joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400635e0
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x30
test byte [rcx + 0x1c0], 2
mov rbx, rcx
je 0x140063642
movsxd rcx, dword [rcx + 0x30]
lea r9, [rsp + 0x40]
mov edx, 6
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x20], 4
lea r8d, [rdx - 5]
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x140063642
mov ecx, 0x40
call fcn.14000e3d0
test al, al
je 0x140063642
mov r8d, dword [rsp + 0x40]
lea rdx, str.NOTE:_setsockopt_TCP_NODELAY_d_failed
mov ecx, 0x40
call fcn.14000e000
movsxd rcx, dword [rbx + 0x30]
lea r8, [rsp + 0x40]
mov edx, 0x8004667e
mov dword [rsp + 0x40], 1
call qword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
je 0x14006368d
mov ecx, 0x110
call fcn.14000e3d0
test al, al
je 0x140063681
lea rdx, str.Set_socket_to_non_blocking_mode_failed
mov ecx, 0x110
call fcn.14000e000
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__exit]
int3
mov eax, dword [rbx + 0x1b0]
movsxd rcx, dword [rbx + 0x30]
mov dword [rsp + 0x40], eax
test eax, eax
js 0x14006375c
movzx eax, word [rbx + 0x28]
cmp ax, 2
je 0x14006370f
cmp ax, 0x17
je 0x1400636d8
mov ecx, reloc.WS2_32.dll_recv
call fcn.14000e3d0
test al, al
je 0x140063750
lea rdx, str.__mtu_disc_is_not_supported_on_this_OS
mov ecx, reloc.WS2_32.dll_recv
call fcn.14000e000
jmp 0x140063750
mov edx, 0x29
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x40]
lea r8d, [rdx + 0x1e]
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x14006375c
mov ecx, 0x110
call fcn.14000e3d0
test al, al
je 0x140063750
lea rdx, str.Error_setting_IPV6_MTU_DISCOVER_type_d_on_TCP6_UDP6_socket
jmp 0x140063741
xor edx, edx
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x40]
lea r8d, [rdx + 0x47]
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x14006375c
mov ecx, 0x110
call fcn.14000e3d0
test al, al
je 0x140063750
lea rdx, str.Error_setting_IP_MTU_DISCOVER_type_d_on_TCP_UDP_socket
mov r8d, dword [rsp + 0x40]
mov ecx, 0x110
call fcn.14000e000
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__exit]
int3
add rsp, 0x30
pop rbx
ret
Function at 0x140063e40
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rsi, qword [rcx + 0x2a0]
mov rbx, rcx
lea rcx, [rsp + 0x30]
mov rdi, rdx
call fcn.140086610
test eax, eax
jne 0x140063e90
lea rcx, [rsp + 0x30]
call fcn.140051120
mov rcx, qword [0x1400c7890]
mov eax, dword [0x1400c7898]
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x34], eax
jmp 0x140063e97
mov rcx, qword [0x1400c7890]
mov eax, dword [rsi + 8]
mov r8d, 0
add eax, dword [rsi + 4]
mov r9, rdi
sub eax, ecx
lea rcx, [rbx + 0x38]
cmovns r8d, eax
mov rax, qword [rbx]
mov rdx, qword [rax + 0x10]
mov rdx, qword [rdx + 0x20]
call fcn.140062c70
mov eax, dword [rdi]
test eax, eax
jne 0x140063fe4
mov rbp, qword [rbx + 0x38]
mov r8, rdi
mov rcx, qword [rbx + 0x268]
mov rdx, rbp
call fcn.1400668f0
test al, al
je 0x140063f59
xor r9d, r9d
lea rdx, [0x1400afd00]
mov rcx, rbp
lea r8d, [r9 + 0xa]
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xa
je 0x140063f2a
cmp dword [0x1400cfe94], 1
jb 0x140063f59
mov ecx, 0x1000121
call fcn.14000e3d0
test al, al
je 0x140063f59
lea rdx, str.establish_socks_proxy_passthru:_TCP_port_write_failed_on_send__
mov ecx, 0x1000121
call fcn.14000e000
jmp 0x140063f59
xor eax, eax
lea rdx, [rbx + 0x270]
xorps xmm0, xmm0
mov r8, rdi
movups xmmword [rbx + 0x270], xmm0
mov qword [rbx + 0x280], rax
mov rcx, rbp
mov dword [rbx + 0x288], eax
call fcn.140066bb0
test al, al
jne 0x140063f65
mov eax, dword [rdi]
test eax, eax
jne 0x140063f65
mov dword [rdi], 0xa
mov eax, dword [rdi]
test eax, eax
jne 0x140063fe4
mov rax, qword [rbx + 0x290]
mov qword [rbx + 0x178], rax
mov rax, qword [rbx + 0x298]
mov qword [rbx + 0x180], rax
mov rax, qword [rbx]
movzx ecx, word [rax + 0x18]
cmp cx, 2
je 0x140063fa3
cmp cx, 0x17
jne 0x140063faa
xorps xmm0, xmm0
movups xmmword [rax + 0x20], xmm0
jmp 0x140063faa
mov dword [rax + 0x1c], 0
mov rax, qword [rbx]
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x140063fd2
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
mov rax, qword [rbx]
mov qword [rax + 0x10], 0
mov rax, qword [rbx]
mov qword [rax + 8], 0
xor r8d, r8d
mov r9, rdi
mov rcx, rbx
lea edx, [r8 + 1]
call fcn.140062e50
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x1400655d0
Capabilities:
Resolve dns

Disassembly:
push rbp
push rsi
push rdi
push r14
sub rsp, 0x228
mov rax, qword [0x1400c7008]
xor rax, rsp
mov qword [rsp + 0x210], rax
movzx eax, word [r8]
mov ebp, r9d
mov rdi, r8
mov rsi, rdx
mov r14, rcx
cmp ax, 2
je 0x140065708
cmp ax, 0x17
jne 0x1400657b2
cmp word [r8 + 8], 0
jne 0x1400656a1
cmp word [r8 + 0xa], 0
jne 0x1400656a1
cmp word [r8 + 0xc], 0
jne 0x1400656a1
cmp word [r8 + 0xe], 0
jne 0x1400656a1
cmp word [r8 + 0x10], 0
jne 0x1400656a1
mov eax, 0xffff
cmp word [r8 + 0x12], ax
jne 0x1400656a1
mov r9, rdx
mov qword [rsp + 0x220], rbx
mov ebx, dword [r8 + 0x14]
lea rcx, [rsp + 0x90]
lea r8, str._s_ip
mov edx, 0x100
call fcn.140003020
mov ecx, ebx
call qword [sym.imp.WS2_32.dll_inet_ntoa]
lea r8, [0x14008b3dc]
mov edx, 0x80
mov r9, rax
lea rcx, [rsp + 0x190]
call fcn.140003020
mov rbx, qword [rsp + 0x220]
jmp 0x1400656ea
mov r9, rsi
lea r8, str._s_ip6
mov edx, 0x100
lea rcx, [rsp + 0x90]
call fcn.140003020
xor eax, eax
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], eax
lea r8, [rsp + 0x190]
mov r9d, 0x80
mov qword [rsp + 0x20], rax
mov rcx, rdi
lea edx, [rax + 0x1c]
call qword [sym.imp.WS2_32.dll_getnameinfo]
lea r8, [rsp + 0x190]
mov rcx, r14
lea rdx, [rsp + 0x90]
call fcn.14000d690
test bpl, 1
jmp 0x140065754
lea rax, [0x14008b3dc]
and ebp, 1
lea r8, str._s_ip
mov r9, rsi
cmove r8, rax
lea rcx, [rsp + 0x90]
mov edx, 0x100
call fcn.140003020
mov ecx, dword [rdi + 4]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
lea rdx, [rsp + 0x90]
mov rcx, r14
mov r8, rax
call fcn.14000d690
test ebp, 1
je 0x1400657b2
cmp word [rdi + 2], 0
je 0x1400657b2
mov r9, rsi
lea r8, str._s_port
mov edx, 0x100
lea rcx, [rsp + 0x90]
call fcn.140003020
movzx ecx, word [rdi + 2]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx r9d, ax
lea r8, [0x140098bd0]
mov edx, 0x40
lea rcx, [rsp + 0x50]
call fcn.140003020
lea r8, [rsp + 0x50]
mov rcx, r14
lea rdx, [rsp + 0x90]
call fcn.14000d690
mov rcx, qword [rsp + 0x210]
xor rcx, rsp
call fcn.140088150
add rsp, 0x228
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140069bc0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rsi
push r12
push r13
push r15
sub rsp, 0x50
movsxd rsi, dword [rsp + 0xa8]
lea rcx, [0x14009b164]
mov r13, r8
mov r12d, edx
call fcn.14000b3a0
lea rcx, str.SHA1
mov qword [rsp + 0x40], rax
call fcn.14000b3a0
lea rcx, [rsi + 8]
mov qword [rsp + 0x48], rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
test rax, rax
je 0x140069d9c
mov r9, qword [rsp + 0x80]
mov rdx, r13
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x88], rbp
lea rbp, [rax + 8]
mov qword [rsp + 0x90], rdi
mov rdi, qword [rsp + 0xa0]
mov dword [rsp + 0x30], esi
mov qword [rsp + 0x98], r14
xor r14d, r14d
mov qword [rsp + 0x28], rdi
mov qword [rax], r14
mov dword [rsp + 0x20], r12d
call fcn.140069920
mov r9, qword [rsp + 0x80]
lea rdx, [r13 + 0x18]
mov rcx, qword [rsp + 0x48]
mov dword [rsp + 0x30], esi
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], r12d
call fcn.140069920
test esi, esi
jle 0x140069d30
cmp esi, 0x40
jb 0x140069d30
lea rax, [rsi - 1]
lea rcx, [rax + rdi]
add rax, rbp
cmp rdi, rax
ja 0x140069cb2
cmp rcx, rbp
jae 0x140069d30
mov r8, rsi
lea rcx, [rdi + 0x10]
mov rdx, rbp
and r8, 0xffffffffffffffc0
sub rdx, rdi
mov r9, 0xfffffffffffffff0
sub r9, rdi
nop dword [rax]
movdqu xmm0, xmmword [rcx - 0x10]
add r14d, 0x40
movdqu xmm1, xmmword [rdx + rcx - 0x10]
movdqu xmm2, xmmword [rdx + rcx]
lea rcx, [rcx + 0x40]
pxor xmm1, xmm0
lea rax, [r9 + rcx]
movdqu xmmword [rcx - 0x50], xmm1
movdqu xmm0, xmmword [rcx - 0x40]
movdqu xmm1, xmmword [rdx + rcx - 0x30]
pxor xmm2, xmm0
movdqu xmmword [rcx - 0x40], xmm2
movdqu xmm0, xmmword [rcx - 0x30]
pxor xmm1, xmm0
movdqu xmmword [rcx - 0x30], xmm1
movdqu xmm0, xmmword [rcx - 0x20]
movdqu xmm1, xmmword [rdx + rcx - 0x20]
pxor xmm1, xmm0
movdqu xmmword [rcx - 0x20], xmm1
cmp rax, r8
jl 0x140069cd0
movsxd rcx, r14d
mov r14, qword [rsp + 0x98]
cmp rcx, rsi
jge 0x140069d61
mov r9, rbp
lea rax, [rcx + rdi]
sub r9, rdi
mov r8, rsi
sub r8, rcx
movzx edx, byte [rax + r9]
xor byte [rax], dl
lea rax, [rax + 1]
sub r8, 1
jne 0x140069d50
mov rdi, rbp
xor eax, eax
mov rbp, qword [rsp + 0x88]
mov rcx, rsi
rep stosb byte [rdi], al
mov rdi, qword [rbx]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rbx, rdi
test rdi, rdi
jne 0x140069d73
mov rdi, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r13
pop r12
pop rsi
pop rbx
ret
call fcn.14000e540
int3
Function at 0x140076a50
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor sil, sil
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
je 0x140076bc7
cmp dword [rcx + 0x10], 0
jl 0x140076bc7
test byte [rcx], 1
je 0x140076bc7
cmp qword [rcx + 0x30], 0
je 0x140076bf9
cmp qword [rdx + 0x10], 0
je 0x140076c12
xor ebp, ebp
mov r8, qword [rbx + 0x30]
test r8, r8
je 0x140076aba
mov edx, dword [rbx + 0x28]
test edx, edx
js 0x140076aba
cmp edx, 1
jge 0x140076b52
mov eax, dword [rbx + 0x20]
test eax, eax
js 0x140076be0
test r8, r8
je 0x140076be0
mov qword [rbx + 0x24], rbp
mov rcx, r8
mov r8d, ebp
test ebp, ebp
js 0x140076aec
sub eax, ebp
movsxd rdx, ebp
sub eax, ebp
cmovns r8d, eax
add rdx, rcx
jmp 0x140076afc
test rcx, rcx
je 0x140076af9
movsxd rdx, ebp
add rdx, rcx
jmp 0x140076afc
mov rdx, rbp
mov ecx, dword [rbx + 0x10]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__read]
mov ecx, eax
test eax, eax
jle 0x140076bbf
cmp qword [rbx + 0x30], rbp
je 0x140076c2b
mov edx, dword [rbx + 0x28]
test edx, edx
js 0x140076c2b
add eax, 0xf4240
cmp eax, 0x1e847f
ja 0x140076c2b
add edx, ecx
js 0x140076c2b
mov ecx, dword [rbx + 0x24]
add ecx, edx
cmp ecx, dword [rbx + 0x20]
jg 0x140076c2b
mov dword [rbx + 0x28], edx
jmp 0x140076aa1
movsxd rcx, dword [rbx + 0x24]
mov sil, 1
movzx r8d, byte [rcx + r8]
lea eax, [rcx + 1]
mov dword [rbx + 0x24], eax
lea eax, [rdx - 1]
mov dword [rbx + 0x28], eax
cmp r8d, 0xd
je 0x140076aa1
cmp r8d, 0xa
je 0x140076bbf
mov r9, qword [rdi + 0x10]
test r9, r9
je 0x140076aa1
movsxd rdx, dword [rdi + 8]
test edx, edx
js 0x140076aa1
movsxd rcx, dword [rdi + 4]
lea eax, [rcx + rdx]
cmp eax, dword [rdi]
jge 0x140076aa1
lea eax, [rdx + 1]
add rcx, r9
mov dword [rdi + 8], eax
mov rax, rdx
add rax, rcx
je 0x140076aa1
mov byte [rax], r8b
jmp 0x140076aa1
mov rcx, rdi
call fcn.140003540
mov rbx, qword [rsp + 0x30]
movzx eax, sil
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
lea r8, str.buf_init_so__read_buf__0_
mov edx, 0x121
lea rcx, str.C:Users_vagrant_buildopenvpn_srcopenvpn_status.c
call fcn.14000e4c0
int3
lea r8, str.buf_defined_so__read_buf_
mov edx, 0x116
lea rcx, str.C:Users_vagrant_buildopenvpn_srcopenvpn_status.c
call fcn.14000e4c0
int3
lea r8, str.buf_defined_buf_
mov edx, 0x117
lea rcx, str.C:Users_vagrant_buildopenvpn_srcopenvpn_status.c
call fcn.14000e4c0
int3
lea r8, str.buf_inc_len_so__read_buf__len_
mov edx, 0x128
lea rcx, str.C:Users_vagrant_buildopenvpn_srcopenvpn_status.c
call fcn.14000e4c0
int3
Function at 0x14007bff0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov eax, dword [rcx + 0x180]
mov rbx, rcx
test eax, eax
jne 0x14007c130
movups xmm0, xmmword [rcx + 0x1d8]
movsd xmm1, qword [rcx + 0x1e8]
movups xmmword [rcx + 0x1f0], xmm0
movsd qword [rcx + 0x200], xmm1
mov rax, qword [rcx + 0x200]
test rax, rax
je 0x14007c05e
mov edi, dword [rcx + 0x1f8]
test edi, edi
js 0x14007c043
mov eax, edi
jmp 0x14007c054
test rax, rax
je 0x14007c05e
mov eax, dword [rcx + 0x1f8]
xor edi, edi
test eax, eax
js 0x14007c05e
cmp edi, eax
ja 0x14007c13b
jmp 0x14007c060
xor edi, edi
mov rcx, qword [rcx + 0x1a0]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
test eax, eax
je 0x14007c154
mov rax, qword [rbx + 0x200]
test rax, rax
je 0x14007c096
cmp dword [rbx + 0x1f8], 0
jl 0x14007c096
movsxd rdx, dword [rbx + 0x1f4]
add rdx, rax
jmp 0x14007c098
xor edx, edx
mov rcx, qword [rbx + 0x178]
lea rax, [rbx + 0x188]
lea r9, [rbx + 0x1a8]
mov qword [rsp + 0x20], rax
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14007c0e0
mov rcx, qword [rbx + 0x1a0]
call qword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
je 0x14007c16d
mov dword [rbx + 0x1b0], 0
jmp 0x14007c122
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp eax, 0x3e5
jne 0x14007c10b
mov eax, 1
mov dword [rbx + 0x1b0], edi
mov dword [rbx + 0x180], eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rbx + 0x1a0]
call qword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
je 0x14007c186
mov dword [rbx + 0x1b0], edi
mov eax, 2
mov dword [rbx + 0x180], eax
nop dword [rax]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
lea r8, str.len___BLEN_tt__reads.buf_
mov edx, 0xd78
lea rcx, str.C:Users_vagrant_buildopenvpn_srcopenvpn_tun.c
call fcn.14000e4c0
int3
lea r8, str.ResetEvent_tt__reads.overlapped.hEvent_
mov edx, 0xd7b
lea rcx, str.C:Users_vagrant_buildopenvpn_srcopenvpn_tun.c
call fcn.14000e4c0
int3
lea r8, str.SetEvent_tt__reads.overlapped.hEvent_
mov edx, 0xd88
lea rcx, str.C:Users_vagrant_buildopenvpn_srcopenvpn_tun.c
call fcn.14000e4c0
int3
lea r8, str.SetEvent_tt__reads.overlapped.hEvent_
mov edx, 0xd9e
lea rcx, str.C:Users_vagrant_buildopenvpn_srcopenvpn_tun.c
call fcn.14000e4c0
int3
Function at 0x14007c1a0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov eax, dword [rcx + 0x208]
mov rbx, rcx
test eax, eax
jne 0x14007c313
movups xmm0, xmmword [rcx + 0x260]
xor edi, edi
movsd xmm1, qword [rcx + 0x270]
movups xmmword [rcx + 0x278], xmm0
movsd qword [rcx + 0x288], xmm1
mov dword [rcx + 0x280], edi
mov rax, qword [rdx + 0x10]
test rax, rax
je 0x14007c206
mov ecx, dword [rdx + 8]
test ecx, ecx
jns 0x14007c1fd
test rax, rax
je 0x14007c206
mov ecx, edi
cmp dword [rdx + 8], ecx
jl 0x14007c206
movsxd rdx, dword [rdx + 4]
add rdx, rax
jmp 0x14007c20b
mov rdx, rdi
mov ecx, edi
mov r10, qword [rbx + 0x288]
test r10, r10
je 0x14007c376
movsxd r9, dword [rbx + 0x280]
test r9d, r9d
js 0x14007c376
cmp ecx, 0xf4240
jae 0x14007c376
movsxd r8, dword [rbx + 0x27c]
lea eax, [r8 + r9]
add eax, ecx
cmp eax, dword [rbx + 0x278]
jg 0x14007c376
lea eax, [r9 + rcx]
add r8, r10
mov dword [rbx + 0x280], eax
mov rax, r9
add rax, r8
je 0x14007c376
movsxd r8, ecx
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [rbx + 0x228]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
test eax, eax
je 0x14007c38f
mov rax, qword [rbx + 0x288]
test rax, rax
je 0x14007c2bd
mov r8d, dword [rbx + 0x280]
test r8d, r8d
jns 0x14007c2b1
test rax, rax
je 0x14007c2bd
mov r8d, edi
cmp dword [rbx + 0x280], edi
jl 0x14007c2bd
movsxd rdx, dword [rbx + 0x27c]
add rdx, rax
jmp 0x14007c2c3
mov rdx, rdi
mov r8d, edi
mov rcx, qword [rbx + 0x178]
lea rax, [rbx + 0x210]
lea r9, [rbx + 0x230]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14007c31e
mov rcx, qword [rbx + 0x228]
mov eax, 2
mov dword [rbx + 0x208], eax
call qword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
je 0x14007c3a8
mov eax, dword [rbx + 0x208]
mov dword [rbx + 0x238], edi
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp eax, 0x3e5
jne 0x14007c349
mov eax, 1
mov dword [rbx + 0x238], edi
mov dword [rbx + 0x208], eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rbx + 0x228]
call qword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
je 0x14007c3c1
mov eax, 2
mov dword [rbx + 0x238], edi
mov dword [rbx + 0x208], eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
lea r8, str.buf_copy_tt__writes.buf__buf_
mov edx, 0xdb6
lea rcx, str.C:Users_vagrant_buildopenvpn_srcopenvpn_tun.c
call fcn.14000e4c0
int3
lea r8, str.ResetEvent_tt__writes.overlapped.hEvent_
mov edx, 0xdb9
lea rcx, str.C:Users_vagrant_buildopenvpn_srcopenvpn_tun.c
call fcn.14000e4c0
int3
lea r8, str.SetEvent_tt__writes.overlapped.hEvent_
mov edx, 0xdc8
lea rcx, str.C:Users_vagrant_buildopenvpn_srcopenvpn_tun.c
call fcn.14000e4c0
int3
lea r8, str.SetEvent_tt__writes.overlapped.hEvent_
mov edx, 0xddd
lea rcx, str.C:Users_vagrant_buildopenvpn_srcopenvpn_tun.c
call fcn.14000e4c0
int3
Function at 0x140080d40
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
push rdi
sub rsp, 0xa0
mov rax, qword [0x1400c7008]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rbx, qword [rcx + 0x18]
lea r9, [r11 - 0x78]
xor edi, edi
mov dword [rsp + 0x78], reloc.WS2_32.dll_inet_ntoa
lea rdx, [r11 - 0x30]
mov qword [r11 - 0x70], rdi
mov rcx, rbx
mov qword [r11 - 0x68], rdi
mov qword [r11 - 0x28], 0x18
lea r8d, [rdi + 0x18]
mov dword [r11 - 0x20], edi
mov qword [r11 - 0x60], rdi
mov qword [r11 - 0x58], rdi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140080e8a
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], rdi
lea r8d, [rdi + 0x20]
mov rcx, rbx
lea rdx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140080e8a
cmp dword [rsp + 0x70], edi
je 0x140080e55
lea ecx, [rdi + 0x40]
call fcn.14000e3d0
test al, al
je 0x140080f20
mov ecx, dword [rsp + 0x70]
lea rdx, [rsp + 0x38]
call fcn.14000ebf0
mov r9d, dword [rsp + 0x70]
lea rdx, str.Register_dns_failed_using_service:__s__status0x_x_
mov r8, rax
lea ecx, [rdi + 0x40]
call fcn.14000e000
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140080e27
mov rbx, qword [rcx]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rbx
test rbx, rbx
jne 0x140080e16
mov rdi, qword [rsp + 0x40]
test rdi, rdi
je 0x140080f20
mov rcx, qword [rdi + 0x10]
mov rbx, qword [rdi]
call qword [rdi + reloc.WS2_32.dll_htonl]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rdi, rbx
test rbx, rbx
jne 0x140080e35
jmp 0x140080f20
cmp dword [0x1400cfe94], 1
jb 0x140080f20
mov ecx, 1
call fcn.14000e3d0
test al, al
je 0x140080f20
lea rdx, str.Register_dns_request_sent_to_the_service
mov ecx, 1
call fcn.14000e000
jmp 0x140080f20
mov ecx, 0x40
call fcn.14000e3d0
test al, al
je 0x140080f20
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
lea rdx, [rsp + 0x48]
call fcn.14000ebf0
mov r9, rax
mov dword [rsp + 0x20], ebx
lea r8, str.Register_dns
mov ecx, 0x40
lea rdx, str._s:_could_not_talk_to_service:__s___lu_
call fcn.14000e000
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140080ef1
nop
mov rbx, qword [rcx]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rbx
test rbx, rbx
jne 0x140080ee0
mov rdi, qword [rsp + 0x50]
test rdi, rdi
je 0x140080f20
nop dword [rax + rax]
mov rcx, qword [rdi + 0x10]
mov rbx, qword [rdi]
call qword [rdi + reloc.WS2_32.dll_htonl]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rdi, rbx
test rbx, rbx
jne 0x140080f00
nop dword [rax + rax]
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140088150
mov rbx, qword [rsp + 0xb8]
add rsp, 0xa0
pop rdi
ret
Function at 0x1400858e0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x1f0
mov rax, qword [0x1400c7008]
xor rax, rsp
mov qword [rsp + 0x1e0], rax
xor ebp, ebp
mov rbx, rcx
test rcx, rcx
je 0x140085958
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp byte [rcx + rax], bpl
jne 0x140085920
inc eax
mov ecx, 1
movsxd rsi, eax
mov rdx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov rdi, rax
test rax, rax
je 0x140085ac9
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
jmp 0x14008595b
mov rdi, rbp
xorps xmm0, xmm0
lea rcx, [rsp + 0xe0]
xor eax, eax
xor edx, edx
mov r8d, 0x100
mov qword [rsp + 0xd0], rax
movups xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0x60], rax
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x90], xmm0
movups xmmword [rsp + 0xa0], xmm0
movups xmmword [rsp + 0xb0], xmm0
movups xmmword [rsp + 0xc0], xmm0
movups xmmword [rsp + 0x50], xmm0
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x100
lea rdx, [rsp + 0xe0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, 0xfffffeff
je 0x140085a78
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoA]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x70], WSAGetLastError
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0xe0]
lea rax, [rsp + 0x70]
mov dword [rsp + 0xac], 1
mov qword [rsp + 0x40], rax
xor r9d, r9d
mov qword [rsp + 0x38], rbp
xor r8d, r8d
mov qword [rsp + 0x30], rbp
mov rdx, rdi
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], ebp
mov word [rsp + 0xb0], bp
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x140085a54
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140085a97
mov ecx, 0x140
call fcn.14000e3d0
test al, al
je 0x140085a97
mov r8, rbx
lea rdx, str.fork_to_self:_CreateProcess_failed:__s
mov ecx, 0x140
call fcn.14000e000
jmp 0x140085a97
mov ecx, 0x140
call fcn.14000e3d0
test al, al
je 0x140085a97
lea rdx, str.fork_to_self:_CreateProcess_failed:_cannot_get_module_name_via_GetModuleFileName
mov ecx, 0x140
call fcn.14000e000
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rsp + 0x1e0]
xor rcx, rsp
call fcn.140088150
lea r11, [rsp + 0x1f0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.14000e540
int3
Function at 0x1400864f0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x50
xor esi, esi
mov rbp, r9
mov ebx, esi
mov qword [rax - 0x20], rsi
lea r9, [rax - 0x28]
mov qword [rax - 0x18], rbx
mov rdi, rcx
mov qword [rax - 0x38], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14008654d
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], rsi
lea r8d, [rsi + 0x20]
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14008654d
mov al, 1
jmp 0x1400865ed
mov ecx, 0x40
call fcn.14000e3d0
test al, al
je 0x1400865ad
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
lea rdx, [rsp + 0x38]
call fcn.14000ebf0
mov rdx, qword [rsp + 0x80]
lea r8, str.Unknown
test rdx, rdx
mov dword [rsp + 0x20], ebx
mov r9, rax
mov ecx, 0x40
cmovne r8, rdx
lea rdx, str._s:_could_not_talk_to_service:__s___lu_
call fcn.14000e000
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
test rsi, rsi
je 0x1400865c6
mov rdi, qword [rsi]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rsi, rdi
test rdi, rdi
jne 0x1400865b2
test rbx, rbx
je 0x1400865eb
nop dword [rax + rax]
mov rcx, qword [rbx + 0x10]
mov rdi, qword [rbx]
call qword [rbx + reloc.WS2_32.dll_htonl]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rbx, rdi
test rdi, rdi
jne 0x1400865d0
xor al, al
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret