joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400a7300
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x18
mov r11, rcx
mov rcx, rdx
mov r10, r8
mov rax, qword [r11 + 0x1a0]
mov edi, dword [r11 + 0x30]
cmp byte [rax + 0x1a], 1
sbb eax, eax
and eax, 7
add eax, 1
imul eax, dword [rdx + 0x1c]
mov edx, eax
lea ebx, [rdx + rdx]
sub ebx, edi
test ebx, ebx
jle 0x1400a745e
movsxd rax, dword [r11 + 0x12c]
test eax, eax
jle 0x1400a745e
lea r14, [r8 + rax*8]
mov eax, ebx
mov esi, ebx
mov dword [rsp + 0xc], edx
and eax, 0xfffffff8
mov qword [rsp + 0x68], rcx
shr esi, 3
mov ebp, ebx
mov dword [rsp + 8], eax
lea r13, [rdi + rdi]
shl rsi, 4
lea r15, [rax + rax]
mov qword [rsp + 0x70], r8
and ebp, 7
mov qword [rsp + 0x78], r9
nop dword [rax + rax]
mov r11, qword [r8]
lea rax, [r11 + r13]
movzx r9d, word [rax - 2]
cmp ebx, 7
jle 0x1400a74ec
movd xmm0, r9d
mov rdx, rax
lea rcx, [rax + rsi]
punpcklwd xmm0, xmm0
pshufd xmm0, xmm0, 0
movdqa xmm1, xmm0
test sil, 0x10
je 0x1400a73d0
lea rdx, [rax + 0x10]
movups xmmword [rax], xmm0
cmp rcx, rdx
je 0x1400a73e0
movups xmmword [rdx], xmm1
add rdx, 0x20
movups xmmword [rdx - 0x10], xmm1
cmp rcx, rdx
jne 0x1400a73d0
test ebp, ebp
je 0x1400a74ce
mov edx, dword [rsp + 8]
add rax, r15
mov r10d, ebp
mov ecx, ebx
sub ecx, edx
lea r12d, [rcx - 1]
cmp r12d, 2
jbe 0x1400a7424
movd xmm3, r9d
add rdx, rdi
pshuflw xmm2, xmm3, 0
movq qword [r11 + rdx*2], xmm2
test cl, 3
je 0x1400a743e
and ecx, 0xfffffffc
mov edx, ecx
sub r10d, ecx
lea rax, [rax + rdx*2]
mov word [rax], r9w
cmp r10d, 1
je 0x1400a743e
mov word [rax + 2], r9w
cmp r10d, 2
je 0x1400a743e
mov word [rax + 4], r9w
add r8, 8
cmp r8, r14
jne 0x1400a7390
mov edx, dword [rsp + 0xc]
mov rcx, qword [rsp + 0x68]
mov r10, qword [rsp + 0x70]
mov r9, qword [rsp + 0x78]
movsxd rax, dword [rcx + 0xc]
test eax, eax
jle 0x1400a74bd
test edx, edx
je 0x1400a74bd
lea rbp, [rax*8]
lea rdi, [rdx*4]
xor esi, esi
nop dword [rax]
mov rdx, qword [r10 + rsi]
mov r8, qword [r9 + rsi]
xor ecx, ecx
lea rbx, [rdx + rdi]
nop
movzx eax, word [rdx]
movzx r11d, word [rdx + 2]
add r8, 2
add rdx, 4
add eax, r11d
add eax, ecx
xor ecx, 1
sar eax, 1
mov word [r8 - 2], ax
cmp rdx, rbx
jne 0x1400a7490
add rsi, 8
cmp rbp, rsi
jne 0x1400a7480
add rsp, 0x18
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
add r8, 8
cmp r8, r14
je 0x1400a744b
mov r11, qword [r8]
lea rax, [r11 + r13]
movzx r9d, word [rax - 2]
jmp 0x1400a73a5
mov r10d, ebx
xor edx, edx
jmp 0x1400a73f2
Function at 0x1400a7500
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x18
mov r11, rcx
mov rcx, rdx
mov r10, r8
mov rax, qword [r11 + 0x1a0]
mov edi, dword [r11 + 0x30]
cmp byte [rax + 0x1a], 1
sbb eax, eax
and eax, 7
add eax, 1
imul eax, dword [rdx + 0x1c]
mov edx, eax
lea ebx, [rdx + rdx]
sub ebx, edi
test ebx, ebx
jle 0x1400a765e
movsxd rax, dword [r11 + 0x12c]
test eax, eax
jle 0x1400a765e
lea r14, [r8 + rax*8]
mov eax, ebx
mov esi, ebx
mov dword [rsp + 0xc], edx
and eax, 0xfffffff8
mov qword [rsp + 0x68], rcx
shr esi, 3
mov ebp, ebx
mov dword [rsp + 8], eax
lea r13, [rdi + rdi]
shl rsi, 4
lea r15, [rax + rax]
mov qword [rsp + 0x70], r8
and ebp, 7
mov qword [rsp + 0x78], r9
nop dword [rax + rax]
mov r11, qword [r8]
lea rax, [r11 + r13]
movzx r9d, word [rax - 2]
cmp ebx, 7
jle 0x1400a76fc
movd xmm0, r9d
mov rdx, rax
lea rcx, [rsi + rax]
punpcklwd xmm0, xmm0
pshufd xmm0, xmm0, 0
movdqa xmm1, xmm0
test sil, 0x10
je 0x1400a75d0
lea rdx, [rax + 0x10]
movups xmmword [rax], xmm0
cmp rcx, rdx
je 0x1400a75e0
movups xmmword [rdx], xmm1
add rdx, 0x20
movups xmmword [rdx - 0x10], xmm1
cmp rcx, rdx
jne 0x1400a75d0
test ebp, ebp
je 0x1400a76de
mov edx, dword [rsp + 8]
add rax, r15
mov r10d, ebp
mov ecx, ebx
sub ecx, edx
lea r12d, [rcx - 1]
cmp r12d, 2
jbe 0x1400a7624
movd xmm3, r9d
add rdx, rdi
pshuflw xmm2, xmm3, 0
movq qword [r11 + rdx*2], xmm2
test cl, 3
je 0x1400a763e
and ecx, 0xfffffffc
mov edx, ecx
sub r10d, ecx
lea rax, [rax + rdx*2]
mov word [rax], r9w
cmp r10d, 1
je 0x1400a763e
mov word [rax + 2], r9w
cmp r10d, 2
je 0x1400a763e
mov word [rax + 4], r9w
add r8, 8
cmp r8, r14
jne 0x1400a7590
mov edx, dword [rsp + 0xc]
mov rcx, qword [rsp + 0x68]
mov r10, qword [rsp + 0x70]
mov r9, qword [rsp + 0x78]
movsxd rax, dword [rcx + 0xc]
test eax, eax
jle 0x1400a76cd
test edx, edx
je 0x1400a76cd
lea rdi, [rax + rax]
lea rsi, [rdx + rdx]
xor ebp, ebp
nop dword [rax]
mov rbx, qword [r9 + rbp*4]
mov r11, qword [r10 + rbp*8]
xor edx, edx
mov ecx, 1
mov r8, qword [r10 + rbp*8 + 8]
nop dword [rax]
movzx r12d, word [r11 + rdx*2 + 2]
movzx eax, word [r11 + rdx*2]
add eax, r12d
movzx r12d, word [r8 + rdx*2]
add eax, r12d
movzx r12d, word [r8 + rdx*2 + 2]
add eax, r12d
add eax, ecx
xor ecx, 3
sar eax, 2
mov word [rbx + rdx], ax
add rdx, 2
cmp rdx, rsi
jne 0x1400a7690
add rbp, 2
cmp rbp, rdi
jne 0x1400a7678
add rsp, 0x18
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
add r8, 8
cmp r8, r14
je 0x1400a764b
mov r11, qword [r8]
lea rax, [r11 + r13]
movzx r9d, word [rax - 2]
jmp 0x1400a75a5
mov r10d, ebx
xor edx, edx
jmp 0x1400a75f2
Function at 0x1400adb40
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov r14d, dword [rcx + 0x30]
mov rdi, rdx
mov rdx, qword [rcx + 0x1a0]
mov rbx, r8
mov rsi, r9
cmp byte [rdx + 0x1a], 1
sbb r12d, r12d
and r12d, 7
add r12d, 1
imul r12d, dword [rdi + 0x1c]
lea r13d, [r12 + r12]
sub r13d, r14d
test r13d, r13d
jle 0x1400adbbc
movsxd rax, dword [rcx + 0x12c]
test eax, eax
jle 0x1400adbbc
mov rbp, r8
lea r15, [r8 + rax*8]
movsxd r13, r13d
nop dword [rax]
mov rcx, qword [rbp]
mov r8, r13
add rbp, 8
add rcx, r14
movzx edx, byte [rcx - 1]
call sym.memset
cmp rbp, r15
jne 0x1400adba0
mov eax, dword [rdi + 0xc]
test eax, eax
jle 0x1400adc1d
test r12d, r12d
je 0x1400adc1d
mov ebp, r12d
xor r11d, r11d
add rbp, rbp
nop dword [rax]
mov rdx, qword [rbx + r11*8]
mov r8, qword [rsi + r11*8]
xor ecx, ecx
lea r10, [rdx + rbp]
nop word cs:[rax + rax]
movzx eax, byte [rdx]
movzx r9d, byte [rdx + 1]
add r8, 1
add rdx, 2
add eax, r9d
add eax, ecx
xor ecx, 1
sar eax, 1
mov byte [r8 - 1], al
cmp rdx, r10
jne 0x1400adbf0
add r11, 1
cmp dword [rdi + 0xc], r11d
jg 0x1400adbd8
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x1400adc30
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov r14d, dword [rcx + 0x30]
mov rsi, rdx
mov rdx, qword [rcx + 0x1a0]
mov rdi, r8
mov rbx, r9
cmp byte [rdx + 0x1a], 1
sbb r11d, r11d
and r11d, 7
add r11d, 1
imul r11d, dword [rsi + 0x1c]
lea r12d, [r11 + r11]
mov r13d, r11d
sub r12d, r14d
test r12d, r12d
jle 0x1400adcac
movsxd rax, dword [rcx + 0x12c]
test eax, eax
jle 0x1400adcac
mov rbp, r8
lea r15, [r8 + rax*8]
movsxd r12, r12d
nop dword [rax]
mov rcx, qword [rbp]
mov r8, r12
add rbp, 8
add rcx, r14
movzx edx, byte [rcx - 1]
call sym.memset
cmp rbp, r15
jne 0x1400adc90
mov eax, dword [rsi + 0xc]
test eax, eax
jle 0x1400add19
test r13d, r13d
je 0x1400add19
xor ebp, ebp
mov r11d, r13d
nop dword [rax]
mov r8, qword [rbx + rbp*8]
mov r10, qword [rdi]
xor edx, edx
mov ecx, 1
mov r9, qword [rdi + 8]
nop word [rax + rax]
movzx r12d, byte [r10 + rdx*2 + 1]
movzx eax, byte [r10 + rdx*2]
add eax, r12d
movzx r12d, byte [r9 + rdx*2]
add eax, r12d
movzx r12d, byte [r9 + rdx*2 + 1]
add eax, r12d
add eax, ecx
xor ecx, 3
sar eax, 2
mov byte [r8 + rdx], al
add rdx, 1
cmp rdx, r11
jne 0x1400adcd8
add rbp, 1
add rdi, 0x10
cmp dword [rsi + 0xc], ebp
jg 0x1400adcc0
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400ceb30
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x38
mov edx, 0x8004667e
mov dword [rsp + 0x2c], 1
lea r8, [rsp + 0x2c]
call qword [sym.imp.WS2_32.dll_ioctlsocket]
add rsp, 0x38
ret

Function at 0x1400cec00
Capabilities:
Initialize winsock library

Disassembly:
sub rsp, 0x1c8
mov ecx, 0x202
lea rdx, [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_WSAStartup]
call sym.SocketBuffer_initialize
call sym.ListInitialize
mov qword [0x14013b400], rax
call sym.ListInitialize
pxor xmm0, xmm0
mov dword [0x14013b410], 0
mov qword [0x14013b408], rax
mov eax, 0xffffffff
mov qword [0x14013b428], rax
movups xmmword [0x14013b418], xmm0
movaps xmmword [0x14013b430], xmm0
add rsp, 0x1c8
ret

Function at 0x1400cecf0
Capabilities:
Set socket configuration

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rsi, qword [0x14011ed70]
mov rbx, rcx
mov rcx, qword [rsi]
call sym.Paho_thread_lock_mutex
mov eax, dword [0x14013b410]
mov rcx, qword [0x14013b418]
lea edx, [rax + 1]
mov dword [0x14013b410], edx
test rcx, rcx
je 0x1400cee10
shl rdx, 4
call sym.realloc
mov qword [0x14013b418], rax
test rax, rax
je 0x1400cee30
mov edx, dword [0x14013b410]
mov rcx, qword [0x14013b420]
shl rdx, 4
test rcx, rcx
je 0x1400cee20
call sym.realloc
mov qword [0x14013b420], rax
test rax, rax
je 0x1400cee30
mov edx, dword [0x14013b410]
mov r10, qword [0x14013b418]
lea r9, [sym.cmpfds]
lea ecx, [rdx - 1]
shl rcx, 4
lea r8, [r10 + rcx]
add rax, rcx
mov ecx, 0x300
mov qword [r8], rbx
mov qword [rax], rbx
mov word [r8 + 8], cx
mov r8d, 0x10
mov rcx, r10
mov word [rax + 8], r8w
mov r8d, 0x10
call sym.qsort
mov edx, dword [0x14013b410]
mov rcx, qword [0x14013b420]
lea r9, [sym.cmpfds]
mov r8d, 0x10
call sym.qsort
mov rcx, rbx
lea r8, [rsp + 0x2c]
mov dword [rsp + 0x2c], 1
mov edx, 0x8004667e
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov ebx, eax
cmp eax, 0xffffffff
je 0x1400cee37
mov rcx, qword [rsi]
call sym.Paho_thread_unlock_mutex
mov eax, ebx
add rsp, 0x38
pop rbx
pop rsi
ret
mov ecx, edx
shl rcx, 4
call sym.malloc
jmp 0x1400ced30
mov rcx, rdx
call sym.malloc
jmp 0x1400ced5f
mov ebx, 0xffffff9d
jmp 0x1400cedfb
lea r8, str.addSocket:_setnonblocking
mov edx, 0xffffffff
mov ecx, 5
call sym.Log
jmp 0x1400cedfb
Function at 0x1400cef20
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rsi, rcx
mov rdi, rdx
call sym.SocketBuffer_getQueuedChar
mov ebx, eax
cmp eax, 0xffffffea
je 0x1400cef48
mov eax, ebx
add rsp, 0x40
pop rbx
pop rsi
pop rdi
ret
xor r9d, r9d
mov r8d, 1
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
je 0x1400cef80
test eax, eax
je 0x1400cefd2
mov ebx, eax
cmp eax, 1
jne 0x1400cef39
movsx edx, byte [rdi]
mov rcx, rsi
xor ebx, ebx
call sym.SocketBuffer_queueChar
jmp 0x1400cef39
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
cmp eax, 0x2714
je 0x1400cefe0
cmp eax, 0x2733
je 0x1400ceff0
cmp eax, 0x2734
je 0x1400cefd2
mov ecx, eax
call sym.strerror
mov qword [rsp + 0x30], rsi
mov edx, 0xffffffff
lea r8, str.Socket_error__s__d__in__s_for_socket__d
mov r9, rax
lea rax, str.recv___getch
mov dword [rsp + 0x20], edi
mov ecx, 3
mov qword [rsp + 0x28], rax
call sym.Log
mov ebx, 0xffffffff
jmp 0x1400cef39
cmp eax, 0x2733
jne 0x1400cefd2
nop word [rax + rax]
xor edx, edx
mov rcx, rsi
call sym.SocketBuffer_interrupted
jmp 0x1400cef39

