joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180008848
Capabilities:
Copy file
Create directory

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x20
mov eax, r8d
mov r12, rcx
mov rsi, r9
lea rbp, [rdx + rax*2]
mov r14, rdx
xor ebx, ebx
mov rcx, rbp
xor r13d, r13d
call qword [sym.imp.KERNEL32.dll_lstrlenW]
test rsi, rsi
mov r15d, eax
je 0x180008896
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, eax
cmp qword [rsp + 0x60], r13
je 0x1800088ab
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r13d, eax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [0x1800339a8]
xor edx, edx
add eax, r15d
add eax, r13d
lea r8d, [rax + rbx + 3]
add r8, r8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov rbx, rax
je 0x18000899d
mov rdx, r12
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
test rsi, rsi
je 0x1800088fa
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcatW]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea rdx, [0x18002d750]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcatW]
jmp 0x180008945
and word [rsi], 0
call qword [sym.imp.KERNEL32.dll_lstrcatW]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea rdx, [0x18002d750]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rbp, [rsi + 2]
mov word [rsi], 0x5c
mov dx, 0x5c
mov rcx, rbp
call qword [sym.imp.SHLWAPI.dll_StrChrW]
mov rdx, rbp
mov rcx, rbx
test rax, rax
mov rsi, rax
jne 0x180008917
call qword [sym.imp.KERNEL32.dll_lstrcatW]
cmp qword [rsp + 0x60], 0
je 0x18000897c
mov rdx, qword [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcatW]
xor r8d, r8d
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CopyFileW]
mov rcx, qword [0x1800339a8]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov r12, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r13
ret
Function at 0x180008fe8
Capabilities:
Enumerate pe sections
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x50
mov rdi, rdx
lea rdx, [rax - 0x10]
xor r8d, r8d
mov rbp, rcx
xor ebx, ebx
call fcn.18001a948
cmp eax, ebx
jne 0x18000912a
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
mov rcx, rbp
call fcn.18000cc8c
cmp rax, rbx
mov r11, rax
je 0x180009116
movsxd r9, dword [rbp + 0x3c]
sub r11d, ebp
add r9, rbp
movzx ecx, word [r9 + 0x14]
movzx r10d, word [r9 + 6]
lea r8, [rcx + r9 + 0x18]
cmp r11d, dword [r8 + 0xc]
jb 0x180009070
mov ecx, dword [r9 + 0x3c]
mov eax, dword [r8 + 0x10]
lea edx, [rax + rcx - 1]
lea eax, [rcx - 1]
not eax
and edx, eax
add edx, dword [r8 + 0xc]
cmp r11d, edx
jb 0x180009082
add r8, 0x28
add r10w, 0xffff
je 0x180009116
jmp 0x18000904e
mov edi, dword [r8 + 0x14]
sub edi, dword [r8 + 0xc]
add edi, r11d
je 0x180009116
mov rcx, qword [rsp + 0x48]
xor r9d, r9d
mov qword [rsp + 0x30], rbx
lea r8d, [r9 + 1]
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
mov rsi, rax
je 0x180009116
xor r9d, r9d
xor r8d, r8d
mov edx, edi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, edi
jne 0x18000910d
lea r9, [rsp + 0x78]
lea rdx, [rsp + 0x40]
mov r8d, 4
mov rcx, rsi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, ebx
je 0x18000910d
cmp dword [rsp + 0x78], 4
jne 0x18000910d
mov ebx, dword [rsp + 0x40]
add rbx, rbp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8, qword [rsp + 0x48]
