joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140008454
Capabilities:
Get hostname

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x270
mov rax, qword [0x1402c0ed0]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov edi, ecx
xor r9d, r9d
mov ecx, 0xbe8
xor r8d, r8d
xor edx, edx
call fcn.1400971cc
xor edx, edx
lea rcx, str.Shcore.dll
mov r8d, 0x800
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov qword [rbx + 0x78], rax
test rax, rax
je 0x1400084d3
lea rdx, str.SetProcessDpiAwareness
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x80], rax
test rax, rax
jne 0x1400084d3
mov rcx, qword [rbx + 0x78]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
and qword [rbx + 0x78], 0
mov ecx, 0x18
mov dword [rbx + 0x99c], 4
call fcn.140097620
mov rcx, rax
mov qword [rbx], rax
call fcn.14009ff1c
or edi, 0x118
mov qword [rbx + 0x30], rax
xor edx, edx
mov dword [rbx + 0x98], edi
mov r8d, 0x800
lea rcx, str.Ws2_32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
test rax, rax
je 0x14000853f
lea rdx, str.GetHostNameW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140008586
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor edi, edi
lea rcx, [rbx + 0x9c]
mov edx, 0xff
call qword [sym.imp.WS2_32.dll_gethostname]
test rdi, rdi
je 0x14000855f
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetSystemPowerStatus]
movzx edx, byte [rsp + 0x41]
mov ecx, edx
sub ecx, 0x80
je 0x1400085d7
cmp ecx, 0x7f
je 0x1400085ce
mov dword [rbx + 0x9ac], edx
jmp 0x1400085e1
mov edx, 0x104
lea rcx, [rsp + 0x50]
call rax
test eax, eax
jne 0x140008551
and qword [rsp + 0x38], 0
lea rax, [rbx + 0x9c]
and qword [rsp + 0x30], 0
lea r8, [rsp + 0x50]
mov dword [rsp + 0x28], 0xff
or r9d, 0xffffffff
xor edx, edx
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
jmp 0x140008551
and dword [rbx + 0x9ac], 0
jmp 0x1400085e1
mov dword [rbx + 0x9ac], 3
mov rax, qword [rbx]
mov edx, reloc.WS2_32.dll_recv
test rax, rax
lea rcx, [rax + 0x9a8]
mov rax, rbx
cmove rcx, rdx
mov qword [rcx], rbx
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1401c7020
mov rbx, qword [rsp + 0x280]
add rsp, 0x270
pop rdi
ret
Function at 0x14000cf8c
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov rdi, qword [0x1402c43c8]
xor eax, eax
and dword [rsp + 0x30], 0
mov edx, 0x7f00
xor ecx, ecx
mov qword [rsp + 0x34], rax
mov qword [rsp + 0x3c], rax
mov dword [rsp + 0x44], eax
call qword [sym.imp.USER32.dll_LoadCursorA]
mov rcx, rax
call fcn.14000c9d4
mov edx, 0x7f8a
mov dword [0x1402e9bdc], eax
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorA]
mov rcx, rax
call fcn.14000c9d4
mov edx, 0x7f03
mov dword [0x1402e9bc4], eax
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorA]
mov rcx, rax
call fcn.14000c9d4
mov edx, 0x7f89
mov dword [0x1402e9bcc], eax
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorA]
mov rcx, rax
call fcn.14000c9d4
mov edx, 0x7f8b
mov dword [0x1402e9c50], eax
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorA]
mov rcx, rax
call fcn.14000c9d4
mov edx, 0x7f01
mov dword [0x1402e9bb8], eax
