joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400281f0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push r12
push r13
sub rsp, 0x50
mov rsi, rdx
mov r13d, 1
mov r12d, r9d
mov edx, r13d
mov rbp, r8
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x140028448
cmp qword [rbx + 0x38], 0xffffffffffffffff
je 0x140028448
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x78], r14
xor r14d, r14d
mov dword [rbx + 0x10], r14d
test r13b, r12b
je 0x1400282ce
cmp word [rbx + 0x80], r14w
jne 0x140028272
mov rdx, rbp
mov rcx, rbx
call fcn.1400274b0
cmp dword [rbx + 0x10], r14d
jne 0x140028438
mov word [rbx + 0x80], r13w
mov r8, qword [rbp + 0x28]
mov rdx, rsi
mov rcx, rbx
call fcn.1400277e0
mov qword [rbp + 0x28], rax
cmp dword [rbx + 0x10], r14d
jne 0x1400282b9
cmp qword [rbx + 0xf8], r14
je 0x1400282b9
mov eax, 5
mov rdi, qword [rsp + 0x70]
mov r14, qword [rsp + 0x78]
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rsi
ret
mov rcx, rbx
mov word [rbx + 0x80], r14w
call fcn.140027420
mov eax, dword [rbx + 0x10]
jmp 0x140028299
test byte [rbp + 8], 0x10
je 0x1400282fd
test r12b, 2
je 0x1400282f9
mov edx, r13d
mov rcx, rsi
test r12d, r12d
jns 0x1400282ec
call fcn.140028100
jmp 0x1400282f1
call fcn.140028030
test eax, eax
je 0x140028434
xor eax, eax
jmp 0x140028299
cmp r12d, 4
je 0x14002835e
mov edi, r12d
xor edx, edx
mov rcx, rsi
and edi, 0x80000000
je 0x14002831a
call fcn.140028100
jmp 0x14002831f
call fcn.140028030
test eax, eax
je 0x140028434
mov eax, dword [rbp + 8]
mov qword [rsp + 0x30], r14
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
mov rcx, rsi
test edi, edi
je 0x140028355
call qword [sym.imp.KERNEL32.dll_CreateFileW]
jmp 0x14002835b
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rsi, 0xffffffffffffffff
je 0x140028434
mov rdx, rbp
mov rcx, rbx
call fcn.1400274b0
cmp dword [rbx + 0x10], r14d
jne 0x140028415
cmp qword [rbx + 0x58], r14
jne 0x1400283a0
mov edx, 0x4000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov qword [rbx + 0x58], rax
test rax, rax
jne 0x1400283a0
mov dword [rbx + 0x10], 2
cmp dword [rbx + 0x10], r14d
jne 0x140028415
nop word [rax + rax]
mov rdx, qword [rbx + 0x58]
mov r8d, 0x4000
mov rcx, rbx
call fcn.1400277e0
mov rdi, rax
test eax, eax
je 0x1400283fa
mov rdx, qword [rbx + 0x58]
lea r9, [rsp + 0x40]
mov r8d, eax
mov rcx, rsi
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400283ed
cmp dword [rsp + 0x40], edi
je 0x1400283f4
mov dword [rbx + 0x10], 3
cmp dword [rbx + 0x10], r14d
je 0x1400283b0
cmp dword [rbx + 0x10], r14d
jne 0x140028415
lea r9, [rbp + 0x1c]
lea r8, [rbp + 0xc]
lea rdx, [rbp + 0x14]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetFileTime]
cmp r12d, 4
je 0x140028438
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call fcn.140027420
mov eax, dword [rbx + 0x10]
jmp 0x140028299
mov dword [rbx + 0x10], r13d
mov rcx, rbx
call fcn.140027420
mov eax, dword [rbx + 0x10]
jmp 0x140028299
mov eax, 9
jmp 0x1400282a3
Function at 0x14002a520