mov rcx, qword [0x1800339a8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rax, rbx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x1800097d0
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x20
mov rbx, qword [0x1800339c8]
test rbx, rbx
je 0x1800098f4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rdi, qword [rbx + 0x30]
test rdi, rdi
je 0x1800098eb
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
test rax, rax
mov rsi, rax
je 0x1800098dc
mov rcx, qword [0x180033bd0]
lea rbp, [0x180000000]
lea rdx, [rcx + rbp + 0x37ea8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x18000985a
mov rax, qword [0x180033bd0]
mov rcx, rsi
lea rdx, [rax + rbp + 0x37ef0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1800098dc
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r8d, dword [rbx + 0x40]
cmp eax, r8d
mov dword [rsp + 0x40], eax
jbe 0x180009881
mov rdx, qword [rbx + 0x38]
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
je 0x1800098dc
mov rcx, qword [rbx + 0x28]
test rcx, rcx
je 0x180009895
call qword [sym.imp.KERNEL32.dll_CloseHandle]
and qword [rbx + 0x28], 0
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x48]
mov rcx, rdi
call fcn.18001b84c
test eax, eax
jne 0x1800098dc
mov edx, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
call fcn.18001dfb8
test eax, eax
jne 0x1800098c8
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor edi, edi
mov r8, qword [rsp + 0x48]
mov rcx, qword [0x1800339a8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
test rdi, rdi
je 0x1800098eb
xor edx, edx
mov rcx, rdi
call fcn.1800206d8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800099a8
Capabilities:
Get common file path
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rcx, qword [0x1800339a8]
mov esi, 0x104
xor edx, edx
mov r8, rsi
mov ebx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov rdi, rax
je 0x180009aae
mov edx, esi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x180009a94
mov dx, 0x3a
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_StrChrA]
lea rdx, [0x180037e32]
mov r8, rdi
lea rcx, [rax + 2]
mov rbx, rax
mov byte [rax + 1], 0
call qword [sym.imp.USER32.dll_wsprintfA]
and qword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
mov r8d, 3
lea rcx, [rbx + 2]
xor r9d, r9d
mov edx, 0xc0000000
mov dword [rsp + 0x20], r8d
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
mov rsi, rax
je 0x180009a94
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x50]
mov rdx, rax
mov r8d, 0x10000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x180009a78
xor ebx, ebx
jmp 0x180009a80
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x180009a9c
call fcn.180022e88
jmp 0x180009a9a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [0x1800339a8]
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rsi, qword [rsp + 0x60]
mov eax, ebx
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret

Function at 0x180009d58
Capabilities:
Enumerate threads

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
sub rsp, 0x40
and dword [rax - 0x28], 0
xor edx, edx
mov rbx, rcx
lea r8d, [rdx + 0x18]
lea rcx, [rax - 0x24]
call sub.ntdll.dll_memset
test rbx, rbx