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorA]
mov rcx, rax
call fcn.14000c9d4
mov edx, 0x7f88
mov dword [0x1402e9bd0], eax
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorA]
mov rcx, rax
call fcn.14000c9d4
mov edx, 0x7f86
mov dword [0x1402e9bd8], eax
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorA]
mov rcx, rax
call fcn.14000c9d4
mov edx, 0x7f83
mov dword [0x1402e9be0], eax
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorA]
mov rcx, rax
call fcn.14000c9d4
mov edx, 0x7f85
mov dword [0x1402e9bc8], eax
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorA]
mov rcx, rax
call fcn.14000c9d4
mov edx, 0x7f82
mov dword [0x1402e9bc0], eax
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorA]
mov rcx, rax
call fcn.14000c9d4
mov edx, 0x7f84
mov dword [0x1402e9c54], eax
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorA]
mov rcx, rax
call fcn.14000c9d4
mov edx, 0x7f04
mov dword [0x1402e9bbc], eax
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorA]
mov rcx, rax
call fcn.14000c9d4
mov edx, 0x7f02
mov dword [0x1402e9bd4], eax
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorA]
mov rcx, rax
call fcn.14000c9d4
lea rcx, [rsp + 0x30]
mov dword [0x1402e9be4], eax
mov dword [rsp + 0x30], 0x18
call qword [sym.imp.USER32.dll_GetCursorInfo]
mov rcx, qword [rsp + 0x38]
call fcn.14000c9d4
mov ecx, eax
call fcn.14000c90c
mov ecx, 0x1d
mov dword [reloc.WS2_32.dll_connect], eax
call fcn.1401d0ba8
xor r9d, r9d
mov rcx, rax
xor r8d, r8d
lea edx, [r9 + 5]
call fcn.140096ee8
mov ecx, 0x58
mov rbx, rax
call qword [sym.imp.WS2_32.dll_htons]
mov ecx, 5
mov word [rbx], ax
call qword [sym.imp.WS2_32.dll_htons]
mov dl, byte [reloc.WS2_32.dll_connect]
xor r8d, r8d
mov byte [rbx + 4], dl
mov rcx, rdi
mov rdx, rbx
mov word [rbx + 2], ax
call fcn.14009e264
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor edx, edx
mov ecx, 0x1fffff
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_OpenThread]
and qword [rsp + 0x28], 0
lea r8, [0x14000ce58]
and dword [rsp + 0x20], 0
xor r9d, r9d
xor edx, edx
mov qword [0x1402c4398], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, qword [rsp + 0x60]
mov qword [0x1402c43b8], rax
add rsp, 0x50
pop rdi
ret
Function at 0x14000e6d4
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp qword [0x1402c47a0], 0
mov rbp, r9
mov ebx, edx
mov rdi, rcx
je 0x14000e751
cmp edx, 2
jl 0x14000e73b
movzx ecx, word [rcx]
call qword [sym.imp.WS2_32.dll_ntohs]
cmp ax, 0xa
jne 0x14000e73b
and qword [rsp + 0x28], 0
lea r8, [0x14000d588]
and dword [rsp + 0x20], 0
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x14000e73b
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x1402c47a0]
mov r8d, ebx
mov rdx, rdi
call fcn.1400a1a48
mov eax, ebx
jmp 0x14000e776
xor esi, esi
jmp 0x14000e764
add esi, eax
mov edx, ebx
sub edx, esi
movsxd rcx, esi
add rcx, rdi
mov r9, rbp
lea r8, [0x140001950]
call fcn.14000dddc
test eax, eax
jne 0x14000e755
mov eax, esi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x14000ea14
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
mov eax, 0x7580
call fcn.1401c7590