Capabilities:
Hash data with crc32
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbx, rcx
call fcn.14002a440
mov r8d, dword [rbx + 0x1af88]
lea eax, [r8 + 3]
cmp eax, dword [rbx + 0x1af8c]
jb 0x14002a569
mov rdx, qword [rbx + 0x1af80]
mov rcx, qword [rbx]
call fcn.14002ba80
mov dword [rbx + 0x1af88], 0
mov ecx, dword [rbx + 0x1af88]
mov rax, qword [rbx + 0x1af80]
mov byte [rcx + rax], dil
inc dword [rbx + 0x1af88]
mov edx, dword [rbx + 0x1af88]
mov rax, qword [rbx + 0x1af80]
movzx ecx, di
shr cx, 8
mov byte [rdx + rax], cl
inc dword [rbx + 0x1af88]
mov edx, dword [rbx + 0x1af88]
mov rax, qword [rbx + 0x1af80]
movzx ecx, dil
not cl
mov byte [rdx + rax], cl
inc dword [rbx + 0x1af88]
mov edx, dword [rbx + 0x1af88]
mov rax, qword [rbx + 0x1af80]
movzx ecx, di
not cx
shr cx, 8
mov byte [rdx + rax], cl
inc dword [rbx + 0x1af88]
mov r8d, dword [rbx + 0x1af88]
mov rdx, qword [rbx + 0x1af80]
mov rcx, qword [rbx]
call fcn.14002ba80
mov rcx, qword [rbx]
mov r8d, edi
mov rdx, rsi
mov dword [rbx + 0x1af88], 0
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.14002ba80

Function at 0x14002adb0
Capabilities:
Hash data with crc32
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
mov edx, 0x8074b50
mov rcx, rbx
call fcn.14002b8e0
mov edx, 0x807
mov rcx, rbx
call fcn.14002b8e0
mov edx, dword [rdi + 8]
mov rcx, rbx
call fcn.14002b8e0
movzx edx, word [rdi + 0xa]
mov rcx, rbx
call fcn.14002b8e0
mov esi, 0xffffffff
mov rcx, rbx
cmp qword [rdi + 0x10], rsi
jb 0x14002ae0f
mov edx, esi
call fcn.14002b8e0
mov edx, esi
jmp 0x14002ae1f
mov edx, dword [rdi + 0x10]
call fcn.14002b8e0
mov rdx, qword [rdi + 0x10]
shr rdx, 0x10
mov rcx, rbx
call fcn.14002b8e0
mov rcx, rbx
cmp qword [rdi + 0x18], rsi
jb 0x14002ae3b
mov edx, esi
call fcn.14002b8e0
mov edx, esi
jmp 0x14002ae4b
mov edx, dword [rdi + 0x18]
call fcn.14002b8e0
mov rdx, qword [rdi + 0x18]
shr rdx, 0x10
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.14002b8e0
Function at 0x14002ae70
Capabilities:
Hash data with crc32
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rdx
mov edx, dword [rcx + 4]
mov rdi, rcx
mov rcx, rbx
call fcn.14002b8e0
movzx edx, word [rdi + 6]
mov rcx, rbx
call fcn.14002b8e0
mov edx, dword [rdi + 8]
mov rcx, rbx
call fcn.14002b8e0
movzx edx, word [rdi + 0xa]
mov rcx, rbx
call fcn.14002b8e0
mov esi, 0xffffffff
mov rcx, rbx
cmp qword [rdi + 0x10], rsi
jb 0x14002aecc
mov edx, esi
call fcn.14002b8e0
mov edx, esi
jmp 0x14002aedc
mov edx, dword [rdi + 0x10]
call fcn.14002b8e0
mov rdx, qword [rdi + 0x10]
shr rdx, 0x10
mov rcx, rbx
call fcn.14002b8e0
mov rcx, rbx
cmp qword [rdi + 0x18], rsi
jb 0x14002aef8
mov edx, esi
call fcn.14002b8e0
mov edx, esi
jmp 0x14002af08
mov edx, dword [rdi + 0x18]
call fcn.14002b8e0
mov rdx, qword [rdi + 0x18]
shr rdx, 0x10
mov rcx, rbx
call fcn.14002b8e0
mov edx, dword [rdi + 0x20]
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.14002b8e0
Function at 0x14002af30
Capabilities:
Hash data with crc32