je 0x180009d8c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
mov dword [rsp + 0x20], 0x1c
lea ecx, [rdx + 4]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
cmp rax, 0xffffffffffffffff
mov rbx, rax
je 0x180009e32
lea rcx, [0x18003601d]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [0x180037283]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [rsp + 0x20]
mov rcx, rbx
mov rsi, rax
call sub.KERNEL32.dll_Thread32First
jmp 0x180009e25
mov ecx, dword [0x180033b90]
cmp dword [rsp + 0x2c], ecx
jne 0x180009e18
mov r8d, dword [rsp + 0x28]
xor edx, edx
mov ecx, 0x1f03ff
call qword [sym.imp.KERNEL32.dll_OpenThread]
test rax, rax
mov rdi, rax
je 0x180009e18
xor r8d, r8d
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_QueueUserAPC]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x180009dda
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x18000bc88
Capabilities:
Initialize winsock library

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x1d0
mov rdi, rcx
lea rdx, [rsp + 0x30]
mov cx, 0x201
call qword [sym.imp.WS2_32.dll_WSAStartup]
xor ebx, ebx
cmp eax, ebx
jne 0x18000bcbf
lea rdx, [rsp + 0x20]
xor r8d, r8d
mov rcx, rdi
call fcn.1800196cc
jmp 0x18000bcc1
mov eax, ebx
cmp eax, ebx
je 0x18000bd55
mov ecx, dword [rsp + 0x24]
cmp ecx, ebx
je 0x18000bd55
cmp ecx, 0x8080808
je 0x18000bd55
cmp ecx, 0xdede43d0
je 0x18000bd55
movzx edx, cl
cmp edx, 0xa
je 0x18000bd55
movzx r8d, cx
cmp r8d, 0xa8c0
je 0x18000bd55
mov eax, ecx
and eax, 0xfff
cmp eax, 0x10ac
je 0x18000bd55
cmp edx, 0x7f
je 0x18000bd55
cmp edx, ebx
je 0x18000bd55
cmp r8d, 0xfea9
je 0x18000bd55
mov eax, ecx
and eax, 0x7fff
cmp eax, 0x12c6
je 0x18000bd55
mov eax, ecx
and eax, 0x3ff
cmp eax, 0x4064
je 0x18000bd55
and ecx, 0xf
cmp cl, 0xe0
je 0x18000bd55
mov dx, 0x3a
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_StrChrA]
cmp rax, rbx
jne 0x18000bd55
mov ebx, 1
mov eax, ebx
mov rbx, qword [rsp + 0x1e0]
add rsp, 0x1d0
pop rdi
ret
Function at 0x18000cc8c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov r11, r9
mov r8, rdx
mov r13, rcx
xor ebx, ebx
movsxd r10, dword [rcx + 0x3c]
lea rax, [r10 + rcx + 0x78]
lea rcx, [r10 + rcx + 0x88]
cmp word [r10 + r13 + 4], 0x14c
cmove rcx, rax
mov eax, dword [rcx]
lea rdi, [r13 + rax]
test eax, eax
je 0x18000ceac
cmp dword [rcx + 4], ebx
je 0x18000ceac
cmp dword [rdi + 0x1c], ebx
je 0x18000ceac
mov eax, dword [rdi + 0x14]
mov dword [rsp + 0x28], eax
test eax, eax
je 0x18000ceac
mov ecx, dword [rdi + 0x1c]
add rcx, r13
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rdx
test rdx, rdx
je 0x18000cd20
cmp rdx, 0xffff
jbe 0x18000cd2e
xor edx, edx
mov qword [rsp + 0x38], rdx
mov eax, dword [rdi + 0x18]
mov dword [rsp + 0x28], eax
cmp dword [rdi + 0x24], 0
je 0x18000ce9d
mov r12d, dword [rdi + 0x24]
add r12, r13
mov qword [rsp + 0x58], r12
mov esi, dword [rdi + 0x20]
add rsi, r13
mov qword [rsp + 0x50], rsi
xor r9d, r9d
mov dword [rsp + 0x20], r9d
lea r14d, [r9 + 1]
cmp r9d, eax
jae 0x18000ceac
xor r15d, r15d
mov dword [rsp + 0x24], r15d
test rdx, rdx
je 0x18000cd97
mov ecx, dword [rdi + 0x10]
movzx eax, word [r12]
add rcx, rax
cmp rdx, rcx
jne 0x18000ce53
mov r15d, r14d
mov dword [rsp + 0x24], r14d
mov rcx, qword [rsp + 0x30]
jmp 0x18000ce58