sub rsp, rax
mov rax, qword [0x1402c0ed0]
xor rax, rsp
mov qword [rsp + 0x7570], rax
mov rsi, qword [rcx]
xor r15d, r15d
mov rbp, qword [rcx + 8]
mov edi, r15d
mov ebx, r15d
mov dword [rsp + 0x30], r15d
jmp 0x14000ead6
mov rcx, qword [0x1402c1a70]
lea rdx, [rsp + 0x40]
mov r8d, 0x7530
movsxd rax, ebx
sub r8d, ebx
mov qword [rsp + 0x20], r15
add rdx, rax
lea r9, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14000eae5
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x14000eae5
cmp dword [0x1402c1a64], r15d
jne 0x14000eae5
add ebx, eax
mov r14d, ebx
jmp 0x14000eaa7
add edi, eax
mov edx, ebx
movsxd rax, edi
lea rcx, [rsp + 0x40]
sub edx, edi
add rcx, rax
mov r9, rbp
mov r8, rsi
call fcn.14000dddc
test eax, eax
jne 0x14000eaa5
cmp edi, ebx
mov eax, r15d
cmove ebx, r15d
cmp edi, r14d
cmovne eax, edi
mov edi, eax
cmp dword [0x1402c1a64], r15d
je 0x14000ea5e
jmp 0x14000eaef
mov dword [0x1402c1a64], 1
xor eax, eax
mov rcx, qword [rsp + 0x7570]
xor rcx, rsp
call fcn.1401c7020
lea r11, [rsp + 0x7580]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x14000f6c8
Capabilities:
Create thread

Disassembly:
push rdi
sub rsp, 0x30
mov rdi, r9
mov r8, rcx
test rdx, rdx
je 0x14000f723
cmp dword [0x1402c43e4], 1
jne 0x14000f6f2
cmp dword [0x1402c1a64], 0
jne 0x14000f6f2
xor eax, eax
jmp 0x14000f7a5
mov eax, dword [rsp + 0x60]
lea r9, [0x140001950]
and dword [0x1402c43e0], 0
mov dword [0x1402c1a68], eax
mov dword [reloc.WS2_32.dll_accept], 5
mov qword [rsp + 0x60], rdi
add rsp, 0x30
pop rdi
jmp fcn.14000f4c0
xor edx, edx
xor r9d, r9d
xor r8d, r8d
lea ecx, [rdx + 0x14]
call fcn.1400971cc
cmp dword [0x1402c43e4], 1
lea rcx, [0x140001950]
mov dword [0x1402c4414], 1
mov qword [rax], rcx
mov qword [rax + 8], rdi
mov dword [rax + 0x10], 1
jne 0x14000f771
cmp dword [0x1402c1a64], 0
jne 0x14000f771
mov rcx, rax
call fcn.1401cf760
jmp 0x14000f6eb
and qword [rsp + 0x28], 0
lea r8, [fcn.14000f2c4]
and dword [rsp + 0x20], 0
mov r9, rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
mov qword [0x1402c4428], rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
add rsp, 0x30
pop rdi
ret

Function at 0x14000f7ac
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, qword [0x1402c47a0]
mov dword [0x1402c1a64], 1
test rbx, rbx
je 0x14000f7eb
mov rcx, rbx
call fcn.140097118
test eax, eax
je 0x14000f7e3
mov rcx, qword [rbx + 0x50]
mov edx, 0x42b
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
and qword [0x1402c47a0], 0
add rsp, 0x20
pop rbx
ret

Function at 0x14000f994
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push r13
push r15
mov r10d, dword [0x1402c4438]
mov ebp, edx
mov r11d, dword [0x1402c4420]
mov eax, r10d
cdq
xor r13d, r13d
idiv r11d
mov r15, r8
mov r12d, ecx
mov r9d, r13d
mov ebx, edx
test edx, edx
je 0x14000f9df
mov r8d, r11d
sub r8d, edx
add r8d, r10d
jmp 0x14000f9e2
mov r8d, r10d
sub r8d, ebp
sub r8d, dword [0x1402c43fc]
test ebx, ebx
je 0x14000f9fa
mov eax, r11d
sub eax, ebx
add eax, r10d
jmp 0x14000f9fd
mov eax, r10d
sub eax, ebp
cmp r8d, eax
jge 0x14000fa8b
mov eax, dword [0x1402c43e8]
cdq
idiv r11d