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
test dword [rdx], 0x80000000
mov rdi, rcx
mov rbx, rdx
mov rcx, rdx
je 0x14002afa3
mov edx, 0x8b1f
call fcn.14002b8e0
mov edx, 0x808
mov rcx, rbx
call fcn.14002b8e0
mov edx, dword [rdi + 4]
mov rcx, rbx
call fcn.14002b8e0
movzx edx, word [rdi + 6]
mov rcx, rbx
call fcn.14002b8e0
mov edx, 0xb02
mov rcx, rbx
call fcn.14002b8e0
mov r8d, dword [rdi + 0x20]
lea rdx, [rdi + 0x50]
inc r8d
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.14002ba80
mov edx, 0x4034b50
call fcn.14002b8e0
mov edx, 0x403
mov rcx, rbx
call fcn.14002b8e0
mov edx, 0x2d
mov rcx, rbx
call fcn.14002b8e0
movzx edx, word [rdi + 0x30]
mov rcx, rbx
call fcn.14002b8e0
movzx edx, word [rdi + 2]
mov rcx, rbx
call fcn.14002b8e0
mov edx, dword [rdi + 4]
mov rcx, rbx
call fcn.14002b8e0
movzx edx, word [rdi + 6]
mov rcx, rbx
call fcn.14002b8e0
mov edx, dword [rdi + 8]
mov rcx, rbx
call fcn.14002b8e0
movzx edx, word [rdi + 0xa]
mov rcx, rbx
call fcn.14002b8e0
or edx, 0xffffffff
mov rcx, rbx
call fcn.14002b8e0
or edx, 0xffffffff
mov rcx, rbx
call fcn.14002b8e0
or edx, 0xffffffff
mov rcx, rbx
call fcn.14002b8e0
or edx, 0xffffffff
mov rcx, rbx
call fcn.14002b8e0
mov edx, dword [rdi + 0x20]
mov rcx, rbx
call fcn.14002b8e0
mov edx, dword [rdi + 0x24]
mov rcx, rbx
add edx, 0x14
call fcn.14002b8e0
mov r8d, dword [rdi + 0x20]
lea rdx, [rdi + 0x50]
mov rcx, rbx
call fcn.14002ba80
mov edx, 1
mov rcx, rbx
call fcn.14002b8e0
mov edx, reloc.WSOCK32.dll_recv
mov rcx, rbx
call fcn.14002b8e0
mov edx, dword [rdi + 0x18]
mov rcx, rbx
call fcn.14002b8e0
mov rdx, qword [rdi + 0x18]
mov rcx, rbx
shr rdx, 0x10
call fcn.14002b8e0
mov rdx, qword [rdi + 0x18]
mov rcx, rbx
shr rdx, 0x20
call fcn.14002b8e0
movzx edx, word [rdi + 0x1e]
mov rcx, rbx
call fcn.14002b8e0
mov edx, dword [rdi + 0x10]
mov rcx, rbx
call fcn.14002b8e0
mov rdx, qword [rdi + 0x10]
mov rcx, rbx
shr rdx, 0x10
call fcn.14002b8e0
mov rdx, qword [rdi + 0x10]
mov rcx, rbx
shr rdx, 0x20
call fcn.14002b8e0
movzx edx, word [rdi + 0x16]
mov rcx, rbx
call fcn.14002b8e0
mov r8d, dword [rdi + 0x24]
test r8d, r8d
je 0x14002b0ff
mov rdx, qword [rdi + 0x40]
mov rcx, rbx
call fcn.14002ba80
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14002b790
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 8
mov r11d, r8d
mov r10, rdx
mov r9d, ecx
test rdx, rdx
jne 0x14002b7a9
xor eax, eax
add rsp, 8
ret
mov qword [rsp], rdi
not r9d
lea rdi, [0x140118b60]
cmp r11d, 8
jb 0x14002b8a1
mov qword [rsp + 0x10], rbx
mov rbx, r11
shr rbx, 3
nop dword [rax]
movzx ecx, byte [r10]
mov eax, r9d
shr r9d, 8
xor rcx, rax
add r10, 8
add r11d, 0xfffffff8
movzx eax, cl
movzx ecx, byte [r10 - 7]
mov edx, dword [rdi + rax*4]
xor edx, r9d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r10 - 6]
mov r8d, dword [rdi + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r10 - 5]
mov edx, dword [rdi + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r10 - 4]
mov r8d, dword [rdi + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r10 - 3]
mov edx, dword [rdi + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r10 - 2]
mov r8d, dword [rdi + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r10 - 1]
mov edx, dword [rdi + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
mov r9d, dword [rdi + rax*4]
xor r9d, edx
dec rbx
jne 0x14002b7d0
mov rbx, qword [rsp + 0x10]
test r11d, r11d
je 0x14002b8cf
nop word [rax + rax]
movzx ecx, byte [r10]
mov eax, r9d
inc r10
xor rcx, rax
shr eax, 8
movzx edx, cl
mov r9d, dword [rdi + rdx*4]
xor r9d, eax
dec r11d
jne 0x14002b8b0
mov rdi, qword [rsp]
not r9d
mov eax, r9d
add rsp, 8
ret
Function at 0x14002b8e0
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
cmp dword [rcx + 0x28], 0
movsxd r11, edx
mov rbx, rcx
jne 0x14002ba6d
mov r10d, r11d
mov byte [rsp + 0x40], r11b
shr r10d, 8
test byte [rcx], 0x10
mov byte [rsp + 0x41], r10b
je 0x14002b9f3
mov r8d, dword [rcx + 0x4c]
mov edx, dword [rcx + 0x44]
movsx rax, r11b
mov ecx, edx
shr edx, 8
mov r9d, r8d
xor rcx, rax
and r9d, 0xfffd
mov qword [rsp + 0x48], rdi
movzx eax, cl
lea rdi, [0x140118b60]
or r9d, 2
mov ecx, dword [rdi + rax*4]
xor ecx, edx
mov dword [rbx + 0x44], ecx
movzx eax, cl
movzx ecx, r8b
add eax, dword [rbx + 0x48]
shr r8d, 8
imul eax, eax, 0x8088405
inc eax
mov dword [rbx + 0x48], eax
movzx eax, byte [rbx + 0x4b]
xor rcx, rax
mov eax, r9d
mov edx, dword [rdi + rcx*4]
xor eax, 1
xor edx, r8d
mov dword [rbx + 0x4c], edx
mov r8d, edx
imul eax, r9d
shr eax, 8
mov r9d, edx
mov edx, dword [rbx + 0x44]
xor al, r11b
mov ecx, edx
shr edx, 8
mov byte [rsp + 0x40], al
movsx rax, r10b
and r9d, 0xfffd
xor rcx, rax
or r9d, 2
movzx eax, cl
mov ecx, dword [rdi + rax*4]
xor ecx, edx
movzx eax, cl
mov dword [rbx + 0x44], ecx
movzx ecx, r8b
add eax, dword [rbx + 0x48]
shr r8d, 8
imul eax, eax, 0x8088405
inc eax
mov dword [rbx + 0x48], eax
movzx eax, byte [rbx + 0x4b]
xor rcx, rax
mov eax, dword [rdi + rcx*4]
mov rdi, qword [rsp + 0x48]
xor eax, r8d
mov dword [rbx + 0x4c], eax
mov eax, r9d
xor eax, 1
imul eax, r9d
shr eax, 8
xor r10b, al
mov byte [rsp + 0x41], r10b
test byte [rbx], 1
je 0x14002ba29
mov rdx, qword [rbx + 0x38]
mov ecx, dword [rbx + 0x40]
lea rax, [rdx + 2]
cmp rax, rcx
jb 0x14002ba15
mov dword [rbx + 0x28], reloc.WSOCK32.dll_inet_ntoa
add rsp, 0x30
pop rbx
ret
mov rcx, qword [rbx + 8]
movzx eax, word [rsp + 0x40]
mov word [rdx + rcx], ax
add qword [rbx + 0x38], 2
jmp 0x14002ba5e
mov rcx, qword [rbx + 8]
lea r9, [rsp + 0x50]
lea rdx, [rsp + 0x40]
mov r8d, 2
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14002ba57
cmp dword [rsp + 0x50], 2
je 0x14002ba5e
mov dword [rbx + 0x28], 3
test dword [rbx], 0x40000000
je 0x14002ba6d
mov dword [rbx + 0x28], reloc.OLEAUT32.dll_SafeArrayLock
add rsp, 0x30
pop rbx
ret
Function at 0x14002ba80
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Hash data with crc32
Write file on windows

Disassembly:
test r8d, r8d
je 0x14002bc38
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
cmp dword [rcx + 0x28], 0
mov edi, r8d
mov rsi, rdx
mov rbx, rcx
jne 0x14002bc29
test byte [rcx], 0x10
je 0x14002bbb4
mov rcx, qword [rcx + 0x50]
test rcx, rcx
je 0x14002bad0
cmp dword [rbx + 0x58], edi
jae 0x14002bad0
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov qword [rbx + 0x50], 0
cmp qword [rbx + 0x50], 0
jne 0x14002bafc
lea eax, [rdi + rdi]
xor ecx, ecx
mov edx, eax
mov dword [rbx + 0x58], eax
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov qword [rbx + 0x50], rax
test rax, rax
jne 0x14002bafc
mov dword [rbx + 0x28], 2
jmp 0x14002bc1a
mov rcx, qword [rbx + 0x50]
mov r8, rdi
mov rdx, rsi
mov qword [rsp + 0x40], rbp
mov rbp, rdi
call sub.MSVCR100.dll_memcpy
test edi, edi
je 0x14002bbab
xor r11d, r11d
lea rsi, [0x140118b60]
nop word [rax + rax]
mov rax, qword [rbx + 0x50]
mov edx, dword [rbx + 0x44]
mov r8d, dword [rbx + 0x4c]
movsx r10, byte [r11 + rax]
mov ecx, edx
shr edx, 8
xor rcx, r10
mov r9d, r8d
inc r11
movzx eax, cl
and r9d, 0xfffd
mov ecx, dword [rsi + rax*4]
or r9d, 2
xor ecx, edx
mov dword [rbx + 0x44], ecx
movzx eax, cl
movzx ecx, r8b
add eax, dword [rbx + 0x48]
shr r8d, 8
imul eax, eax, 0x8088405
inc eax
mov dword [rbx + 0x48], eax
movzx eax, byte [rbx + 0x4b]
xor rcx, rax
mov eax, dword [rsi + rcx*4]
mov ecx, r9d
xor ecx, 1
xor eax, r8d
mov dword [rbx + 0x4c], eax
mov rax, qword [rbx + 0x50]
imul ecx, r9d
shr ecx, 8
xor cl, r10b
dec rbp
mov byte [r11 + rax - 1], cl
jne 0x14002bb30
mov rsi, qword [rbx + 0x50]
mov rbp, qword [rsp + 0x40]
test byte [rbx], 1
je 0x14002bbeb
mov rdx, qword [rbx + 0x38]
mov eax, dword [rbx + 0x40]
lea rcx, [rdx + rdi]
cmp rcx, rax
jb 0x14002bbd2
mov dword [rbx + 0x28], reloc.WSOCK32.dll_inet_ntoa
jmp 0x14002bc1a
mov rax, qword [rbx + 8]
mov r8, rdi
lea rcx, [rdx + rax]
mov rdx, rsi
call sub.MSVCR100.dll_memcpy
add qword [rbx + 0x38], rdi
jmp 0x14002bc1a
mov rcx, qword [rbx + 8]
lea r9, [rsp + 0x50]
mov r8d, edi
mov rdx, rsi
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14002bc13
cmp dword [rsp + 0x50], edi
je 0x14002bc1a
mov dword [rbx + 0x28], 3
test dword [rbx], 0x40000000
je 0x14002bc29
mov dword [rbx + 0x28], reloc.OLEAUT32.dll_SafeArrayLock
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
repz ret
Function at 0x14002bd70
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov eax, dword [rcx]
mov rsi, rdx
mov rbx, rcx
bt eax, 0x1e
jae 0x14002bda6
mov dword [rcx + 0x28], reloc.OLEAUT32.dll_SafeArrayLock
xor eax, eax
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
test al, al
jns 0x14002bde3
mov eax, dword [rcx + 0x8c]
mov edi, dword [rcx + 0x88]
cmp eax, edi
jae 0x14002be09
sub edi, eax
mov edx, eax
cmp edi, r8d
cmova edi, r8d
add rdx, qword [rcx + 0x80]
mov rcx, rsi
mov r8d, edi
mov dword [rsp + 0x40], edi
call sub.MSVCR100.dll_memcpy
add dword [rbx + 0x8c], edi
jmp 0x14002be1f
mov rcx, qword [rcx + 0x80]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14002be1b
mov dword [rbx + 0x28], 7
xor eax, eax
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov edi, dword [rsp + 0x40]
mov ecx, edi
mov r8d, edi
mov rdx, rsi
add qword [rbx + 0x70], rcx
mov ecx, dword [rbx + 0x78]
call fcn.14002b790
mov rsi, qword [rsp + 0x50]
mov dword [rbx + 0x78], eax
mov rbx, qword [rsp + 0x48]
mov eax, edi
add rsp, 0x30
pop rdi
ret
Function at 0x14002d530
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rax, qword [r9]
mov rbp, qword [r9 + 8]
xor esi, esi
movzx r10d, word [rax + 0x14]
mov r13, r9
mov r14, r8
mov r12, rdx
mov r15, rcx
cmp si, word [rax + 6]
jae 0x14002d627
lea rdi, [r10 + rax + 0x28]
mov ecx, dword [rdi]
test ecx, ecx
jne 0x14002d5c8
movsxd rax, dword [r14 + 0x38]
test eax, eax
jle 0x14002d611
mov ecx, dword [rdi - 4]
mov r9d, 0x40
mov r8d, 0x1000
mov rdx, rax
add rcx, rbp
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
je 0x14002d654
mov ecx, dword [rdi - 4]
add rcx, rbp
mov dword [rdi - 8], ecx
test rbx, rbx
je 0x14002d611
mov r8, rbx
xor edx, edx
call sub.MSVCR100.dll_memset
jmp 0x14002d611
test r12, r12
je 0x14002d5d7
mov eax, dword [rdi + 4]
add eax, ecx
cmp r12, rax
jb 0x14002d649
mov rdx, rcx
mov ecx, dword [rdi - 4]
mov r9d, 0x40
add rcx, rbp
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
je 0x14002d654
mov ebx, dword [rdi - 4]
mov edx, dword [rdi + 4]
mov r8d, dword [rdi]
add rbx, rbp
add rdx, r15
mov rcx, rbx
call sub.MSVCR100.dll_memcpy
mov dword [rdi - 8], ebx
mov rax, qword [r13]
inc esi
add rdi, 0x28
movzx ecx, word [rax + 6]
cmp esi, ecx
jl 0x14002d575
mov eax, 1
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov ecx, recv
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x14002d62c
Function at 0x14002e420
Capabilities:
Accept command line arguments
Create thread

Disassembly:
push rbp
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x10], rbx
mov qword [rbp + 0x18], rsi
mov qword [rbp + 0x20], rdi
mov qword [rbp + 0x28], r12
mov rbx, rdx
mov r12, rcx
test rcx, rcx
je 0x14002e5ae
cmp dword [rcx + 0x20], 0
jne 0x14002e5ae
cmp qword [rcx + 0x48], 0
je 0x14002e5ae
cmp dword [rcx + 0x24], 0
je 0x14002e5ae
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
or rcx, 0xffffffffffffffff
mov rsi, rax
xor eax, eax
mov rdi, rsi
repne scasw ax, word [rdi]
mov rdi, rsi
not rcx
lea rcx, [rcx + rcx + 0x10]
cmp rcx, 0x400
ja 0x14002e4d2
or rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
not rcx
lea rcx, [rcx + rcx + 0x10]
lea rax, [rcx + 0xf]
cmp rax, rcx
ja 0x14002e4b4
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.140100df0
sub rsp, rax
lea rdi, [rsp + 0x30]
test rdi, rdi
je 0x14002e4f9
mov dword [rdi], 0xcccc
jmp 0x14002e4f5
or rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
not rcx
lea rcx, [rcx + rcx + 0x10]
call qword [sym.imp.MSVCR100.dll_malloc]
mov rdi, rax
test rax, rax
je 0x14002e4f9
mov dword [rax], 0xdddd
add rdi, 0x10
mov rdx, rdi
mov rcx, rsi
sub rdx, rsi
nop word [rax + rax]
movzx eax, word [rcx]
add rcx, 2
mov word [rdx + rcx - 2], ax
test ax, ax
jne 0x14002e510
mov rcx, rsi
sub rcx, rbx
nop word [rax + rax]
movzx eax, word [rbx]
add rbx, 2
mov word [rcx + rbx - 2], ax
test ax, ax
jne 0x14002e530
mov r8, qword [r12 + 0x48]
xor eax, eax
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.MSVCR100.dll__beginthreadex]
mov edx, WSAAsyncSelect
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rdx, rdi
sub rsi, rdi
nop word [rax + rax]
movzx ecx, word [rdx]
add rdx, 2
mov word [rsi + rdx - 2], cx
test cx, cx
jne 0x14002e580
test rdi, rdi
je 0x14002e5a9
cmp dword [rdi - 0x10], 0xdddd
lea rcx, [rdi - 0x10]
jne 0x14002e5a9
call qword [sym.imp.MSVCR100.dll_free]
mov rax, rbx
jmp 0x14002e5b0
xor eax, eax
mov rbx, qword [rbp + 0x10]
mov rsi, qword [rbp + 0x18]
mov rdi, qword [rbp + 0x20]
mov r12, qword [rbp + 0x28]
mov rsp, rbp
pop rbp
ret
Function at 0x14002e9f0
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
mov qword [rsp + 0x18], rbp
push rdi
push r12
push r13
sub rsp, 0x80
mov r12, rcx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rbp, qword [rsp + 0x28]
mov r13, qword [rsp + 0x30]
cmp r12, 0x40000000
jbe 0x14002ea31
lea rax, [r12 - 0x40000000]
cmp rbp, rax
cmovb rbp, rax
mov rdi, qword [0x14013e4e8]
lea rax, [r12 + 0x40000000]
cmp r13, rax
cmova r13, rax
sub r13, 0xfff
test rdi, rdi
je 0x14002ea70
cmp rdi, rbp
jb 0x14002ea68
cmp rdi, r13
jae 0x14002ea68
cmp qword [rdi + 8], 0
jne 0x14002ebcd
mov rdi, qword [rdi]
test rdi, rdi
jne 0x14002ea53
mov qword [rsp + 0xa0], rbx
mov qword [rsp + 0xa8], rsi
mov rbx, r12
cmp r12, rbp
jb 0x14002eae5
nop dword [rax + rax]
mov esi, dword [rsp + 0x48]
mov rax, rbx
xor edx, edx
div rsi
sub rbx, rdx
sub rbx, rsi
cmp rbx, rbp
jb 0x14002eae5
nop word [rax + rax]
lea rdx, [rsp + 0x50]
mov r8d, gethostbyaddr
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x14002eae5
cmp dword [rsp + 0x70], 0x10000
je 0x14002eb41
mov rbx, qword [rsp + 0x58]
cmp rbx, rsi
jb 0x14002eae5
sub rbx, rsi
cmp rbx, rbp
jae 0x14002eab0
test rdi, rdi
jne 0x14002eb7b
cmp r12, r13
ja 0x14002ebbd
nop word [rax + rax]
mov r8d, dword [rsp + 0x48]
mov rdx, r13
mov rcx, r12
call fcn.14002e950
mov r12, rax
test rax, rax
je 0x14002eb76
mov edx, 0x1000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
test rax, rax
jne 0x14002eb7b
cmp r12, r13
jbe 0x14002eb00
jmp 0x14002ebbd
test rbx, rbx
je 0x14002eae5
mov edx, 0x1000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
test rax, rax
jne 0x14002eb7b
cmp rbx, rbp
jae 0x14002ea90
jmp 0x14002eaee
test rdi, rdi
je 0x14002ebbd
xor eax, eax
lea rcx, [rdi + 0x40]
mov rdx, rcx
mov qword [rdi + 8], rax
mov dword [rdi + 0x10], eax
sub rdx, rdi
nop
mov rax, qword [rdi + 8]
add rdx, 0x40
mov qword [rcx], rax
mov qword [rdi + 8], rcx
add rcx, 0x40
cmp rdx, 0xfc0
jbe 0x14002eb90
mov rax, qword [0x14013e4e8]
mov qword [0x14013e4e8], rdi
mov qword [rdi], rax
mov rsi, qword [rsp + 0xa8]
mov rbx, qword [rsp + 0xa0]
mov rax, rdi
mov rbp, qword [rsp + 0xb0]
add rsp, 0x80
pop r13
pop r12
pop rdi
ret