mov r10d, dword [rsi]
add r10, r13
mov qword [rsp + 0x48], r10
test r8, r8
je 0x18000cdec
mov al, byte [r8]
cmp byte [r10], al
jne 0x18000ce58
mov rdx, r8
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x18000ce32
mov r15d, r14d
mov dword [rsp + 0x24], r14d
mov rdx, qword [rsp + 0x38]
mov r8, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0x30]
mov r9d, dword [rsp + 0x20]
mov r11, qword [rsp + 0xb8]
jmp 0x18000ce58
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov edx, eax
mov rcx, qword [rsp + 0x48]
call fcn.180014d10
cmp dword [rsp + 0xb0], eax
cmove r15d, r14d
mov dword [rsp + 0x24], r15d
mov rdx, qword [rsp + 0x38]
mov r8, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0x30]
mov r9d, dword [rsp + 0x20]
mov r11, qword [rsp + 0xb8]
jmp 0x18000ce58
mov rdx, qword [rsp + 0x38]
mov r8, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0x30]
mov r9d, dword [rsp + 0x20]
mov r11, qword [rsp + 0xb8]
jmp 0x18000ce58
mov rcx, qword [rsp + 0x30]
test r15d, r15d
je 0x18000ce7a
movzx eax, word [r12]
lea rbx, [rcx + rax*4]
mov qword [rsp + 0x40], rbx
test r11, r11
je 0x18000ceac
mov eax, dword [rsi]
add rax, r13
mov qword [r11], rax
jmp 0x18000ceac
add rsi, 4
mov qword [rsp + 0x50], rsi
add r12, 2
mov qword [rsp + 0x58], r12
add r9d, r14d
mov dword [rsp + 0x20], r9d
mov eax, dword [rsp + 0x28]
jmp 0x18000cd5b
test rdx, rdx
je 0x18000ceac
lea rbx, [rcx + rdx*4 - 4]
mov qword [rsp + 0x40], rbx
jmp 0x18000ceb5
mov rax, rbx
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x18000d3c8
Capabilities:
Connect pipe
Read pipe
Write pipe

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
xor esi, esi
mov ebp, r8d
mov r15, r9
and dword [rax - 0x38], esi
xor eax, eax
test r9, r9
mov r13, rdx
mov r12d, ecx
lea r14d, [rbp + 0x10]
mov dword [rsp + 0x44], eax
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x4c], eax
lea ebx, [rsi + 8]
je 0x18000d420
mov rcx, r9
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [rax + 1]
add r14d, esi
jmp 0x18000d42c
cmp ecx, 0x119
je 0x18000d4e7
mov rcx, qword [0x1800339a8]
mov r8d, r14d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov rdi, rax
je 0x18000d4e5
test esi, esi
mov ecx, dword [0x180033b90]
mov dword [rax + 0xc], esi
mov dword [rax + 4], ecx
movzx ecx, r12w
mov dword [rax], ecx
lea ecx, [rsi + rbp]
mov dword [rax + 8], ecx
je 0x18000d475
lea rcx, [rax + 0x10]
mov r8d, esi
mov rdx, r15
call sub.ntdll.dll_memcpy
test r13, r13
je 0x18000d48e
test ebp, ebp
je 0x18000d48e
lea rcx, [rsi + rdi + 0x10]
mov r8, rbp
mov rdx, r13
call sub.ntdll.dll_memcpy
mov rcx, qword [0x180033b08]
lea rax, [rsp + 0x90]
mov dword [rsp + 0x30], 1
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
mov r8d, r14d
mov rdx, rdi
mov dword [rsp + 0x20], 0x10
call qword [sym.imp.KERNEL32.dll_CallNamedPipeA]
test eax, eax
jne 0x18000d4d1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x18000d4d3
xor ebx, ebx
mov rcx, qword [0x1800339a8]
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, ebx
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x18000d9e0
Capabilities:
Connect socket
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
xor eax, eax
mov rdi, rcx
mov rcx, qword [rcx + 0x38]
and word [rsp + 0x20], ax
lea rdx, [rsp + 0x40]
lea r8d, [rax + 8]
mov byte [rsp + 0x48], 0
mov dword [rsp + 0x49], eax
mov word [rsp + 0x4d], ax
mov byte [rsp + 0x4f], al
mov qword [rsp + 0x22], rax
mov dword [rsp + 0x2a], eax
mov word [rsp + 0x2e], ax
call fcn.180015d90
test eax, eax
mov ebx, eax
jne 0x18000dafa
cmp byte [rsp + 0x40], 1
lea ebx, [rax + 0x57]
je 0x18000da45
cmp byte [rsp + 0x40], 2
jne 0x18000dafa
cmp byte [rsp + 0x47], 0
je 0x18000da76
mov rcx, qword [rdi + 0x38]
xor r9d, r9d
lea rdx, [rsp + 0x47]
lea r8d, [r9 + 1]
call qword [sym.imp.WS2_32.dll_recv]
mov cl, byte [rsp + 0x47]
test eax, eax
jle 0x18000da6e
test cl, cl
jne 0x18000da4c
test cl, cl
jne 0x18000dafa
mov edx, 1
lea ecx, [rdx + 1]
lea r8d, [rdx + 5]
call qword [sym.imp.WS2_32.dll_socket]
cmp rax, 0xffffffffffffffff
mov qword [rdi + 0x40], rax
je 0x18000db07
movzx ecx, word [rsp + 0x41]
lea rdx, [rsp + 0x20]
mov r8d, 0x10
mov word [rsp + 0x22], cx
mov ecx, dword [rsp + 0x43]
mov word [rsp + 0x20], 2
mov dword [rsp + 0x24], ecx
mov rcx, rax
call qword [sym.imp.WS2_32.dll_connect]
test eax, eax
jne 0x18000dac7
xor ebx, ebx
jmp 0x18000db13
lea rcx, [rdi + 0x40]
call fcn.18000a888
mov ebx, 0x4d0
mov byte [rsp + 0x49], 0x5b
mov rcx, qword [rdi + 0x38]
xor r9d, r9d
lea rdx, [rsp + 0x48]
lea r8d, [r9 + 8]
call qword [sym.imp.WS2_32.dll_send]
mov ecx, 0x4d4
test eax, eax
cmovle ebx, ecx
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ebx, eax
jne 0x18000dad5
mov byte [rsp + 0x49], 0x5a
jmp 0x18000dada
Function at 0x18000dd18
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x50
mov rdi, rcx
mov rcx, rdx
mov rbp, rdx
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov rcx, rdi
mov esi, eax
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov rcx, qword [0x1800339a8]
lea r8d, [rax + rsi + 1]
xor edx, edx
mov r13d, eax
add r8, 5
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp rax, rbx
mov r12, rax
je 0x18000df44
mov rdx, rbp
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [rsi + 1]
mov rdx, rdi
mov rcx, r12
mov byte [rsi + r12], 0x5c
mov byte [rax + r12], bl
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea rdx, [0x1800370c3]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov rcx, qword [0x1800339a8]
lea r8d, [r13 + 1]
add r8, r8
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp rax, rbx
mov rbp, rax
je 0x18000df32
movsx eax, byte [rdi]
cmp ax, bx
mov word [rbp], ax
je 0x18000ddeb
mov rcx, rbp
add rdi, 1
add rcx, 2
movsx eax, byte [rdi]
cmp ax, bx
mov word [rcx], ax
jne 0x18000ddd8
mov rdx, rbp
xor ecx, ecx
call qword [sym.imp.CRYPT32.dll_CertOpenSystemStoreW]
cmp rax, rbx
mov rdi, rax
je 0x18000df20
xor edx, edx
mov rcx, rax
mov esi, ebx
call qword [sym.imp.CRYPT32.dll_CertEnumCertificatesInStore]
cmp rax, rbx
je 0x18000df15
mov rdx, rax
mov rcx, rdi
add esi, 1
call qword [sym.imp.CRYPT32.dll_CertEnumCertificatesInStore]
cmp rax, rbx
jne 0x18000de18
cmp esi, ebx
je 0x18000df15
xor eax, eax
lea r8, [0x180036bf8]
lea rdx, [rsp + 0x40]
lea esi, [rax + 4]
xor r9d, r9d
mov rcx, rdi
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x20], esi
call qword [sym.imp.CRYPT32.dll_PFXExportCertStoreEx]
cmp eax, ebx
je 0x18000df15
mov r8d, dword [rsp + 0x40]
mov rcx, qword [0x1800339a8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp rax, rbx
mov qword [rsp + 0x48], rax
je 0x18000df15
lea r8, [0x180036bf8]
lea rdx, [rsp + 0x40]
xor r9d, r9d
mov rcx, rdi
mov dword [rsp + 0x20], esi
call qword [sym.imp.CRYPT32.dll_PFXExportCertStoreEx]
cmp eax, ebx
je 0x18000df01
mov qword [rsp + 0x30], rbx
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
mov rcx, r12
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
mov rsi, rax
je 0x18000df01
mov r8d, dword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
lea r9, [rsp + 0x80]
mov rcx, rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8, qword [rsp + 0x48]
mov rcx, qword [0x1800339a8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.CRYPT32.dll_CertCloseStore]
mov rcx, qword [0x1800339a8]
mov r8, rbp
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [0x1800339a8]
mov r8, r12
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea r11, [rsp + 0x50]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x18000e0ac
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov qword [rax + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
movsxd rbx, dword [rdx + 0x3c]
mov rbp, rcx
mov r13, rdx
add rbx, rdx
mov r15, r8
movzx edi, word [rbx + 0x14]
movzx esi, word [rbx + 6]
mov r12d, dword [rbx + 0x3c]
lea rax, [rbx + 0x88]
mov r9d, ebx
lea r14, [rbx + 4]
sub r9d, edx
mov dx, 0x14c
lea rcx, [rbx + 0x98]
add r9d, 4
cmp word [r14], dx
cmove rcx, rax
mov eax, dword [rbx + 0x54]
cmp dword [rcx], 0
jne 0x18000e136
sub eax, r9d
mov ecx, r9d
mov rdx, r14
mov r8d, eax
add rcx, rbp
call sub.ntdll.dll_memcpy
mov r11d, dword [r13 + 0x3c]
mov dword [rbp + 0x3c], r11d
jmp 0x18000e144
mov r8d, eax
mov rdx, r13
mov rcx, rbp
call sub.ntdll.dll_memcpy
test esi, esi
je 0x18000e18b
mov r14, qword [rsp + 0x50]
lea ebp, [r12 - 1]
lea rdi, [rdi + rbx + 0x2c]
not ebp
mov eax, dword [rdi - 4]
lea ecx, [rax + r12 - 1]
and ecx, ebp
je 0x18000e178
mov edx, dword [rdi]
mov r8d, ecx
mov ecx, dword [rdi - 8]
add rcx, r14
add rdx, r13
call sub.ntdll.dll_memcpy
add rdi, 0x28
sub rsi, 1
jne 0x18000e159
mov rbp, qword [rsp + 0x50]
lea r14, [rbx + 4]
test r15, r15
mov dx, 0x14c
lea rax, [rbx + 0xa0]
cmove r15, rbp
cmp word [r14], dx
lea rcx, [rbx + 0xb0]
cmove rcx, rax
cmp dword [rcx], 0
je 0x18000e24d
mov r8d, dword [rcx + 4]
test r8d, r8d
je 0x18000e24d
cmp word [r14], dx
jne 0x18000e1cd
mov eax, dword [rbx + 0x34]
jmp 0x18000e1d1
mov rax, qword [rbx + 0x30]
mov ecx, dword [rcx]
mov rdi, r15
sub r15, qword [rbx + 0x30]
add rcx, rbp
sub rdi, rax
cmp r8d, 8
jbe 0x18000e24d
mov ebx, 0xfff
mov eax, dword [rcx + 4]
mov r10d, dword [rcx]
lea rdx, [rax - 8]
add r10, rbp
shr rdx, 1
cmp r8d, eax
jl 0x18000e23e
test edx, edx
je 0x18000e23e
lea r9, [rcx + 8]
mov r11d, edx
movzx eax, word [r9]
shr eax, 0xc
cmp eax, 3
je 0x18000e229
cmp eax, 0xa
jne 0x18000e234
mov ax, word [r9]
and rax, rbx
add qword [rax + r10], r15
jmp 0x18000e234
mov ax, word [r9]
and rax, rbx
add dword [rax + r10], edi
add r9, 2
sub r11, 1
jne 0x18000e20b
mov eax, dword [rcx + 4]
sub r8d, eax
add rcx, rax
cmp r8d, 8
ja 0x18000e1eb
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
xor eax, eax
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret