joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180419680
Capabilities:
Connect socket

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx]
mov r8d, dword [rdx + 0x80]
call qword [sym.imp.ws2_32.dll_connect]
test eax, eax
je 0x1804196aa
call sub.kernel32.dll_GetLastError
shl rax, 0x20
or rax, 2
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret

Function at 0x1804196c0
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx]
movzx eax, dl
mov dword [rsp + 0x24], eax
lea r8, [rsp + 0x24]
mov edx, 0x8004667e
call qword [sym.imp.ws2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
je 0x1804196ea
xor eax, eax
add rsp, 0x28
ret
call sub.kernel32.dll_GetLastError
shl rax, 0x20
or rax, 2
add rsp, 0x28
ret

Function at 0x180419700
Capabilities:
Set socket configuration

Disassembly:
mov edx, edx
jmp 0x180419700
sub rsp, 0x38
mov rcx, qword [rcx]
mov dword [rsp + 0x34], edx
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x34]
mov edx, 0xffff
mov r8d, 0x1002
call qword [sym.imp.ws2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x180419735
xor eax, eax
add rsp, 0x38
ret
call sub.kernel32.dll_GetLastError
shl rax, 0x20
or rax, 2
add rsp, 0x38
ret

Function at 0x180419750
Capabilities:
Set socket configuration

Disassembly:
jmp 0x180419750
sub rsp, 0x38
mov rcx, qword [rcx]
movzx eax, dl
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x34]
mov edx, 0xffff
mov r8d, 4
call qword [sym.imp.ws2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x180419788
xor eax, eax
add rsp, 0x38
ret
call sub.kernel32.dll_GetLastError
shl rax, 0x20
or rax, 2
add rsp, 0x38
ret

Function at 0x1804197a0
Capabilities:
Set socket configuration

Disassembly:
mov edx, edx
jmp 0x1804197a0
sub rsp, 0x38
mov rcx, qword [rcx]
mov dword [rsp + 0x34], edx
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x34]
mov edx, 0xffff
mov r8d, 0x1001
call qword [sym.imp.ws2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x1804197d5
xor eax, eax
add rsp, 0x38
ret
call sub.kernel32.dll_GetLastError
shl rax, 0x20
or rax, 2
add rsp, 0x38
ret
Function at 0x1804197f0
Capabilities:
Set socket configuration

Disassembly:
push rsi
push rdi
sub rsp, 0x58
mov rdi, rdx
mov rsi, qword [rcx]
mov dword [rsp + 0x48], 1
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x48]
mov rcx, rsi
mov edx, 0xffff
mov r8d, 8
call qword [sym.imp.ws2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x180419917
mov r9d, dword [rdi + 8]
xor ecx, ecx
mov r8d, 0
cmp r9d, 0x3b9aca00
je 0x180419878
mov eax, 0x3e8
mul qword [rdi]
mov r8d, r9d
imul r9, r8, 0x431bde83
shr r9, 0x32
add r9, rax
adc rdx, 0
mov eax, 0xffffffff
cmp r9, rax
cmovae r9, rax
xor r8d, r8d
neg rdx
sbb r8d, r8d
or r8d, r9d
mov r9d, dword [rdi + 0x18]
cmp r9d, 0x3b9aca00
je 0x1804198b9
mov eax, 0x3e8
mul qword [rdi + 0x10]
mov ecx, r9d
imul r9, rcx, 0x431bde83
shr r9, 0x32
add r9, rax
adc rdx, 0
mov eax, 0xffffffff
cmp r9, rax
cmovae r9, rax
xor ecx, ecx
neg rdx
sbb ecx, ecx
or ecx, r9d
mov dword [rsp + 0x48], 1
mov dword [rsp + 0x4c], r8d
mov dword [rsp + 0x50], ecx
mov dword [rsp + 0x54], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
lea rax, [rsp + 0x54]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0x48]
mov rcx, rsi
mov edx, 0x98000004
mov r9d, 0xc
call qword [sym.imp.ws2_32.dll_WSAIoctl]
cmp eax, 0xffffffff
je 0x180419917
xor eax, eax
jmp 0x180419924
call sub.kernel32.dll_GetLastError
shl rax, 0x20
or rax, 2
add rsp, 0x58
pop rdi
pop rsi
ret

Function at 0x18041bec0
Capabilities:
Set socket configuration

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov esi, edx
cmp word [rcx], 0
mov eax, 2
mov edi, 0x17
cmove edi, eax
mov eax, dword [0x1805298b8]
cmp eax, 3
jne 0x18041bf5d
mov ecx, edi
mov edx, esi
xor r8d, r8d
call qword [sym.imp.ws2_32.dll_socket]
cmp rax, 0xffffffffffffffff
je 0x18041bf38
mov rsi, rax
mov dword [rsp + 0x2c], 1
lea r8, [rsp + 0x2c]
mov rcx, rax
mov edx, 0x8004667e
call qword [sym.imp.ws2_32.dll_ioctlsocket]
test eax, eax
je 0x18041bf4e
call sub.kernel32.dll_GetLastError
mov edi, eax
shl rdi, 0x20
or rdi, 2
mov rcx, rsi
call qword [sym.imp.ws2_32.dll_closesocket]
mov eax, 1
jmp 0x18041bf53
call sub.kernel32.dll_GetLastError
mov edi, eax
shl rdi, 0x20
or rdi, 2
mov eax, 1
jmp 0x18041bf53
xor eax, eax
mov rdi, rsi
mov rdx, rdi
add rsp, 0x38
pop rdi
pop rsi
ret
mov byte [rsp + 0x2b], 1
lea rax, [rsp + 0x2b]
mov qword [rsp + 0x30], rax
lea rax, str.C:Userslucak.cargo_registry_srcindex.crates.io_6f17d22bba15001fmio_1.0.2_src_syswindows_net.rs
mov qword [rsp + 0x20], rax
lea rcx, [0x1805298b8]
lea r9, [0x1804e6c38]
lea r8, [rsp + 0x30]
xor edx, edx
call fcn.1804741d0
jmp 0x18041bee4
Function at 0x18041bfa0
Capabilities:
Connect socket

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rbx, rdx
mov rsi, rcx
mov rcx, rdx
mov edx, 1
call fcn.18041bec0
mov rdi, rdx
test rax, rax
je 0x18041bfd2
mov qword [rsi + 8], rdi
mov qword [rsi], 0xffffffffffffffff
jmp 0x18041c073
cmp word [rbx], 0
je 0x18041bff7
movups xmm0, xmmword [rbx + 4]
movzx eax, word [rbx + 0x1c]
rol ax, 8
mov ecx, dword [rbx + 0x18]
add rbx, 0x14
mov r8d, 0x1c
mov dx, 0x17
jmp 0x18041c010
movzx eax, word [rbx + 6]
rol ax, 8
add rbx, 2
xorps xmm0, xmm0
mov r8d, 0x10
mov dx, 2
mov r9d, dword [rbx]
mov word [rsp + 0x24], dx
mov word [rsp + 0x26], ax
mov dword [rsp + 0x28], r9d
movups xmmword [rsp + 0x2c], xmm0
mov dword [rsp + 0x3c], ecx
lea rdx, [rsp + 0x24]
mov rcx, rdi
call qword [sym.imp.ws2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x18041c04a
call sub.kernel32.dll_GetLastError
cmp eax, 0x2733
jne 0x18041c057
mov qword [rsi], rdi
mov qword [rsi + 8], 0
jmp 0x18041c073
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov qword [rsi], 0xffffffffffffffff
mov rcx, rdi
call qword [sym.imp.ws2_32.dll_closesocket]
mov rax, rsi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
Function at 0x180425380
Capabilities:
Get common file path

