joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400688b0
Capabilities:
Enumerate processes

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x180
mov rax, qword [0x14009d810]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov rdi, rdx
mov ebp, ecx
lea rdx, [rsp + 0x40]
xor r15d, r15d
mov rcx, r8
mov rsi, r8
xor r14b, r14b
mov dword [rsp + 0x34], 4
mov dword [rsp + 0x40], 0x130
mov dword [rsp + 0x30], r15d
call qword [sym.imp.KERNEL32.dll_Process32First]
cmp eax, 1
jne 0x1400689ca
mov qword [rsp + 0x1b0], rbx
lea rdx, [rsp + 0x6c]
lea rcx, str.explorer.exe
call fcn.140047390
test eax, eax
jne 0x14006899d
mov r8d, dword [rsp + 0x48]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x14006899d
mov r8, rdi
mov edx, 0xa
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140068983
mov r9d, dword [rsp + 0x34]
mov rcx, qword [rdi]
lea rax, [rsp + 0x34]
lea r8, [rsp + 0x30]
mov edx, listen
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x140068983
cmp ebp, dword [rsp + 0x30]
je 0x1400689b6
mov rcx, qword [rdi]
test rcx, rcx
je 0x140068994
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi], r15
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x40]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
cmp eax, 1
je 0x140068913
jmp 0x1400689c2
mov rcx, rbx
mov r14b, 1
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x1b0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, r14b
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.140042af0
add rsp, 0x180
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14006ac70
Capabilities:
Check if file exists
Contain obfuscated stackstrings

Disassembly:
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xc0
mov qword [rbp - 0x41], 0xfffffffffffffffe
mov qword [rsp + 0xf0], rbx
mov rax, qword [0x14009d810]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rdi, rdx
mov rsi, rcx
mov word [rbp - 6], 0x6957
mov word [rbp + 0x14], 0x736e
mov dword [rbp + 0x19], 0x6f475c6c
mov dword [rbp + 0xd], 0x5c6e6f69
mov dword [rbp + 0x22], 0x6f726843
mov word [rbp], 0x5c73
mov dword [rbp + 7], 0x6556746e
mov dword [rbp - 0xd], 0x6f736f72
mov dword [rbp - 0x15], 0x45524157
mov dword [rbp + 3], 0x65727275
mov dword [rbp + 0x1e], 0x20656c67
mov dword [rbp - 0x11], 0x63694d5c
mov word [rbp + 0x11], 0x6e55
mov byte [rbp + 0x13], 0x69
mov word [rbp - 9], 0x7466
mov byte [rbp + 2], 0x43
mov word [rbp + 0x17], 0x6c61
mov word [rbp + 0x26], 0x656d
mov dword [rbp - 0x19], 0x54464f53
mov word [rbp + 0xb], 0x7372
mov word [rbp - 3], 0x6f64
mov byte [rbp + 0x28], 0
mov byte [rbp + 0x1d], reloc.WS2_32.dll_WSAGetLastError
mov byte [rbp - 7], 0x5c
mov byte [rbp - 1], 0x77
mov byte [rbp - 4], WSASetLastError
mov byte [rbp + 0x16], reloc.WS2_32.dll_WSACleanup
mov word [rbp - 0x1b], WSASetLastError
mov dword [rbp - 0x29], 0x74736e49
mov word [rbp - 0x22], 0x6f4c
mov word [rbp - 0x25], 0x6c61
mov dword [rbp - 0x20], 0x69746163
mov byte [rbp - 0x1c], reloc.WS2_32.dll_WSAGetLastError
mov byte [rbp - 0x23], WSAGetLastError
mov word [rbp - 0x33], 0x652e
mov word [rbp - 0x36], 0x6d6f
mov word [rbp - 0x39], 0x6863
mov byte [rbp - 0x34], 0x65
mov byte [rbp - 0x37], WSACleanup
mov word [rbp - 0x31], 0x6578
mov byte [rbp - 0x2f], 0
lea rax, [rbp - 0x59]
mov qword [rbp - 0x49], rax
lea rdx, [rbp - 0x29]
lea rcx, [rbp - 0x59]
call fcn.140005f20
mov rbx, rax
lea rdx, [rbp - 0x19]
lea rcx, [rbp - 0x51]
call fcn.140005f20
nop
mov r9, rdi
mov r8, rbx
mov rdx, rax
call section..ecode
test al, al
jne 0x14006adfc
lea rax, [rbp - 0x59]
mov qword [rbp - 0x51], rax
lea rdx, [rbp - 0x29]
lea rcx, [rbp - 0x59]
call fcn.140005f20
mov rbx, rax
lea rdx, [rbp - 0x19]
lea rcx, [rbp - 0x49]
call fcn.140005f20
nop
mov r9, rdi
mov r8, rbx
mov rdx, rax
call fcn.14006b560
test al, al
je 0x14006ae24
lea r9, [rbp - 0x39]
mov r8, qword [rdi]
lea rdx, [0x1400937e8]
mov rcx, rdi
call fcn.140005810
mov rcx, qword [rdi]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
setne al
test al, al
jne 0x14006ae30
mov rcx, rdi
call fcn.14006ae80
test al, al
je 0x14006ae55
xor ebx, ebx
mov dword [rbp - 0x59], ebx
lea rdx, [rbp - 0x59]
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetBinaryTypeA]
test eax, eax
je 0x14006ae51
cmp dword [rbp - 0x59], 6
jne 0x14006ae51
mov ebx, 1
mov byte [rsi], bl
mov al, 1
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.140042af0
mov rbx, qword [rsp + 0xf0]
add rsp, 0xc0
pop rdi
pop rsi
pop rbp
ret
Function at 0x14006b3f0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x160
mov rax, qword [0x14009d810]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rdi, rcx
mov qword [rsp + 0x30], 0
call qword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x104
mov ebx, eax
call fcn.1400467a0
lea rdx, [rsp + 0x30]
mov ecx, ebx
call qword [sym.imp.WTSAPI32.dll_WTSQueryUserToken]
test eax, eax
je 0x14006b48c
mov r8, qword [rsp + 0x30]
test r8, r8
je 0x14006b48c
xor r9d, r9d
lea rax, [rsp + 0x40]
xor ecx, ecx
lea edx, [r9 + 0x1c]
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
lea r8, [rsp + 0x40]
lea rdx, [0x1400937dc]
mov rcx, rdi
call fcn.140005810
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x14006b48e
xor al, al
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140042af0
mov rbx, qword [rsp + 0x178]
add rsp, 0x160
pop rdi
ret

Function at 0x14006b4c0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov rbx, rdx
mov rdi, rcx
mov dword [rsp + 0x20], 0
lea rcx, str.x__b_
mov rax, qword [str.x__b_]
call qword [rax + Ordinal_26]
add rax, 0x18
mov qword [rdi], rax
mov dword [rsp + 0x20], 1
mov qword [rsp + 0x50], 0
lea r9, [rsp + 0x50]
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
test eax, eax
jne 0x14006b543
mov rdx, qword [rsp + 0x50]
test rdx, rdx
je 0x14006b543
mov rcx, rdi
call fcn.1400046d0
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rax, rdi
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x14006b560
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x10], rdx
mov qword [r11 + 8], rcx
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov qword [r11 - 0x38], 0xfffffffffffffffe
mov rbx, r9
mov r14, r8
mov r15, rdx
mov esi, 1
xor edi, edi
mov qword [r11 - 0x40], rdi
lea rax, [r11 - 0x40]
mov qword [r11 - 0x58], rax
mov r9d, 0x20219
xor r8d, r8d
mov rdx, qword [rdx]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14006b662
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x80], 0x800
mov rax, qword [rbx]
sub esi, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, 0x800
or eax, esi
jge 0x14006b5ed
mov edx, 0x800
mov rcx, rbx
call fcn.140006160
mov rax, qword [rbx]
lea rcx, [rsp + 0x80]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
mov r8, qword [r14]
lea rdx, [0x140093733]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.SHLWAPI.dll_SHGetValueA]
mov esi, eax
mov rcx, qword [rbx]
test rcx, rcx
je 0x14006b635
movsxd rdx, dword [rcx - 0xc]
call fcn.1400456c4
mov edi, eax
test eax, eax
js 0x14006b657
mov rax, qword [rbx]
cmp edi, dword [rax - 0xc]
jg 0x14006b657
mov dword [rax - 0x10], edi
movsxd rcx, edi
mov rax, qword [rbx]
mov byte [rcx + rax], 0
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14006b662
mov ecx, 0x80070057
call fcn.140006270
int3
test esi, esi
sete dil
mov rdx, qword [r15]
sub rdx, 0x18
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14006b680
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov rdx, qword [r14]
sub rdx, 0x18
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14006b698
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.WS2_32.dll_htonl + 8]
movzx eax, dil
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x14006b6b0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
push r14
push r15
sub rsp, 0x30
mov r15, rdx
mov rdx, qword [rdx]
lea rax, [rsp + 0x50]
mov r14, r9
mov rsi, r8
mov rcx, 0xffffffff80000002
mov r9d, 0x20206
xor r8d, r8d
mov ebx, 1
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14006b73a
mov rcx, qword [r14]
mov r8, qword [rsi]
lea rdx, [0x140093733]
mov eax, dword [rcx - 0x10]
mov r9d, ebx
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.SHLWAPI.dll_SHSetValueA]
mov rcx, qword [rsp + 0x50]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [r15]
test ebx, ebx
sete dil
sub rdx, 0x18
or ebx, 0xffffffff
lock add dword [rdx + 0x10], ebx
jg 0x14006b759
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rdx, qword [rsi]
mov eax, ebx
sub rdx, 0x18
lock xadd dword [rdx + 0x10], eax
dec eax
jg 0x14006b774
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rdx, qword [r14]
sub rdx, 0x18
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14006b78c
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.WS2_32.dll_htonl + 8]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
movzx eax, dil
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x14006f010
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
xor ecx, ecx
mov rax, r8
mov qword [rbx], rcx
mov qword [rbx + 8], rcx
mov rdi, rdx
mov dword [rsp + 0x20], ecx
mov r8, r9
mov rdx, rax
mov rcx, rbx
mov dword [rbx + 0x50], 0x6a09e667
mov dword [rbx + 0x54], 0xbb67ae85
mov dword [rbx + 0x58], 0x3c6ef372
mov dword [rbx + 0x5c], 0xa54ff53a
mov dword [rbx + 0x60], 0x510e527f
mov dword [rbx + 0x64], 0x9b05688c
mov dword [rbx + 0x68], 0x1f83d9ab
mov dword [rbx + 0x6c], 0x5be0cd19
call fcn.14006f3c0
mov rdx, rdi
mov rcx, rbx
call fcn.14006f0a0
mov rbx, qword [rsp + 0x40]
mov rax, rdi
add rsp, 0x30
pop rdi
ret
Function at 0x140071450
Capabilities:
Get common file path
Get disk information

Disassembly:
push rbp
push rdi
push r14
sub rsp, 0x6a0
lea rbp, [rsp + 0x40]
mov qword [rbp + 0x18], 0xfffffffffffffffe
mov qword [rbp + 0x688], rbx
mov qword [rbp + 0x690], rsi
mov rax, qword [0x14009d810]
xor rax, rbp
mov qword [rbp + 0x650], rax
mov r14, rcx
xor esi, esi
mov dword [rbp + 0x14], esi
lea rcx, str.x__b_
mov rax, qword [str.x__b_]
call qword [rax + Ordinal_26]
lea rbx, [rax + 0x18]
mov qword [rbp], rbx
lea rdx, [0x140093733]
test rdx, 0xffffffffffff0000
jne 0x1400714d9
movzx edi, dx
mov ecx, edi
call fcn.140005b20
test rax, rax
je 0x1400714e9
mov r8d, edi
mov rdx, rax
lea rcx, [rbp]
call fcn.140005c70
jmp 0x1400714e5
xor r8d, r8d
lea rcx, [rbp]
call fcn.140005e30
mov rbx, qword [rbp]
mov word [rbp + 0x440], si
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x442]
call fcn.1400467a0
mov word [rbp + 0x230], si
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x232]
call fcn.1400467a0
mov dword [rbp + 8], esi
mov dword [rbp + 0x10], esi
mov dword [rbp + 0xc], esi
mov word [rbp + 0x20], si
xor edx, edx
mov r8d, 0x206
lea rcx, [rbp + 0x22]
call fcn.1400467a0
xor r9d, r9d
lea r8d, [r9 + 0x25]
lea rdx, [rbp + 0x20]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov word [rbp + 0x26], si
mov dword [rsp + 0x38], 0x105
lea rax, [rbp + 0x230]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0xc]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x10]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 8]
mov r8d, 0x105
lea rdx, [rbp + 0x440]
lea rcx, [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x1400715b1
mov r8d, dword [rbp + 8]
lea rdx, [0x140093c4c]
lea rcx, [rbp]
call fcn.140005810
mov rbx, qword [rbp]
or rdi, 0xffffffffffffffff
test rbx, rbx
je 0x140071614
mov rdx, rdi
nop dword [rax]
inc rdx
cmp byte [rbx + rdx], 0
jne 0x1400715c0
inc edx
cmp edx, 0x3fffffff
jg 0x140071614
movsxd rax, edx
add rax, rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x1400715ec
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.140047330
sub rsp, rcx
lea rcx, [rsp + 0x40]
mov r9d, 3
mov r8d, edx
mov rdx, rbx
call fcn.140006cc0
mov rsi, rax
mov rdx, rsi
mov rcx, r14
call fcn.140006560
nop
lea rdx, [rbx - 0x18]
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140071635
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.WS2_32.dll_htonl + 8]
mov rax, r14
mov rcx, qword [rbp + 0x650]
xor rcx, rbp
call fcn.140042af0
mov rbx, qword [rbp + 0x688]
mov rsi, qword [rbp + 0x690]
lea rsp, [rbp + 0x660]
pop r14
pop rdi
pop rbp
ret
Function at 0x140071b10
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x270
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov rax, qword [0x14009d810]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rbx, rcx
mov qword [rsp + 0x50], rcx
mov dword [rsp + 0x44], 0
lea rcx, str.x__b_
mov rax, qword [str.x__b_]
call qword [rax + Ordinal_26]
add rax, 0x18
mov qword [rbx], rax
mov dword [rsp + 0x44], 1
mov byte [rsp + 0x60], 0
xor edx, edx
mov r8d, 0x1ff
lea rcx, [rsp + 0x61]
call fcn.1400467a0
mov dword [rsp + 0x30], 0x200
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftCryptography
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140071c75
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, str.MachineGuid
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x140071c41
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftCryptography
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140071c75
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, str.MachineGuid
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140071c75
lea rcx, [rsp + 0x60]
or rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140071c50
mov r8d, eax
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.140006990
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, rbx
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140042af0
add rsp, 0x270
pop rbx
ret
Function at 0x140074000
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbx
push rsi
push rdi
push r14
sub rsp, 0x48
mov qword [rax - 0x38], 0xfffffffffffffffe
mov rbx, r9
mov rsi, r8
mov r14, rdx
mov ecx, 1
mov dword [rax + 0x20], ecx
mov dword [rax + 8], 0x800
mov rax, qword [r9]
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, 0x800
or eax, ecx
jge 0x140074057
mov edx, 0x800
mov rcx, rbx
call fcn.140006160
mov rax, qword [rbx]
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x88]
mov r8, qword [rsi]
mov rdx, qword [r14]
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHGetValueA]
mov edi, eax
mov rcx, qword [rbx]
test rcx, rcx
jne 0x140074092
xor eax, eax
jmp 0x14007409f
movsxd rdx, dword [rcx - 0xc]
call fcn.1400456c4
test eax, eax
js 0x1400740f5
mov rcx, qword [rbx]
cmp eax, dword [rcx - 0xc]
jg 0x1400740f5
mov dword [rcx - 0x10], eax
movsxd rcx, eax
mov rax, qword [rbx]
mov byte [rcx + rax], 0
test edi, edi
sete dil
mov rdx, qword [r14]
sub rdx, 0x18
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
jg 0x1400740d7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov rdx, qword [rsi]
sub rdx, 0x18
lock add dword [rdx + 0x10], 0xffffffff
jg 0x1400740ef
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.WS2_32.dll_htonl + 8]
movzx eax, dil
jmp 0x140074100
mov ecx, 0x80070057
call fcn.140006270
nop
add rsp, 0x48
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x401880
Capabilities:
Write file on windows

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x250
lea rsi, fcn.00722b30
movq xmm0, rsi
mov r10, qword [r8]
mov r11, qword [r8 + 8]
lea rbx, [rsp + 0x50]
mov qword [rsp + 0x20], r10
mov r9, rcx
lea r8, [rsp + 0x20]
movq xmm1, rbx
mov qword [rsp + 0x28], r11
lea rcx, [rsp + 0x30]
punpcklqdq xmm0, xmm1
movaps xmmword [rsp + 0x30], xmm0
movdqa xmm0, xmmword [0x0087bb10]
movaps xmmword [rsp + 0x40], xmm0
call r9
mov rdi, qword [fcn.007116c0]
mov ecx, 2
call rdi
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
mov r8d, 1
mov r9, rax
call sub.msvcrt.dll_fwrite
mov ecx, 2
call rdi
mov ecx, 0xa
mov rdx, rax
call sub.msvcrt.dll_fputc
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x30], rsi
cmp rcx, rbx
je 0x401926
call fcn.0086bab0
nop
add rsp, 0x250
pop rbx
pop rsi
pop rdi
ret
Function at 0x403690
Capabilities:
Write file on windows

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x690
lea rdi, fcn.00722b30
xor r9d, r9d
movq xmm0, rdi
mov r10, qword [rdx]
mov r11, qword [rdx + 8]
mov rdx, qword [r8 + 8]
mov rax, qword [r8]
lea rsi, [rsp + 0x80]
lea r13, [rsp + 0x40]
mov qword [rsp + 0x38], rdx
mov rbx, rcx
movq xmm1, rsi
lea rcx, [rsp + 0x60]
lea r8, [rsp + 0x30]
mov rdx, r13
punpcklqdq xmm0, xmm1
mov qword [rsp + 0x40], r10
movaps xmmword [rsp + 0x60], xmm0
movdqa xmm0, xmmword [0x0087bb10]
mov qword [rsp + 0x48], r11
mov qword [rsp + 0x30], rax
movaps xmmword [rsp + 0x70], xmm0
call fcn.00722070
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__fileno]
mov r12d, eax
mov ecx, eax
call qword [sym.imp.msvcrt.dll__isatty]
mov rcx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
test eax, eax
jne 0x403778
mov r9, rbx
mov r8, rbp
mov edx, 1
call sub.msvcrt.dll_fwrite
cmp rax, rbp
jb 0x40389c
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x60], rdi
cmp rcx, rsi
je 0x40375f
call fcn.0086bab0
nop
add rsp, 0x690
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov qword [rsp + 0x40], rcx
mov rdx, r13
lea rcx, [rsp + 0x280]
mov qword [rsp + 0x48], rbp
call fcn.004019e0
mov rax, qword [rsp + 0x290]
mov dword [rsp + 0x5c], 0
mov ecx, r12d
mov r13, qword [rsp + 0x288]
lea rbx, [rax - 1]
call qword [sym.imp.msvcrt.dll__get_osfhandle]
mov rcx, rax
lea r9, [rsp + 0x5c]
mov r8d, ebx
mov rdx, r13
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteConsoleW]
test eax, eax
je 0x40380a
lea rax, fcn.00722c50
mov rcx, qword [rsp + 0x288]
mov qword [rsp + 0x280], rax
lea rax, [rsp + 0x2a0]
cmp rcx, rax
je 0x40374a
call fcn.0086bab0
jmp 0x40374a
mov ecx, 0x10
call fcn.0086bbe0
lea rdx, str.failed_to_write_to_console
mov rcx, rax
mov r13, rax
call fcn.00818b10
lea rax, [0x00924e40]
lea r8, [0x00401770]
mov rcx, r13
mov qword [r13], rax
lea rdx, [0x0091ff80]
call fcn.0086c380
mov r12, rax
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x60], rdi
cmp rcx, rsi
je 0x40385e
call fcn.0086bab0
mov rcx, r12
call fcn.00704b70
mov rcx, r13
mov r12, rax
call fcn.0086bf30
lea rax, fcn.00722c50
mov rcx, qword [rsp + 0x288]
mov qword [rsp + 0x280], rax
lea rax, [rsp + 0x2a0]
cmp rcx, rax
je 0x40384a
call fcn.0086bab0
jmp 0x40384a
mov ecx, 0x18
call fcn.0086bbe0
mov r14, rax
call qword [sym.imp.msvcrt.dll__errno]
mov edx, dword [rax]
lea rbx, str.cannot_write_to_file
mov r8, r13
mov rcx, r14
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], 0x14
call fcn.00722a90
lea r8, [0x004017b0]
lea rdx, [0x0091ffa0]
mov rcx, r14
call fcn.0086c380
mov r12, rax
jmp 0x403871
Function at 0x406f60
Capabilities:
Query environment variable

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
cmp qword [0x00993168], 0
mov r12, rcx
mov rsi, rdx
mov r13, r8
je 0x4070e0
mov rbx, qword [0x00993150]
test rbx, rbx
je 0x407020
lea rbp, [0x00993148]
mov rdi, rbp
nop dword [rax]
cmp qword [rbx + 0x28], 0
je 0x406fc0
cmp qword [rsi + 8], 0
je 0x406fc0
mov rcx, qword [rbx + 0x20]
mov rdx, qword [rsi]
call sub.msvcrt.dll_strcmp
test eax, eax
js 0x406ff8
nop
mov rdi, rbx
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x406fa0
cmp rdi, rbp
je 0x407020
cmp qword [rsi + 8], 0
jne 0x407000
lea rdx, [rdi + 0x30]
mov rcx, r12
call fcn.0043c550
mov rax, r12
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov rbx, qword [rbx + 0x18]
jmp 0x406fc7
cmp qword [rdi + 0x28], 0
je 0x406fd8
mov rdx, qword [rdi + 0x20]
mov rcx, qword [rsi]
call sub.msvcrt.dll_strcmp
test eax, eax
jns 0x406fd8
nop word [rax + rax]
cmp qword [r13 + 0x28], 0
je 0x4070b0
mov rbx, qword [r13 + 0x10]
lea rbp, [r13 + 8]
mov rdi, rbp
test rbx, rbx
je 0x4070b0
nop dword [rax + rax]
cmp qword [rbx + 0x28], 0
je 0x407060
cmp qword [rsi + 8], 0
je 0x407060
mov rcx, qword [rbx + 0x20]
mov rdx, qword [rsi]
call sub.msvcrt.dll_strcmp
test eax, eax
js 0x4070d8
nop
mov rdi, rbx
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x407040
cmp rdi, rbp
je 0x4070b0
cmp qword [rsi + 8], 0
je 0x406fd8
cmp qword [rdi + 0x28], 0
je 0x406fd8
mov rcx, qword [rsi]
mov rdx, qword [rdi + 0x20]
mov qword [rsp + 0x28], rcx
call sub.msvcrt.dll_strcmp
mov rcx, qword [rsp + 0x28]
test eax, eax
jns 0x406fd8
jmp 0x4070b3
mov rcx, qword [rsi]
call sub.msvcrt.dll_getenv
mov rcx, r12
mov rdx, rax
call fcn.0043c460
mov rax, r12
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov rbx, qword [rbx + 0x18]
jmp 0x407067
call fcn.00406650
jmp 0x406f83
Function at 0x40dee0
Capabilities:
Set console window title

Disassembly:
push r13
push r12
push rbx
sub rsp, 0x30
lea rax, [0x00925050]
mov qword [rcx], rax
mov rbx, rcx
mov r13, rdx
mov qword [rcx + 8], 0
mov qword [rcx + 0x10], 0
mov ecx, 1
call fcn.006ac0f0
cmp eax, 0xe
je 0x40df38
cmp eax, 7
je 0x40df38
mov rax, qword [0x0091c9d0]
mov byte [rax], 0
add rsp, 0x30
pop rbx
pop r12
pop r13
ret
mov ecx, 0x158
call fcn.0086bb00
mov qword [rbx + 8], rax
mov r12, rax
call fcn.0069e710
xor r9d, r9d
mov r8d, 1
mov rdx, r12
mov rcx, rax
call fcn.006bb7f0
test eax, eax
js 0x40df1d
mov rcx, qword [rbx + 8]
xor edx, edx
call fcn.006bd740
mov rax, qword [rbx + 8]
mov ecx, 0xfffffff6
mov qword [rbx + 0x10], rax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x40dfa7
mov dword [rsp + 0x20], 0
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleMode]
test eax, eax
jne 0x40dfe8
cmp byte [r13], 0
je 0x40df27
lea rcx, [rsp + 0x20]
mov rdx, r13
call fcn.00412a20
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x40df27
call fcn.0086baa0
jmp 0x40df27
mov edx, dword [rsp + 0x20]
mov rcx, r12
and edx, 0xffffffbf
mov dword [rsp + 0x20], edx
or dl, 0x80
call qword [sym.imp.KERNEL32.dll_SetConsoleMode]
jmp 0x40dfa7