joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1802f4690
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rdx + 0x110], 0xffffffffffffffff
mov esi, r9d
mov rdi, r8
mov dword [rsp + 0x38], 1
mov rbx, rdx
mov rbp, rcx
je 0x1802f46cc
mov eax, 0xfffff00e
jmp 0x1802f47bb
lea r8, [rsp + 0x38]
mov edx, 0x8004667e
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
jne 0x1802f46ef
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
jmp 0x1802f47bb
xor r8d, r8d
mov rcx, rdi
lea edx, [r8 + 1]
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
jne 0x1802f470e
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1802f47bb
mov rdx, qword [rbp + 0x38]
xor r9d, r9d
mov r8, rdi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
test rax, rax
jne 0x1802f4733
cmp dword [rsp + 0x50], eax
je 0x1802f4703
or dword [rbx + 0x58], 0x80000
mov ecx, dword [0x180760514]
cmp esi, 0x17
mov eax, dword [rbx + 0x58]
cmove ecx, dword [0x180760510]
bt eax, 0x13
jb 0x1802f4769
test ecx, ecx
jne 0x1802f4769
mov dl, 3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFileCompletionNotificationModes]
test eax, eax
je 0x1802f4703
or dword [rbx + 0x58], 0x20000
mov eax, dword [rbx + 0x58]
bt eax, 0x18
jae 0x1802f4784
mov r8d, 1
mov rdx, rdi
mov rcx, rbx
call fcn.1802f4120
test eax, eax
jne 0x1802f47bb
test dword [rbx + 0x58], 0x2000000
je 0x1802f47a6
mov r9d, 0x3c
mov rdx, rdi
mov rcx, rbx
lea r8d, [r9 - 0x3b]
call fcn.1802f40a0
test eax, eax
jne 0x1802f47bb
mov qword [rbx + 0x110], rdi
cmp esi, 0x17
jne 0x1802f47b9
or dword [rbx + 0x58], 0x400000
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x1802f47d0
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x30
cmp qword [rcx + 0x110], 0xffffffffffffffff
mov esi, r9d
mov r15d, r8d
mov rdi, rdx
mov rbx, rcx
jne 0x1802f4868
test sil, 1
je 0x1802f4814
cmp word [rdx], 0x17
je 0x1802f4814
mov eax, 0x57
jmp 0x1802f48cc
movzx ecx, word [rdx]
xor r8d, r8d
lea edx, [r8 + 1]
call qword [sym.imp.WS2_32.dll_socket]
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x1802f4838
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
jmp 0x1802f48cc
movzx r9d, word [rdi]
mov r8, rbp
mov rcx, qword [rbx + 8]
mov rdx, rbx
mov dword [rsp + 0x20], 0
call fcn.1802f4690
mov r14d, eax
test eax, eax
je 0x1802f4868
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_closesocket]
mov eax, r14d
jmp 0x1802f48cc
cmp word [rdi], 0x17
jne 0x1802f4898
mov rcx, qword [rbx + 0x110]
lea r9, [rsp + 0x50]
mov edx, 0x29
mov dword [rsp + 0x20], 4
and esi, 1
mov dword [rsp + 0x50], esi
lea r8d, [rdx - 0xe]
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rcx, qword [rbx + 0x110]
mov r8d, r15d
mov rdx, rdi
call qword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x1802f48c3
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2740
jne 0x1802f48cc
mov dword [rbx + 0x118], eax
or dword [rbx + 0x58], 0x2000
xor eax, eax
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x1802f4c80
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
xor r9d, r9d
mov r11d, edx
mov rdi, rcx
mov r10d, r9d
mov ebx, r9d
cmp edx, 2
jb 0x1802e78c1
lea eax, [rdx - 2]
mov qword [rsp + 0x10], rsi
shr eax, 1
mov r8, rcx
inc eax
mov edx, eax
lea esi, [rax + rax]
lea rcx, [rax + rax]
mov eax, dword [r8]
lea r8, [r8 + 0x20]
add r9, rax
mov eax, dword [r8 - 0x10]
add r10, rax
sub rdx, 1
jne 0x1802e7892
cmp esi, r11d
mov rsi, qword [rsp + 0x10]
jb 0x1802e78d0
lea rax, [r10 + r9]
add rax, rbx
mov rbx, qword [rsp + 0x18]
pop rdi
ret
test r11d, r11d
je 0x1802e78d6
mov rcx, r9
nop dword [rax]
add rcx, rcx
mov ebx, dword [rdi + rcx*8]
lea rax, [r10 + r9]
add rax, rbx
mov rbx, qword [rsp + 0x18]
pop rdi
ret
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
cmp dword [rcx + 0x100], 0
mov ebx, r8d
mov rdi, rdx
jbe 0x1802ea2b9
mov eax, 0xfffff008
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
lea r9, [rsp + 0x30]
call fcn.1802ea350
test eax, eax
je 0x1802ea2da
mov ecx, dword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.1802fa2c0
mov edx, ebx
mov rcx, rdi
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x1802e7860
mov eax, dword [rcx + 0x58]
test al, 1
je 0x1802ebded
mov eax, 0xfffff00d
ret
bt eax, 0xf
jb 0x1802ebdf9
mov eax, 0xfffff031
ret
mov eax, dword [rcx + 0x10]
cmp eax, 7
je 0x1802ebe1b
cmp eax, 0xc
je 0x1802ebe16
cmp eax, 0xe
je 0x1802ebe11
mov eax, 0xfffff02a
ret
jmp 0x1802ea290
jmp 0x1802f4c80
mov eax, 0xfffff008
ret
sub rsp, 0x48
cmp dword [rcx + 0x100], 0
jbe 0x1802f4c97
mov eax, 0xfffff008
add rsp, 0x48
ret
mov rcx, qword [rcx + 0x110]
lea r9, [rsp + 0x50]
xor eax, eax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], eax
call qword [sym.imp.WS2_32.dll_WSASend]
cmp eax, 0xffffffff
jne 0x1802f4cd0
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.1802fa2c0
add rsp, 0x48
ret
mov eax, dword [rsp + 0x50]
add rsp, 0x48
ret

Function at 0x1802f71e0
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
xor ecx, ecx
mov edx, 0xfffff027
cmp eax, 0xffffffff
mov dword [rbx], eax
cmove ecx, edx
mov eax, ecx
add rsp, 0x20
pop rbx
ret

Function at 0x1802f7210
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [rcx]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x1802f7225
add rsp, 0x28
ret
call fcn.18033623c
int3
Function at 0x1802f7380
Capabilities:
Create thread
Get system information on windows
Resume thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x60
test byte [rdx], 1
mov rbp, r9
mov r14, r8
mov rsi, rcx
je 0x1802f73e0
mov rbx, qword [rdx + 8]
test rbx, rbx
je 0x1802f73e2
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov eax, dword [rsp + 0x34]
dec rbx
add rbx, rax
dec rax
not rax
and rbx, rax
mov eax, ebx
cmp rax, rbx
je 0x1802f73e2
mov eax, 0xfffff019
jmp 0x1802f7474
xor ebx, ebx
mov ecx, 0x18
call fcn.1802e7aa0
mov rdi, rax
test rax, rax
jne 0x1802f73fb
mov eax, 0xfffff027
jmp 0x1802f7474
mov qword [rsp + 0x28], 0
lea r8, [0x1802f7120]
mov r9, rdi
mov dword [rsp + 0x20], 4
mov edx, ebx
mov qword [rax], r14
xor ecx, ecx
mov qword [rax + 8], rbp
call fcn.18032d054
test rax, rax
jne 0x1802f7462
call fcn.18032a710
mov rcx, rdi
mov ebx, dword [rax]
call fcn.1802e78f0
test ebx, ebx
je 0x1802f7472
cmp ebx, 0xb
je 0x1802f745b
cmp ebx, 0xd
je 0x1802f7454
cmp ebx, 0x16
je 0x1802f73d6
mov eax, 0xfffff01a
jmp 0x1802f7474
mov eax, 0xfffff004
jmp 0x1802f7474
mov eax, 0xfffff008
jmp 0x1802f7474
mov qword [rsi], rax
mov rcx, rax
mov qword [rdi + 0x10], rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
xor eax, eax
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x1802f7f90
Capabilities:
Create pipe

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rbx, rdx
test r9d, r9d
mov edx, 0x40040003
mov eax, 0x400c0003
cmovne edx, eax
mov rdi, r8
xor eax, eax
mov rsi, rcx
mov rcx, qword [rbx + 0x120]
mov r9d, 0xff
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], 0x10000
mov dword [rsp + 0x20], 0x10000
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov qword [rdi + 0x70], rax
cmp rax, 0xffffffffffffffff
jne 0x1802f8005
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov rdx, qword [rsi + 0x38]
xor r9d, r9d
mov r8, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
test rax, rax
je 0x1802f803d
mov rax, qword [rdi + 0x70]
mov rsi, qword [rsp + 0x58]
mov qword [rbx + 0x118], rax
mov eax, 1
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
lea rdx, [0x1803d15b0]
call fcn.1802fa210
int3
Function at 0x1802f8470
Capabilities:
Connect pipe

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
test r9d, r9d
jne 0x1802f8513
call fcn.1802f7f90
test eax, eax
jne 0x1802f8513
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x1802f84ac
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1802f84ba
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx eax, ax
or eax, 0x80070000
cdqe
mov qword [rbx + 0x40], rax
mov qword [rbx + 0x68], 0
mov rax, qword [rsi + 0x48]
test rax, rax
je 0x1802f84f8
mov rax, qword [rax + 0x68]
mov qword [rbx + 0x68], rax
mov rax, qword [rsi + 0x48]
mov qword [rax + 0x68], rbx
mov qword [rsi + 0x48], rbx
inc dword [rdi + 0x78]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov qword [rbx + 0x68], rbx
mov qword [rsi + 0x48], rbx
inc dword [rdi + 0x78]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
xorps xmm0, xmm0
mov qword [rsp + 0x30], r14
movups xmmword [rbx + 0x40], xmm0
lea rdx, [rbx + 0x40]
movups xmmword [rbx + 0x50], xmm0
mov rcx, qword [rbx + 0x70]
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
jne 0x1802f85ba
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x1802f85ba
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x217
jne 0x1802f8557
xor eax, eax
jmp 0x1802f858b
mov rcx, qword [rbx + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x70], 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x1802f857b
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1802f8589
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx eax, ax
or eax, 0x80070000
cdqe
mov qword [rbx + 0x40], rax
mov qword [rbx + 0x68], 0
mov rax, qword [rsi + 0x48]
test rax, rax
je 0x1802f85b2
mov rax, qword [rax + 0x68]
mov qword [rbx + 0x68], rax
mov rax, qword [rsi + 0x48]
mov qword [rax + 0x68], rbx
jmp 0x1802f85b6
mov qword [rbx + 0x68], rbx
mov qword [rsi + 0x48], rbx
mov r14, qword [rsp + 0x30]
inc dword [rdi + 0x78]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1802f8710
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
test dword [rdx + 0x58], 0x1000000
lea rdi, [rdx + 0x80]
mov rbx, rdx
mov rsi, rcx
je 0x1802f875b
mov qword [rdx + 0x238], 0
lea rcx, [0x1802f9660]
mov rdx, rdi
mov r8d, reloc.WS2_32.dll_recv
call qword [sym.imp.KERNEL32.dll_QueueUserWorkItem]
jmp 0x1802f87ea
lea rcx, [rdi + 0x40]
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
movups xmmword [rcx + 0x10], xmm0
test dword [rdx + 0x58], 0x80000
je 0x1802f877e
mov rax, qword [rdi + 0x70]
or rax, 1
mov qword [rdi + 0x58], rax
mov qword [rsp + 0x20], rcx
lea rdx, [0x180754921]
mov rcx, qword [rbx + 0x118]
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1802f87ae
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x1802f87ee
test dword [rbx + 0x58], 0x80000
je 0x1802f8845
cmp qword [rdi + 0x78], 0xffffffffffffffff
lea rcx, [rdi + 0x78]
jne 0x1802f8845
mov rdx, qword [rdi + 0x70]
lea r8, [0x1802f34c0]
mov dword [rsp + 0x28], 4
mov r9, rdi
mov dword [rsp + 0x20], 0xffffffff
call qword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
test eax, eax
jne 0x1802f8845
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x1802f8800
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1802f880e
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx eax, ax
or eax, 0x80070000
cdqe
mov qword [rdi + 0x40], rax
mov qword [rdi + 0x68], 0
mov rax, qword [rsi + 0x48]
test rax, rax
je 0x1802f883b
mov rax, qword [rax + 0x68]
mov qword [rdi + 0x68], rax
mov rax, qword [rsi + 0x48]
mov qword [rax + 0x68], rdi
mov qword [rsi + 0x48], rdi
jmp 0x1802f884d
mov qword [rdi + 0x68], rdi
mov qword [rsi + 0x48], rdi
jmp 0x1802f884d
mov rcx, rbx
call fcn.1802f7f50
or dword [rbx + 0x58], 0x10000
inc dword [rbx + 0x78]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x1802f8870
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov ebx, r8d
mov rdi, rdx
mov rbp, rcx
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x40]
mov esi, r9d
call fcn.1802e7ca0
mov edx, ebx
lea r8, [rsp + 0x30]
mov rcx, rdi
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x30], xmm0
call qword [rdi + 0x68]
mov rdx, qword [rsp + 0x38]
test rdx, rdx
je 0x1802f8928
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x1802f8928
mov rcx, qword [rdi + 0x118]
lea r9, [rsp + 0x70]
cmp esi, eax
mov qword [rsp + 0x20], 0
cmova esi, eax
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1802f8913
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r9, [rsp + 0x40]
mov rdx, rdi
mov r8d, eax
mov rcx, rbp
call fcn.1802f89f0
jmp 0x1802f893a
mov edx, dword [rsp + 0x70]
lea r8, [rsp + 0x30]
mov rcx, rdi
call qword [rdi + reloc.WS2_32.dll_WSASetLastError]
mov eax, dword [rsp + 0x70]
jmp 0x1802f893c
lea r8, [rsp + 0x30]
mov rdx, 0xfffffffffffff024
mov rcx, rdi
call qword [rdi + reloc.WS2_32.dll_WSASetLastError]
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret

Function at 0x1802f8a30
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
xor r14d, r14d
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
mov ebx, r14d
test r8d, r8d
je 0x1802f8a8a
nop word [rax + rax]
mov r8d, edi
mov edx, ebx
sub r8d, ebx
mov qword [rsp + 0x20], r14
add rdx, rsi
lea r9, [rsp + 0x60]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1802f8a9f
add ebx, dword [rsp + 0x60]
cmp ebx, edi
jb 0x1802f8a60
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1802f8a8c
Function at 0x1802fbe60
Capabilities:
Initialize winsock library

Disassembly:
sub rsp, 0x478
mov rax, qword [0x1804be628]
xor rax, rsp
mov qword [rsp + 0x460], rax
lea r8, [0x180760500]
xor edx, edx
lea rcx, str.0.0.0.0
call fcn.1802e7d00
test eax, eax
jne 0x1802fbffd
lea r8, [0x1807604e0]
xor edx, edx
lea rcx, [0x1803d1b80]
call fcn.1802e7d70
test eax, eax
jne 0x1802fbffd
lea ecx, [rax + 0x43]
call qword [sym.imp.USER32.dll_GetSystemMetrics]
cmp eax, 1
je 0x1802fbfe5
mov ecx, 0x202
lea rdx, [rsp + 0x2c0]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x1802fc003
mov qword [rsp + 0x480], rbx
lea edx, [rax + 1]
xor r8d, r8d
mov qword [rsp + 0x470], rdi
lea ecx, [rax + 2]
mov dword [0x180760514], 1
call qword [sym.imp.WS2_32.dll_socket]
xor edi, edi
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1802fbf63
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], 0x274
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov edx, 0xffff
mov r8d, 0x2005
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x1802fbf5a
mov eax, dword [0x180760514]
test dword [rsp + 0x40], 0x20000
cmovne eax, edi
mov dword [0x180760514], eax
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_closesocket]
xor r8d, r8d
mov dword [0x180760510], 1
lea edx, [r8 + 1]
lea ecx, [rdx + 0x16]
call qword [sym.imp.WS2_32.dll_socket]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1802fbfd5
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], 0x274
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov edx, 0xffff
mov r8d, 0x2005
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x1802fbfcc
mov eax, dword [0x180760510]
test dword [rsp + 0x40], 0x20000
cmovne eax, edi
mov dword [0x180760510], eax
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_closesocket]
mov rbx, qword [rsp + 0x480]
mov rdi, qword [rsp + 0x470]
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.18031edb0
add rsp, 0x478
ret
call fcn.18033623c
int3
lea rdx, str.WSAStartup
mov ecx, eax
call fcn.1802fa210
int3
Function at 0x18030f0b0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
sub rsp, 0x60
mov rax, qword [0x1804be628]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rsi, rcx
lea rcx, str.HWLOC_PCI_LOCALITY
call fcn.18032ace4
mov rbx, rax
test rax, rax
je 0x18030f1b4
xor edx, edx
mov qword [rsp + 0x78], rdi
mov rcx, rax
mov dword [rsi + 0x350], 1
call fcn.1803396a8
mov edi, eax
test eax, eax
js 0x18030f1a4
lea rdx, [rsp + 0x20]
mov ecx, eax
call fcn.18032f9c0
test eax, eax
jne 0x18030f19b
mov eax, dword [rsp + 0x34]
cmp eax, 0x10000
jg 0x18030f170
inc eax
movsxd rcx, eax
call fcn.18032acec
mov rbx, rax
test rax, rax
je 0x18030f15f
mov r8d, dword [rsp + 0x34]
mov rdx, rax
mov ecx, edi
call fcn.180336ee4
movsxd rcx, dword [rsp + 0x34]
cmp eax, ecx
jne 0x18030f15f
mov byte [rcx + rbx], 0
mov rdx, rbx
mov rcx, rsi
call fcn.18030f1d0
mov rcx, rbx
call fcn.18032a77c
mov ecx, edi
call fcn.180336818
jmp 0x18030f1af
call fcn.1802ff010
cmp eax, 2
jge 0x18030f19b
mov ecx, 2
call fcn.1803267d4
mov r9d, dword [rsp + 0x34]
lea rdx, str.hwloc_pci:_Ignoring_HWLOC_PCI_LOCALITY_file___s_too_large___lu_bytes__n
mov rcx, rax
mov r8, rbx
call fcn.180004160
mov ecx, edi
call fcn.180336818
jmp 0x18030f1af
mov rdx, rbx
mov rcx, rsi
call fcn.18030f1d0
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.18031edb0
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop rsi
ret

Function at 0x1803137c0
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [0x1804be490]
cmp eax, 1
jbe 0x180313809
mov rdx, qword [0x180754a08]
test rdx, rdx
je 0x180313801
lea ecx, [rax - 1]
call rdx
movzx ecx, ax
mov eax, dword [0x1804be490]
shl eax, 6
add eax, 0xffffffc0
add eax, ecx
add rsp, 0x58
ret
shl eax, 6
add rsp, 0x58
ret
mov eax, dword [rsp + 0x40]
add rsp, 0x58
ret
Function at 0x180318d00
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push r12
push r13
sub rsp, 0x78
mov rax, qword [0x1804be628]
xor rax, rsp
mov qword [rsp + 0x50], rax
cmp byte [rcx], 0x2d
mov r13, r8
mov r12, rdx
jne 0x180318d2f
cmp byte [rcx + 1], 0
jne 0x180318d2f
xor eax, eax
jmp 0x180318d34
sbb eax, eax
or eax, 1
mov qword [rsp + 0xb8], rsi
lea rbx, str._dev_stdin
test eax, eax
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x68], r14
lea rdx, [0x1804871d0]
cmovne rbx, rcx
mov qword [rsp + 0x60], r15
mov rcx, rbx
call fcn.18032e4ac
mov rbp, rax
test rax, rax
je 0x180318e49
lea rdx, [rsp + 0x20]
mov rcx, rbx
mov edi, 0x1000
call fcn.18032fa98
test eax, eax
jne 0x180318d9e
mov eax, 0x8000
test word [rsp + 0x26], ax
je 0x180318d9e
mov eax, dword [rsp + 0x34]
inc eax
movsxd rdi, eax
lea rcx, [rdi + 1]
call fcn.18032acec
mov rsi, rax
test rax, rax
je 0x180318e41
mov r9, rbp
mov r8, rdi
mov edx, 1
mov rcx, rax
call fcn.18032d9fc
mov r15, rax
mov byte [rax + rsi], 0
cmp rax, rdi
jne 0x180318e21
nop dword [rax]
nop word [rax + rax]
add rdi, rdi
mov rcx, rsi
lea rdx, [rdi + 1]
call fcn.18032aa58
mov r14, rax
test rax, rax
je 0x180318e39
mov rbx, rdi
lea rcx, [rax + r15]
shr rbx, 1
mov r9, rbp
mov r8, rbx
mov edx, 1
mov rsi, rax
call fcn.18032d9fc
add r15, rax
mov byte [rsi + r15], 0
cmp rax, rbx
je 0x180318de0
mov rcx, rbp
call fcn.18032d220
lea rax, [r15 + 1]
mov qword [r12], rsi
mov qword [r13], rax
xor eax, eax
jmp 0x180318e4e
mov rcx, rsi
call fcn.18032a77c
mov rcx, rbp
call fcn.18032d220
mov eax, 0xffffffff
mov r15, qword [rsp + 0x60]
mov r14, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov rsi, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.18031edb0
add rsp, 0x78
pop r13
pop r12
pop rbp
pop rbx
ret

Function at 0x1803366e0
Capabilities:
Delete directory

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x180336700
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.18032a6a0
or eax, 0xffffffff
jmp 0x180336702
xor eax, eax
add rsp, 0x28
ret
Function at 0x140004000
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
cld
and rsp, 0xfffffffffffffff0
call fcn.1400040d6
push r9
push r8
push rdx
push rcx
xor rdx, rdx
mov rdx, qword gs:[rdx + 0x60]
push rsi
mov rdx, qword [rdx + 0x18]
mov rdx, qword [rdx + 0x20]
xor r9, r9
mov rsi, qword [rdx + 0x50]
movzx rcx, word [rdx + 0x4a]
xor rax, rax
lodsb al, byte [rsi]
cmp al, 0x61
jl 0x140004037
sub al, 0x20
ror r9d, 0xd
add r9d, eax
loop 0x14000402d
push rdx
mov rdx, qword [rdx + 0x20]
push r9
mov eax, dword [rdx + 0x3c]
add rax, rdx
cmp word [rax + 0x18], 0x20b
jne 0x1400040cb
mov eax, dword [rax + 0x88]
test rax, rax
je 0x1400040cb
add rax, rdx
mov ecx, dword [rax + 0x18]
mov r8d, dword [rax + 0x20]
push rax
add r8, rdx
jrcxz 0x1400040ca
xor r9, r9
dec rcx
mov esi, dword [r8 + rcx*4]
add rsi, rdx
xor rax, rax
ror r9d, 0xd
lodsb al, byte [rsi]
add r9d, eax
cmp al, ah
jne 0x140004081
add r9, qword [rsp + 8]
cmp r9d, r10d
jne 0x140004072
pop rax
mov r8d, dword [rax + 0x24]
add r8, rdx
mov cx, word [r8 + rcx*2]
mov r8d, dword [rax + 0x1c]
add r8, rdx
mov eax, dword [r8 + rcx*4]
add rax, rdx
pop r8
pop r8
pop rsi
pop rcx
pop rdx
pop r8
pop r9
pop r10
sub rsp, 0x20
push r10
jmp rax
pop rax
pop r9
pop rdx
mov rdx, qword [rdx]
jmp 0x140004021
Function at 0x140001000
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Inject apc
Resume thread
Use process replacement

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0xf0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0xe0], rax
xorps xmm0, xmm0
lea rcx, str.C:WindowsSystem32calc.exe
movups xmmword [rsp + 0x70], xmm0
xor ebp, ebp
mov eax, 0x90
mov word [rsp + 0x68], ax
xor r9d, r9d
xor eax, eax
xor r8d, r8d
mov qword [r11 - 0x28], rax
xor edx, edx
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], ebp
movups xmmword [r11 - 0x78], xmm0
movups xmmword [r11 - 0x68], xmm0
movups xmmword [r11 - 0x58], xmm0
movups xmmword [r11 - 0x48], xmm0
movups xmmword [r11 - 0x38], xmm0
movups xmmword [rsp + 0x50], xmm0
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov rdi, qword [rsp + 0x50]
xor edx, edx
mov rsi, qword [rsp + 0x58]
mov rcx, rdi
mov r9d, 0x1000
mov dword [rsp + 0x20], 0x40
mov r8d, 2
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r9d, 2
mov qword [rsp + 0x20], rbp
mov rdx, rax
lea r8, [rsp + 0x68]
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
xor r8d, r8d
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_QueueUserAPC]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ResumeThread]
xor eax, eax
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.140001140
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x140001a08
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001a52
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001a52
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001a52
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001a52
cmp dword [rcx + 0x84], 0xe
jbe 0x140001a52
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001a54
xor al, al
add rsp, 0x28
ret