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x478
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], 2
mov qword [rsp + 0x48], 0
mov r8d, 0x200
mov eax, 2
mov qword [rsp + 0x28], rax
xor edi, edi
mov r14, qword [sym.imp.kernel32.dll_GetWindowsDirectoryW]
mov ebx, 0xffffffff
xor r12d, r12d
cmp r8, 0x201
jae 0x180425410
jmp 0x1804253ff
jae 0x1804254cc
cmp r8, 0x201
jae 0x180425410
mov esi, 0x200
lea r13, [rsp + 0x78]
mov rbp, r8
jmp 0x18042543b
sub r8, r12
mov rax, rdi
sub rax, r12
cmp r8, rax
ja 0x18042549c
cmp rdi, rbx
mov r12d, 0xffffffff
cmovb r12, rdi
mov qword [rsp + 0x48], r12
mov rsi, r12
mov r13, qword [rsp + 0x28]
mov rbp, r12
xor ecx, ecx
call qword [sym.imp.kernel32.dll_SetLastError]
mov rcx, r13
mov edx, ebp
call r14
mov r15d, eax
test eax, eax
jne 0x180425460
call qword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x18042557f
mov r8d, r15d
cmp rbp, r8
jne 0x1804253f0
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1804255aa
lea r8, [rbp*2]
cmp rbp, 0x7fffffff
cmova r8, rbx
cmp r8, 0x201
jb 0x1804253ff
jmp 0x180425410
mov qword [rsp + 0x20], 2
mov r9d, 2
lea rcx, [rsp + 0x38]
mov rdx, r12
call fcn.180469640
mov rdi, qword [rsp + 0x38]
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x28], rax
jmp 0x18042541e
cmp rsi, r8
jb 0x1804255aa
mov rax, qword [rsp + 0x50]
mov rsi, qword [rax]
mov rbx, qword [rax + 8]
lea r14, [rsp + 0x58]
mov rcx, r14
mov rdx, r13
call fcn.180432650
mov rdx, qword [rsi]
mov r8, qword [rsi + 8]
mov rcx, r14
call fcn.18042f7f0
cmp byte [rbx], 0
jne 0x18042551c
lea rdx, str.exestrings_passed_to_WinAPI_cannot_contain_NULs
lea rcx, [rsp + 0x58]
mov r8d, 3
call fcn.180430190
mov rdx, qword [rsp + 0x60]
mov r8, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x30]
mov rcx, rsi
call fcn.18042bd40
mov rdx, qword [rsp + 0x58]
test rdx, rdx
je 0x18042554d
mov rcx, qword [rsp + 0x60]
mov r8d, 1
call fcn.1802cbf20
test rdi, rdi
je 0x180425568
add rdi, rdi
mov r8d, 2
mov rcx, qword [rsp + 0x28]
mov rdx, rdi
call fcn.1802cbf20
mov rax, rsi
add rsp, 0x478
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rsp + 0x30]
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000001
mov qword [rsi], rax
test rdi, rdi
jne 0x180425552
jmp 0x180425568
ud2
Function at 0x1804258a0
Capabilities:
Get common file path

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x478
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], 2
mov qword [rsp + 0x48], 0
mov r8d, 0x200
mov eax, 2
mov qword [rsp + 0x28], rax
xor edi, edi
mov r14, qword [sym.imp.kernel32.dll_GetSystemDirectoryW]
mov ebx, 0xffffffff
xor r12d, r12d
cmp r8, 0x201
jae 0x180425930
jmp 0x18042591f
jae 0x1804259ec
cmp r8, 0x201
jae 0x180425930
mov esi, 0x200
lea r13, [rsp + 0x78]
mov rbp, r8
jmp 0x18042595b
sub r8, r12
mov rax, rdi
sub rax, r12
cmp r8, rax
ja 0x1804259bc
cmp rdi, rbx
mov r12d, 0xffffffff
cmovb r12, rdi
mov qword [rsp + 0x48], r12
mov rsi, r12
mov r13, qword [rsp + 0x28]
mov rbp, r12
xor ecx, ecx
call qword [sym.imp.kernel32.dll_SetLastError]
mov rcx, r13
mov edx, ebp
call r14
mov r15d, eax
test eax, eax
jne 0x180425980
call qword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x180425a9f
mov r8d, r15d
cmp rbp, r8
jne 0x180425910
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x180425aca
lea r8, [rbp*2]
cmp rbp, 0x7fffffff
cmova r8, rbx
cmp r8, 0x201
jb 0x18042591f
jmp 0x180425930
mov qword [rsp + 0x20], 2
mov r9d, 2
lea rcx, [rsp + 0x38]
mov rdx, r12
call fcn.180469640
mov rdi, qword [rsp + 0x38]
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x28], rax
jmp 0x18042593e
cmp rsi, r8
jb 0x180425aca
mov rax, qword [rsp + 0x50]
mov rsi, qword [rax]
mov rbx, qword [rax + 8]
lea r14, [rsp + 0x58]
mov rcx, r14
mov rdx, r13
call fcn.180432650
mov rdx, qword [rsi]
mov r8, qword [rsi + 8]
mov rcx, r14
call fcn.18042f7f0
cmp byte [rbx], 0
jne 0x180425a3c
lea rdx, str.exestrings_passed_to_WinAPI_cannot_contain_NULs
lea rcx, [rsp + 0x58]
mov r8d, 3
call fcn.180430190
mov rdx, qword [rsp + 0x60]
mov r8, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x30]
mov rcx, rsi
call fcn.18042bd40
mov rdx, qword [rsp + 0x58]
test rdx, rdx
je 0x180425a6d
mov rcx, qword [rsp + 0x60]
mov r8d, 1
call fcn.1802cbf20
test rdi, rdi
je 0x180425a88
add rdi, rdi
mov r8d, 2
mov rcx, qword [rsp + 0x28]
mov rdx, rdi
call fcn.1802cbf20
mov rax, rsi
add rsp, 0x478
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rsp + 0x30]
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000001
mov qword [rsi], rax
test rdi, rdi
jne 0x180425a72
jmp 0x180425a88
ud2
Function at 0x180426150
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x458
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 2
mov qword [rsp + 0x50], 0
mov r14, qword [rdx + 8]
mov r8d, 0x200
mov eax, 2
mov qword [rsp + 0x30], rax
xor edi, edi
mov esi, 0xffffffff
xor r12d, r12d
cmp r8, 0x201
jae 0x1804261d0
jmp 0x1804261bf
jae 0x18042629b
cmp r8, 0x201
jae 0x1804261d0
mov ebx, 0x200
lea r13, [rsp + 0x58]
mov rbp, r8
jmp 0x1804261ff
sub r8, r12
mov rax, rdi
sub rax, r12
cmp r8, rax
ja 0x18042626b
cmp rdi, rsi
mov r12d, 0xffffffff
cmovb r12, rdi
mov qword [rsp + 0x50], r12
mov rbx, r12
mov r13, qword [rsp + 0x30]
mov rbp, r12
xor ecx, ecx
call qword [sym.imp.kernel32.dll_SetLastError]
mov rcx, r14
mov rdx, r13
mov r8d, ebp
call qword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
mov r15d, eax
test eax, eax
jne 0x18042622b
call qword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x1804262e2
mov r8d, r15d
cmp rbp, r8
jne 0x1804261b0
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x18042630d
lea r8, [rbp*2]
cmp rbp, 0x7fffffff
cmova r8, rsi
cmp r8, 0x201
jb 0x1804261bf
jmp 0x1804261d0
mov qword [rsp + 0x20], 2
mov r9d, 2
lea rcx, [rsp + 0x40]
mov rdx, r12
call fcn.180469640
mov rdi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x30], rax
jmp 0x1804261e2
cmp rbx, r8
jb 0x18042630d
mov rsi, qword [rsp + 0x38]
mov rcx, rsi
mov rdx, r13
call fcn.180432650
test rdi, rdi
je 0x1804262cb
add rdi, rdi
mov r8d, 2
mov rcx, qword [rsp + 0x30]
mov rdx, rdi
call fcn.1802cbf20
mov rax, rsi
add rsp, 0x458
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rsp + 0x38]
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
test rdi, rdi
jne 0x1804262b5
jmp 0x1804262cb
ud2
Function at 0x180426310
Capabilities:
Get common file path

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x458
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 2
mov qword [rsp + 0x50], 0
mov r8d, 0x200
mov eax, 2
mov qword [rsp + 0x30], rax
xor edi, edi
mov r14, qword [sym.imp.kernel32.dll_GetCurrentDirectoryW]
mov ebx, 0xffffffff
xor r15d, r15d
cmp r8, 0x201
jae 0x180426390
jmp 0x18042637f
jae 0x18042644c
cmp r8, 0x201
jae 0x180426390
mov esi, 0x200
lea r12, [rsp + 0x58]
mov r13, r8
jmp 0x1804263bb
sub r8, r15
mov rax, rdi
sub rax, r15
cmp r8, rax
ja 0x18042641c
cmp rdi, rbx
mov r15d, 0xffffffff
cmovb r15, rdi
mov qword [rsp + 0x50], r15
mov rsi, r15
mov r12, qword [rsp + 0x30]
mov r13, r15
xor ecx, ecx
call qword [sym.imp.kernel32.dll_SetLastError]
mov ecx, r13d
mov rdx, r12
call r14
mov ebp, eax
test eax, eax
jne 0x1804263e0
call qword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x180426493
mov r8d, ebp
cmp r13, r8
jne 0x180426370
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1804264be
lea r8, [r13*2]
cmp r13, 0x7fffffff
cmova r8, rbx
cmp r8, 0x201
jb 0x18042637f
jmp 0x180426390
mov qword [rsp + 0x20], 2
mov r9d, 2
lea rcx, [rsp + 0x40]
mov rdx, r15
call fcn.180469640
mov rdi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x30], rax
jmp 0x18042639e
cmp rsi, r8
jb 0x1804264be
mov rsi, qword [rsp + 0x38]
mov rcx, rsi
mov rdx, r12
call fcn.180432650
test rdi, rdi
je 0x18042647c
add rdi, rdi
mov r8d, 2
mov rcx, qword [rsp + 0x30]
mov rdx, rdi
call fcn.1802cbf20
mov rax, rsi
add rsp, 0x458
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rsp + 0x38]
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
test rdi, rdi
jne 0x180426466
jmp 0x18042647c
ud2
Function at 0x1804264c0
Capabilities:
Get common file path

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x458
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 2
mov qword [rsp + 0x50], 0
mov r15d, 0x200
mov eax, 2
mov qword [rsp + 0x30], rax
xor edi, edi
mov r14d, 0xffffffff
xor r12d, r12d
cmp r15, 0x201
jae 0x180426540
jmp 0x18042652f
jae 0x180426605
cmp r15, 0x201
jae 0x180426540
mov ebx, 0x200
lea r13, [rsp + 0x58]
mov rbp, r15
jmp 0x18042656f
sub r15, r12
mov rax, rdi
sub rax, r12
cmp r15, rax
ja 0x1804265d2
cmp rdi, r14
mov r12d, 0xffffffff
cmovb r12, rdi
mov qword [rsp + 0x50], r12
mov rbx, r12
mov r13, qword [rsp + 0x30]
mov rbp, r12
xor ecx, ecx
call qword [sym.imp.kernel32.dll_SetLastError]
mov rcx, r13
mov edx, ebp
call qword [sym.imp.kernel32.dll_GetSystemDirectoryW]
mov esi, eax
test eax, eax
jne 0x180426596
call qword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x180426638
mov r15d, esi
cmp rbp, r15
jne 0x180426520
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1804266b8
lea r15, [rbp*2]
cmp rbp, 0x7fffffff
cmova r15, r14
cmp r15, 0x201
jb 0x18042652f
jmp 0x180426540
mov qword [rsp + 0x20], 2
mov r9d, 2
lea rcx, [rsp + 0x40]
mov rdx, r12
mov r8, r15
call fcn.180469640
mov rdi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x30], rax
jmp 0x180426552
cmp rbx, r15
jb 0x1804266b8
lea r14, [r15 + r15]
test esi, esi
je 0x180426663
movzx eax, byte [0x1805297c8]
mov edx, 2
mov rcx, r14
call fcn.1802cbf10
test rax, rax
je 0x1804266ba
mov rsi, rax
jmp 0x180426668
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rbx, qword [rsp + 0x38]
mov qword [rbx + 8], rax
movabs rax, 0x8000000000000000
mov qword [rbx], rax
test rdi, rdi
jne 0x18042668b
jmp 0x1804266a1
mov esi, 2
mov rcx, rsi
mov rdx, r13
mov r8, r14
call fcn.180468b10
mov rbx, qword [rsp + 0x38]
mov qword [rbx], r15
mov qword [rbx + 8], rsi
mov qword [rbx + 0x10], r15
test rdi, rdi
je 0x1804266a1
add rdi, rdi
mov r8d, 2
mov rcx, qword [rsp + 0x30]
mov rdx, rdi
call fcn.1802cbf20
mov rax, rbx
add rsp, 0x458
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
ud2
mov ecx, 2
mov rdx, r14
call fcn.180407090
int3

Function at 0x180427b00
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rcx, [rsp + 0x20]
call qword [sym.imp.kernel32.dll_GetSystemInfo]
mov ecx, dword [rsp + 0x40]
xor eax, eax
test rcx, rcx
sete al
lea rdx, str.The_number_of_hardware_threads_is_not_known_for_the_target_platform
cmovne rdx, rcx
add rsp, 0x58
ret
Function at 0x180429360
Capabilities:
Set socket configuration

Disassembly:
cmp qword [rcx + 0x18], 0xffffffffffffffff
je 0x180407890
add rcx, 0x18
jmp 0x18041c0d0
ud2
jmp 0x180429360
sub rsp, 0x38
movzx eax, dl
mov rcx, qword [rcx]
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x34]
mov edx, 6
mov r8d, 1
call qword [sym.imp.ws2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x180429398
xor eax, eax
add rsp, 0x38
ret
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
add rsp, 0x38
ret

Function at 0x1804293b0
Capabilities:
Send data
Send data on socket

Disassembly:
sub rsp, 0x28
cmp r8, 0x7fffffff
mov eax, 0x7fffffff
cmovae r8, rax
mov rcx, qword [rcx]
xor r9d, r9d
call qword [sym.imp.ws2_32.dll_send]
cmp eax, 0xffffffff
je 0x1804293df
movsxd rdx, eax
xor eax, eax
add rsp, 0x28
ret
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov eax, 1
add rsp, 0x28
ret

Function at 0x180429400
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub rsp, 0x28
mov rax, qword [rcx]
mov rcx, qword [rax]
cmp r8, 0x7fffffff
mov eax, 0x7fffffff
cmovae r8, rax
xor r9d, r9d
call qword [sym.imp.ws2_32.dll_recv]
cmp eax, 0xffffffff
je 0x180429435
movsxd rdx, eax
xor ecx, ecx
mov rax, rcx
add rsp, 0x28
ret
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
xor edx, edx
mov ecx, 0
cmp eax, 0x274a
je 0x18042942d
shl rax, 0x20
or rax, 2
mov ecx, 1
mov rdx, rax
mov rax, rcx
add rsp, 0x28
ret

Function at 0x180429470
Capabilities:
Send data
Send data on socket

Disassembly:
sub rsp, 0x28
mov rax, qword [rcx]
cmp r8, 0x7fffffff
mov ecx, 0x7fffffff
cmovae r8, rcx
mov rcx, qword [rax]
xor r9d, r9d
call qword [sym.imp.ws2_32.dll_send]
cmp eax, 0xffffffff
je 0x1804294a2
movsxd rdx, eax
xor eax, eax
add rsp, 0x28
ret
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov eax, 1
add rsp, 0x28
ret

Function at 0x1804294c0
Capabilities:
Send data
Send data on socket

Disassembly:
push rsi
sub rsp, 0x40
mov rax, qword [rcx]
mov ecx, 0xffffffff
cmp r8, rcx
cmovae r8, rcx
mov dword [rsp + 0x3c], 0
mov rcx, qword [rax]
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x3c]
call qword [sym.imp.ws2_32.dll_WSASend]
mov esi, eax
cmp esi, 0xffffffff
jne 0x18042950f
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
xor ecx, ecx
cmp esi, 0xffffffff
sete cl
mov edx, dword [rsp + 0x3c]
cmove rdx, rax
mov rax, rcx
add rsp, 0x40
pop rsi
ret
Function at 0x18042bbd0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x68
mov rsi, r9
mov rbx, r8
mov rdi, rcx
mov rax, qword [rdx]
mov r8, qword [rdx + 8]
mov rcx, r9
mov rdx, rax
call fcn.18042f7f0
cmp byte [rbx], 0
jne 0x18042bc12
lea rdx, str.exe.NULcmd.exemaximum_number_of_ProcThreadAttributes_exceeded
mov r8d, 3
mov rcx, rsi
call fcn.180430190
movabs r15, 0x8000000000000000
mov rdx, qword [rsi + 8]
mov r8, qword [rsi + 0x10]
lea rcx, [rsp + 0x38]
call fcn.180424ec0
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
cmp rax, r15
je 0x18042bc73
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rcx
lea rcx, [rsp + 0x20]
lea rdx, [rsp + 0x50]
call fcn.18043ecb0
mov r14, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x28]
cmp r14, r15
jne 0x18042bd00
mov eax, ebx
and eax, 3
lea rcx, [rax - 2]
cmp rcx, 2
jb 0x18042bcca
test rax, rax
je 0x18042bcca
mov r14, qword [rbx - 1]
mov r12, qword [rbx + 7]
mov rax, qword [r12]
test rax, rax
je 0x18042bc9d
mov rcx, r14
call rax
dec rbx
mov rdx, qword [r12 + 8]
test rdx, rdx
je 0x18042bcb7
mov r8, qword [r12 + 0x10]
mov rcx, r14
call fcn.1802cbf20
mov edx, 0x18
mov r8d, 8
mov rcx, rbx
call fcn.1802cbf20
mov qword [rdi], r15
mov rdx, qword [rsi]
test rdx, rdx
je 0x18042bcf1
mov rcx, qword [rsi + 8]
mov r8d, 1
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp fcn.1802cbf20
nop
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov r12, qword [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x18042bd20
mov qword [rdi], r14
mov qword [rdi + 8], rbx
mov qword [rdi + 0x10], r12
jmp 0x18042bccd
mov qword [rdi], r15
test r14, r14
je 0x18042bccd
add r14, r14
mov r8d, 2
mov rcx, rbx
mov rdx, r14
call fcn.1802cbf20
jmp 0x18042bccd
Function at 0x18042bd40
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rsi, rcx
movabs r14, 0x8000000000000000
lea rcx, [rsp + 0x40]
call fcn.180424ec0
mov rax, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
cmp rax, r14
je 0x18042bda3
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], rcx
lea rcx, [rsp + 0x28]
lea rdx, [rsp + 0x58]
call fcn.18043ecb0
mov rbx, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
cmp rbx, r14
jne 0x18042be09
mov eax, edi
and eax, 3
lea rcx, [rax - 2]
cmp rcx, 2
jb 0x18042bdf7
test rax, rax
je 0x18042bdf7
mov rbx, qword [rdi - 1]
mov r15, qword [rdi + 7]
mov rax, qword [r15]
test rax, rax
je 0x18042bdcc
mov rcx, rbx
call rax
dec rdi
mov rdx, qword [r15 + 8]
test rdx, rdx
je 0x18042bde4
mov r8, qword [r15 + 0x10]
mov rcx, rbx
call fcn.1802cbf20
mov edx, 0x18
mov r8d, 8
mov rcx, rdi
call fcn.1802cbf20
mov qword [rsi], r14
mov rax, rsi
add rsp, 0x70
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov r15, qword [rsp + 0x38]
mov rcx, rdi
call qword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x18042be29
mov qword [rsi], rbx
mov qword [rsi + 8], rdi
mov qword [rsi + 0x10], r15
jmp 0x18042bdfa
mov qword [rsi], r14
test rbx, rbx
je 0x18042bdfa
add rbx, rbx
mov r8d, 2
mov rcx, rdi
mov rdx, rbx
call fcn.1802cbf20
jmp 0x18042bdfa

Function at 0x18042d010
Capabilities:
Delete file

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
mov r8, rdx
mov rdx, rcx
movabs rbx, 0x8000000000000000
lea rcx, [rsp + 0x28]
call fcn.180424ec0
mov rax, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
cmp rax, rbx
je 0x18042d075
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], rcx
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x40]
mov r8b, 1
call fcn.1804398f0
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
cmp rdi, rbx
jne 0x18042d083
mov rbx, rsi
mov rax, rbx
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret
mov rcx, rsi
call qword [sym.imp.kernel32.dll_DeleteFileW]
test eax, eax
je 0x18042d0ad
test rdi, rdi
je 0x18042d0d8
add rdi, rdi
mov r8d, 2
mov rcx, rsi
mov rdx, rdi
call fcn.1802cbf20
xor ebx, ebx
jmp 0x18042d078
call qword [sym.imp.kernel32.dll_GetLastError]
mov ebx, eax
shl rbx, 0x20
or rbx, 2
test rdi, rdi
je 0x18042d078
add rdi, rdi
mov r8d, 2
mov rcx, rsi
mov rdx, rdi
call fcn.1802cbf20
jmp 0x18042d078
xor ebx, ebx
jmp 0x18042d078