joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400319c0
Capabilities:
Get hostname

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x150
mov rax, qword [0x1400ec008]
xor rax, rsp
mov qword [rsp + 0x140], rax
xor esi, esi
mov dword [rsp + 0x20], 0x11c
mov rdi, rdx
mov qword [rsp + 0x24], rsi
mov rbx, rcx
mov qword [rsp + 0x2c], rsi
xor edx, edx
mov word [rsp + 0x34], si
lea rcx, [rsp + 0x36]
mov r8d, 0xfe
call fcn.14007a110
mov r8b, 3
mov qword [rsp + 0x134], rsi
lea edx, [rsi + 2]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov r8b, 3
lea edx, [rsi + 1]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov r8b, 3
lea edx, [rsi + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
lea edx, [rsi + 0x23]
mov dword [rsp + 0x24], 6
mov r8, rax
mov dword [rsp + 0x28], 2
lea rcx, [rsp + 0x20]
mov word [rsp + 0x134], si
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov edx, edi
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_gethostname]
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.140078840
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140031b10
Capabilities:
Resolve dns

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x20
xor r12d, r12d
mov r15, r9
mov qword [rsp + 0x50], r12
mov rdi, r8
mov qword [r9], r12
mov rbx, rdx
mov r14d, r12d
mov ebp, r12d
test rcx, rcx
je 0x140031b56
call fcn.140033fd0
mov r14, rax
test rax, rax
je 0x140031c80
test rbx, rbx
je 0x140031b6f
mov rcx, rbx
call fcn.140033fd0
mov rbp, rax
test rax, rax
je 0x140031c80
lea r9, [rsp + 0x50]
mov r8, rdi
mov rdx, rbp
mov rcx, r14
call qword [sym.imp.WS2_32.dll_GetAddrInfoW]
mov esi, eax
test eax, eax
jne 0x140031c85
lea rbx, [rsp + 0x50]
mov rdi, r15
cmp qword [rsp + 0x50], r12
je 0x140031c85
mov ecx, 0x30
call fcn.140088334
mov qword [rdi], rax
test rax, rax
je 0x140031c80
mov rcx, qword [rbx]
test rcx, rcx
je 0x140031c59
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
mov rax, qword [rdi]
mov qword [rax + 0x28], r12
mov rax, qword [rbx]
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x140031c00
call fcn.140034090
mov rcx, qword [rdi]
mov qword [rcx + 0x18], rax
test rax, rax
je 0x140031c80
mov rax, qword [rbx]
mov rcx, qword [rax + 0x10]
test rcx, rcx
je 0x140031c1d
call fcn.140088334
mov rcx, qword [rdi]
mov qword [rcx + 0x20], rax
test rax, rax
je 0x140031c80
mov r8, qword [rbx]
mov rdx, qword [r8 + 0x10]
test rdx, rdx
je 0x140031c40
mov rcx, qword [rdi]
mov r9, rdx
mov r8, qword [r8 + 0x20]
mov rcx, qword [rcx + 0x20]
call fcn.140028eb0
test eax, eax
jne 0x140031c80
mov rbx, qword [rbx]
mov rdi, qword [rdi]
add rbx, 0x28
add rdi, 0x28
cmp qword [rbx], r12
jne 0x140031ba0
jmp 0x140031c85
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], rcx
mov qword [rax + 0x20], rcx
mov qword [rax + 0x28], rcx
call fcn.140084fc0
mov dword [rax], reloc.WS2_32.dll_shutdown
call fcn.140088550
mov esi, 8
test r14, r14
je 0x140031c92
mov rcx, r14
call fcn.14007a8b4
test rbp, rbp
je 0x140031c9f
mov rcx, rbp
call fcn.14007a8b4
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140031caf
call qword [sym.imp.WS2_32.dll_FreeAddrInfoW]
test esi, esi
je 0x140031cc3
mov rcx, qword [r15]
test rcx, rcx
je 0x140031cc3
call fcn.140031ab0
mov qword [r15], r12
mov rbx, qword [rsp + 0x58]
mov eax, esi
mov rbp, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x140031f20
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov edi, edx
mov ebx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp ebx, eax
jne 0x140031f49
mov ecx, edi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140033a70
mov edx, dword [0x140112160]
xor eax, eax
test edx, edx
jle 0x140031f96
lea rcx, [0x140111960]
nop dword [rax]
cmp dword [rcx], ebx
je 0x140031f7b
inc eax
add rcx, 4
cmp eax, edx
jl 0x140031f60