Function at 0x1400cf000
Capabilities:
Receive data
Receive data on socket

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rdi, rcx
mov rbx, rdx
mov rsi, r8
mov r12, r9
test rdx, rdx
je 0x1400cf0a0
call sym.SocketBuffer_getQueuedData
mov r8d, ebx
xor r9d, r9d
mov rcx, rdi
mov rbp, rax
mov rax, qword [rsi]
lea rdx, [rbp + rax]
sub r8d, eax
call qword [sym.imp.WS2_32.dll_recv]
mov dword [r12], eax
cmp eax, 0xffffffff
je 0x1400cf0d0
test eax, eax
je 0x1400cf128
movsxd rdx, eax
add rdx, qword [rsi]
mov qword [rsi], rdx
mov rcx, rdi
cmp rdx, rbx
je 0x1400cf0b8
call sym.SocketBuffer_interrupted
mov rax, qword [rsi]
mov r9d, ebx
mov edx, 0xffffffff
lea r8, str._d_bytes_expected_but__d_bytes_now_received
mov ecx, 1
mov dword [rsp + 0x20], eax
call sym.Log
mov rax, rbp
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sym.SocketBuffer_complete
call sym.SocketBuffer_complete
mov rax, rbp
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r13d, eax
cmp eax, 0x2714
je 0x1400cf130
cmp eax, 0x2733
je 0x1400cf130
cmp eax, 0x2734
je 0x1400cf148
mov ecx, eax
call sym.strerror
mov qword [rsp + 0x30], rdi
mov edx, 0xffffffff
lea r8, str.Socket_error__s__d__in__s_for_socket__d
mov r9, rax
lea rax, str.recv___getdata
mov dword [rsp + 0x20], r13d
mov ecx, 3
mov qword [rsp + 0x28], rax
call sym.Log
mov dword [r12], r13d
xor ebp, ebp
jmp 0x1400cf08e
mov dword [r12], r13d
cmp r13d, 0x2733
jne 0x1400cf128
mov rdx, qword [rsi]
jmp 0x1400cf061
mov dword [r12], 0x2734
xor ebp, ebp
jmp 0x1400cf08e
Function at 0x1400cf190
Capabilities:
Send data
Send data on socket

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x40
mov dword [r9], 0
mov rsi, rcx
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.WS2_32.dll_WSASend]
mov ebx, eax
cmp eax, 0xffffffff
je 0x1400cf1d8
mov eax, ebx
add rsp, 0x40
pop rbx
pop rsi
pop rdi
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
cmp eax, 0x2714
je 0x1400cf230
cmp eax, 0x2733
je 0x1400cf230
cmp eax, 0x2734
je 0x1400cf1c8
mov ecx, eax
call sym.strerror
mov qword [rsp + 0x30], rsi
mov edx, 0xffffffff
lea r8, str.Socket_error__s__d__in__s_for_socket__d
mov r9, rax
lea rax, str.WSASend___putdatas
mov dword [rsp + 0x20], edi
mov ecx, 3
mov qword [rsp + 0x28], rax
call sym.Log
jmp 0x1400cf1c8
cmp edi, 0x2733
mov eax, 0xffffffea
cmove ebx, eax
mov eax, ebx
add rsp, 0x40
pop rbx
pop rsi
pop rdi
ret
Function at 0x1400d14b0
Capabilities:
Move file

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov esi, ecx
mov rcx, qword [0x14013b728]
mov rbx, rdx
test rcx, rcx
je 0x1400d150d
mov r8, rdx
lea rdx, [0x140118e50]
call sym.fprintf.constprop.0_1
mov ecx, 1
mov rdi, qword [dbg.__acrt_iob_func]
call rdi
mov rcx, qword [0x14013b728]
cmp rcx, rax
je 0x1400d1508
mov eax, dword [0x14013b710]
add eax, 1
cmp eax, dword [0x1400f1964]
mov dword [0x14013b710], eax
jge 0x1400d1540
call sym.fflush
mov rax, qword [0x14013b708]
test rax, rax
je 0x1400d1530
mov rdx, rbx
mov ecx, esi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp rax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
call sym.fclose
mov rcx, qword [0x14013b718]
call qword [sym.imp.msvcrt.dll__unlink]
mov rdx, qword [0x14013b718]
mov rcx, qword [0x14013b720]
call sym.rename
mov rcx, qword [0x14013b720]
lea rdx, [0x140118e54]
call sym.fopen
mov qword [0x14013b728], rax
test rax, rax
je 0x1400d1598
mov dword [0x14013b710], 0
jmp 0x1400d150d
mov ecx, 1
call rdi
mov qword [0x14013b728], rax
jmp 0x1400d1584

Function at 0x1400d15b0
Capabilities:
Move file

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
mov eax, dword [0x1400f1960]
mov esi, ecx
mov rbx, rdx
cmp eax, 0xffffffff
je 0x1400d16c0
cmp eax, ecx
jg 0x1400d16cc
mov rdx, qword [0x14013b728]
test rdx, rdx
je 0x1400d16d8
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__localtime64]
lea r8, str._Y_m_d__H_M_S
mov edx, 0x50
lea rcx, [0x14013b507]
mov r9, rax
call sym.strftime
movzx r9d, word [rbx + 8]
mov edx, 0x1ea
mov rdi, qword [sym.imp.msvcrt.dll__snprintf]
lea r8, str.._.3hu
lea rcx, [0x14013b516]
call rdi
mov r9d, dword [rbx + 0x10]
lea r8, str.__.4d_
mov edx, 0x200
lea rcx, [0x14013b500]
call rdi
cmp dword [rbx + 0x128], 2
mov byte [0x14013b506], 0x20
je 0x1400d1740
mov edx, dword [rbx + 0x130]
mov ecx, dword [rbx + 0x14]
call sym.Messages_get
cmp dword [rbx + 0x128], 1
mov r8, rax
mov eax, dword [rbx + 0x1c]
je 0x1400d16f0
mov edx, dword [rbx + 0x124]
lea rcx, [0x14013b51b]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x40], edx
lea rdx, [rbx + 0x20]
mov qword [rsp + 0x38], rdx
lea rdx, [0x140118e74]
mov qword [rsp + 0x28], rdx
mov edx, 0x1e5
mov r9d, dword [rbx + 0x18]
call rdi
lea rdx, [0x14013b507]
mov ecx, esi
add rsp, 0x50
pop rbx
pop rsi
pop rdi
jmp fcn.1400d14b0
cmp dword [0x1400f1970], ecx
jle 0x1400d15d3
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp qword [0x14013b708], 0
jne 0x1400d15e3
jmp 0x1400d16b2
mov edx, dword [rbx + 0x12c]
lea rcx, [0x14013b51b]
mov dword [rsp + 0x48], edx
mov edx, dword [rbx + 0x124]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x40], edx
lea rdx, [rbx + 0x20]
mov qword [rsp + 0x38], rdx
lea rdx, [0x140118e74]
mov qword [rsp + 0x28], rdx
mov edx, 0x1e5
mov dword [rsp + 0x20], eax
mov r9d, dword [rbx + 0x18]
call rdi
jmp 0x1400d16ab
lea rdx, [rbx + 0x20]
mov r8d, 0x1e5
lea rcx, [0x14013b51b]
call sym.strncpy
jmp 0x1400d16ab
Function at 0x1400d2fa0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx + 0xc8]
mov rbx, rcx
mov r8, rdx
test rax, rax
je 0x1400d2fe8
mov rdx, qword [rcx]
mov r9, qword [rax]
lea rcx, [rcx + 0xc0]
call qword [rax + 8]
test eax, eax
je 0x1400d2fd8
add rsp, 0x20
pop rbx
ret
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp sym.MQTTPersistence_restorePackets
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x1400d38b0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
mov r8, rcx
mov r9, rdx
xor ecx, ecx
xor edx, edx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
add rsp, 0x38
jmp qword [sym.imp.KERNEL32.dll_CloseHandle]

Function at 0x1400d3d00
Capabilities:
Query environment variable

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
or byte [rdx + 0x20], 8
mov rbx, rdx
mov rdx, qword [rdx + 0x100]
mov rsi, rcx
mov edi, r8d
mov ebp, r9d
test rdx, rdx
je 0x1400d3ec0
lea rax, str.http:__
lea r9, [rbx + 0x58]
mov rcx, rbx
mov qword [rsp + 0x20], rax
lea r8, [rbx + 0x50]
call sym.MQTTProtocol_setHTTPProxy
test eax, eax
je 0x1400d3d58
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov r9, qword [rbx + 0x50]
mov edx, 0xffffffff
mov ecx, 4
lea r8, str.Setting_http_proxy_to__s
call sym.Log
mov r9, qword [rbx + 0x58]
test r9, r9
je 0x1400d3d91
lea r8, str.Setting_http_proxy_auth_to__s
mov edx, 0xffffffff
mov ecx, 4
call sym.Log
mov rcx, qword [rbx + 0x50]
test rcx, rcx
je 0x1400d3e20
lea rdx, [rsp + 0x3c]
mov r9d, 0x1f90
lea r12, [rbx + 0x30]
xor r8d, r8d
call sym.MQTTProtocol_addressPort
mov rcx, qword [rbx + 0x50]
mov r8d, dword [rsp + 0x3c]
mov r9, r12
mov rdx, rax
call sym.Socket_new
lea edx, [rax - 0x2733]
cmp edx, 1
jbe 0x1400d3e64
test eax, eax
jne 0x1400d3d4a
cmp qword [rbx + 0x50], 0
je 0x1400d3e80
movzx eax, word [rbx + 0x20]
xor edx, edx
mov r8, rsi
mov rcx, r12
and ax, 0xfc3f
or ax, 0x140
mov word [rbx + 0x20], ax
call sym.Proxy_connect
test edi, edi
jne 0x1400d3ee0
test eax, eax
je 0x1400d3e84
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
cmp edi, 1
lea rdx, [rsp + 0x3c]
lea r12, [rbx + 0x30]
mov rcx, rsi
sbb eax, eax
xor r8d, r8d
and eax, 0x70b
lea r9d, [rax + 0x50]
call sym.MQTTProtocol_addressPort
mov r8d, dword [rsp + 0x3c]
mov r9, r12
mov rcx, rsi
mov rdx, rax
call sym.Socket_new
lea edx, [rax - 0x2733]
cmp edx, 1
ja 0x1400d3dd8
movzx edx, word [rbx + 0x20]
and dx, 0xfc3f
or edx, 0x40
mov word [rbx + 0x20], dx
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
test edi, edi
jne 0x1400d3ee0
mov r9, qword [rsp + 0x98]
mov r8, qword [rsp + 0x90]
mov edx, ebp
mov rcx, rbx
call sym.MQTTPacket_send_connect
test eax, eax
jne 0x1400d3f10
movzx edx, word [rbx + 0x20]
and dx, 0xfc3f
or dh, 1
mov word [rbx + 0x20], dx
jmp 0x1400d3d4a
lea rcx, str.http_proxy
call sym.getenv
mov rdx, rax
test rax, rax
je 0x1400d3d91
jmp 0x1400d3d2a
xor edx, edx
mov r8, rsi
mov rcx, r12
call sym.WebSocket_connect
cmp eax, 0xffffffea
jne 0x1400d3e10
movzx edx, word [rbx + 0x20]
and dx, 0xfc3f
or dl, 0xc0
mov word [rbx + 0x20], dx
jmp 0x1400d3d4a
and word [rbx + 0x20], 0xfc3f
jmp 0x1400d3d4a
Function at 0x1400d4130
Capabilities:
Create directory

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov r13, rcx
mov rcx, r8
mov rbp, rdx
mov rbx, r8
mov rdi, r9
call sym.strlen
lea r12, [rax + 1]
mov rcx, r12
call sym.malloc
mov rsi, rax
test rax, rax
je 0x1400d435d
mov r8, r12
mov rdx, rbx
mov rcx, rax
call sym.memcpy
jmp 0x1400d4183
mov byte [rax], 0x2d
mov edx, 0x3a
mov rcx, rsi
call sym.strchr
test rax, rax
jne 0x1400d4180
mov rcx, rdi
call sym.strlen
mov rcx, rbp
mov r12, rax
call sym.strlen
mov rcx, rsi
mov rbx, rax
call sym.strlen
lea rbx, [r12 + rbx + 3]
add rbx, rax
mov rcx, rbx
call sym.malloc
mov r12, rax
test rax, rax
je 0x1400d4364
mov rcx, rax
mov qword [rsp + 0x28], rsi
mov r9, rdi
mov rdx, rbx
mov qword [rsp + 0x20], rbp
lea r8, str._s__s__s
call qword [sym.imp.msvcrt.dll__snprintf]
mov rcx, r12
cdqe
cmp rax, rbx
jae 0x1400d4331
call sym.strlen
lea rdi, [rax + 1]
mov rcx, rdi
call sym.malloc
mov rbx, rax
test rax, rax
je 0x1400d434d
mov rcx, rdi
call sym.malloc
mov r14, rax
test rax, rax
je 0x1400d4345
mov r8, rdi
mov rdx, r12
mov rcx, rax
call sym.memcpy
movzx eax, byte [r14]
cmp al, 0x2f
je 0x1400d42d0
cmp al, 0x5c
je 0x1400d42d0
lea rdi, [0x140119149]
mov rcx, r14
mov rdx, rdi
call sym.strtok
mov rcx, rbx
mov rdx, rax
call sym.strcpy
mov rbp, qword [sym.imp.msvcrt.dll__mkdir]
mov rcx, rbx
call rbp
test eax, eax
jne 0x1400d42b4
nop dword [rax]
mov rdx, rdi
xor ecx, ecx
call sym.strtok
mov r15, rax
test rax, rax
je 0x1400d4300
mov rcx, rbx
call sym.strlen
mov rdx, r15
mov byte [rbx + rax], 0x2f
lea rcx, [rbx + rax + 1]
call sym.strcpy
mov rcx, rbx
call rbp
test eax, eax
je 0x1400d4280
call qword [sym.imp.msvcrt.dll__errno]
cmp dword [rax], 0x11
je 0x1400d4280
mov rdx, rdi
xor ecx, ecx
mov edi, 0xfffffffe
call sym.strtok
jmp 0x1400d4302
mov byte [rbx], al
lea rdi, [0x140119149]
lea rcx, [r14 + 1]
mov rdx, rdi
call sym.strtok
lea rcx, [rbx + 1]
mov rdx, rax
call sym.strcpy
jmp 0x1400d426d
xor edi, edi
mov qword [r13], r12
mov rcx, r14
call sym.free
mov rcx, rbx
call sym.free
mov rcx, rsi
call sym.free
mov eax, edi
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
call sym.free
mov rcx, rsi
mov edi, 0xfffffffe
call sym.free
jmp 0x1400d431e
mov rcx, rbx
call sym.free
mov rcx, r12
call sym.free
mov rcx, rsi
call sym.free
mov edi, 0xffffff9d
jmp 0x1400d431e
mov rcx, rsi
call sym.free
jmp 0x1400d435d

Function at 0x1400d4370
Capabilities:
Create directory

Disassembly:
sub rsp, 0x28
call qword [sym.imp.msvcrt.dll__mkdir]
test eax, eax
jne 0x1400d4388
xor eax, eax
add rsp, 0x28
ret
call qword [sym.imp.msvcrt.dll__errno]
cmp dword [rax], 0x11
je 0x1400d437e
mov eax, 0xfffffffe
jmp 0x1400d4380