joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45d650
Capabilities:
Log keystrokes
Manipulate console buffer

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x78
mov rbx, rcx
mov ecx, dword [rcx + 0x58]
mov edx, ecx
and dh, 0xfe
sub dword [rbx + 0x7c], 1
mov dword [rbx + 0x58], edx
jne 0x45d6a0
test cl, 1
je 0x45d6c0
test edx, 0x20000
je 0x45d68d
test edx, 0x2000000
jne 0x45d6e0
and edx, 0x400000
je 0x45d730
xor esi, esi
mov eax, esi
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
ret
jns 0x45d671
lea rdx, [0x004b27b0]
lea rcx, [0x004b2d37]
mov r8d, 0x401
call fcn.00480c40
mov edx, dword [rbx + 0x58]
jmp 0x45d671
test cl, 0x40
je 0x45d671
mov edx, ecx
and edx, 0xfffffebf
and ecx, 0x20
mov dword [rbx + 0x58], edx
je 0x45d671
mov rax, qword [rbx + 8]
sub dword [rax + 8], 1
jmp 0x45d671
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
mov dword [rsp + 0x60], 0
mov rcx, qword [rbx + 0x110]
lea r9, [rsp + 0x4c]
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
test eax, eax
jne 0x45d68d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x45d68f
lea rcx, [0x004cb858]
call fcn.004581a0
mov eax, 2
xchg dword [0x004cb87c], eax
cmp eax, 1
je 0x45d764
lea rcx, [0x004cb858]
call fcn.00458170
or dword [rbx + 0x58], 0x400000
jmp 0x45d68d
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
mov r8d, 3
mov edx, 0xc0000000
lea rcx, str.conout_
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
mov rdi, rax
je 0x45d7b9
lea rdx, [0x004cb860]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
jne 0x45d852
mov ecx, 1
movabs rax, 0xd000100000001
xor edx, edx
mov word [rsp + 0x50], cx
mov qword [rsp + 0x54], rax
mov ecx, 0xd
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov r8d, 0xd
mov word [rsp + 0x5c], ax
mov dword [rsp + 0x60], 0
mov word [rsp + 0x5e], r8w
lea rdx, [rsp + 0x50]
mov rcx, qword [rbx + 0x110]
lea r9, [rsp + 0x4c]
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
test eax, eax
je 0x45d831
cmp rdi, 0xffffffffffffffff
je 0x45d758
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x45d758
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp rdi, 0xffffffffffffffff
mov ebp, eax
jne 0x45d8c4
mov esi, eax
test ebp, ebp
jne 0x45d68f
jmp 0x45d758
lock or dword [0x004cb878], 1
mov eax, 1
xor edx, edx
mov ecx, 0xd
mov word [rsp + 0x50], ax
movabs rax, 0xd000100000001
mov qword [rsp + 0x54], rax
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov edx, 0xd
mov word [rsp + 0x5c], ax
mov dword [rsp + 0x60], 0
mov word [rsp + 0x5e], dx
mov rcx, qword [rbx + 0x110]
lea rdx, [rsp + 0x50]
lea r9, [rsp + 0x4c]
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
test eax, eax
jne 0x45d823
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov esi, ebp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x45d845
Function at 0x45e4e0
Capabilities:
Set socket configuration

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
cmp qword [rdx + 0x70], 0xffffffffffffffff
mov eax, 0xfffff00e
mov rdi, rcx
mov rbx, rdx
mov rsi, r8
mov ebp, r9d
mov dword [rsp + 0x2c], 1
jne 0x45e531
lea r8, [rsp + 0x2c]
mov edx, 0x8004667e
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
je 0x45e540
mov r9d, ebp
mov r8, rsi
mov rdx, rbx
mov rcx, rdi
call fcn.0045e380
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x45e550
Capabilities:
Set socket configuration

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
xor esi, esi
test byte [rcx + 0x59], 2
mov rbx, rcx
mov rbp, rdx
mov r12d, r8d
mov edi, r9d
mov dword [rsp + 0x38], 0
jne 0x45e5bb
mov r13d, r9d
and r13d, 1
jne 0x45e5d0
mov rcx, qword [rbx + 0x70]
cmp rcx, 0xffffffffffffffff
je 0x45e660
and edi, 4
jne 0x45e5e0
cmp word [rbp], 0x17
je 0x45e616
mov r8d, r12d
mov rdx, rbp
call qword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
je 0x45e650
or dword [rbx + 0x58], 0x200
xor esi, esi
mov eax, esi
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
cmp word [rdx], 0x17
mov esi, 0x57
je 0x45e583
jmp 0x45e5bb
mov dword [rsp + 0x3c], 1
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x3c]
mov r8d, 4
mov edx, 0xffff
call qword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x45e650
cmp word [rbp], 0x17
mov rcx, qword [rbx + 0x70]
jne 0x45e59d
or dword [rbx + 0x58], 0x1000000
test r13d, r13d
jne 0x45e59d
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x38]
mov r8d, 0x1b
mov edx, 0x29
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rcx, qword [rbx + 0x70]
jmp 0x45e59d
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
jmp 0x45e5bb
movzx ecx, word [rbp]
xor r8d, r8d
mov edx, 2
call qword [sym.imp.WS2_32.dll_socket]
cmp rax, 0xffffffffffffffff
mov r14, rax
je 0x45e650
movzx r9d, word [rbp]
mov rcx, qword [rbx + 8]
mov r8, rax
mov rdx, rbx
call fcn.0045e4e0
test eax, eax
mov esi, eax
jne 0x45e6a0
mov rcx, qword [rbx + 0x70]
jmp 0x45e591
mov rcx, r14
call qword [sym.imp.WS2_32.dll_closesocket]
jmp 0x45e5bb
Function at 0x45f0f0
Capabilities:
Set socket configuration

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x70
mov eax, dword [rcx + 0x58]
mov rsi, rcx
mov r12, rdx
mov rbp, r8
mov edi, r9d
and eax, 0x1000200
cmp eax, 0x200
je 0x45f1d0
mov rdx, qword [0x004ba900]
mov r9d, 4
mov r8d, 0x1c
call fcn.0045e550
test eax, eax
mov ebx, eax
jne 0x45f1e2
test rbp, rbp
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x40], 0
je 0x45f175
lea r8, [rsp + 0x50]
xor edx, edx
mov rcx, rbp
call fcn.0043fce0
test eax, eax
jne 0x45f1d0
mov eax, dword [rsp + 0x68]
mov dword [rsp + 0x40], eax
mov rax, qword [r12 + 8]
mov rdx, qword [r12 + 0x10]
test edi, edi
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rdx
je 0x45f200
cmp edi, 1
jne 0x45f1d0
mov r8d, 0xc
mov rcx, qword [rsi + 0x70]
mov dword [rsp + 0x20], 0x14
lea r9, [rsp + 0x30]
mov edx, 0x29
call qword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x45f1d5
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.00441a00
mov ebx, eax
jmp 0x45f1d5
mov ebx, 0xfffff019
mov eax, ebx
add rsp, 0x70
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov ecx, eax
call fcn.00441a00
mov ebx, eax
mov eax, ebx
add rsp, 0x70
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov r8d, 0xd
jmp 0x45f198
Function at 0x45faa0
Capabilities:
Send data
Send data on socket

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x60
mov esi, dword [rsp + 0xb0]
test r8d, r8d
mov rbx, rcx
mov rbp, rdx
mov edi, r8d
mov r12, r9
je 0x45fb70
cmp qword [rbx + 0x68], 0
jne 0x45fba0
test byte [rbx + 0x59], 2
jne 0x45fb02
cmp esi, 0x10
je 0x45fb90
cmp esi, 0x1c
jne 0x45fbb0
mov rdx, qword [0x004ba900]
xor r9d, r9d
mov r8d, esi
mov rcx, rbx
call fcn.0045e550
test eax, eax
jne 0x45fb56
mov rcx, qword [rbx + 0x70]
mov qword [rsp + 0x40], 0
lea r9, [rsp + 0x5c]
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], esi
mov r8d, edi
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], 0
mov rdx, rbp
call qword [sym.imp.WS2_32.dll_WSASendTo]
test eax, eax
jne 0x45fb50
mov eax, dword [rsp + 0x5c]
add rsp, 0x60
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.00441a00
add rsp, 0x60
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
lea rdx, str.src_win_udp.c
lea rcx, str.nbufs___0
mov r8d, 0x3a0
call fcn.00480c40
jmp 0x45fac6
mov rdx, qword [0x004ba8f0]
jmp 0x45faf0
mov eax, 0xfffff008
jmp 0x45fb42
mov eax, 0xfffff019
jmp 0x45fb42

Function at 0x4601e0
Capabilities:
Enumerate processes

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x150
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rsi, [rsp + 0x20]
xor edx, edx
mov ecx, 2
mov edi, eax
mov dword [rsp + 0x20], 0x130
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rdx, rsi
mov rcx, rax
mov rbx, rax
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x46022f
jmp 0x460250
mov rdx, rsi
mov rcx, rbx
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x460250
cmp dword [rsp + 0x28], edi
jne 0x460220
mov esi, dword [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
add rsp, 0x150
pop rbx
pop rsi
pop rdi
ret
mov esi, 0xffffffff
jmp 0x460239
Function at 0x461670
Capabilities:
Get common file path
Get session user name

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x468
test rcx, rcx
mov rbx, rcx
je 0x4617c1
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x38]
mov edx, 0x20008
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x461750
lea rsi, [rsp + 0x34]
lea rdi, [rsp + 0x250]
mov dword [rsp + 0x34], 0x208
mov rcx, qword [rsp + 0x38]
mov r8, rsi
mov rdx, rdi
call qword [sym.imp.USERENV.dll_GetUserProfileDirectoryW]
test eax, eax
jne 0x461701
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebx, 0x7a
je 0x4617e6
mov ecx, ebx
call fcn.00441a00
add rsp, 0x468
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea rbp, [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x34], 0x202
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
jne 0x461770
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x4617e6
mov ecx, eax
call fcn.00441a00
add rsp, 0x468
pop rbx
pop rsi
pop rdi
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.00441a00
add rsp, 0x468
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea r8, [rbx + 0x18]
mov qword [rbx + 0x18], 0
mov edx, 0xffffffff
mov rcx, rdi
call fcn.00461000
test eax, eax
jne 0x4616f5
mov qword [rbx], 0
mov r8, rbx
mov edx, 0xffffffff
mov rcx, rbp
call fcn.00461000
test eax, eax
jne 0x4617d0
mov qword [rbx + 8], 0xffffffffffffffff
mov qword [rbx + 0x10], 0
jmp 0x4616f5
mov eax, 0xfffff019
jmp 0x4616f5
mov rcx, qword [rbx + 0x18]
mov dword [rsp + 0x2c], eax
call fcn.0043ebd0
mov eax, dword [rsp + 0x2c]
jmp 0x4616f5
mov eax, 0xfffff027
jmp 0x4616f5
Function at 0x461d80
Capabilities:
Link many functions at runtime

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
lea rcx, str.ntdll.dll
mov rdi, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rdi
test rax, rax
mov rsi, rax
je 0x461f9a
lea rdx, str.RtlNtStatusToDosError
mov rcx, rax
mov rbx, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rbx
test rax, rax
mov qword [0x004cd0c0], rax
je 0x461f86
lea rdx, str.NtDeviceIoControlFile
mov rcx, rsi
call rbx
test rax, rax
mov qword [0x004cd0f8], rax
je 0x461f86
lea rdx, str.NtQueryInformationFile
mov rcx, rsi
call rbx
test rax, rax
mov qword [0x004cd098], rax
je 0x461f86
lea rdx, str.NtSetInformationFile
mov rcx, rsi
call rbx
test rax, rax
mov qword [0x004cd0b8], rax
je 0x461f86
lea rdx, str.NtQueryVolumeInformationFile
mov rcx, rsi
call rbx
test rax, rax
mov qword [0x004cd0d0], rax
je 0x461f86
lea rdx, str.NtQueryDirectoryFile
mov rcx, rsi
call rbx
cmp qword [0x004cd0d0], 0
mov qword [0x004cd0e0], rax
je 0x461f86
lea rdx, str.NtQuerySystemInformation
mov rcx, rsi
call rbx
test rax, rax
mov qword [0x004cd0f0], rax
je 0x461f86
lea rcx, str.kernel32.dll
call rdi
test rax, rax
mov rsi, rax
je 0x461f9a
lea rdx, str.GetQueuedCompletionStatusEx
mov rcx, rax
call rbx
lea rdx, str.SetFileCompletionNotificationModes
mov rcx, rsi
mov qword [0x004cd0a0], rax
call rbx
lea rdx, str.CreateSymbolicLinkW
mov rcx, rsi
mov qword [0x004cd0a8], rax
call rbx
lea rdx, str.CancelIoEx
mov rcx, rsi
mov qword [0x004cd078], rax
call rbx
lea rdx, str.InitializeConditionVariable
mov rcx, rsi
mov qword [0x004cd0e8], rax
call rbx
lea rdx, str.SleepConditionVariableCS
mov rcx, rsi
mov qword [0x004cd070], rax
call rbx
lea rdx, str.SleepConditionVariableSRW
mov rcx, rsi
mov qword [0x004cd100], rax
call rbx
lea rdx, str.WakeAllConditionVariable
mov rcx, rsi
mov qword [0x004cd088], rax
call rbx
lea rdx, str.WakeConditionVariable
mov rcx, rsi
mov qword [0x004cd0c8], rax
call rbx
lea rdx, str.CancelSynchronousIo
mov rcx, rsi
mov qword [0x004cd090], rax
call rbx
lea rdx, str.GetFinalPathNameByHandleW
mov rcx, rsi
mov qword [0x004cd0b0], rax
call rbx
lea rcx, str.powrprof.dll
mov qword [0x004cd0d8], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x461f7e
lea rdx, str.PowerRegisterSuspendResumeNotification
mov rcx, rax
call rbx
mov qword [0x004cd080], rax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.GetProcAddress
mov ecx, eax
call fcn.00441940
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.GetModuleHandleA
mov ecx, eax
call fcn.00441940
nop
nop
Function at 0x462090
Capabilities:
Initialize winsock library

Disassembly:
push rsi
push rbx
sub rsp, 0x468
mov ecx, 0x202
lea rdx, [rsp + 0x40]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x462299
lea r8, [0x004cd120]
lea rcx, str.0.0.0.0
xor edx, edx
call fcn.0043fc90
test eax, eax
jne 0x46226c
lea r8, [0x004cd130]
lea rcx, [0x004b36f3]
xor edx, edx
call fcn.0043fce0
test eax, eax
jne 0x46226c
xor r8d, r8d
mov edx, 1
mov ecx, 2
mov rsi, qword [sym.imp.WS2_32.dll_socket]
call rsi
cmp rax, 0xffffffffffffffff
mov rbx, rax
je 0x462200
lea rax, [rsp + 0x3c]
mov dword [rsp + 0x3c], 0x274
lea r9, [rsp + 0x1e0]
mov r8d, 0x2005
mov edx, 0xffff
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_getsockopt]
cmp eax, 0xffffffff
je 0x462271
test byte [rsp + 0x1e2], 2
je 0x4621e0
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_closesocket]
cmp eax, 0xffffffff
je 0x462285
xor r8d, r8d
mov edx, 1
mov ecx, 0x17
call rsi
cmp rax, 0xffffffffffffffff
mov rbx, rax
je 0x462240
lea rax, [rsp + 0x3c]
mov dword [rsp + 0x3c], 0x274
lea r9, [rsp + 0x1e0]
mov r8d, 0x2005
mov edx, 0xffff
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_getsockopt]
cmp eax, 0xffffffff
je 0x462271
test byte [rsp + 0x1e2], 2
je 0x4621f0
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_closesocket]
cmp eax, 0xffffffff
je 0x462285
add rsp, 0x468
pop rbx
pop rsi
ret
mov dword [0x004cd14c], 1
jmp 0x462153
mov dword [0x004cd110], 1
jmp 0x4621c2
mov rbx, qword [sym.imp.WS2_32.dll_WSAGetLastError]
call rbx
lea edx, [rax - 0x273b]
cmp edx, 1
jbe 0x462165
sub eax, 0x273e
cmp eax, 1
jbe 0x462165
call rbx
lea rdx, str.socket
mov ecx, eax
call fcn.00441940
nop word cs:[rax + rax]
mov rbx, qword [sym.imp.WS2_32.dll_WSAGetLastError]
call rbx
lea edx, [rax - 0x273b]
cmp edx, 1
jbe 0x4621d4
sub eax, 0x273e
cmp eax, 1
ja 0x462226
add rsp, 0x468
pop rbx
pop rsi
ret
call sub.msvcrt.dll_abort
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.getsockopt
mov ecx, eax
call fcn.00441940
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.closesocket
mov ecx, eax
call fcn.00441940
lea rdx, str.WSAStartup
mov ecx, eax
call fcn.00441940
nop
nop dword [rax + rax]
Function at 0x469310
Capabilities:
Check for software breakpoints

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, rcx
mov edi, edx
mov rsi, r8
je 0x4694d0
mov rcx, qword [rbx + 0x20]
lea rdx, str.Error_processing_request__HTTP_response_code_is__u____s__._Closing_connection._n
mov dword [rbx + 0x120], 9
mov byte [rbx + 0x119], 1
mov r9, rsi
mov r8d, edi
call fcn.0046f900
mov rcx, qword [rbx + 0x38]
test rcx, rcx
je 0x469367
call sym.xmrig.exe_MHD_destroy_response
mov qword [rbx + 0x38], 0
mov rcx, rsi
mov edx, dword [rcx]
add rcx, 4
lea eax, [rdx - 0x1010101]
not edx
and eax, edx
and eax, 0x80808080
je 0x46936a
mov edx, eax
shr edx, 0x10
test eax, 0x8080
cmove eax, edx
lea rdx, [rcx + 2]
cmove rcx, rdx
mov edx, eax
add dl, al
mov rdx, rsi
sbb rcx, 3
xor r8d, r8d
sub rcx, rsi
call sym.xmrig.exe_MHD_create_response_from_buffer
test rax, rax
mov rsi, rax
je 0x4693bf
cmp qword [rbx + 0x38], 0
je 0x469472
mov rcx, rsi
call sym.xmrig.exe_MHD_destroy_response
mov dword [rbx + 0x70], 0xffffffff
mov rcx, rbx
call fcn.00464df0
test eax, eax
je 0x4693f0
mov dword [rbx + 0x120], 0xa
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov rcx, qword [rbx + 0x20]
lea rdx, str.Closing_connection__failed_to_create_response_header__n
call fcn.0046f900
mov rsi, qword [rbx + 0x20]
mov dword [rbx + 0x120], 0x13
mov dword [rbx + 0x124], 3
mov rdi, qword [rbx + 0x38]
test byte [rsi + 0x18d], 0x10
je 0x4694b4
test rdi, rdi
je 0x46943e
mov qword [rbx + 0x38], 0
mov rcx, rdi
call sym.xmrig.exe_MHD_destroy_response
mov rax, qword [rsi + 0x70]
test rax, rax
je 0x469463
cmp byte [rbx + 0x10c], 0
je 0x469463
mov rcx, qword [rsi + 0x78]
mov r9d, 1
lea r8, [rbx + 0x48]
mov rdx, rbx
call rax
mov byte [rbx + 0x10c], 0
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov eax, dword [rbx + 0x120]
cmp eax, 4
je 0x469486
cmp eax, 9
jne 0x4693bf
cmp qword [rsi + 0x28], 0
mov rcx, qword [rbx + 0x20]
je 0x4694e0
test byte [rcx + 0x18d], 0x80
je 0x469560
cmp edi, 0x65
je 0x4694e0
lea rdx, str.Application_used_invalid_status_code_for_upgrade_response__n
call fcn.0046f900
jmp 0x4693bf
mov rcx, qword [rbx + 0x110]
mov edx, 1
call qword [sym.imp.WS2_32.dll_shutdown]
jmp 0x469429
lea rax, str.HTTP_1.0
mov qword [rcx + 0x68], rax
jmp 0x46932a
mov rcx, rsi
call fcn.00472330
mov rcx, qword [rbx + 0x58]
mov qword [rbx + 0x38], rsi
mov dword [rbx + 0x128], edi
test rcx, rcx
je 0x46950b
lea rdx, str.HEAD
call fcn.0046fff0
test eax, eax
jne 0x469550
cmp edi, 0xc7
setbe dl
cmp edi, 0xcc
sete al
or dl, al
jne 0x469550
cmp edi, 0x130
je 0x469550
cmp dword [rbx + 0x120], 4
je 0x469571
cmp byte [rbx + 0x11b], 0
jne 0x4693bf
mov rcx, rbx
call fcn.00467220
jmp 0x4693bf
mov rax, qword [rsi + 0x60]
mov qword [rbx + 0xe0], rax
jmp 0x469529
lea rdx, str.Attempted_upgrade_connection_on_daemon_without_MHD_ALLOW_UPGRADE_option__n
call fcn.0046f900
jmp 0x4693bf
mov rcx, qword [rbx + 0x58]
test rcx, rcx
je 0x469532
lea rdx, str.POST
call fcn.0046fff0
test eax, eax
je 0x46959d
mov byte [rbx + 0x119], 1
mov dword [rbx + 0x120], 9
jmp 0x469532
mov rcx, qword [rbx + 0x58]
lea rdx, [0x004b3d48]
call fcn.0046fff0
test eax, eax
jne 0x46958a
jmp 0x469532
Function at 0x469980
Capabilities:
Send data
Send data on socket

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov ebp, dword [rcx + 0x18c]
lea r14, [rcx + 0x128]
mov rdi, rcx
and ebp, 4
mov rcx, r14
setne r12b
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp byte [rdi + 0x173], 0
je 0x469ac4
mov rbx, qword [rdi + 0x28]
mov byte [rdi + 0x173], 0
test rbx, rbx
je 0x469ac4
xor r13d, r13d
cmp byte [rbx + 0x178], 0
mov rsi, qword [rbx + 8]
je 0x469a70
mov rax, qword [rbx + 0x168]
test rax, rax
je 0x4699fd
movzx edx, byte [rax + 8]
test dl, dl
je 0x469a70
cmp byte [rax + 9], 0
je 0x469a70
test rsi, rsi
mov rdx, qword [rbx]
je 0x469b50
mov qword [rsi], rdx
mov rdx, qword [rbx]
test rdx, rdx
je 0x469b41
mov rcx, qword [rbx + 8]
mov qword [rdx + 8], rcx
test rax, rax
mov qword [rbx], 0
mov qword [rbx + 8], 0
mov byte [rbx + 0x170], 0
je 0x469ad2
mov rax, qword [rdi + 0x30]
mov qword [rbx], rax
cmp qword [rdi + 0x38], 0
je 0x469b60
mov rax, qword [rdi + 0x30]
mov qword [rax + 8], rbx
mov qword [rdi + 0x30], rbx
mov byte [rbx + 0x178], 0
mov r13d, 1
nop word [rax + rax]
test rsi, rsi
mov rbx, rsi
jne 0x4699d2
and r12d, r13d
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test r12b, r12b
je 0x469ab2
xor r9d, r9d
mov rcx, qword [rdi + 0x168]
mov r8d, 1
lea rdx, [0x004b4d60]
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jle 0x469b69
mov eax, r13d
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov rcx, r14
xor r13d, r13d
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x469ab2
mov rax, qword [rdi + 0x10]
mov qword [rbx], rax
cmp qword [rdi + 0x18], 0
je 0x469b8e
mov rax, qword [rdi + 0x10]
mov qword [rax + 8], rbx
test ebp, ebp
mov qword [rdi + 0x10], rbx
jne 0x469a5d
mov rax, qword [rbx + 0x100]
test rax, rax
jne 0x469b97
cmp rax, qword [rdi + 0x180]
je 0x469baf
mov rax, qword [rdi + 0x50]
mov qword [rbx + 0x18], 0
mov qword [rbx + 0x10], rax
cmp qword [rdi + 0x58], 0
je 0x469bd7
mov rax, qword [rdi + 0x50]
mov qword [rax + 0x18], rbx
mov qword [rdi + 0x50], rbx
jmp 0x469a5d
mov rdx, qword [rbx + 8]
mov qword [rdi + 0x28], rdx
jmp 0x469a20
mov qword [rdi + 0x20], rdx
jmp 0x469a0c
mov qword [rdi + 0x38], rbx
jmp 0x469a59
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x469ab2
lea rdx, str.Failed_to_signal_resume_of_connection_via_inter_thread_communication_channel.
mov rcx, rdi
call fcn.0046f900
jmp 0x469ab2
mov qword [rdi + 0x18], rbx
jmp 0x469aec
call fcn.0046ffb0
mov qword [rbx + 0xf8], rax
mov rax, qword [rbx + 0x100]
jmp 0x469b08
mov rax, qword [rdi + 0x40]
mov qword [rbx + 0x18], 0
mov qword [rbx + 0x10], rax
cmp qword [rdi + 0x48], 0
je 0x469be0
mov rax, qword [rdi + 0x40]
mov qword [rax + 0x18], rbx
mov qword [rdi + 0x40], rbx
jmp 0x469a5d
mov qword [rdi + 0x58], rbx
jmp 0x469b38
mov qword [rdi + 0x48], rbx
jmp 0x469bce
Function at 0x46a5d0
Capabilities:
Send data
Send data on socket
Send http request

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov r12, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rdi, [rcx + 0x128]
mov rsi, rcx
mov rcx, rdi
call r12
mov rbx, qword [rsi + 0x38]
mov rbp, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rbx, rbx
je 0x46a782
mov r14, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov r15, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r13, qword [sym.imp.WS2_32.dll_closesocket]
jmp 0x46a72a
mov rdx, qword [rbx]
mov qword [rax], rdx
mov rax, qword [rbx]
test rax, rax
je 0x46a750
mov rdx, qword [rbx + 8]
mov qword [rax + 8], rdx
mov qword [rbx], 0
mov qword [rbx + 8], 0
mov rcx, rdi
call rbp
test byte [rsi + 0x18c], 4
je 0x46a669
cmp byte [rbx + 0x11a], 0
je 0x46a760
mov rcx, qword [rbx + 0x168]
test rcx, rcx
je 0x46a685
mov qword [rbx + 0x168], 0
call sub.msvcrt.dll_free
mov rcx, qword [rbx + 0x40]
call fcn.0046fd40
mov rax, qword [rsi + 0x80]
sub dword [rsi + 0x178], 1
mov byte [rsi + 0x172], 0
test rax, rax
je 0x46a6be
mov rcx, qword [rsi + 0x88]
mov r9d, 1
lea r8, [rbx + 0x50]
mov rdx, rbx
call rax
mov rdx, qword [rbx + 0x98]
mov r8d, dword [rbx + 0xf0]
mov rcx, rsi
call fcn.0046a4a0
mov rcx, qword [rbx + 0x38]
test rcx, rcx
je 0x46a6ea
call sym.xmrig.exe_MHD_destroy_response
mov qword [rbx + 0x38], 0
mov rcx, qword [rbx + 0x110]
cmp rcx, 0xffffffffffffffff
je 0x46a702
call r13
test eax, eax
jne 0x46a7c1
mov rcx, qword [rbx + 0x98]
test rcx, rcx
je 0x46a713
call sub.msvcrt.dll_free
mov rcx, rbx
call sub.msvcrt.dll_free
mov rcx, rdi
call r12
mov rbx, qword [rsi + 0x38]
test rbx, rbx
je 0x46a782
mov rax, qword [rbx + 8]
test rax, rax
jne 0x46a625
mov rax, qword [rbx]
mov qword [rsi + 0x30], rax
mov rax, qword [rbx]
test rax, rax
jne 0x46a637
nop word [rax + rax]
mov rax, qword [rbx + 8]
mov qword [rsi + 0x38], rax
jmp 0x46a63f
mov rcx, qword [rbx + 0xa0]
mov edx, 0xffffffff
call r14
test eax, eax
jne 0x46a7a0
mov rcx, qword [rbx + 0xa0]
call r15
jmp 0x46a669
mov rcx, rdi
mov rax, rbp
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp rax
lea r9, str.Failed_to_join_a_thread_n
mov r8d, 0xc73
lea rdx, str.T:_Bin_prep_mhd_src_libmicrohttpd_0.9.55_src_microhttpd_daemon.c
mov rcx, qword [0x004cd150]
call qword [0x004cd158]
lea r9, str.Close_socket_failed._n
mov r8d, 0xcaa
lea rdx, str.T:_Bin_prep_mhd_src_libmicrohttpd_0.9.55_src_microhttpd_daemon.c
mov rcx, qword [0x004cd150]
call qword [0x004cd158]
nop
nop dword [rax]
nop word cs:[rax + rax]