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
cmp eax, 0xffffffff
je 0x140031f96
movsxd rcx, eax
xor edx, edx
lea rax, [0x140110960]
mov rcx, qword [rax + rcx*8]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140032180
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rsi
push rbp
push r14
push r15
lea rbp, [rsp - 0xffa0]
mov eax, 0x100a0
call fcn.14009f8b0
sub rsp, rax
mov rax, qword [0x1400ec008]
xor rax, rsp
mov qword [rbp + 0xff90], rax
xor r15d, r15d
or esi, 0xffffffff
mov qword [rsp + 0x38], r15
mov r14d, r15d
call fcn.140084fc0
cmp qword [0x1400eeed0], r15
mov dword [rax], r15d
je 0x1400321d6
xor eax, eax
jmp 0x1400323c6
lea rax, [rsp + 0x38]
mov qword [rsp + 0x100c0], rbx
mov r9d, 0x20101
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov word [rbp - 0x70], r15w
lea rdx, str.SOFTWAREOpenSSH
mov word [rsp + 0x50], r15w
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x30], 0x8000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400322ea
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rdx, str.DefaultShell
lea rax, [rbp - 0x70]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400322ea
cmp word [rbp - 0x70], r14w
je 0x1400322ea
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rdx, str.DefaultShellCommandOption
lea rax, [rsp + 0x50]
mov dword [rsp + 0x30], 0x20
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x40], 4
mov dword [rsp + 0x34], 1
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1400322ac
mov word [rsp + 0x50], r15w
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rdx, str.DefaultShellEscapeArguments
lea rax, [rsp + 0x34]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14003232f
cmp dword [rsp + 0x34], r14d
setne byte [0x1400ed440]
jmp 0x14003232f
mov edx, 0x8000
lea rcx, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x140032312
call fcn.140084fc0
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx], eax
jmp 0x1400323bc
lea r8, str.cmd.exe
mov edx, 0x8000
lea rcx, [rbp - 0x70]
call fcn.140088654
test eax, eax
jne 0x1400323bc
lea rcx, [rbp - 0x70]
mov qword [rsp + 0x100c8], rdi
call fcn.140034090
mov rdi, rax
test rax, rax
je 0x1400323b4
cmp word [rsp + 0x50], r14w
je 0x14003236c
lea rcx, [rsp + 0x50]
call fcn.140034090
mov r14, rax
test rax, rax
jne 0x14003236c
mov rcx, rdi
call fcn.14007a8b4
jmp 0x1400323b4
mov rax, rdi
cmp byte [rdi], r15b
je 0x140032384
cmp byte [rax], 0x2f
jne 0x14003237c
mov byte [rax], 0x5c
inc rax
cmp byte [rax], r15b
jne 0x140032374
mov rbx, rdi
cmp byte [rdi], r15b
je 0x1400323a3
nop dword [rax]
movzx ecx, byte [rbx]
call fcn.14008a014
mov byte [rbx], al
lea rbx, [rbx + 1]
cmp byte [rbx], r15b
jne 0x140032390
mov qword [0x1400eeed0], rdi
mov esi, r15d
mov qword [0x1400eeec8], r14
mov rdi, qword [rsp + 0x100c8]
mov rbx, qword [rsp + 0x100c0]
mov eax, esi
mov rcx, qword [rbp + 0xff90]
xor rcx, rsp
call fcn.140078840
mov rsi, qword [rsp + 0x100d0]
add rsp, 0x100a0
pop r15
pop r14
pop rbp
ret
Function at 0x140032950
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
mov eax, 0x10050
call fcn.14009f8b0
sub rsp, rax
mov rax, qword [0x1400ec008]
xor rax, rsp
mov qword [rsp + 0x10040], rax
mov rbx, rcx
mov edx, 0x8000
lea rcx, [rsp + 0x40]
xor ebp, ebp
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
jne 0x1400329b4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.GetWindowsDirectoryW_failed_with__d
call fcn.140046c70
call fcn.140084fc0
mov dword [rax], 0x83
mov eax, ebp
jmp 0x140032a98
mov qword [rsp + 0x10068], rsi
mov rcx, rbx
mov qword [rsp + 0x10070], rdi
call fcn.14007a83c
mov qword [rsp + 0x38], rbp
lea r8, [rsp + 0x40]
mov qword [rsp + 0x30], rbp
or r9d, 0xffffffff
mov dword [rsp + 0x28], ebp
xor edx, edx
mov ecx, 0xfde9
mov qword [rsp + 0x20], rbp
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rsi, eax
test eax, eax
je 0x140032a3c
mov rcx, rsi
call fcn.140088334
mov rbx, rax
test rax, rax
je 0x140032a3c
mov qword [rsp + 0x38], rbp
lea r8, [rsp + 0x40]
mov qword [rsp + 0x30], rbp
or r9d, 0xffffffff
mov dword [rsp + 0x28], esi
xor edx, edx
mov ecx, 0xfde9
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x140032a3f
mov rbx, rbp
mov rsi, qword [rsp + 0x10068]
test rdi, rdi
je 0x140032a68
test rbx, rbx
je 0x140032a68
mov qword [0x14010fde0], rdi
lea rax, [0x14010fde0]
mov qword [0x14010fe00], rbx
jmp 0x140032a90
call fcn.140084fc0
mov dword [rax], reloc.WS2_32.dll_inet_ntoa
test rdi, rdi
je 0x140032a80
mov rcx, rdi
call fcn.14007a8b4
test rbx, rbx
je 0x140032a8d
mov rcx, rbx
call fcn.14007a8b4
mov rax, rbp
mov rdi, qword [rsp + 0x10070]
mov rcx, qword [rsp + 0x10040]
xor rcx, rsp
call fcn.140078840
mov rbx, qword [rsp + 0x10078]
add rsp, 0x10050
pop rbp
ret
Function at 0x140035180
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx + 0x40], 0
mov esi, edx
mov rdi, rcx
mov ebx, 0x19000
jne 0x1400351cf
mov ecx, ebx
call fcn.140088334
mov qword [rdi + 0x40], rax
test rax, rax
jne 0x1400351cf
call fcn.140084fc0
mov ebx, reloc.WS2_32.dll_inet_ntoa
mov dword [rax], ebx
or eax, 0xffffffff
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rdi + 0x90]
call qword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
jne 0x1400351e6
cmp esi, ebx
cmovb ebx, esi
mov rdx, qword [rdi + 0x40]
lea rax, [0x140035160]
mov rcx, qword [rdi + 0x90]
mov r9, rdi
mov r8d, ebx
mov qword [rsp + 0x20], rax
mov dword [rdi + 0x48], ebx
call qword [sym.imp.KERNEL32.dll_ReadFileEx]
test eax, eax
je 0x140035229
mov dword [rdi + 0x54], 1
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp eax, 0xe
jg 0x140035259
je 0x140035252
cmp eax, 1
je 0x14003524b
jle 0x14003527d
cmp eax, 3
jle 0x140035271
cmp eax, 5
je 0x14003526a
jmp 0x14003527d
mov ebx, 0x82
jmp 0x14003527d
mov ebx, reloc.WS2_32.dll_inet_ntoa
jmp 0x14003527d
cmp eax, 0x50
je 0x140035278
cmp eax, 0x7b
je 0x140035271
cmp eax, 0x522
jne 0x14003527d
mov ebx, reloc.WS2_32.dll_listen
jmp 0x14003527d
mov ebx, 2
jmp 0x14003527d
mov ebx, setsockopt
call fcn.140084fc0
mov dword [rax], ebx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, rdi
lea rcx, str.ReadFileEx___ERROR:_d__io:_p
mov edx, eax
call fcn.140046c70
mov rbx, qword [rsp + 0x40]
or eax, 0xffffffff
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x140036e80
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
cmp dword [rcx + 0x48], 0
mov rdi, rcx
jne 0x140036ec7
mov ecx, 0x800
call fcn.140088334
mov qword [rdi + 0x40], rax
test rax, rax
jne 0x140036ec0
call fcn.140084fc0
mov ebx, reloc.WS2_32.dll_inet_ntoa
mov dword [rax], ebx
or eax, 0xffffffff
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov dword [rdi + 0x48], 0x800
xor eax, eax
lea r8, [0x140036c90]
mov qword [rsp + 0x28], rax
mov r9, rdi
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call fcn.14008ca3c
test rax, rax
jne 0x140036f6e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp eax, 0xe
jg 0x140036f1e
je 0x140036f17
cmp eax, 1
je 0x140036f10
jle 0x140036f42
cmp eax, 3
jle 0x140036f36
cmp eax, 5
je 0x140036f2f
jmp 0x140036f42
mov ebx, 0x82
jmp 0x140036f42
mov ebx, reloc.WS2_32.dll_inet_ntoa
jmp 0x140036f42
cmp eax, 0x50
je 0x140036f3d
cmp eax, 0x7b
je 0x140036f36
cmp eax, 0x522
jne 0x140036f42
mov ebx, reloc.WS2_32.dll_listen
jmp 0x140036f42
mov ebx, 2
jmp 0x140036f42
mov ebx, setsockopt
call fcn.140084fc0
mov dword [rax], ebx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, rdi
lea rcx, str.TermRead_initiate___ERROR__beginthreadex__d__io:_p
mov edx, eax
call fcn.140046c70
or eax, 0xffffffff
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x40]
mov qword [rdi + 0x18], rax
xor eax, eax
mov dword [rdi + 0x54], 1
add rsp, 0x30
pop rdi
ret

Function at 0x140037130
Capabilities:
Create thread

Disassembly:
push rdi
sub rsp, 0x30
xor eax, eax
lea r8, [0x140036fe0]
mov qword [rcx + 0xa4], rax
mov rdi, rcx
mov dword [rcx + 0xac], eax
mov r9, rcx
mov dword [rcx + 0xa4], edx
xor edx, edx
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov dword [rsp + 0x20], eax
call fcn.14008ca3c
test rax, rax
jne 0x1400371f8
mov qword [rsp + 0x40], rbx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp eax, 0xe
jg 0x1400371a8
je 0x1400371a1
cmp eax, 1
je 0x14003719a
jle 0x1400371cc
cmp eax, 3
jle 0x1400371c0
cmp eax, 5
je 0x1400371b9
jmp 0x1400371cc
mov ebx, 0x82
jmp 0x1400371cc
mov ebx, reloc.WS2_32.dll_inet_ntoa
jmp 0x1400371cc
cmp eax, 0x50
je 0x1400371c7
cmp eax, 0x7b
je 0x1400371c0
cmp eax, 0x522
jne 0x1400371cc
mov ebx, reloc.WS2_32.dll_listen
jmp 0x1400371cc
mov ebx, 2
jmp 0x1400371cc
mov ebx, setsockopt
call fcn.140084fc0
mov dword [rax], ebx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, rdi
lea rcx, str.syncio_initiate_write_initiate___ERROR__beginthreadex__d__io:_p
mov edx, eax
call fcn.140046c70
mov rbx, qword [rsp + 0x40]
or eax, 0xffffffff
add rsp, 0x30
pop rdi
ret
mov qword [rdi + 0x38], rax
xor eax, eax
mov dword [rdi + 0x74], 1
add rsp, 0x30
pop rdi
ret
Function at 0x140038260
Capabilities:
Manipulate console buffer

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x1400ec008]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov edi, edx
mov ebx, ecx
call fcn.140037410
mov rcx, rax
lea rdx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
je 0x140038301
movsx ecx, word [rsp + 0x2a]
mov word [rsp + 0x20], bx
mov word [rsp + 0x22], di
lea eax, [rcx - 1]
cmp edi, eax
jle 0x1400382d0
mov edx, dword [0x1401108ac]
cmp edi, edx
jle 0x1400382d0
cmp edx, edi
jge 0x1400382d0
mov ebx, edi
sub ebx, edx
nop dword [rax]
call fcn.14003c570
sub rbx, 1
jne 0x1400382c0
movzx ecx, word [rsp + 0x2a]
movsx eax, cx
cmp edi, eax
jl 0x1400382df
dec cx
mov word [rsp + 0x22], cx
call fcn.140037410
mov edx, dword [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
test eax, eax
jne 0x1400382fb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x1401108ac], edi
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140078840
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret

Function at 0x140038470
Capabilities:
Manipulate console buffer

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x1400ec008]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov edi, edx
mov ebx, ecx
call fcn.140037410
mov rcx, rax
lea rdx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
je 0x1400384ca
add bx, word [rsp + 0x2c]
add di, word [rsp + 0x2e]
mov word [rsp + 0x20], bx
mov word [rsp + 0x22], di
call fcn.140037410
mov edx, dword [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140078840
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret

Function at 0x1400384f0
Capabilities:
Manipulate console buffer

Disassembly:
push rdi
sub rsp, 0x470
mov rax, qword [0x1400ec008]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov edi, ecx
call fcn.140037410
mov rcx, rax
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
je 0x1400385ef
mov qword [rsp + 0x488], rbx
movzx ebx, word [rsp + 0x44]
mov qword [rsp + 0x490], rbp
mov qword [rsp + 0x498], rsi
mov dword [rsp + 0x30], 0x10100
lea eax, [rbx + rdi]
mov word [rsp + 0x38], ax
movzx eax, word [rsp + 0x46]
mov word [rsp + 0x3a], ax
mov word [rsp + 0x3e], ax
movzx eax, word [rsp + 0x4e]
mov word [rsp + 0x3c], ax
call fcn.140037410
mov r9d, dword [0x1400fef90]
lea rdx, [rsp + 0x60]
mov r8d, dword [rsp + 0x30]
mov rcx, rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadConsoleOutputA]
call fcn.140037bf0
sub word [rsp + 0x3c], di
mov word [rsp + 0x38], bx
mov dword [rsp + 0x30], 0x10100
call fcn.140037410
mov r9d, dword [0x1400fef90]
lea rdx, [rsp + 0x60]
mov r8d, dword [rsp + 0x30]
mov rcx, rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteConsoleOutputA]
mov rsi, qword [rsp + 0x498]
mov rbp, qword [rsp + 0x490]
mov rbx, qword [rsp + 0x488]
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.140078840
add rsp, 0x470
pop rdi
ret
Function at 0x140038740
Capabilities:
Manipulate console buffer

Disassembly:
push r14
sub rsp, 0x60
mov rax, qword [0x1400ec008]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov r14, qword [0x1400fef88]
xor eax, eax
mov dword [rsp + 0x30], eax
call fcn.140037410
test rax, rax
jne 0x140038782
xor eax, eax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140078840
add rsp, 0x60
pop r14
ret
call fcn.140037410
mov rcx, rax
lea rdx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
je 0x14003876c
movsx edx, word [rsp + 0x42]
movsx eax, word [rsp + 0x44]
movsx ecx, word [rsp + 0x46]
mov qword [rsp + 0x70], rbx
sub ecx, edx
mov qword [rsp + 0x78], rsi
inc ecx
movsx esi, word [rsp + 0x48]
sub esi, eax
mov qword [rsp + 0x80], rdi
inc esi
mov word [rsp + 0x30], dx
imul esi, ecx
mov word [rsp + 0x32], ax
call fcn.140037410
mov r9d, dword [rsp + 0x30]
mov rcx, rax
lea rax, [rsp + 0x34]
mov r8d, esi
mov dl, 0x20
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterA]
mov rdi, qword [r14]
call fcn.140037410
movzx edx, word [rdi + 2]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
call fcn.140037410
mov r9d, dword [rsp + 0x30]
mov rcx, rax
movzx edx, word [rdi + 2]
lea rax, [rsp + 0x34]
mov r8d, esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_FillConsoleOutputAttribute]
call fcn.140037410
mov r9d, dword [0x1400fef90]
mov rcx, rax
mov r8d, dword [r14 + 8]
lea rax, [rsp + 0x42]
mov rdx, qword [r14]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteConsoleOutputA]
mov edi, eax
call fcn.140037410
mov rcx, rax
lea r8, [r14 + 0x10]
mov edx, 1
call qword [sym.imp.KERNEL32.dll_SetConsoleWindowInfo]
movsx edx, word [r14 + 0xe]
movsx ecx, word [r14 + 0xc]
call fcn.140038260
mov rsi, qword [rsp + 0x78]
mov eax, edi
mov rdi, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140078840
add rsp, 0x60
pop r14
ret
Function at 0x14003c300
Capabilities:
Write file on windows

Disassembly:
test r8d, r8d
je 0x14003c45e
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x30
cmp dword [0x1400fef74], 0
mov r14, r9
mov edi, r8d
mov rbx, rdx
mov rbp, rcx
mov qword [rsp + 0x50], rsi
jne 0x14003c404
xor r14d, r14d
cmp dword [0x1400ed508], r14d
je 0x14003c360
lea rdx, str.e_2J
mov dword [0x1400ed508], r14d
mov rcx, rbx
call fcn.14007950c
test rax, rax
je 0x14003c360
call fcn.140038a10
cmp dword [0x1400fef94], r14d
jne 0x14003c3cf
cmp edi, 5
jb 0x14003c3cf
lea rdx, str.e__1h
mov qword [rsp + 0x58], r15
mov rcx, rbx
call fcn.14002c160
mov ecx, dword [0x1400fefb0]
lea rdx, str.e__1l
test rax, rax
mov r15d, 1
mov rsi, rax
cmovne ecx, r15d
mov dword [0x1400fefb0], ecx
mov rcx, rbx
call fcn.14002c160
test rax, rax
je 0x14003c3ca
test rsi, rsi
je 0x14003c3c3
mov dword [0x1400fefb0], r15d
cmp rsi, rax
ja 0x14003c3ca
mov dword [0x1400fefb0], r14d
mov r15, qword [rsp + 0x58]
cmp dword [0x1400fef7c], r14d
je 0x14003c3dd
call fcn.140038900
xor r9d, r9d
mov qword [rsp + 0x20], r14
mov r8d, edi
mov rdx, rbx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [0x1400fef7c], r14d
je 0x14003c44c
call fcn.1400388b0
jmp 0x14003c44c
cmp edi, 1
jne 0x14003c411
cmp byte [rdx], 0xd
jne 0x14003c411
mov byte [rdx], 0xa
mov rsi, qword [rsp + 0x70]
lea rbp, [rdx + rdi]
nop word [rax + rax]
mov r9, rsi
mov r8, r14
mov rdx, rbp
mov rcx, rbx
mov rdi, rbx
call fcn.14003c620
mov rbx, rax
cmp rax, rdi
je 0x14003c44c
cmp rax, rbp
jae 0x14003c44c
test rsi, rsi
je 0x14003c420
cmp qword [rsi], 0
je 0x14003c420
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rbp
ret
Function at 0x14004db30
Capabilities:
Resolve dns

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x3f0]
sub rsp, 0x4f0
mov rax, qword [0x1400ec008]
xor rax, rsp
mov qword [rbp + 0x3e0], rax
mov ebx, edx
mov dword [rsp + 0x40], 0x80
mov edi, ecx
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x80
call fcn.14007a110
lea r8, [rsp + 0x40]
mov ecx, edi
lea rdx, [rsp + 0x50]
test ebx, ebx
je 0x14004db99
call fcn.14002e320
test eax, eax
je 0x14004dba2
xor eax, eax
jmp 0x14004dc94
call fcn.14002e210
test eax, eax
jne 0x14004db92
movzx edx, word [rsp + 0x50]
cmp dx, 0x17
jne 0x14004dc17
cmp dword [rsp + 0x58], 0
mov dword [rsp + 0x40], 0x1c
jne 0x14004dc17
cmp dword [rsp + 0x5c], 0
jne 0x14004dc17
mov ecx, 0xffff
call qword [sym.imp.WS2_32.dll_htonl]
cmp dword [rsp + 0x60], eax
jne 0x14004dc12
lea rcx, str.Normalising_mapped_IPv4_in_IPv6_address
call fcn.140046c70
movzx ecx, word [rsp + 0x52]
xor edx, edx
mov eax, dword [rsp + 0x64]
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x58], rdx
mov edx, 2
mov word [rsp + 0x50], dx
mov dword [rsp + 0x40], shutdown
mov dword [rsp + 0x54], eax
mov word [rsp + 0x52], cx
jmp 0x14004dc17
movzx edx, word [rsp + 0x50]
movzx ecx, dx
sub ecx, 1
je 0x14004dc8a
sub ecx, 1
je 0x14004dc2d
cmp ecx, 0x15
jne 0x14004db92
mov edx, dword [rsp + 0x40]
lea r8, [rbp - 0x30]
xor eax, eax
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], eax
lea rcx, [rsp + 0x50]
mov r9d, 0x401
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_getnameinfo]
test eax, eax
je 0x14004dc84
mov ecx, eax
call fcn.14003d9b0
mov r9, rax
lea rdx, str.get_socket_address
mov r8d, 2
lea rcx, str._s:_getnameinfo__d_failed:__s
call fcn.140046b30
xor eax, eax
jmp 0x14004dc94
lea rcx, [rbp - 0x30]
jmp 0x14004dc8f
lea rcx, [rsp + 0x52]
call fcn.14004ccf0
mov rcx, qword [rbp + 0x3e0]
xor rcx, rsp
call fcn.140078840
lea r11, [rsp + 0x4f0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret