsi
ret
Function at 0x1400e9dd0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x390
mov rax, qword [0x140209b48]
xor rax, rsp
mov qword [rsp + 0x380], rax
mov r12, rcx
lea rcx, [rsp + 0x160]
xor r13d, r13d
mov rbp, rdx
mov rsi, r13
call fcn.1400012c0
mov rdx, qword [0x14020aee0]
cmp byte [rdx], sil
je 0x1400e9e2c
lea rcx, [rsp + 0x160]
call fcn.14017b470
jmp 0x1400e9e86
lea rcx, [rsp + 0x40]
call fcn.1400012c0
lea rdx, str..PIPEEverything_Service
lea rcx, [rsp + 0x40]
call fcn.140175d10
call fcn.1400cd3c0
test rax, rax
je 0x1400e9e6a
call fcn.1400cd3c0
lea rdx, str.___s_
lea rcx, [rsp + 0x40]
mov r8, rax
call fcn.140176950
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0x160]
call fcn.14017b470
lea rcx, [rsp + 0x40]
call fcn.140175010
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
cmp eax, 0xea60
ja 0x1400e9fe4
mov qword [rsp + 0x3b0], rbx
nop
nop
mov rcx, qword [rsp + 0x168]
mov qword [rsp + 0x30], r13
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
mov dword [rsp + 0x28], 0x40000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov rbx, rax
jne 0x1400e9f27
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Open_pipe_failed__d_n
mov edx, eax
call fcn.1400b35e0
call fcn.1400e7690
test eax, eax
je 0x1400e9fdc
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
cmp eax, 0xea60
jbe 0x1400e9eb0
jmp 0x1400e9fdc
mov ecx, 0x138
call fcn.1400ce030
xor edx, edx
mov r8d, 0x138
mov rcx, rax
mov rsi, rax
call fcn.1401a6e60
lea rcx, [rsi + 0xa8]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [rsi + 0xd0]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [rsi + 0xf8]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov qword [rsi], rbx
call fcn.1400d78a0
mov qword [rsi + 0x20], rax
call fcn.1400d78a0
mov qword [rsi + 0x98], r12
mov qword [rsi + 0x40], rax
mov qword [rsi + 0xa0], rbp
call fcn.1400d78a0
mov qword [rsi + 0x80], rax
call fcn.1400d78a0
mov qword [rsi + 0x88], rax
call fcn.1400d78a0
lea rcx, [0x1400e9260]
mov rdx, rsi
mov qword [rsi + 0x90], rax
call fcn.1400de910
mov rcx, rsi
mov qword [rsi + 0x78], rax
call fcn.1400e9cb0
test eax, eax
jne 0x1400e9fdc
mov rcx, rsi
call fcn.1400e79c0
mov rsi, r13
mov rbx, qword [rsp + 0x3b0]
lea rcx, [rsp + 0x160]
call fcn.140175010
mov rax, rsi
mov rcx, qword [rsp + 0x380]
xor rcx, rsp
call fcn.1401a6ae0
lea r11, [rsp + 0x390]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x1400ea2b0
Capabilities:
Terminate process

Disassembly:
push rdi
sub rsp, 0x60
mov r8d, 4
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
test rax, rax
mov rdi, rax
je 0x1400ea330
lea rax, [rsp + 0x80]
lea r8, [rsp + 0x30]
mov r9d, 0x24
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x20], rax
call qword [0x140200a40]
test eax, eax
je 0x1400ea327
mov r8d, dword [rsp + 0x4c]
xor edx, edx
mov qword [rsp + 0x70], rbx
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
mov rbx, rax
je 0x1400ea322
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x70]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
add rsp, 0x60
pop rdi
ret
Function at 0x1400ea5f0
Capabilities:
Start service

Disassembly:
push rbx
sub rsp, 0x370
mov rax, qword [0x140209b48]
xor rax, rsp
mov qword [rsp + 0x360], rax
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 2]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
test rax, rax
mov rbx, rax
je 0x1400ea76f
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x380], rdi
call fcn.1400012c0
lea rdx, [0x1401b2850]
lea rcx, [rsp + 0x30]
call fcn.140175d10
call fcn.1400cd3c0
test rax, rax
je 0x1400ea66b
call fcn.1400cd3c0
lea rdx, str.___s_
lea rcx, [rsp + 0x30]
mov r8, rax
call fcn.140176950
mov r8, qword [rsp + 0x38]
cmp byte [r8], 0
je 0x1400ea695
movzx eax, byte [r8]
cmp al, 0x5c
je 0x1400ea682
cmp al, 0x2f
jne 0x1400ea686
mov byte [r8], 0x20
add r8, 1
cmp byte [r8], 0
jne 0x1400ea676
mov r8, qword [rsp + 0x38]
lea rcx, [rsp + 0x150]
mov edx, 0x101
call fcn.14017a370
lea rcx, [rsp + 0x30]
call fcn.140175010
lea rdx, [rsp + 0x150]
mov r8d, reloc.WS2_32.dll_recv
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
test rax, rax
mov rdi, rax
je 0x1400ea735
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x1400ea72a
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.start_service__08x_n
mov edx, eax
call fcn.1400b35e0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x420
je 0x1400ea72a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, qword [0x1401fd5f8]
mov edx, reloc.WS2_32.dll_recv
mov r9, qword [r8 + 0x2090]
mov r8, qword [r8]
xor ecx, ecx
mov dword [rsp + 0x20], eax
call fcn.1400d47d0
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x1400ea75c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, qword [0x1401fd5f8]
mov edx, reloc.WS2_32.dll_recv
mov r9, qword [r8 + 0x2078]
mov r8, qword [r8]
xor ecx, ecx
mov dword [rsp + 0x20], eax
call fcn.1400d47d0
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rdi, qword [rsp + 0x380]
jmp 0x1400ea796
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, qword [0x1401fd5f8]
mov edx, reloc.WS2_32.dll_recv
mov r9, qword [r8 + 0x2088]
mov r8, qword [r8]
xor ecx, ecx
mov dword [rsp + 0x20], eax
call fcn.1400d47d0
mov rcx, qword [rsp + 0x360]
xor rcx, rsp
call fcn.1401a6ae0
add rsp, 0x370
pop rbx
ret
Function at 0x1400ea7b0
Capabilities:
Stop service
Terminate process

Disassembly:
push rdi
sub rsp, 0x3c0
mov rax, qword [0x140209b48]
xor rax, rsp
mov qword [rsp + 0x3b0], rax
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
test rax, rax
mov rdi, rax
je 0x1400ea99e
lea rcx, [rsp + 0x80]
mov qword [rsp + 0x3d8], rbp
call fcn.1400012c0
lea rdx, [0x1401b2850]
lea rcx, [rsp + 0x80]
call fcn.140175d10
call fcn.1400cd3c0
test rax, rax
je 0x1400ea836
call fcn.1400cd3c0
lea rdx, str.___s_
lea rcx, [rsp + 0x80]
mov r8, rax
call fcn.140176950
mov r8, qword [rsp + 0x88]
cmp byte [r8], 0
je 0x1400ea866
movzx eax, byte [r8]
cmp al, 0x5c
je 0x1400ea850
cmp al, 0x2f
jne 0x1400ea854
mov byte [r8], 0x20
add r8, 1
cmp byte [r8], 0
jne 0x1400ea844
mov r8, qword [rsp + 0x88]
lea rcx, [rsp + 0x1a0]
mov edx, 0x101
call fcn.14017a370
lea rcx, [rsp + 0x80]
call fcn.140175010
lea rdx, [rsp + 0x1a0]
mov r8d, 0x20
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
test rax, rax
mov rbp, rax
je 0x1400ea964
lea r8, [rsp + 0x60]
mov edx, 1
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x1400ea959
lea r8d, [rax + 4]
lea rdx, [rsp + 0x1a0]
mov rcx, rdi
mov qword [rsp + 0x3e0], rsi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
test rax, rax
mov rsi, rax
je 0x1400ea951
lea rax, [rsp + 0x30]
lea r8, [rsp + 0x38]
mov r9d, 0x24
xor edx, edx
mov rcx, rsi
mov qword [rsp + 0x20], rax
call qword [0x140200a40]
test eax, eax
je 0x1400ea948
mov r8d, dword [rsp + 0x54]
xor edx, edx
mov qword [rsp + 0x3d0], rbx
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
mov rbx, rax
je 0x1400ea940
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x3d0]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rsi, qword [rsp + 0x3e0]
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x1400ea98b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, qword [0x1401fd5f8]
mov edx, reloc.WS2_32.dll_recv
mov r9, qword [r8 + 0x2078]
mov r8, qword [r8]
xor ecx, ecx
mov dword [rsp + 0x20], eax
call fcn.1400d47d0
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rbp, qword [rsp + 0x3d8]
jmp 0x1400ea9c5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, qword [0x1401fd5f8]
mov edx, reloc.WS2_32.dll_recv
mov r9, qword [r8 + 0x2088]
mov r8, qword [r8]
xor ecx, ecx
mov dword [rsp + 0x20], eax
call fcn.1400d47d0
mov rcx, qword [rsp + 0x3b0]
xor rcx, rsp
call fcn.1401a6ae0
add rsp, 0x3c0
pop rdi
ret
Function at 0x1400eb750
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x30
mov rbx, qword [rcx + 0x80]
mov rdi, rcx
test rbx, rbx
je 0x1400eb847
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x50], rsi
xor ebp, ebp
nop
nop
cmp dword [rbx + 0x18], ebp
mov rsi, qword [rbx]
je 0x1400eb7f7
cmp dword [rdi + 0x90], ebp
je 0x1400eb7bd
mov rcx, qword [rdi + 0x50]
lea rdx, [rdi + 0x30]
lea r8, [rsp + 0x40]
xor r9d, r9d
mov dword [rdi + 0x90], ebp
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
je 0x1400eb829
mov ecx, dword [rsp + 0x40]
add qword [rbx + 0x10], rcx
sub dword [rbx + 0x18], ecx
jmp 0x1400eb7f2
mov rcx, qword [rdi + 0x50]
mov dword [rdi + 0x40], ebp
mov dword [rdi + 0x44], ebp
mov r8d, dword [rbx + 0x18]
mov rdx, qword [rbx + 0x10]
lea rax, [rdi + 0x30]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400eb852
mov edx, dword [rsp + 0x40]
add qword [rbx + 0x10], rdx
sub dword [rbx + 0x18], edx
cmp dword [rbx + 0x18], ebp
jne 0x1400eb788
mov rcx, qword [rbx + 8]
call fcn.1400ce0b0
mov rcx, rbx
call fcn.1400ce0b0
test rsi, rsi
mov qword [rdi + 0x80], rsi
jne 0x1400eb81b
mov qword [rdi + 0x88], rbp
test rsi, rsi
mov rbx, rsi
jne 0x1400eb780
jmp 0x1400eb83d
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e4
je 0x1400eb86b
mov dword [rdi + 0x5c], 1
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x1400eb836
lea rcx, str.write_pending..._n
call fcn.1400b35e0
mov dword [rdi + 0x90], 1
jmp 0x1400eb83d

Function at 0x1400eb880
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x20
movsxd rdi, r9d
mov r12, rcx
mov rsi, r8
lea rcx, str.write_reply__d__u_n
mov r8d, edi
mov ebx, edx
call fcn.1400b35e0
mov ecx, 0x20
call fcn.1400ce030
lea r10d, [rdi + 8]
mov ecx, r10d
mov rbp, rax
mov dword [rax + 0x18], r10d
call fcn.1400ce030
mov ecx, dword [rbp + 0x18]
mov r8, rdi
mov qword [rbp + 8], rax
mov qword [rbp + 0x10], rax
mov dword [rax], ecx
lea rcx, [rax + 8]
mov rdx, rsi
mov dword [rax + 4], ebx
call fcn.1401a6b10
cmp qword [r12 + 0x80], 0
je 0x1400eb908
mov rax, qword [r12 + 0x88]
mov qword [rax], rbp
jmp 0x1400eb910
mov qword [r12 + 0x80], rbp
mov qword [rbp], 0
mov rcx, r12
mov qword [r12 + 0x88], rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
jmp fcn.1400eb750
Function at 0x1400eb950
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.last_error__u_n
mov edx, eax
mov ebx, eax
call fcn.1400b35e0
mov edx, 5
lea rcx, str.write_reply__d__u_n
lea r8d, [rdx - 1]
call fcn.1400b35e0
mov ecx, 0x20
call fcn.1400ce030
mov ecx, ntohs
mov dword [rax + 0x18], ntohs
mov rdi, rax
call fcn.1400ce030
mov ecx, dword [rdi + 0x18]
mov qword [rdi + 8], rax
mov qword [rdi + 0x10], rax
mov dword [rax], ecx
mov dword [rax + 4], 5
mov dword [rax + 8], ebx
cmp qword [rsi + 0x80], 0
je 0x1400eb9d8
mov rax, qword [rsi + 0x88]
mov qword [rax], rdi
jmp 0x1400eb9df
mov qword [rsi + 0x80], rdi
mov qword [rdi], 0
mov rcx, rsi
mov qword [rsi + 0x88], rdi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.1400eb750
Function at 0x1400ed590
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
xor edi, edi
mov rbx, rcx
cmp dword [rcx + 0x60], edi
je 0x1400ed640
nop
nop
cmp dword [rbx + 0x7c], edi
mov rcx, qword [rbx + 0x50]
je 0x1400ed5e3
lea rdx, [rbx + 0x10]
lea r8, [rsp + 0x40]
xor r9d, r9d
mov dword [rbx + 0x7c], edi
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
je 0x1400ed682
mov ecx, dword [rsp + 0x40]
add qword [rbx + 0x68], rcx
sub dword [rbx + 0x60], ecx
jmp 0x1400ed637
mov r8d, dword [rbx + 0x60]
mov rdx, qword [rbx + 0x68]
lea rax, [rbx + 0x10]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov dword [rbx + 0x20], edi
mov dword [rbx + 0x24], edi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400ed6a1
mov rdx, qword [rbx + 0x68]
mov r9d, dword [rsp + 0x40]
mov r8d, dword [rbx + 0x60]
sub rdx, qword [rbx + 0x70]
lea rcx, str.read_total:_p__remaining:__u__numread:__u_n
call fcn.1400b35e0
mov r11d, dword [rsp + 0x40]
add qword [rbx + 0x68], r11
sub dword [rbx + 0x60], r11d
cmp dword [rbx + 0x60], edi
jne 0x1400ed5b0
cmp dword [rbx + 0x78], edi
je 0x1400ed6c0
mov rcx, rbx
call fcn.1400ec4d0
mov rcx, qword [rbx + 0x70]
test rcx, rcx
je 0x1400ed65b
call fcn.1400ce0b0
mov ecx, 4
call fcn.1400ce030
mov dword [rbx + 0x60], 4
mov dword [rbx + 0x78], edi
mov qword [rbx + 0x70], rax
mov qword [rbx + 0x68], rax
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e4
jne 0x1400ed707
mov dword [rbx + 0x7c], 1
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x1400ed707
mov dword [rbx + 0x7c], 1
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rbx + 0x70]
mov edi, dword [rcx]
lea eax, [rdi - 8]
cmp eax, 0x7ffff8
ja 0x1400ed707
call fcn.1400ce0b0
mov rcx, rdi
call fcn.1400ce030
mov qword [rbx + 0x70], rax
mov dword [rax], edi
mov rax, qword [rbx + 0x70]
mov dword [rbx + 0x78], 1
add rax, 4
mov qword [rbx + 0x68], rax
lea eax, [rdi - 4]
mov dword [rbx + 0x60], eax
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov dword [rbx + 0x5c], 1
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x1400f2da0
Capabilities:
Log keystrokes

Disassembly:
push rbx
sub rsp, 0x20
cmp ecx, 0x9c47
jg 0x1400f2e21
je 0x1400f2e57
sub ecx, 0x9c41
je 0x1400f2e61
sub ecx, 3
je 0x1400f2e15
sub ecx, 1
je 0x1400f2e02
cmp ecx, 1
jne 0x1400f2e90
call fcn.140125980
test eax, eax
je 0x1400f2e90
call fcn.1400f1c20
test eax, eax
je 0x1400f2e90
xor ecx, ecx
mov byte [0x14020ae3e], 1
add rsp, 0x20
pop rbx
jmp qword [sym.imp.USER32.dll_PostQuitMessage]
movsx edx, byte [0x14020acd2]
xor ecx, ecx
add rsp, 0x20
pop rbx
jmp fcn.14015b020
xor ecx, ecx
add rsp, 0x20
pop rbx
jmp fcn.14011e5a0
sub ecx, 0x9c48
je 0x1400f2e4e
sub ecx, 0x69c
je 0x1400f2e42
cmp ecx, 1
jne 0x1400f2e90
xor ecx, ecx
add rsp, 0x20
pop rbx
jmp fcn.1401068c0
xor ecx, ecx
add rsp, 0x20
pop rbx
jmp fcn.140129f90
call fcn.140100eb0
test eax, eax
jne 0x1400f2e90
call fcn.1401027c0
test rax, rax
jne 0x1400f2e90
mov rcx, qword [0x14020ad20]
mov r8d, 1
xor edx, edx
call fcn.140006770
mov r8d, 1
xor ecx, ecx
mov rdx, rax
mov rbx, rax
call fcn.140104b60
mov rcx, rbx
call fcn.140005de0
add rsp, 0x20
pop rbx
ret