joyce8/EMBER2024-capa huggingface dataset:
Function at 0x455db0
Capabilities:
Allocate thread local storage

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rax, qword [rcx + 0x30]
mov rdi, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rsi, [rcx + 8]
mov rbx, rcx
mov r12d, r8d
mov r13, rdx
mov qword [rsp + 0x20], rax
mov rax, qword [rcx + 0x38]
mov rcx, rsi
mov qword [rsp + 0x28], rax
call rdi
add dword [rbx], 1
mov rcx, rsi
mov rbp, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rbp
mov rcx, r13
call rbp
lea rdx, [rsp + 0x20]
mov r9d, r12d
xor r8d, r8d
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov rcx, rsi
mov r12d, eax
call rdi
mov eax, dword [rbx]
cmp r12d, 1
lea edx, [rax - 1]
mov dword [rbx], edx
jne 0x455d70
test edx, edx
jne 0x455d70
mov rcx, rsi
call rbp
mov rcx, qword [rbx + 0x38]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, r13
call rdi
xor eax, eax
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov rcx, rsi
call rbp
mov rcx, r13
call rdi
cmp r12d, 1
jbe 0x455d5e
cmp r12d, 0x102
jne 0x455d9b
mov eax, 0xfffff039
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
call sub.msvcrt.dll_abort
nop
nop dword [rax + rax]
nop word cs:[rax + rax]
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [0x0054c960], eax
je 0x455dd0
add rsp, 0x28
ret
call sub.msvcrt.dll_abort
nop
nop word cs:[rax + rax]

Function at 0x455e00
Capabilities:
Create thread
Resume thread

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rbp, rcx
mov ecx, 0x18
mov rdi, rdx
mov rsi, r8
call fcn.0043d450
test rax, rax
mov rbx, rax
je 0x455ee0
mov qword [rax], rdi
mov qword [rax + 8], rsi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 4
mov r9, rax
lea r8, [0x00456930]
call qword [sym.imp.msvcrt.dll__beginthreadex]
test rax, rax
je 0x455e74
mov qword [rbp], rax
mov rcx, rax
mov qword [rbx + 0x10], rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
xor eax, eax
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
call qword [sym.imp.msvcrt.dll__errno]
mov eax, dword [rax]
mov rcx, rbx
mov dword [rsp + 0x3c], eax
call fcn.0043d460
mov eax, dword [rsp + 0x3c]
cmp eax, 0xb
je 0x455ec2
jle 0x455eb0
cmp eax, 0xd
je 0x455ed0
cmp eax, 0x16
jne 0x455eb4
mov eax, 0xfffff019
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
test eax, eax
je 0x455e6b
mov eax, 0xfffff01a
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov eax, 0xfffff008
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov eax, 0xfffff004
jmp 0x455e6b
mov eax, 0xfffff027
jmp 0x455e6b
Function at 0x456910
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [rcx]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x456925
add rsp, 0x28
ret
call sub.msvcrt.dll_abort
nop
nop dword [rax + rax]
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, qword [rcx]
mov rsi, qword [rcx + 8]
mov rdi, qword [rcx + 0x10]
call fcn.0043d460
cmp byte [0x0054c950], 0
jne 0x456963
lea rdx, [0x00455db0]
lea rcx, [0x0054c950]
call fcn.00455c00
lea rcx, [0x0054c960]
mov rdx, rdi
call fcn.00456910
mov rcx, rsi
call rbx
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret

Function at 0x458250
Capabilities:
Manipulate console buffer

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov rbp, qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx r13d, byte [rsp + 0xc0]
mov rsi, rcx
mov dword [rsp + 0xa8], edx
mov r14d, r9d
movzx r12d, r8b
lea rbx, [rsp + 0x30]
mov rdi, qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
mov r15, qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4582d1
mov edx, dword [rsp + 0xa8]
mov r9d, r14d
mov r8d, r12d
mov rcx, rbx
mov dword [rsp + 0x20], r13d
call fcn.00458000
mov rcx, qword [rsi + 0x110]
mov edx, eax
call rdi
test eax, eax
jne 0x4582f3
call r15
cmp eax, 0x57
jne 0x458310
mov rcx, qword [rsi + 0x110]
mov rdx, rbx
call rbp
test eax, eax
jne 0x4582a0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, qword [rsp + 0xc8]
mov dword [rdx], eax
jmp 0x4582a0
xor eax, eax
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
call r15
mov rdi, qword [rsp + 0xc8]
mov dword [rdi], eax
mov eax, 0xffffffff
jmp 0x4582f5
Function at 0x45bb30
Capabilities:
Log keystrokes
Manipulate console buffer

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x70
mov rbx, rcx
mov ecx, dword [rcx + 0x58]
mov edx, ecx
and dh, 0xfe
sub dword [rbx + 0x7c], 1
mov dword [rbx + 0x58], edx
jne 0x45bb80
test cl, 1
je 0x45bba0
test edx, 0x20000
je 0x45bb6c
test edx, 0x2000000
jne 0x45bbc0
and edx, 0x400000
je 0x45bc10
xor esi, esi
mov eax, esi
add rsp, 0x70
pop rbx
pop rsi
pop rdi
ret
jns 0x45bb50
lea rdx, [0x0051ca50]
lea rcx, [0x0051cfe7]
mov r8d, 0x406
call fcn.00472160
mov edx, dword [rbx + 0x58]
jmp 0x45bb50
test cl, 0x40
je 0x45bb50
mov edx, ecx
and edx, 0xfffffebf
and ecx, 0x20
mov dword [rbx + 0x58], edx
je 0x45bb50
mov rax, qword [rbx + 8]
sub dword [rax + 8], 1
jmp 0x45bb50
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
mov dword [rsp + 0x60], 0
mov rcx, qword [rbx + 0x110]
lea r9, [rsp + 0x4c]
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
test eax, eax
jne 0x45bb6c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x45bb6e
lea rcx, [0x0054c978]
call fcn.004563a0
mov eax, 2
xchg dword [0x0054c99c], eax
cmp eax, 1
je 0x45bc44
lea rcx, [0x0054c978]
call fcn.00456370
or dword [rbx + 0x58], 0x400000
jmp 0x45bb6c
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
mov r8d, 3
mov edx, 0xc0000000
lea rcx, str.conout_
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
mov rdi, rax
je 0x45bd30
lea rdx, [0x0054c980]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
je 0x45bd30
lock or dword [0x0054c998], 1
mov eax, 1
mov edx, 1
mov ecx, 0xd
mov word [rsp + 0x58], dx
mov word [rsp + 0x5a], cx
xor edx, edx
mov ecx, 0xd
mov word [rsp + 0x50], ax
mov dword [rsp + 0x54], 1
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov r8d, 0xd
mov word [rsp + 0x5c], ax
mov dword [rsp + 0x60], 0
mov word [rsp + 0x5e], r8w
lea rdx, [rsp + 0x50]
mov rcx, qword [rbx + 0x110]
lea r9, [rsp + 0x4c]
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
test eax, eax
je 0x45bdc3
xor esi, esi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
jne 0x45bb6e
jmp 0x45bc38
mov r9d, 1
mov r10d, 1
mov r11d, 0xd
mov esi, 0xd
xor edx, edx
mov word [rsp + 0x50], r9w
mov word [rsp + 0x58], r10w
mov word [rsp + 0x5a], r11w
mov ecx, 0xd
mov dword [rsp + 0x54], 1
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov word [rsp + 0x5e], si
mov word [rsp + 0x5c], ax
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x60], 0
mov rcx, qword [rbx + 0x110]
lea r9, [rsp + 0x4c]
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
test eax, eax
je 0x45bdb0
cmp rdi, 0xffffffffffffffff
jne 0x45bd16
jmp 0x45bc38
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp rdi, 0xffffffffffffffff
jne 0x45bdc9
mov esi, eax
jmp 0x45bd21
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x45bd18
Function at 0x45c970
Capabilities:
Set socket configuration

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x40
cmp qword [rdx + 0x70], 0xffffffffffffffff
mov eax, 0xfffff00e
mov rdi, rcx
mov rbx, rdx
mov rsi, r8
mov dword [rsp + 0x2c], r9d
mov dword [rsp + 0x3c], 1
jne 0x45c9c4
lea r8, [rsp + 0x3c]
mov edx, 0x8004667e
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
mov r9d, dword [rsp + 0x2c]
je 0x45c9d0
mov r8, rsi
mov rdx, rbx
mov rcx, rdi
call fcn.0045c810
add rsp, 0x40
pop rbx
pop rsi
pop rdi
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
add rsp, 0x40
pop rbx
pop rsi
pop rdi
ret

Function at 0x45c9e0
Capabilities:
Set socket configuration

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
xor esi, esi
test byte [rcx + 0x59], 2
mov rbx, rcx
mov rbp, rdx
mov r12d, r8d
mov edi, r9d
mov dword [rsp + 0x38], 0
jne 0x45ca4b
mov r13d, r9d
and r13d, 1
jne 0x45ca60
mov rcx, qword [rbx + 0x70]
cmp rcx, 0xffffffffffffffff
je 0x45cae1
and edi, 4
jne 0x45ca70
cmp word [rbp], 0x17
je 0x45caa1
mov r8d, r12d
mov rdx, rbp
call qword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
je 0x45cad4
or dword [rbx + 0x58], 0x200
xor esi, esi
mov eax, esi
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
cmp word [rdx], 0x17
mov esi, 0x57
jne 0x45ca4b
jmp 0x45ca13
mov dword [rsp + 0x3c], 1
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x3c]
mov r8d, 4
mov edx, 0xffff
call qword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x45cad4
mov rcx, qword [rbx + 0x70]
jmp 0x45ca26
or dword [rbx + 0x58], 0x1000000
test r13d, r13d
jne 0x45ca2d
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x38]
mov r8d, 0x1b
mov edx, 0x29
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rcx, qword [rbx + 0x70]
jmp 0x45ca2d
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
jmp 0x45ca4b
movzx ecx, word [rbp]
xor r8d, r8d
mov edx, 2
call qword [sym.imp.WS2_32.dll_socket]
cmp rax, 0xffffffffffffffff
mov r14, rax
je 0x45cad4
movzx r9d, word [rbp]
mov rcx, qword [rbx + 8]
mov r8, rax
mov rdx, rbx
call fcn.0045c970
test eax, eax
mov esi, eax
jne 0x45cb1f
mov rcx, qword [rbx + 0x70]
jmp 0x45ca21
mov rcx, r14
call qword [sym.imp.WS2_32.dll_closesocket]
jmp 0x45ca4b
Function at 0x45d550
Capabilities:
Set socket configuration

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x70
mov eax, dword [rcx + 0x58]
mov rsi, rcx
mov r12, rdx
mov rdi, r8
mov ebp, r9d
and eax, 0x1000200
cmp eax, 0x200
je 0x45d630
mov rdx, qword [0x00523e00]
mov r9d, 4
mov r8d, 0x1c
call fcn.0045c9e0
test eax, eax
mov ebx, eax
jne 0x45d642
test rdi, rdi
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x40], 0
je 0x45d5d5
lea r8, [rsp + 0x50]
xor edx, edx
mov rcx, rdi
call fcn.0043e620
test eax, eax
jne 0x45d630
mov eax, dword [rsp + 0x68]
mov dword [rsp + 0x40], eax
mov rax, qword [r12 + 8]
mov rdx, qword [r12 + 0x10]
test ebp, ebp
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rdx
je 0x45d660
cmp ebp, 1
jne 0x45d630
mov r8d, 0xc
mov rcx, qword [rsi + 0x70]
mov dword [rsp + 0x20], 0x14
lea r9, [rsp + 0x30]
mov edx, 0x29
call qword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x45d635
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.00440300
mov ebx, eax
jmp 0x45d635
mov ebx, 0xfffff019
mov eax, ebx
add rsp, 0x70
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov ecx, eax
call fcn.00440300
mov ebx, eax
mov eax, ebx
add rsp, 0x70
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov r8d, 0xd
jmp 0x45d5f8
Function at 0x45dec0
Capabilities:
Send data
Send data on socket

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xf0
mov esi, dword [rsp + 0x140]
test r8d, r8d
mov rbx, rcx
mov r12, rdx
mov edi, r8d
je 0x45df90
lea rbp, [rsp + 0x70]
mov rcx, r9
mov rdx, rbp
call fcn.00460f20
test eax, eax
jne 0x45df81
cmp qword [rbx + 0x68], 0
jne 0x45dff0
test byte [rbx + 0x59], 2
jne 0x45df3f
cmp esi, 0x10
je 0x45dfe0
cmp esi, 0x1c
mov eax, 0xfffff019
jne 0x45df81
mov rdx, qword [0x00523e00]
xor r9d, r9d
mov r8d, esi
mov rcx, rbx
call fcn.0045c9e0
test eax, eax
jne 0x45dfc6
mov rdx, r12
mov rcx, qword [rbx + 0x70]
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], esi
lea r9, [rsp + 0x6c]
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], 0
mov r8d, edi
call qword [sym.imp.WS2_32.dll_WSASendTo]
mov edx, eax
mov eax, dword [rsp + 0x6c]
test edx, edx
jne 0x45dfc0
add rsp, 0xf0
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
lea rdx, str.src_win_udp.c
lea rcx, str.nbufs___0
mov r8d, 0x3a1
mov qword [rsp + 0x58], r9
call fcn.00472160
mov r9, qword [rsp + 0x58]
jmp 0x45dee6
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.00440300
add rsp, 0xf0
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rdx, qword [0x00523df0]
jmp 0x45df29
mov eax, 0xfffff008
jmp 0x45df81

Function at 0x45e600
Capabilities:
Enumerate processes

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x150
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rsi, [rsp + 0x20]
xor edx, edx
mov ecx, 2
mov edi, eax
mov dword [rsp + 0x20], 0x130
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rdx, rsi
mov rcx, rax
mov rbx, rax
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x45e64f
jmp 0x45e660
mov rdx, rsi
mov rcx, rbx
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x45e660
cmp edi, dword [rsp + 0x28]
jne 0x45e640
mov esi, dword [rsp + 0x40]
jmp 0x45e665
mov esi, 0xffffffff
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
add rsp, 0x150
pop rbx
pop rsi
pop rdi
ret
Function at 0x45fa90
Capabilities:
Get common file path
Get session user name

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x468
test rcx, rcx
mov rbx, rcx
je 0x45fc10
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x38]
mov edx, 0x20008
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x45fb70
lea rsi, [rsp + 0x34]
lea rdi, [rsp + 0x250]
mov dword [rsp + 0x34], 0x104
mov rcx, qword [rsp + 0x38]
mov r8, rsi
mov rdx, rdi
call qword [sym.imp.USERENV.dll_GetUserProfileDirectoryW]
test eax, eax
jne 0x45fb21
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebx, 0x7a
je 0x45fc20
mov ecx, ebx
call fcn.00440300
add rsp, 0x468
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea rbp, [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x34], 0x101
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
jne 0x45fb90
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x45fc20
mov ecx, eax
call fcn.00440300
add rsp, 0x468
pop rbx
pop rsi
pop rdi
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.00440300
add rsp, 0x468
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea r8, [rbx + 0x18]
mov qword [rbx + 0x18], 0
mov edx, 0xffffffff
mov rcx, rdi
call fcn.0045f400
test eax, eax
jne 0x45fb15
mov qword [rbx], 0
mov r8, rbx
mov edx, 0xffffffff
mov rcx, rbp
call fcn.0045f400
test eax, eax
jne 0x45fbf0
mov qword [rbx + 0x10], 0
mov dword [rbx + 8], 0xffffffff
mov dword [rbx + 0xc], 0xffffffff
jmp 0x45fb15
mov rcx, qword [rbx + 0x18]
mov dword [rsp + 0x2c], eax
call fcn.0043d460
mov eax, dword [rsp + 0x2c]
jmp 0x45fb15
mov eax, 0xfffff019
jmp 0x45fb15
mov eax, 0xfffff027
jmp 0x45fb15
Function at 0x45fc40
Capabilities:
Query environment variable

Disassembly:
push r12
push rbp
mov eax, 0x10050
push rdi
push rsi
push rbx
call fcn.0046fa50
sub rsp, rax
mov ebx, 0xfffff019
test rdx, rdx
mov rdi, rdx
mov rsi, r8
sete dl
test r8, r8
sete al
or dl, al
jne 0x45fc8e
test rcx, rcx
je 0x45fc8e
cmp qword [r8], 0
je 0x45fc8e
lea r8, [rsp + 0x48]
mov edx, 0xffffffff
call fcn.0045f9b0
test eax, eax
mov ebx, eax
je 0x45fca0
mov eax, ebx
add rsp, 0x10050
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
lea r12, [rsp + 0x50]
mov r8d, 0x7fff
mov rcx, qword [rsp + 0x48]
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov rcx, qword [rsp + 0x48]
mov ebp, eax
call fcn.0043d460
cmp rbp, 0x7ffe
ja 0x45fd00
test rbp, rbp
jne 0x45fd19
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xcb
je 0x45fdbd
mov ecx, eax
call fcn.00440300
mov ebx, eax
mov eax, ebx
add rsp, 0x10050
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
lea rdx, str.src_win_util.c
lea rcx, str.len___MAX_ENV_VAR_LENGTH
mov r8d, 0x595
call fcn.00472160
xor edx, edx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0xffffffff
mov r8, r12
mov ecx, 0xfde9
mov rbp, qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
call rbp
test eax, eax
je 0x45fda0
mov rdx, qword [rsi]
mov eax, eax
cmp rax, rdx
ja 0x45fdb0
mov dword [rsp + 0x28], edx
mov qword [rsp + 0x38], 0
xor edx, edx
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x20], rdi
mov r9d, 0xffffffff
mov r8, r12
mov ecx, 0xfde9
call rbp
test eax, eax
je 0x45fda0
sub eax, 1
mov qword [rsi], rax
jmp 0x45fc8e
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x45fce4
mov qword [rsi], rax
mov ebx, 0xfffff024
jmp 0x45fc8e
mov ebx, 0xfffff026
jmp 0x45fc8e
Function at 0x4600a0
Capabilities:
Link many functions at runtime

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
lea rcx, str.ntdll.dll
mov rdi, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rdi
test rax, rax
mov rsi, rax
je 0x460315
lea rdx, str.RtlNtStatusToDosError
mov rcx, rax
mov rbx, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rbx
test rax, rax
mov qword [0x0054e0b0], rax
je 0x460301
lea rdx, str.NtDeviceIoControlFile
mov rcx, rsi
call rbx
test rax, rax
mov qword [0x0054e098], rax
je 0x460301
lea rdx, str.NtQueryInformationFile
mov rcx, rsi
call rbx
test rax, rax
mov qword [0x0054e078], rax
je 0x460301
lea rdx, str.NtSetInformationFile
mov rcx, rsi
call rbx
test rax, rax
mov qword [0x0054e0a0], rax
je 0x460301
lea rdx, str.NtQueryVolumeInformationFile
mov rcx, rsi
call rbx
test rax, rax
mov qword [0x0054e0a8], rax
je 0x460301
lea rdx, str.NtQueryDirectoryFile
mov rcx, rsi
call rbx
cmp qword [0x0054e0a8], 0
mov qword [0x0054e0d0], rax
je 0x460301
lea rdx, str.NtQuerySystemInformation
mov rcx, rsi
call rbx
test rax, rax
mov qword [0x0054e080], rax
je 0x460301
lea rcx, str.kernel32.dll
call rdi
test rax, rax
mov rsi, rax
je 0x460315
lea rdx, str.GetQueuedCompletionStatusEx
mov rcx, rax
call rbx
mov rcx, rsi
lea rdx, str.SetFileCompletionNotificationModes
mov qword [0x0054e0c0], rax
call rbx
mov rcx, rsi
lea rdx, str.CreateSymbolicLinkW
mov qword [0x0054e070], rax
call rbx
mov rcx, rsi
lea rdx, str.CancelIoEx
mov qword [0x0054e088], rax
call rbx
mov rcx, rsi
lea rdx, str.InitializeConditionVariable
mov qword [0x0054e0e0], rax
call rbx
mov rcx, rsi
lea rdx, str.SleepConditionVariableCS
mov qword [0x0054e060], rax
call rbx
mov rcx, rsi
lea rdx, str.SleepConditionVariableSRW
mov qword [0x0054e090], rax
call rbx
mov rcx, rsi
lea rdx, str.WakeAllConditionVariable
mov qword [0x0054e0f8], rax
call rbx
mov rcx, rsi
lea rdx, str.WakeConditionVariable
mov qword [0x0054e0d8], rax
call rbx
mov rcx, rsi
lea rdx, str.CancelSynchronousIo
mov qword [0x0054e0e8], rax
call rbx
mov rcx, rsi
lea rdx, str.GetFinalPathNameByHandleW
mov qword [0x0054e0f0], rax
call rbx
lea rcx, str.powrprof.dll
mov qword [0x0054e068], rax
mov rsi, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
call rsi
test rax, rax
je 0x4602a1
lea rdx, str.PowerRegisterSuspendResumeNotification
mov rcx, rax
call rbx
mov qword [0x0054e0b8], rax
lea rcx, str.user32.dll
call rsi
test rax, rax
je 0x4602c2
lea rdx, str.SetWinEventHook
mov rcx, rax
call rbx
mov qword [0x0054e0c8], rax
lea rcx, str.iphlpapi.dll
call rsi
test rax, rax
mov rsi, rax
je 0x4602f9
lea rdx, str.ConvertInterfaceIndexToLuid
mov rcx, rax
call rbx
lea rdx, str.ConvertInterfaceLuidToNameW
mov qword [0x0054ca28], rax
mov rcx, rsi
call rbx
mov qword [0x0054ca20], rax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.GetProcAddress
mov ecx, eax
call fcn.00440240
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.GetModuleHandleA
mov ecx, eax
call fcn.00440240
nop
nop
nop
nop
nop
nop
nop
Function at 0x460430
Capabilities:
Initialize winsock library

Disassembly:
push rsi
push rbx
sub rsp, 0x468
mov ecx, 0x202
lea rdx, [rsp + 0x40]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x460634
lea r8, [0x0054e100]
lea rcx, str.0.0.0.0
xor edx, edx
call fcn.0043e5d0
test eax, eax
jne 0x460607
lea r8, [0x0054e110]
lea rcx, [0x0051d9f3]
xor edx, edx
call fcn.0043e620
test eax, eax
jne 0x460607
xor r8d, r8d
mov edx, 1
mov ecx, 2
mov rsi, qword [sym.imp.WS2_32.dll_socket]
call rsi
cmp rax, 0xffffffffffffffff
mov rbx, rax
je 0x4605a0
lea rax, [rsp + 0x3c]
mov dword [rsp + 0x3c], 0x274
lea r9, [rsp + 0x1e0]
mov r8d, 0x2005
mov edx, 0xffff
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_getsockopt]
cmp eax, 0xffffffff
je 0x460620
test byte [rsp + 0x1e2], 2
je 0x460580
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_closesocket]
cmp eax, 0xffffffff
je 0x46060c
xor r8d, r8d
mov edx, 1
mov ecx, 0x17
call rsi
cmp rax, 0xffffffffffffffff
mov rbx, rax
je 0x4605e0
lea rax, [rsp + 0x3c]
mov dword [rsp + 0x3c], 0x274
lea r9, [rsp + 0x1e0]
mov r8d, 0x2005
mov edx, 0xffff
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_getsockopt]
cmp eax, 0xffffffff
je 0x460620
test byte [rsp + 0x1e2], 2
je 0x460590
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_closesocket]
cmp eax, 0xffffffff
je 0x46060c
add rsp, 0x468
pop rbx
pop rsi
ret
mov dword [0x0054e130], 1
jmp 0x4604f3
mov dword [0x0054e12c], 1
jmp 0x460562
mov rbx, qword [sym.imp.WS2_32.dll_WSAGetLastError]
call rbx
lea edx, [rax - 0x273b]
cmp edx, 1
jbe 0x460505
sub eax, 0x273e
cmp eax, 1
jbe 0x460505
call rbx
lea rdx, str.socket
mov ecx, eax
call fcn.00440240
nop word cs:[rax + rax]
mov rbx, qword [sym.imp.WS2_32.dll_WSAGetLastError]
call rbx
lea edx, [rax - 0x273b]
cmp edx, 1
jbe 0x460574
sub eax, 0x273e
cmp eax, 1
ja 0x4605c6
jmp 0x460574
call sub.msvcrt.dll_abort
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.closesocket
mov ecx, eax
call fcn.00440240
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.getsockopt
mov ecx, eax
call fcn.00440240
lea rdx, str.WSAStartup
mov ecx, eax
call fcn.00440240
nop
nop dword [rax]
nop word cs:[rax + rax]
Function at 0x46eaf0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov rsi, rcx
mov ecx, dword [0x0054d284]
mov rdi, rdx
mov rbp, r8
test ecx, ecx
jle 0x46ec08
mov rax, qword [0x0054d288]
xor ebx, ebx
add rax, 8
mov rdx, qword [rax]
cmp rsi, rdx
jb 0x46eb3c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rsi, rdx
jb 0x46ebee
add ebx, 1
add rax, 0x18
cmp ebx, ecx
jne 0x46eb20
mov rcx, rsi
call fcn.0046f750
test rax, rax
mov r12, rax
je 0x46ec40
movsxd rbx, ebx
lea rbx, [rbx + rbx*2]
shl rbx, 3
mov r13, rbx
add r13, qword [0x0054d288]
mov qword [r13 + 0x10], rax
mov dword [r13], 0
call fcn.0046f8a0
mov edx, dword [r12 + 0xc]
mov r8d, 0x30
add rax, rdx
lea rdx, [rsp + 0x20]
mov qword [r13 + 8], rax
mov rax, qword [0x0054d288]
mov rcx, qword [rax + rbx + 8]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x46ec23
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x46ebe7
sub eax, 4
and eax, 0xfffffffb
je 0x46ebe7
add rbx, qword [0x0054d288]
mov r8d, 0x40
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x20]
mov r9, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x46ec0f
add dword [0x0054d284], 1
mov r8, rbp
mov rdx, rdi
mov rcx, rsi
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sub.msvcrt.dll_memcpy
xor ebx, ebx
jmp 0x46eb47
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.0046ea80
mov rax, qword [0x0054d288]
mov edx, dword [r12 + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 8]
call fcn.0046ea80
lea rcx, str.Address__p_has_no_image_section
mov rdx, rsi
call fcn.0046ea80
nop

Function at 0x46f3c0
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x0054d560]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x0054d540]
test rbx, rbx
je 0x46f414
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x46f40b
test rsi, rsi
je 0x46f40b
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x46f3f0
lea rcx, [0x0054d560]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]