test edx, edx
je 0x14000fa23
mov eax, r11d
sub eax, edx
add eax, dword [0x1402c43e8]
jmp 0x14000fa29
mov eax, dword [0x1402c43e8]
imul eax, r8d
mov rdi, r13
add eax, r12d
imul eax, dword [0x1402c4448]
movsxd rdx, eax
mov eax, dword [0x1402c4448]
add rdx, r15
imul eax, r11d
movsxd rcx, eax
sar rcx, 2
lea rax, [rdx + rcx*4]
lea rcx, [rcx*4 + 3]
shr rcx, 2
cmp rdx, rax
cmova rcx, r13
test rcx, rcx
je 0x14000fa83
imul r9d, r9d, 0x1000193
inc rdi
xor r9d, dword [rdx]
lea rdx, [rdx + 4]
cmp rdi, rcx
jb 0x14000fa6d
inc r8d
jmp 0x14000f9ec
mov rbx, qword [rsp + 0x18]
mov eax, r9d
mov rbp, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
mov r12, qword [rsp + 0x30]
pop r15
pop r13
ret
Function at 0x140011114
Capabilities:
Create thread
Shutdown system

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1402c0ed0]
xor rax, rsp
mov qword [rbp - 8], rax
xor esi, esi
mov r14d, edx
mov ebx, ecx
test ecx, ecx
jne 0x14001114b
xor eax, eax
jmp 0x1400112d5
cmp ebx, 6
jne 0x14001116c
lea ecx, [rbx - 4]
call qword [sym.imp.KERNEL32.dll_SetThreadExecutionState]
lea ecx, [rbx - 2]
call qword [sym.imp.KERNEL32.dll_SetThreadExecutionState]
mov eax, 1
jmp 0x1400112d5
cmp ebx, 7
jne 0x140011176
lea ecx, [rbx - 6]
jmp 0x14001115c
cmp ebx, 8
jne 0x140011186
or ecx, 0xffffffff
call qword [sym.imp.USER32.dll_MessageBeep]
jmp 0x140011162
cmp ebx, 9
jne 0x1400111bc
mov qword [rsp + 0x28], rsi
lea r8, [0x14000d588]
xor r9d, r9d
mov dword [rsp + 0x20], esi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp - 0x20], rax
test rax, rax
je 0x140011162
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140011162
cmp ebx, 5
jg 0x140011144
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rbp - 0x20]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140011144
lea r8, [rbp - 0x14]
xor ecx, ecx
lea rdx, str.SeShutdownPrivilege
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov rcx, qword [rbp - 0x20]
lea r8, [rbp - 0x18]
xor r9d, r9d
mov qword [rsp + 0x28], rsi
xor edx, edx
mov dword [rbp - 0x18], 1
mov dword [rbp - 0xc], 2
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x140011238
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140011144
sub ebx, 1
je 0x140011287
sub ebx, 1
je 0x14001126f
sub ebx, 1
je 0x140011265
sub ebx, 1
je 0x14001125e
cmp ebx, 1
jne 0x1400112c9
xor ecx, ecx
mov edx, r14d
call qword [sym.imp.KERNEL32.dll_SetSystemPowerState]
jmp 0x1400112a0
mov ecx, 1
jmp 0x140011253
mov dword [rsp + 0x20], 1
jmp 0x140011273
mov dword [rsp + 0x20], esi
xor edx, edx
xor ecx, ecx
lea r9d, [rdx + 1]
lea r8d, [rdx + 0x1e]
call qword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownA]
jmp 0x1400112a0
mov edx, 0x80000000
test r14d, r14d
je 0x140011298
mov ecx, 4
jmp 0x14001129a
xor ecx, ecx
call qword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
je 0x1400112c9
mov rcx, qword [rbp - 0x20]
lea r8, [rbp - 0x18]
mov qword [rsp + 0x28], rsi
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x20], rsi
mov dword [rbp - 0xc], esi
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov esi, 1
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1401c7020
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
mov r14, qword [rsp + 0x78]
add rsp, 0x50
pop rbp
ret
Function at 0x1400112f8
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x30
mov rbx, rdx
lea r8, [rsp + 0x40]
lea rdx, str.SoftwareOpen_SourceMeshAgent2
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
xor ecx, ecx
test eax, eax
jne 0x140011362
or rax, 0xffffffffffffffff
inc rax
cmp word [rbx + rax*2], cx
jne 0x140011328
mov rcx, qword [rsp + 0x40]
lea rdx, str.KeyStore
add eax, eax
mov r9d, 1
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x30
pop rbx
ret
Function at 0x14005cf18
Capabilities:
Get disk information
Get disk size

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x460
mov rax, qword [0x1402c0ed0]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov rax, rdx
lea r9, [rsp + 0x30]
mov rbx, rcx
lea rdx, [rsp + 0x50]
mov rcx, rax
mov r8d, 0x400
call qword [sym.imp.KERNEL32.dll_GetVolumePathNamesForVolumeNameA]
test eax, eax
je 0x14005d0cb
cmp byte [rsp + 0x50], 0
je 0x14005d0cb
mov rcx, rbx
call fcn.14001da8c
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.14001d5ac
mov esi, 0xfffffffe
lea r8, str.name
mov edx, esi
mov rcx, rbx
call fcn.14001ab40
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeA]
lea r9, [rsp + 0x40]
mov edi, eax
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
je 0x14005d02a
mov rcx, qword [rsp + 0x38]
xorps xmm1, xmm1
cvtsi2sd xmm1, rcx
test rcx, rcx
jns 0x14005cfde
addsd xmm1, qword [0x1402a0778]
mov rcx, rbx
call fcn.14001d3dc
lea r8, str.size
mov edx, esi
mov rcx, rbx
call fcn.14001ab40
mov rax, qword [rsp + 0x40]
xorps xmm1, xmm1
cvtsi2sd xmm1, rax
test rax, rax
jns 0x14005d011
addsd xmm1, qword [0x1402a0778]
mov rcx, rbx
call fcn.14001d3dc
lea r8, str.free
mov edx, esi
mov rcx, rbx
call fcn.14001ab40
sub edi, 2
je 0x14005d073
sub edi, 1
je 0x14005d06a
sub edi, 1
je 0x14005d061
sub edi, 1
je 0x14005d058
mov rcx, rbx
cmp edi, 1
je 0x14005d04f
lea rdx, str.UNKNOWN
jmp 0x14005d07d
lea rdx, str.RAMDISK
jmp 0x14005d07d
lea rdx, str.CDROM
jmp 0x14005d07a
lea rdx, str.REMOTE
jmp 0x14005d07a
lea rdx, str.FIXED
jmp 0x14005d07a
lea rdx, str.REMOVABLE
mov rcx, rbx
call fcn.14001d5ac
lea r8, [0x1402532b8]
mov edx, esi
mov rcx, rbx
call fcn.14001ab40
mov r9d, 0x18075380
mov dword [rsp + 0x20], 6
xor r8d, r8d
lea rdx, [0x14005cee8]
mov rcx, rbx
call fcn.14001dd44
lea r8, str.toString
mov edx, esi
mov rcx, rbx
call fcn.14001ab40
mov eax, 1
jmp 0x14005d0cd
xor eax, eax
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.1401c7020
lea r11, [rsp + 0x460]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140086dbc
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x30
or ebx, 0xffffffff
mov rbp, rcx
mov edx, ebx
call fcn.14001a0ec
lea r8, [rsp + 0x70]
mov edx, ebx
mov rcx, rbp
mov r15, rax
call fcn.14001bd64
mov rcx, rbp
call fcn.14001d85c
lea r8, [0x140298738]
mov edx, ebx
mov rcx, rbp
call fcn.140064520
mov rcx, rbp
mov rdi, rax
call fcn.14001e460
mov rbx, qword [rsp + 0x70]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor r14d, r14d
test rdi, rdi
je 0x140086e96
lea ecx, [rbx + 1]
movsxd rcx, ecx
add rcx, 8
call fcn.1400971cc
mov r9, rbx
mov r8, r15
mov rdx, rbx
mov rsi, rax
lea rcx, [rax + 8]
mov qword [rax], rdi
call section..text
mov byte [rsi + rbx + 8], r14b
mov rcx, qword [rdi]
call fcn.140097118
test eax, eax
je 0x140086e70
mov rcx, qword [rdi]
cmp qword [rcx - 0x10], r14
jbe 0x140086e6d
lea r14, [rcx + 0x18]
add r14, qword [rcx - 0x18]
mov r14, qword [r14]
mov r8, qword [rdi]
lea r9, [0x14008c2f0]
mov rdx, qword [r14]
mov rcx, qword [rdi + 0x18]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], 1
call fcn.1400641e0
jmp 0x140086eec
lea esi, [rbx + 4]
movsxd rcx, esi
call fcn.1400971cc
mov r9, rbx
mov r8, r15
mov rdx, rbx
mov rdi, rax
lea rcx, [rax + 4]
mov dword [rax], esi
call section..text
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r9, [rsp + 0x68]
mov qword [rsp + 0x20], r14
mov rcx, rax
mov r8d, esi
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbp
call fcn.14001e460
mov rcx, rdi
call fcn.1401cf760
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140092eac
Capabilities:
Connect socket
Set socket configuration

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
xor eax, eax
lea rdi, [rcx + 0xcc]
mov qword [rdi], rax
mov rsi, r9
mov qword [rdi + 8], rax
mov rbp, r8
mov qword [rdi + 0x10], rax
mov rbx, rcx
mov dword [rdi + 0x18], eax
and dword [rcx + 0x1e8], eax
mov rax, qword [rsp + 0x60]
mov qword [rcx + 0x1f0], rax
mov rax, qword [rsp + 0x68]
mov qword [rcx + 0x1f8], rax
test r8, r8
jne 0x140092f07
xor eax, eax
jmp 0x140092f14
mov edx, 0xfe
mov rcx, rbp
call fcn.1401d0514
lea rcx, [rbx + 0xe8]
mov r9, rax
mov r8, rbp
mov edx, 0xff
call section..text
test rsi, rsi
je 0x140092f4c
cmp word [rsi], 0x17
mov edx, 0x1c
mov r8, rsi
mov rcx, rdi
lea r9d, [rdx - 0xc]
cmove r9d, edx
call section..text
mov rax, qword [rsp + 0x78]
xor r8d, r8d
mov r9, qword [rsp + 0x70]
mov rcx, rbx
mov qword [rsp + 0x60], rax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
jmp fcn.140092af4

Function at 0x140092f7c
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov ebx, 0xfffffffc
mov rdi, rcx
lea r14d, [rbx + 5]
jmp 0x140092fa1
pause
xor eax, eax
lock cmpxchg dword [rcx + 0x288], r14d
je 0x140092f9f
mov rax, qword [rcx + 0x2d0]
cmp qword [rax], 0
jbe 0x1400930e6
cmp qword [rcx + 0x280], 0
jne 0x1400930e6
cmp dword [rcx + 0x258], 0
jne 0x140093002
xor edx, edx
xor r9d, r9d
xor r8d, r8d
lea ecx, [rdx + 0x38]
call fcn.1400971cc
xor ebx, ebx
mov dword [rax + 0x2c], 3
mov qword [rdi + 0x280], rax
mov qword [rdi + 0x278], rax
jmp 0x1400930e6
mov rcx, qword [rcx + 0x2c0]
mov edx, reloc.WS2_32.dll_ntohs
call fcn.1400d0dd0
mov rdx, qword [rdi + 0x2d0]
xor r9d, r9d
mov rcx, qword [rdi + 0x68]
mov r8d, dword [rdx]
mov rdx, qword [rdx + 8]
call qword [sym.imp.WS2_32.dll_send]
movsxd rsi, eax
test eax, eax
jle 0x1400930e6
mov rcx, qword [rdi + 0x2d0]
mov eax, dword [rcx]
cmp esi, eax
jge 0x1400930cc
xor r9d, r9d
sub eax, esi
movsxd rdx, eax
xor r8d, r8d
lea ecx, [r9 + 0x38]
call fcn.1400971cc
mov rcx, rax
mov rbx, rax
neg rcx
sbb rcx, rcx
lea rdx, [rax + 0x40]
and rcx, rdx
mov qword [rax], rcx
mov rdx, qword [rdi + 0x2d0]
mov r8d, dword [rdx]
sub r8d, esi
mov dword [rax + 0x2c], 3
mov dword [rax + 8], r8d
mov rax, qword [rdi + 0x2d0]
movsxd rdx, r8d
mov r8, rsi
mov r9, rdx
add r8, qword [rax + 8]
call section..text
mov rcx, qword [rdi + 0x2c0]
xor r9d, r9d
mov qword [rdi + 0x280], rbx
xor r8d, r8d
mov qword [rdi + 0x278], rbx
mov edx, r14d
xor ebx, ebx
call fcn.1400d0e00
jmp 0x1400930e6
jne 0x1400930e6
mov rcx, qword [rdi + 0x2c0]
xor r9d, r9d
xor r8d, r8d
mov edx, r14d
call fcn.1400d0e00
mov ebx, r14d
mov rsi, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov dword [rdi + 0x288], 0
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x1400946e8
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x30
and dword [rcx + 0x70], 0
lea rax, [0x1402d9a40]
and dword [rcx + 0x74], 0
mov rbx, rcx
and dword [rcx + 0x254], 0
and dword [rcx + 0x2a4], 0
mov qword [rcx + 0x68], rdx
mov qword [rcx + 0x220], r8
mov qword [rcx + 0x240], r9
mov dword [rcx + 0x258], 1
mov rcx, qword [rcx + 0x268]
cmp rcx, rax
je 0x14009475a
movsxd rdx, dword [rbx + 0x274]
call fcn.1401d5f9c
test rax, rax
je 0x14009478a
mov qword [rbx + 0x268], rax
mov eax, dword [rbx + 0x274]
mov dword [rbx + 0x270], eax
and dword [rbx + 0x25c], 0
lea r8, [rsp + 0x40]
and dword [rbx + 0x260], 0
mov edx, 0x8004667e
mov rcx, qword [rbx + 0x68]
mov dword [rsp + 0x40], 1
call qword [sym.imp.WS2_32.dll_ioctlsocket]
add rsp, 0x30
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, 0x946
lea rdx, str...microstackILibAsyncSocket.c
mov r8d, ebx
mov dword [rsp + 0x20], eax
mov r9d, 0xfe
xor ecx, ecx
call fcn.14009fb9c
mov r8d, ebx
lea rdx, str...microstackILibAsyncSocket.c
lea rcx, str.CRITICALEXIT__FILE:__s__LINE:__d_r_n
call fcn.1400010e4
mov ecx, 0xfe
call fcn.1401c9718
int3

Function at 0x140094830
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
lea rdi, [rcx + 0x94]
mov esi, 0x1c
cmp word [rdi], 0
mov rax, rdx
mov dword [rsp + 0x30], esi
je 0x14009487d
cmp word [rdi], 0x17
lea ebx, [rsi - 0xc]
mov edx, ebx
mov r8, rdi
cmove edx, esi
mov rcx, rax
mov r9d, edx
call section..text
cmp word [rdi], 0x17
cmove ebx, esi
mov eax, ebx
jmp 0x140094890
mov rcx, qword [rcx + 0x68]
lea r8, [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_getsockname]
mov eax, dword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1400948a0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub rsp, 0x58
mov rax, qword [0x1402c0ed0]
xor rax, rsp
mov qword [rsp + 0x48], rax
movzx eax, word [rcx + 0x94]
mov dword [rsp + 0x20], 0x1c
cmp ax, 0x17
jne 0x1400948d7
movzx ecx, word [rcx + 0x96]
call qword [sym.imp.WS2_32.dll_ntohs]
jmp 0x14009490a
cmp ax, 2
je 0x1400948c8
mov rcx, qword [rcx + 0x68]
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x28]
call qword [sym.imp.WS2_32.dll_getsockname]
cmp word [rsp + 0x28], 0x17
jne 0x140094900
movzx ecx, word [rsp + 0x2a]
jmp 0x1400948cf
cmp word [rsp + 0x28], 2
je 0x1400948f9
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1401c7020
add rsp, 0x58
ret