joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400110c8
Capabilities:
Write file on windows

Disassembly:
jmp 0x140019740
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x1400300f1]
call fcn.14001179e
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x68], 0
je 0x140019797
mov r8, qword [rbp + 0x130]
mov rdx, qword [rbp + 0x128]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x1400198a3
mov rax, qword [rbp + 0x130]
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x130], 0
jle 0x14001983c
cmp qword [rbp + 0x28], 0
jle 0x14001983c
mov rax, qword [rbp + 0x28]
cmp qword [rbp + 0x130], rax
jge 0x1400197dc
mov rax, qword [rbp + 0x130]
mov qword [rbp + 0x28], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x128]
mov rcx, rax
call fcn.140011726
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x128]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x128], rax
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov edx, dword [rbp + 0x28]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
cmp qword [rbp + 0x130], 0
jle 0x140019892
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x80], 0
je 0x140019892
mov rax, qword [rbp + 0x120]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x130]
mov edx, 1
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.ucrtbased.dll_fwrite]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov rax, qword [rbp + 0x130]
mov rcx, qword [rbp + 8]
sub rcx, rax
mov rax, rcx
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret

Function at 0x140011438
Capabilities:
Terminate process

Disassembly:
jmp 0x14001c080
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x14001154b
Capabilities:
Parse pe header

Disassembly:
jmp 0x14001cbb0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14001cbd0
xor al, al
jmp 0x14001cc51
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14001cbe3
xor al, al
jmp 0x14001cc51
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001cc0d
xor al, al
jmp 0x14001cc51
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x14001cc21
xor al, al
jmp 0x14001cc51
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x14001cc33
xor al, al
jmp 0x14001cc51
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001cc4f
xor al, al
jmp 0x14001cc51
mov al, 1
add rsp, 0x38
ret
Function at 0x140011636
Capabilities:
Extract resource via kernel32 functions

Disassembly:
jmp 0x140015c00
push rbp
push rdi
sub rsp, 0x2a8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x6e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140029018]
xor rax, rbp
mov qword [rbp + 0x268], rax
lea rcx, [0x1400300f3]
call fcn.14001179e
mov r8d, 0xa
mov edx, 0x65
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
je 0x140015cfb
mov rdx, qword [rbp + 8]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
je 0x140015cfb
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x48], 0
je 0x140015cfb
mov rdx, qword [rbp + 8]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [rbp + 0x64], eax
mov edx, 0x108
lea rcx, [rbp + 0x90]
call fcn.1400112e9
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 0x20
lea rdx, str.C:UsersdeldroidDesktopmain_projhope_rebirthcpp_ratencryption_testx64Debugoutput_file.ext
lea rcx, [rbp + 0x90]
call fcn.1400112d5
nop
mov eax, dword [rbp + 0x64]
mov r8d, eax
mov rdx, qword [rbp + 0x48]
lea rcx, [rbp + 0x90]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const____ptr64__long_long___int64_____ptr64]
nop
lea rcx, [rbp + 0x90]
call fcn.1400111e0
lea rcx, [rbp - 0x30]
lea rdx, [0x140023f10]
call fcn.140011654
mov rcx, qword [rbp + 0x268]
xor rcx, rbp
call fcn.140011393
lea rsp, [rbp + 0x278]
pop rdi
pop rbp
ret
Function at 0x140011785
Capabilities:
Write file on windows

Disassembly:
jmp 0x1400162b0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1e8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x3e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x208]
mov rax, qword [0x140029018]
xor rax, rbp
mov qword [rbp + 0x1a0], rax
lea rcx, [0x1400300f1]
call fcn.14001179e
mov rax, qword [rbp + 0x1d0]
cmp qword [rax + 0x68], 0
je 0x140016316
mov rax, qword [rbp + 0x1d0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x14001631d
mov al, 1
jmp 0x140016477
call fcn.140011221
mov rcx, qword [rbp + 0x1d0]
mov rcx, qword [rcx]
mov qword [rbp + 0x198], rcx
mov edx, eax
mov rcx, qword [rbp + 0x1d0]
mov rax, qword [rbp + 0x198]
call qword [rax + 0x18]
mov dword [rbp + 0x164], eax
call fcn.140011221
mov dword [rbp + 0x184], eax
lea rdx, [rbp + 0x164]
lea rcx, [rbp + 0x184]
call fcn.140011672
movzx eax, al
test eax, eax
je 0x140016378
xor al, al
jmp 0x140016477
mov qword [rbp + 8], 0x20
lea rax, [rbp + 0x48]
mov rcx, qword [rbp + 0x1d0]
add rcx, 0x74
lea rdx, [rbp + 0x68]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rbp + 0x28]
mov rdx, rcx
mov rax, qword [rbp + 0x1d0]
mov rcx, qword [rax + 0x68]
call qword [sym.imp.MSVCP140D.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rbp + 0x194], eax
cmp dword [rbp + 0x194], 0
je 0x1400163dd
cmp dword [rbp + 0x194], 1
je 0x1400163e8
cmp dword [rbp + 0x194], 3
je 0x140016466
jmp 0x140016475
mov rax, qword [rbp + 0x1d0]
mov byte [rax + 0x71], 0
lea rax, [rbp + 0x28]
mov rcx, qword [rbp + 0x68]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0
jbe 0x140016438
mov rax, qword [rbp + 0x1d0]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x88]
mov edx, 1
lea rcx, [rbp + 0x28]
call qword [sym.imp.ucrtbased.dll_fwrite]
cmp qword [rbp + 0x88], rax
je 0x140016438
xor al, al
jmp 0x140016477
mov rax, qword [rbp + 0x1d0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x140016453
mov dword [rbp + 0x194], 1
jmp 0x14001645d
mov dword [rbp + 0x194], 0
movzx eax, byte [rbp + 0x194]
jmp 0x140016477
mov rax, qword [rbp + 0x1d0]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x140016477
xor al, al
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x140024670]
call fcn.140011654
mov rax, rdi
mov rcx, qword [rbp + 0x1a0]
xor rcx, rbp
call fcn.140011393
lea rsp, [rbp + 0x1b8]
pop rdi
pop rbp
ret

Function at 0x140caf915
Capabilities:
Encode data using xor

Disassembly:
jmp 0x140ca8e05
push rsi
lea rdi, [0x140cb9d80]
push 0x3f0ac3bf
movzx esi, byte [rcx]
xor esi, ebp
and esi, 0xff
mov esi, dword [rdi + rsi*4]
shr ebp, 8
xor ebp, esi
inc rcx
xor ebp, 0x881b9515
dec rdx
lea rsp, [rsp + 8]
jne 0x140ca8e0d
pop rsi
not ebp
mov dword [rbx], ebp
jmp fcn.140c7b133
test rdx, rdx
lea rsp, [rsp + 0x10]
je 0x140ca8e3d
jmp 0x140c8b848
Function at 0x140447d50
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x140447d5d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x140447d6d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x140447d55
lea eax, [rcx + 1]
call r11
adc eax, eax
add ebx, ebx
jne 0x140447d85
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x140447d72
sub eax, 3
jb 0x140447d9f
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x140447dd6
movsxd rbp, eax
lea eax, [rcx + 1]
call r11
adc ecx, ecx
call r11
adc ecx, ecx
jne 0x140447dc6
mov ecx, eax
add eax, 2
call r11
adc ecx, ecx
add ebx, ebx
jne 0x140447dc4
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x140447db3
cmp rbp, 0xfffffffffffff300
adc ecx, eax
call fcn.140447d12
jmp 0x140447d5d
pop rsi
pop rdi
pop rax
mov dword [rdi], eax
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x3dd000
mov dl, 0x55
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x140447e26
cmp rsi, rcx
jae 0x140447e2e
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x140447e0d
cmp al, 0x8f
ja 0x140447e0d
cmp byte [rsi - 2], 0xf
je 0x140447e13
sub al, 0xe8
cmp al, 1
ja 0x140447df7
cmp rsi, rcx
jae 0x140447e2e
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x140447dfd
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x140447e2e
lodsb al, byte [rsi]
jmp 0x140447e0d
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x443000]
mov eax, dword [rdi]
or eax, eax
je 0x140447e8b
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x4485f0]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x140447e3b
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x140447e85
mov qword [rbx], rax
add rbx, 8
jmp 0x140447e5b
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x140447ecf
cmp al, 0xef
ja 0x140447eb7
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x140447e97
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0x140447ea6
mov eax, dword [rdi]
add rdi, 4
jmp 0x140447ea6
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.140447f4e], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.140447f4e
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x140447f3e
sub rsp, 0xffffffffffffff80
jmp 0x140001125
Function at 0x14143f470
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14143f47d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14143f48d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x14143f475
lea eax, [rcx + 1]
jmp 0x14143f49b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x14143f4ae
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x14143f494
sub eax, 3
jb 0x14143f4ce
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14143f51d
sar eax, 1
movsxd rbp, eax
jb 0x14143f504
jmp 0x14143f4dc
add ebx, ebx
jne 0x14143f4da
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x14143f504
inc ecx
add ebx, ebx
jne 0x14143f4ea
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x14143f504
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14143f4fd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14143f4ec
add ecx, 2
jmp 0x14143f509
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.14143f432
jmp 0x14143f47d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0xcea00
mov dl, 0xe
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x14143f569
cmp rsi, rcx
jae 0x14143f571
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x14143f550
cmp al, 0x8f
ja 0x14143f550
cmp byte [rsi - 2], 0xf
je 0x14143f556
sub al, 0xe8
cmp al, 1
ja 0x14143f53a
cmp rsi, rcx
jae 0x14143f571
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x14143f540
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x14143f571
lodsb al, byte [rsi]
jmp 0x14143f550
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x143c000]
mov eax, dword [rdi]
or eax, eax
je 0x14143f5ce
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x143f000]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x14143f57e
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x14143f5c8
mov qword [rbx], rax
add rbx, 8
jmp 0x14143f59e
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x14143f608
cmp al, 0xef
ja 0x14143f5fa
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x14143f5da
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x14143f5e9
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1a7]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.14143f687], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.14143f687
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x14143f677
sub rsp, 0xffffffffffffff80
jmp 0x140001350
Function at 0x100401080
Capabilities:
Download and write a file
Get socket status
Receive and write data from server to client
Receive data
Receive data on socket
Send data
Send data on socket
Terminate process
Write file on windows

Disassembly:
sub rsp, 0x28
call sym.__getreent
mov r8d, 0x22
mov edx, 1
lea rcx, str._n____Receive:_CtrlC..Ill_quit.._n
mov r9, qword [rax + 0x10]
call sym.fwrite
call sym.__getreent
mov r8d, 0x15
mov edx, 1
lea rcx, str._n___Let_me_exit...._n
mov r9, qword [rax + 0x10]
call sym.fwrite
call sym.__getreent
mov r8d, 0x10
mov edx, 1
lea rcx, str.___All_Right__n_n
mov r9, qword [rax + 0x10]
call sym.fwrite
xor ecx, ecx
call sym.exit
nop
nop dword [rax]
Function at 0x100401650
Capabilities:
Resolve dns

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x100401680
call sym.gethostbyname
test rax, rax
je 0x100401680
mov rax, qword [rax + 0x18]
mov rax, qword [rax]
test rax, rax
je 0x100401680
mov rax, qword [rax]
add rsp, 0x20
pop rbx
ret
call sym.__getreent
mov r8, rbx
lea rdx, str._nERROR:__s:_Wrong_host_address_n_n
mov rcx, qword [rax + 0x10]
call sym.fprintf
mov rax, 0xffffffffffffffff
jmp 0x100401676
Function at 0x1004024f0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call sym.__getreent
mov r8d, 0x1b
mov edx, 1
lea rcx, str._nUsage_of_Packet_Transmit:_n
mov r9, qword [rax + 0x10]
call sym.fwrite
call sym.__getreent
mov r8, rbx
lea rdx, str.___s___listentranslave___option_____log_hex_text__file___n
mov rcx, qword [rax + 0x10]
call sym.fprintf
call sym.__getreent
mov r8, rbx
lea rdx, str.___s__about_n_n
mov rcx, qword [rax + 0x10]
call sym.fprintf
call sym.__getreent
mov r8d, 0xb
mov edx, 1
lea rcx, str._options:__n
mov r9, qword [rax + 0x10]
call sym.fwrite
call sym.__getreent
mov r8d, 0x27
mov edx, 1
lea rcx, str.___listen__local_port1____local_port2__n
mov r9, qword [rax + 0x10]
call sym.fwrite
call sym.__getreent
mov r8d, 0x36
mov edx, 1
lea rcx, str.___tran____local_port_____remote_host____remote_port__n
mov r9, qword [rax + 0x10]
call sym.fwrite
call sym.__getreent
mov r8d, 0x47
mov edx, 1
lea rcx, str.___slave___remote_host1___remote_port1___remote_host2___remote_port2__n_n
mov r9, qword [rax + 0x10]
call sym.fwrite
call sym.__getreent
mov r8d, 0x1e
mov edx, 1
lea rcx, str.___hex___:_hex_mode_data_dump_n
mov r9, qword [rax + 0x10]
call sym.fwrite
call sym.__getreent
mov r8d, 0x1f
mov edx, 1
lea rcx, str.___text__:_text_mode_data_dump_n
mov r9, qword [rax + 0x10]
call sym.fwrite
call sym.__getreent
mov r8d, 0x1e
mov edx, 1
lea rcx, str.___log___:_save_transfer_log_n_n
mov r9, qword [rax + 0x10]
add rsp, 0x20
pop rbx
jmp sym.fwrite

Function at 0x100402630
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x28
call sym.__getreent
mov r8d, 0xe
mov edx, 1
lea rcx, str._nBy:_____Null_n
mov r9, qword [rax + 0x10]
call sym.fwrite
call sym.__getreent
mov r8d, 0x19
mov edx, 1
lea rcx, str.Email:___Null_gmail.com_n_n
mov r9, qword [rax + 0x10]
add rsp, 0x28
jmp sym.fwrite
Function at 0x1004034e0
Capabilities:
Write file on windows

Disassembly:
push r13
push r12
sub rsp, 0x28
mov r12d, ecx
mov r13, rdx
call sym.__main
lea rdx, [sym.ctrl_c]
mov ecx, 2
call sym.signal
mov rdx, r13
mov ecx, r12d
add rsp, 0x28
pop r12
pop r13
jmp sym.main_func
Function at 0x4140a0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41422b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call sym.runtime.stdcall3.abi0
xorps xmm15, xmm15
mov r14, qword [0x00586548]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x414105
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x414114
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x414133
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x414143
cmp rbx, 0x1000
jae 0x41410b
jmp 0x4141ad
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x414155
xor edx, edx
jmp 0x4141a4
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call sym.runtime.stdcall3.abi0
xorps xmm15, xmm15
mov r14, qword [0x00586548]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x414139
jmp 0x414128
call sym.runtime.getlasterror.abi0
xorps xmm15, xmm15
mov r14, qword [0x00586548]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call sym.runtime.printlock
lea rax, [0x004a419b]
mov ebx, 0x18
nop dword [rax]
call sym.runtime.printstring
mov rax, qword [rsp + 0x38]
call sym.runtime.printuint
lea rax, [0x004a44a2]
mov ebx, 0x19
nop dword [rax + rax]
call sym.runtime.printstring
mov rax, qword [rsp + 0x30]
call sym.runtime.printuint
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x004a603f]
mov ebx, 0x21
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.runtime.sysUnusedOS
Function at 0x414260
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x414486
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call sym.runtime.stdcall4.abi0
xorps xmm15, xmm15
mov r14, qword [0x00586548]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x4142d3
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x4142e2
add rsp, 0x50
pop rbp
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x414305
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x414315
cmp rbx, 0x1000
jae 0x4142d9
nop
jmp 0x414398
add rsp, 0x50
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop word [rax + rax]
cmp rbx, 0x1000
jae 0x41432d
xor esi, esi
jmp 0x41438a
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call sym.runtime.stdcall4.abi0
xorps xmm15, xmm15
mov r14, qword [0x00586548]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x41430b
jmp 0x4142f6
call sym.runtime.getlasterror.abi0
xorps xmm15, xmm15
mov r14, qword [0x00586548]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x414420
nop dword [rax + rax]
call sym.runtime.printlock
lea rax, [0x004a44bb]
mov ebx, 0x19
call sym.runtime.printstring
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
call sym.runtime.printuint
lea rax, [0x004a44a2]
mov ebx, 0x19
call sym.runtime.printstring
mov eax, dword [rsp + 0x34]
call sym.runtime.printuint
nop
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x004a1b8f]
mov ebx, 0xd
call sym.runtime.throw
nop dword [rax + rax]
cmp eax, 0x5af
je 0x4143c0
call sym.runtime.printlock
lea rax, [0x004a44bb]
mov ebx, 0x19
call sym.runtime.printstring
mov rax, qword [rsp + 0x38]
call sym.runtime.printuint
lea rax, [0x004a44a2]
mov ebx, 0x19
call sym.runtime.printstring
mov eax, dword [rsp + 0x34]
nop dword [rax]
call sym.runtime.printuint
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x004a595f]
mov ebx, 0x1f
nop dword [rax + rax]
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp sym.runtime.sysUsedOS