joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140199220
Capabilities:
Create process on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0xa8
mov rsi, rcx
mov rax, qword [0x1401ee038]
xor rax, rsp
mov qword [rsp + 0xa0], rax
movabs r14, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x50]
mov qword [rdi + 0x40], r14
movaps xmm0, xmmword [0x1401c1a60]
movaps xmmword [rdi + 0x30], xmm0
movaps xmmword [rdi + 0x20], xmm0
movaps xmmword [rdi + 0x10], xmm0
movaps xmmword [rdi], xmm0
lea rdx, str.PinShortcutToTaskbar
lea r8, str.....operadesktopchrome_importschromeinstallerutil_taskbar_util.cc
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov r9d, 0x7e
call fcn.1400f6c50
mov rcx, rdi
mov rdx, rbx
xor r8d, r8d
call fcn.1400e9cb0
call fcn.140087740
cmp eax, 0xd
jl 0x14019932c
lea rdi, [rsp + 0x30]
mov qword [rdi], r14
mov rcx, rdi
call fcn.1400a49c0
cmp qword [rdi], 0
je 0x140199328
cmp byte [rsi + 0x17], 0
jns 0x1401992c6
mov rsi, qword [rsi]
mov rcx, rsi
call qword [sym.imp.SHELL32.dll_ILCreateFromPathW]
mov rdi, rax
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
mov rax, qword [rax + 0x80]
xor edx, edx
mov r8, rdi
mov r9d, 4
call qword [0x14021c008]
test eax, eax
setns sil
test rdi, rdi
je 0x140199306
mov rcx, rdi
call qword [sym.imp.SHELL32.dll_ILFree]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140199363
mov qword [rsp + 0x30], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x14021c008]
jmp 0x140199363
xor esi, esi
jmp 0x140199363
cmp byte [rsi + 0x17], 0
jns 0x140199335
mov rsi, qword [rsi]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea rdx, str.taskbarpin
xor ecx, ecx
mov r8, rsi
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp rax, 0x21
setge sil
lea rcx, [rsp + 0x50]
call fcn.1400e9f20
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.14012b460
mov eax, esi
add rsp, 0xa8
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x1401a0ac0
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x1401ee038]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r12, qword [rcx + 0x10]
cmp r12, qword [rcx + 0x18]
je 0x1401a0b21
test r12, r12
je 0x1401a0c38
mov rax, qword [rdi]
mov qword [r12], rax
add qword [rsi + 0x10], 8
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14012b460
nop
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r14, qword [rsi]
mov rbx, qword [rsi + 8]
mov rax, rbx
sub rax, r14
jbe 0x1401a0b86
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
add rax, rcx
inc rax
sar rax, 1
mov r13, rax
neg r13
shl rax, 3
mov r14, rbx
sub r14, rax
mov r15, r12
sub r15, rbx
je 0x1401a0b6f
mov rcx, r14
mov rdx, rbx
mov r8, r15
call fcn.14012dd40
mov r12, qword [rsi + 8]
add r14, r15
mov qword [rsi + 0x10], r14
lea rax, [r12 + r13*8]
mov qword [rsi + 8], rax
mov r12, r14
jmp 0x1401a0aee
mov rax, r12
sub rax, r14
sar rax, 2
cmp r12, r14
mov r15d, 1
cmovne r15, rax
lea rax, [rsi + 0x20]
mov qword [rsp + 0x50], rax
mov rax, r15
shr rax, 0x3d
jne 0x1401a0c64
lea rcx, [r15*8]
call fcn.14012a8b0
mov rdx, r15
and rdx, 0xfffffffffffffffc
mov rcx, r12
sub rcx, rbx
mov r9, r12
lea rdx, [rax + rdx*2]
mov r8, rdx
sub r9, rbx
je 0x1401a0c03
sar rcx, 3
lea r8, [r9 + rdx]
shl rcx, 3
xor r9d, r9d
mov r10, rdx
add r10, r9
je 0x1401a0c38
mov r11, qword [rbx + r9]
mov qword [r10], r11
add r9, 8
cmp rcx, r9
jne 0x1401a0beb
lea r9, [rax + r15*8]
mov qword [rsi], rax
lea rcx, [rsp + 0x30]
mov qword [rcx], r14
mov qword [rsi + 8], rdx
mov qword [rcx + 8], rbx
mov qword [rsi + 0x10], r8
mov qword [rcx + 0x10], r12
mov qword [rsi + 0x18], r9
mov qword [rcx + 0x18], r12
call fcn.1401a0fd0
mov r12, qword [rsi + 0x10]
jmp 0x1401a0aee
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x28
call fcn.140166ee0
call fcn.1401661a0
int3
Function at 0x1401a0c70
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x1401ee038]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, qword [rcx + 8]
cmp rbx, qword [rcx]
je 0x1401a0ccf
mov r15, rbx
add r15, 0xfffffffffffffff8
je 0x1401a0de0
mov rax, qword [rdi]
mov qword [r15], rax
add qword [rsi + 8], 0xfffffffffffffff8
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14012b460
nop
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov r14, qword [rsi + 0x10]
mov r15, qword [rsi + 0x18]
cmp r14, r15
jae 0x1401a0d2a
sub r15, r14
sar r15, 3
lea rax, [r15 + 1]
shr rax, 0x3f
lea r12, [r15 + rax]
inc r12
sar r12, 1
lea r15, [r14 + r12*8]
mov rax, r14
sub rax, rbx
sub r15, rax
sub r14, rbx
je 0x1401a0d19
mov rcx, r15
mov rdx, rbx
mov r8, r14
call fcn.14012dd40
mov rbx, qword [rsi + 0x10]
mov qword [rsi + 8], r15
lea rax, [rbx + r12*8]
mov qword [rsi + 0x10], rax
jmp 0x1401a0c9e
mov rax, r15
sub rax, rbx
sar rax, 2
cmp r15, rbx
mov r12d, 1
cmovne r12, rax
lea rax, [rsi + 0x20]
mov qword [rsp + 0x48], rax
mov rax, r12
shr rax, 0x3d
jne 0x1401a0e0c
lea rcx, [r12*8]
call fcn.14012a8b0
lea rdx, [r12*2 + 6]
and rdx, 0xfffffffffffffff8
add rdx, rax
mov rcx, r14
sub rcx, rbx
mov r9, r14
mov r8, rdx
sub r9, rbx
je 0x1401a0dab
sar rcx, 3
lea r8, [r9 + rdx]
shl rcx, 3
xor r9d, r9d
mov r10, rdx
add r10, r9
je 0x1401a0de0
mov r11, qword [rbx + r9]
mov qword [r10], r11
add r9, 8
cmp rcx, r9
jne 0x1401a0d93
lea r9, [rax + r12*8]
mov qword [rsi], rax
lea rcx, [rsp + 0x28]
mov qword [rcx], rbx
mov qword [rsi + 8], rdx
mov qword [rcx + 8], rbx
mov qword [rsi + 0x10], r8
mov qword [rcx + 0x10], r14
mov qword [rsi + 0x18], r9
mov qword [rcx + 0x18], r15
call fcn.1401a0fd0
mov r15, qword [rsi + 8]
jmp 0x1401a0c9e
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x28
call fcn.140166ee0
call fcn.1401661a0
int3
Function at 0x1401a0e20
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x1401ee038]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, qword [rcx + 8]
cmp rbx, qword [rcx]
je 0x1401a0e7f
mov r15, rbx
add r15, 0xfffffffffffffff8
je 0x1401a0f90
mov rax, qword [rdi]
mov qword [r15], rax
add qword [rsi + 8], 0xfffffffffffffff8
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14012b460
nop
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov r14, qword [rsi + 0x10]
mov r15, qword [rsi + 0x18]
cmp r14, r15
jae 0x1401a0eda
sub r15, r14
sar r15, 3
lea rax, [r15 + 1]
shr rax, 0x3f
lea r12, [r15 + rax]
inc r12
sar r12, 1
lea r15, [r14 + r12*8]
mov rax, r14
sub rax, rbx
sub r15, rax
sub r14, rbx
je 0x1401a0ec9
mov rcx, r15
mov rdx, rbx
mov r8, r14
call fcn.14012dd40
mov rbx, qword [rsi + 0x10]
mov qword [rsi + 8], r15
lea rax, [rbx + r12*8]
mov qword [rsi + 0x10], rax
jmp 0x1401a0e4e
mov rax, r15
sub rax, rbx
sar rax, 2
cmp r15, rbx
mov r12d, 1
cmovne r12, rax
mov rax, qword [rsi + 0x20]
mov qword [rsp + 0x48], rax
mov rax, r12
shr rax, 0x3d
jne 0x1401a0fbc
lea rcx, [r12*8]
call fcn.14012a8b0
lea rdx, [r12*2 + 6]
and rdx, 0xfffffffffffffff8
add rdx, rax
mov rcx, r14
sub rcx, rbx
mov r9, r14
mov r8, rdx
sub r9, rbx
je 0x1401a0f5b
sar rcx, 3
lea r8, [r9 + rdx]
shl rcx, 3
xor r9d, r9d
mov r10, rdx
add r10, r9
je 0x1401a0f90
mov r11, qword [rbx + r9]
mov qword [r10], r11
add r9, 8
cmp rcx, r9
jne 0x1401a0f43
lea r9, [rax + r12*8]
mov qword [rsi], rax
lea rcx, [rsp + 0x28]
mov qword [rcx], rbx
mov qword [rsi + 8], rdx
mov qword [rcx + 8], rbx
mov qword [rsi + 0x10], r8
mov qword [rcx + 0x10], r14
mov qword [rsi + 0x18], r9
mov qword [rcx + 0x18], r15
call fcn.1401a0fd0
mov r15, qword [rsi + 8]
jmp 0x1401a0e4e
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x28
call fcn.140166ee0
call fcn.1401661a0
int3
Function at 0x140001d3e
Capabilities:
Get system information on windows

Disassembly:
jmp 0x1400773d0
sub rsp, 0x58
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
lea rax, [fcn.140001d3e]
test rax, rax
setne al
add rsp, 0x58
ret
Function at 0x140001f23
Capabilities:
Get file size
Move file

Disassembly:
jmp 0x1400741a0
push rbx
sub rsp, 0x180
mov rax, qword [0x1401475c0]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov rbx, rcx
mov rcx, qword [rcx + 0x118]
test rcx, rcx
je 0x140074328
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0x3200000
jb 0x140074328
lea rcx, [rsp + 0x71]
xor edx, edx
mov r8d, 0xff
mov qword [rsp + 0x198], rdi
mov byte [rsp + 0x70], 0
call sub.MSVCR120.dll_memset
xor eax, eax
xor ecx, ecx
mov byte [rsp + 0x58], 0
mov qword [rsp + 0x59], rax
mov qword [rsp + 0x61], rax
mov dword [rsp + 0x69], eax
mov word [rsp + 0x6d], ax
mov byte [rsp + 0x6f], al
call qword [sym.imp.MSVCR120.dll__time64]
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x50], rax
call qword [sym.imp.MSVCR120.dll__localtime64]
lea r8, str.__d__02d__02d__02d__02d__02d.txt
mov ecx, dword [rax]
mov edx, dword [rax + 0x10]
mov r9d, dword [rax + 0x14]
mov dword [rsp + 0x40], ecx
mov ecx, dword [rax + 4]
inc edx
mov dword [rsp + 0x38], ecx
mov ecx, dword [rax + 8]
mov eax, dword [rax + 0xc]
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], edx
lea rcx, [rsp + 0x58]
mov edx, reloc.WS2_32.dll_socket
add r9d, 0x76c
call qword [sym.imp.MSVCR120.dll__snprintf]
movzx eax, byte [rbx + 0xd]
lea rdx, [rsp + 0x70]
test al, al
je 0x1400742a6
lea r8, [rsp + 0x70]
mov rcx, rbx
sub rcx, r8
cmp al, 0x2e
je 0x1400742a6
mov byte [rdx], al
movzx eax, byte [rcx + rdx + 0xe]
inc rdx
test al, al
jne 0x140074294
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x70]
mov r8d, 0xff
call qword [sym.imp.MSVCR120.dll_strncat]
mov rcx, qword [rbx + 0x118]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x70]
lea rcx, [rbx + 0xd]
mov qword [rbx + 0x118], 0
call qword [sym.imp.MSVCR120.dll_rename]
xor r9d, r9d
mov qword [rsp + 0x30], 0
lea rcx, [rbx + 0xd]
lea r8d, [r9 + 1]
mov edx, 0xc0000000
mov dword [rsp + 0x28], 0x80
mov dword [rbx + 8], 0
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, qword [rsp + 0x198]
mov qword [rbx + 0x118], rax
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1400bcf10
add rsp, 0x180
pop rbx
ret
Function at 0x140002405
Capabilities:
Get common file path

Disassembly:
jmp 0x140076c50
mov rax, rsp
push rdi
sub rsp, 0x270
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x1401475c0]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rdi, rdx
mov rsi, rcx
mov qword [rsp + 0x40], rcx
xor ebx, ebx
mov dword [rsp + 0x30], ebx
mov qword [rcx + 0x18], 7
mov qword [rcx + 0x10], rbx
mov word [rcx], bx
mov dword [rsp + 0x30], 1
mov word [rsp + 0x50], bx
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x52]
call sub.MSVCR120.dll_memset
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [rbx + 0x2e]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x140076d7c
cmp word [rsp + 0x50], ax
jne 0x140076cec
mov r8d, ebx
jmp 0x140076d00
lea rax, [rsp + 0x50]
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x140076cf5
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.14000219e
mov r8d, 1
lea rdx, [0x1400ce800]
mov rcx, rsi
call fcn.140003724
cmp qword [rdi + 0x10], 0
je 0x140076d52
cmp qword [rdi + 0x18], 8
jb 0x140076d33
mov rdi, qword [rdi]
cmp word [rdi], 0
je 0x140076d4a
or rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp word [rdi + rbx*2], 0
jne 0x140076d40
mov r8, rbx
mov rdx, rdi
jmp 0x140076d5f
mov r8d, ntohl
lea rdx, [0x1400ce808]
mov rcx, rsi
call fcn.140003724
mov r8d, 1
lea rdx, [0x1400ce800]
mov rcx, rsi
call fcn.140003724
mov rax, rsi
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1400bcf10
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140002dab
Capabilities:
Get common file path

Disassembly:
jmp 0x140080bb0
push rbx
push rsi
push rdi
sub rsp, 0x180
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rax, qword [0x1401475c0]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
cmp byte [rcx + 0x10], 0
jne 0x140080d0e
mov byte [rsp + 0x60], 0
xor edx, edx
mov r8d, 0x103
lea rcx, [rsp + 0x61]
call sub.MSVCR120.dll_memset
lea rdx, [rsp + 0x60]
mov ecx, 0x103
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
movsxd rcx, eax
cmp byte [rsp + rcx + 0x5f], 0x5c
je 0x140080c35
lea rax, [rsp + 0x60]
dec rax
lea rax, [rax + 1]
cmp byte [rax], 0
jne 0x140080c22
movzx ecx, word [0x1400cf658]
mov word [rax], cx
mov qword [rsp + 0x50], reloc.WS2_32.dll_ntohs
xor r8d, r8d
mov qword [rsp + 0x48], r8
mov byte [rsp + 0x38], r8b
cmp byte [rsp + 0x60], r8b
je 0x140080c6a
lea rax, [rsp + 0x60]
or r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140080c60
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x38]
call fcn.140001415
nop
mov r8d, reloc.WS2_32.dll_ntohs
lea rdx, str.upgrade_sensors
lea rcx, [rsp + 0x38]
call fcn.140002b1c
mov dword [rsp + 0x20], 0x64
mov r9b, 1
mov r8, rdi
mov rdx, rsi
lea rcx, [rsp + 0x38]
call fcn.140001b36
mov byte [rbx + 0x10], al
call fcn.140003a8f
mov r10, qword [rax]
movzx edx, byte [rbx + 0x10]
mov dword [rsp + 0x28], edx
lea rdx, str.sensors_init_result__d_.
mov qword [rsp + 0x20], rdx
mov r9d, reloc.WLDAP32.dll_Ordinal_32
lea r8, str.CSensorsCollector::Init
lea rdx, str.DataCollectorSensorsCollector.cpp
mov rcx, rax
call qword [r10 + reloc.WS2_32.dll_recv]
cmp byte [rbx + 0x10], 0
je 0x140080cfc
xor ecx, ecx
call fcn.140001a96
mov rcx, rbx
call fcn.140003076
nop
cmp qword [rsp + 0x50], 0x10
jb 0x140080d0e
mov rcx, qword [rsp + 0x38]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1400bcf10
add rsp, 0x180
pop rdi
pop rsi
pop rbx
ret

Function at 0x140003053
Capabilities:
Check os version

Disassembly:
jmp 0x1400b3190
push rbx
sub rsp, 0x150
mov rax, qword [0x1401475c0]
xor rax, rsp
mov qword [rsp + 0x140], rax
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x114
xor ebx, ebx
call sub.MSVCR120.dll_memset
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x1400b31e3
cmp dword [rsp + 0x24], 6
mov eax, 1
cmovae ebx, eax
mov eax, ebx
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400bcf10
add rsp, 0x150
pop rbx
ret
Function at 0x14000daa0
Capabilities:
Get common file path

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
lea rcx, str.kernel32
xor esi, esi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdi, rax
test rax, rax
jne 0x14000daca
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret
lea rdx, str.LoadLibraryExA
mov rcx, rax
mov qword [rsp + 0x40], rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x140117e58]
mov rcx, rbx
mov rbp, rax
call sub.MSVCR120.dll_strpbrk
test rax, rax
je 0x14000db2c
mov rcx, rbx
test rbp, rbp
je 0x14000db16
xor edx, edx
lea r8d, [rdx + 8]
call rbp
mov rbp, qword [rsp + 0x40]
mov rsi, rax
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbp, qword [rsp + 0x40]
mov rsi, rax
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret
test rbp, rbp
je 0x14000db63
lea rdx, str.AddDllDirectory
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000db63
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call rbp
mov rbp, qword [rsp + 0x40]
mov rsi, rax
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x50], r13
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov r13d, eax
test eax, eax
je 0x14000dc27
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasb al, byte [rdi]
mov qword [rsp + 0x48], r12
not rcx
lea rax, [rcx - 1]
lea ecx, [r13 + 1]
add rcx, rax
call qword [sub.MSVCR120.dll_malloc]
mov r12, rax
test rax, rax
je 0x14000dc19
mov edx, r13d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x14000dc19
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r12
repne scasb al, byte [rdi]
mov eax, 0x5c
mov rdi, r12
not rcx
mov word [rcx + r12 - 1], ax
or rcx, 0xffffffffffffffff
xor eax, eax
repne scasb al, byte [rdi]
not rcx
lea rdx, [rcx - 1]
add rdx, r12
sub rdx, rbx
nop word [rax + rax]
movzx eax, byte [rbx]
inc rbx
mov byte [rdx + rbx - 1], al
test al, al
jne 0x14000dbf0
mov rcx, r12
test rbp, rbp
je 0x14000dc10
xor edx, edx
lea r8d, [rdx + 8]
call rbp
jmp 0x14000dc16
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
mov rcx, r12
call qword [sub.MSVCR120.dll_free]
mov r12, qword [rsp + 0x48]
mov r13, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x40]
mov rax, rsi
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret
Function at 0x14000dc40
Capabilities:
Initialize winsock library

Disassembly:
sub rsp, 0x1c8
test cl, 2
je 0x14000dc84
lea rdx, [rsp + 0x20]
mov ecx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x14000dc77
movzx eax, word [rsp + 0x20]
cmp al, 2
jne 0x14000dc71
shr ax, 8
cmp al, 2
je 0x14000dc84
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 2
add rsp, 0x1c8
ret
call fcn.140025420
test eax, eax
jne 0x14000dcf8
lea rcx, str.iphlpapi.dll
call fcn.14000daa0
mov qword [0x140148990], rax
test rax, rax
je 0x14000dcca
lea rdx, str.if_nametoindex
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140148998]
test rax, rax
cmovne rcx, rax
mov qword [0x140148998], rcx
xor edx, edx
lea r9d, [rdx + 3]
lea r8d, [rdx + 2]
lea ecx, [rdx + 6]
call fcn.140025670
xor ecx, ecx
test eax, eax
setne cl
mov dword [0x14014915c], ecx
lea rcx, [0x140149148]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xor eax, eax
add rsp, 0x1c8
ret
Function at 0x140018d60
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, r9
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recv]
movsxd rcx, eax
cmp rcx, 0xffffffffffffffff
jne 0x140018da7
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
xor ecx, ecx
mov edx, 0x51
cmp eax, 0x2733
mov eax, gethostname
mov qword [rbx], 0
sete cl
test ecx, ecx
cmovne eax, edx
add rsp, 0x20
pop rbx
ret
mov qword [rbx], rcx
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x140018e50
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp dword [rcx + 0x1030], 0
mov rsi, r9
mov rbp, r8
movsxd rbx, edx
mov rdi, rcx
je 0x140018f02
cmp qword [rcx + 0x720], 0
je 0x140018ebe
mov edx, 1
call fcn.140016590
mov r11, qword [rdi + 0x678]
mov r9, rsi
mov r8, rbp
mov edx, ebx
mov rcx, rdi
mov qword [rsp + 0x20], r11
call qword [rdi + 0x720]
xor edx, edx
mov rcx, rdi
mov ebx, eax
call fcn.140016590
mov eax, ebx
jmp 0x140018f04
test edx, edx
js 0x140018f02
cmp ebx, 2
jg 0x140018f02
mov r9, qword [rdi + 0x670]
lea rdx, [0x140118bd8]
lea rcx, [rbx + rbx*2]
add rcx, rdx
mov edx, 2
lea r8d, [rdx - 1]
call sub.MSVCR120.dll_fwrite
mov r9, qword [rdi + 0x670]
mov r8d, 1
mov rdx, rsi
mov rcx, rbp
call sub.MSVCR120.dll_fwrite
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x140018f20
Capabilities:
Write file on windows

Disassembly:
test rcx, rcx
je 0x14001906f
mov rax, rsp
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], r8
mov qword [rax + 0x20], r9
push rbx
sub rsp, 0x850
cmp dword [rcx + 0x1030], 0
mov rbx, rcx
je 0x140019067
mov r8, rdx
lea r9, [rax + 0x18]
lea rcx, [rsp + 0x30]
mov edx, 0x801
mov qword [rax - 0x10], rdi
call fcn.14000c1f0
cmp eax, 0x801
jb 0x140018fbb
mov rdx, qword [rsp + 0x868]
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
cmp byte [rcx + rdx - 2], 0xa
jne 0x140018fa2
lea r8, str...._n
lea edx, [rax + 5]
lea rcx, [rsp + 0x82c]
jmp 0x140018fb6
lea r8, [0x140118bf0]
mov edx, 4
lea rcx, [rsp + 0x82d]
call fcn.14000c260
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x30]
repne scasb al, byte [rdi]
not rcx
lea rdi, [rcx - 1]
cmp dword [rbx + 0x1030], eax
je 0x14001905f
cmp qword [rbx + 0x720], rax
je 0x140019029
lea edx, [rax + 1]
mov rcx, rbx
call fcn.140016590
mov rdx, qword [rbx + 0x678]
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rdx
mov r9, rdi
mov rcx, rbx
xor edx, edx
call qword [rbx + 0x720]
xor edx, edx
mov rcx, rbx
call fcn.140016590
mov rdi, qword [rsp + 0x848]
add rsp, 0x850
pop rbx
ret
mov r9, qword [rbx + 0x670]
mov edx, 2
lea rcx, [0x140118bd8]
lea r8d, [rdx - 1]
call sub.MSVCR120.dll_fwrite
mov r9, qword [rbx + 0x670]
lea rcx, [rsp + 0x30]
mov r8d, 1
mov rdx, rdi
call sub.MSVCR120.dll_fwrite
mov rdi, qword [rsp + 0x848]
add rsp, 0x850
pop rbx
repz ret
Function at 0x140019080
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
sub rsp, 0x150
cmp dword [rcx + 0x1030], 0
mov rbx, rcx
jne 0x1400190b1
cmp qword [rcx + 0x680], 0
je 0x1400191bd
mov r8, rdx
lea r9, [rsp + 0x170]
lea rcx, [rsp + 0x30]
mov edx, 0x100
mov qword [rsp + 0x148], rdi
call fcn.14000c1f0
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x30]
repne scasb al, byte [rdi]
not rcx
lea rdi, [rcx - 1]
mov rcx, qword [rbx + 0x680]
test rcx, rcx
je 0x14001911a
cmp dword [rbx + 0x181c], eax
jne 0x14001911a
lea rdx, [rsp + 0x30]
movzx eax, byte [rdx]
inc rcx
inc rdx
mov byte [rcx - 1], al
test al, al
jne 0x140019100
mov dword [rbx + 0x181c], 1
cmp dword [rbx + 0x1030], 0
mov byte [rsp + rdi + 0x30], 0xa
je 0x1400191b5
cmp qword [rbx + 0x720], 0
je 0x14001917e
mov edx, 1
mov rcx, rbx
call fcn.140016590
mov rdx, qword [rbx + 0x678]
lea r9, [rdi + 1]
mov qword [rsp + 0x20], rdx
lea r8, [rsp + 0x30]
mov rcx, rbx
xor edx, edx
call qword [rbx + 0x720]
xor edx, edx
mov rcx, rbx
call fcn.140016590
mov rdi, qword [rsp + 0x148]
add rsp, 0x150
pop rbx
ret
mov r9, qword [rbx + 0x670]
mov edx, 2
lea rcx, [0x140118bd8]
lea r8d, [rdx - 1]
call sub.MSVCR120.dll_fwrite
mov r9, qword [rbx + 0x670]
lea rdx, [rdi + 1]
lea rcx, [rsp + 0x30]
mov r8d, 1
call sub.MSVCR120.dll_fwrite
mov rdi, qword [rsp + 0x148]
add rsp, 0x150
pop rbx
ret

Function at 0x1400194d0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
movsxd rcx, edx
mov rax, qword [rbx + 0x748]
mov rbp, qword [rbx + rcx*8 + 0x4c0]
mov rdi, rcx
shl rdi, 5
mov rsi, qword [rdi + rbx + 0x510]
sub rsi, qword [rdi + rbx + 0x518]
test byte [rax + 0x7c], 3
je 0x1400195e9
lea rax, [0x1400191d0]
cmp qword [rbx + rcx*8 + 0x4e8], rax
jne 0x1400195e9
cmp qword [rdi + rbx + 0x508], 0
je 0x140019543
test rsi, rsi
je 0x1400195e9
or r8, 0xffffffffffffffff
xor r9d, r9d
mov rcx, rbp
or rdx, r8
call fcn.1400463c0
cmp eax, 0xffffffff
je 0x1400195e9
test al, 1
je 0x1400195e9
cmp qword [rdi + rbx + 0x508], 0
jne 0x1400195bb
mov rax, qword [rbx]
mov ecx, dword [rax + 0xbe8]
add ecx, ecx
movsxd rcx, ecx
mov qword [rdi + rbx + 0x510], rcx
call qword [sub.MSVCR120.dll_malloc]
mov qword [rdi + rbx + 0x508], rax
test rax, rax
jne 0x1400195a1
mov eax, reloc.WLDAP32.dll_Ordinal_27
jmp 0x1400195eb
mov rsi, qword [rdi + rbx + 0x510]
xor eax, eax
mov qword [rdi + rbx + 0x518], rax
mov qword [rdi + rbx + 0x520], rax
mov rdx, qword [rdi + rbx + 0x508]
xor r9d, r9d
mov r8d, esi
add rdx, qword [rdi + rbx + 0x518]
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_recv]
movsxd rcx, eax
test eax, eax
jle 0x1400195e9
add qword [rdi + rbx + 0x518], rcx
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret