joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001b30
Capabilities:
Encode data using base64 via winapi

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov eax, 0x43f0
call fcn.14001cf10
sub rsp, rax
mov rax, qword [0x14002b008]
xor rax, rsp
mov qword [rsp + 0x43e0], rax
movaps xmm0, xmmword [str.HEAD__s_HTTP_1.1_r_nHost:__s_r_nAuthorization:_NTLM__s_r_nConnection:_Keep_Alive_r_n_r_n]
mov r15, r8
mov eax, dword [0x140026b38]
mov ebp, edx
movaps xmm1, xmmword [0x140026b00]
mov rsi, rcx
mov rdi, qword [rsp + 0x4440]
mov rbx, qword [0x14002ceb8]
movaps xmmword [rsp + 0x50], xmm0
movaps xmm0, xmmword [0x140026b10]
mov dword [rsp + 0x98], eax
movzx eax, word [0x140026b3c]
movaps xmmword [rsp + 0x70], xmm0
movsd xmm0, qword [0x140026b30]
movaps xmmword [rsp + 0x60], xmm1
movaps xmm1, xmmword [0x140026b20]
mov word [rsp + 0x9c], ax
movzx eax, byte [0x140026b3e]
movsd qword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0x80], xmm1
mov byte [rsp + 0x9e], al
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x3f40
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xorps xmm0, xmm0
lea rcx, [rsp + 0xa0]
mov r14, rax
xor edx, edx
xor eax, eax
mov r8d, 0x400
mov dword [rsp + 0x48], eax
movups xmmword [rsp + 0x38], xmm0
call fcn.140005910
mov r8d, socket
lea rcx, [rsp + 0x38]
mov rdx, rbx
call fcn.14000d854
mov r8d, 0x400
lea rcx, [rsp + 0xa0]
mov rdx, rdi
call fcn.14000d854
mov dword [rsp + 0x30], 0x3f40
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x3f40
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r8d, 0x40000001
mov edx, ebp
mov rbx, rax
mov rcx, rsi
lea rax, [rsp + 0x30]
mov r9, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
test eax, eax
je 0x140001d0e
xor edx, edx
lea rcx, [rsp + 0x4a0]
mov r8d, 0x3f40
call fcn.140005910
movsxd r8, dword [rsp + 0x30]
lea rcx, [rsp + 0x4a0]
mov rdx, rbx
call fcn.1400078c0
lea rax, [rsp + 0x4a0]
mov rcx, r14
lea r9, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0xa0]
lea rdx, [rsp + 0x50]
call fcn.1400012f0
mov dword [r15], eax
mov rax, r14
mov rcx, qword [rsp + 0x43e0]
xor rcx, rsp
call fcn.140004020
mov rbx, qword [rsp + 0x4438]
add rsp, 0x43f0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.CryptBinaryToStringA_failed_with_error_code__d
call fcn.140001010
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, 0xffffffff
call fcn.14000d508
int3
Function at 0x140001d50
Capabilities:
Decode data using base64 via winapi

Disassembly:
mov qword [rsp + 8], rbx
push rsi
push rdi
push r14
mov eax, 0x3fa0
call fcn.14001cf10
sub rsp, rax
mov rax, qword [0x14002b008]
xor rax, rsp
mov qword [rsp + 0x3f90], rax
mov r14, r9
movsxd rdi, edx
mov rsi, r8
mov dword [rsp + 0x40], 0x4d4c544e
xor r8d, r8d
mov byte [rsp + 0x44], 0x20
xor r9d, r9d
mov r11, rcx
test edx, edx
jle 0x140001dc8
xor ecx, ecx
xor edx, edx
nop
movzx eax, byte [rsp + rdx + 0x40]
cmp byte [rcx + r11], al
jne 0x140001db7
inc r8d
inc rdx
cmp rdx, 5
je 0x140001dc4
inc r9d
inc rcx
cmp rcx, rdi
jl 0x140001da0
jmp 0x140001dc8
lea r8d, [r9 + 1]
xor ebx, ebx
cmp r8d, edi
jge 0x140001e05
movsxd rdx, r8d
lea rcx, [rsp + 0x50]
sub rdx, rcx
lea rax, [rsp + 0x50]
lea r8, [rdx + r11]
movzx ecx, byte [rax + r8]
cmp cl, 0xd
jne 0x140001df5
cmp byte [r8 + rax + 1], 0xa
je 0x140001e05
mov byte [rax], cl
inc ebx
inc rax
lea rcx, [rax + rdx]
cmp rcx, rdi
jl 0x140001de3
lea rdx, [rsp + 0x50]
lea rcx, str.b64type_s_n
call fcn.140001010
mov dword [r14], 0x3f40
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x3f40
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsp + 0x30], 0
lea rcx, [rsp + 0x50]
mov r9, rax
mov qword [rsp + 0x28], 0
mov r8d, 1
mov qword [rsp + 0x20], r14
mov edx, ebx
mov rdi, rax
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
je 0x140001ecb
mov rdx, rdi
lea rcx, str.decodes_s_n
call fcn.140001010
xor edx, edx
mov r8d, 0x3f40
mov rcx, rsi
call fcn.140005910
movsxd r8, dword [r14]
mov rdx, rdi
mov rcx, rsi
call fcn.1400078c0
mov rdx, rsi
lea rcx, str.decodes_s_n
call fcn.140001010
mov rcx, qword [rsp + 0x3f90]
xor rcx, rsp
call fcn.140004020
mov rbx, qword [rsp + 0x3fc0]
add rsp, 0x3fa0
pop r14
pop rdi
pop rsi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.CryptStringToBinaryA_failed_with_error_code__d
call fcn.140001010
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, 0xffffffff
call fcn.14000d508
int3
Function at 0x1400036c0
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x1f80]
mov eax, 0x2080
call fcn.14001cf10
sub rsp, rax
mov rax, qword [0x14002b008]
xor rax, rsp
mov qword [rbp + 0x1f70], rax
mov rbx, rcx
mov dword [rsp + 0x30], 0x424d53fe
movsxd rcx, dword [r8]
xor esi, esi
mov rdi, rdx
mov qword [rsp + 0x34], 0x10040
mov r14d, 1
mov qword [rsp + 0x3c], 0x1f0003
mov dword [rsp + 0x44], esi
lea eax, [rcx + 1]
mov qword [rsp + 0x48], rcx
mov dword [r8], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
movaps xmm0, xmmword [rsp + 0x30]
lea r8d, [r14 + 0x67]
movups xmm2, xmmword [0x140027460]
lea rdx, [rsp + 0x70]
mov dword [rsp + 0x50], eax
movaps xmm1, xmmword [rsp + 0x40]
xor r9d, r9d
mov rax, qword [rdi + 0x2c]
mov rcx, rbx
mov qword [rsp + 0x58], rax
movups xmmword [rsp + 0x74], xmm0
mov dword [rsp + 0x20], esi
mov dword [rsp + 0x54], esi
movaps xmm0, xmmword [rsp + 0x50]
movups xmmword [rbp - 0x6c], xmm0
mov byte [rsp + 0x23], 0x64
movups xmm0, xmmword [str.127.0.0.1c_]
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x70], eax
mov eax, dword [0x1400272a0]
movups xmmword [rbp - 0x44], xmm0
mov dword [rbp - 0x4c], 9
movsd xmm0, qword [0x140027298]
movsd qword [rbp - 0x34], xmm0
movups xmmword [rbp - 0x7c], xmm1
mov dword [rbp - 0x48], 0x1c0048
movups xmmword [rbp - 0x5c], xmm2
mov dword [rbp - 0x2c], eax
call qword [sym.imp.WS2_32.dll_send]
xor r9d, r9d
mov r8d, 0x2000
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_recv]
mov r8d, dword [rdi + 0xc]
lea rdx, str.127.0.0.1c_
test r8d, r8d
je 0x1400037ef
lea rcx, str.____SMB_Connect_Tree:__S_failed_with_status_code_0x_x_n
call fcn.140001010
mov eax, esi
jmp 0x1400037fe
lea rcx, str.___SMB_Connect_Tree:__S__success_n
call fcn.140001010
mov eax, r14d
mov rcx, qword [rbp + 0x1f70]
xor rcx, rsp
call fcn.140004020
add rsp, 0x2080
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140003820
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f88]
mov eax, 0x2088
call fcn.14001cf10
sub rsp, rax
mov rax, qword [0x14002b008]
xor rax, rsp
mov qword [rbp + 0x1f70], rax
mov rbx, qword [rdx + 0x2c]
mov rdi, r9
mov r15, r8
mov r14, rdx
mov r12, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r9d, dword [r15]
mov rsi, 0xffffffffffffffff
inc r9d
mov rdx, rsi
mov dword [r15], r9d
nop dword [rax]
inc rdx
cmp word [rdi + rdx*2], 0
jne 0x140003880
add dx, dx
mov r8, rsi
xor r13d, r13d
mov dword [rsp + 0x20], r13d
nop dword [rax + rax]
inc r8
cmp word [rdi + r8*2], r13w
jne 0x1400038a0
add r8w, 0x3c
mov dword [rsp + 0x50], eax
add r8w, r8w
mov qword [rsp + 0x3c], 0x1f0005
movzx ecx, r8w
mov byte [rsp + 0x23], r8b
shr cx, 8
mov r10d, 1
mov byte [rsp + 0x22], cl
mov eax, dword [rsp + 0x20]
movsxd rcx, r9d
mov qword [rsp + 0x48], rcx
lea r8d, [r10 + 4]
lea ecx, [r9 + 1]
mov dword [rsp + 0x30], 0x424d53fe
mov qword [rsp + 0x34], 0x10040
movaps xmm0, xmmword [rsp + 0x30]
mov dword [r15], ecx
movups xmm2, xmmword [0x140027460]
mov dword [rsp + 0x44], r13d
movaps xmm1, xmmword [rsp + 0x40]
mov dword [rsp + 0x54], r10d
mov qword [rsp + 0x58], rbx
mov dword [rsp + 0x70], eax
mov eax, 0x78
movups xmmword [rsp + 0x74], xmm0
mov dword [rbp - 0x28], r8d
mov r8, rsi
movaps xmm0, xmmword [rsp + 0x50]
movups xmmword [rbp - 0x5c], xmm2
mov dword [rbp - 0x4c], 0xff000039
movups xmmword [rbp - 0x7c], xmm1
mov dword [rbp - 0x48], 2
movups xmmword [rbp - 0x6c], xmm0
mov qword [rbp - 0x44], r13
mov qword [rbp - 0x3c], r13
mov dword [rbp - 0x34], 0x120196
mov dword [rbp - 0x30], 0x80
mov dword [rbp - 0x2c], r10d
mov dword [rbp - 0x24], 0x60
mov word [rbp - 0x20], ax
mov word [rbp - 0x1e], dx
mov qword [rbp - 0x1c], r13
inc r8
cmp word [rdi + r8*2], r13w
jne 0x140003980
add r8, r8
lea rcx, [rbp - 0x14]
mov rdx, rdi
call fcn.1400078c0
nop dword [rax]
cmp word [rdi + rsi*2 + 2], r13w
lea rsi, [rsi + 1]
jne 0x1400039a0
lea r8d, [rsi*2 + 0x7c]
xor r9d, r9d
lea rdx, [rsp + 0x70]
mov rcx, r12
call qword [sym.imp.WS2_32.dll_send]
xor r9d, r9d
mov r8d, 0x2000
mov rdx, r14
mov rcx, r12
call qword [sym.imp.WS2_32.dll_recv]
mov edx, dword [r14 + 0xc]
test edx, edx
je 0x1400039f3
lea rcx, str.____SMB_Create_Request_File_failed_with_status_code_0x_x_n
call fcn.140001010
mov eax, r13d
jmp 0x140003a07
mov rdx, rdi
lea rcx, str.___SMB_Create_Request_File:__S_success_n
call fcn.140001010
mov eax, 1
mov rcx, qword [rbp + 0x1f70]
xor rcx, rsp
call fcn.140004020
add rsp, 0x2088
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140003d30
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1fa0]
mov eax, 0x20a0
call fcn.14001cf10
sub rsp, rax
mov rax, qword [0x14002b008]
xor rax, rsp
mov qword [rbp + 0x1f90], rax
movups xmm0, xmmword [0x140027648]
movzx esi, byte [0x140027660]
mov rdi, r8
mov rbx, qword [rdx + 0x2c]
mov r15, rdx
movups xmmword [rsp + 0x70], xmm0
mov r14, rcx
mov r13d, 1
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
movsxd rdx, dword [rdi]
lea r8d, [r13 + 0x5c]
mov dword [rsp + 0x50], eax
xor r12d, r12d
mov qword [rsp + 0x48], rdx
xor r9d, r9d
mov dword [rsp + 0x20], r12d
lea ecx, [rdx + 1]
mov dword [rsp + 0x30], 0x424d53fe
mov dword [rdi], ecx
lea rdx, [rbp - 0x70]
movups xmm2, xmmword [r15 + 0x84]
mov qword [rsp + 0x34], 0x10040
mov rcx, r14
movups xmm3, xmmword [0x140027460]
mov dword [rsp + 0x3c], 0x1f0006
movaps xmm0, xmmword [rsp + 0x30]
movups xmmword [rbp - 0x6c], xmm0
mov dword [rsp + 0x54], r13d
movups xmmword [rsp + 0x78], xmm2
mov qword [rsp + 0x58], rbx
movaps xmm0, xmmword [rsp + 0x50]
movups xmmword [rbp - 0x4c], xmm0
mov qword [rsp + 0x40], 0x30
movups xmm0, xmmword [rsp + 0x70]
mov byte [rsp + 0x23], 0x58
movaps xmm1, xmmword [rsp + 0x40]
mov eax, dword [rsp + 0x20]
unpckhpd xmm2, xmm2
movups xmmword [rbp - 0x2c], xmm0
mov dword [rbp - 0x70], eax
movups xmmword [rbp - 0x5c], xmm1
mov byte [rbp - 0x14], sil
movups xmmword [rbp - 0x3c], xmm3
movsd qword [rbp - 0x1c], xmm2
call qword [sym.imp.WS2_32.dll_send]
xor r9d, r9d
mov r8d, 0x2000
mov rdx, r15
mov rcx, r14
call qword [sym.imp.WS2_32.dll_recv]
mov edx, dword [r15 + 0xc]
test edx, edx
je 0x140003e6e
lea rcx, str.____SMB_Close_File_Request_failed_with_status_code_0x_x_n
call fcn.140001010
mov eax, r12d
jmp 0x140003e7d
lea rcx, str.___SMB_Close_File_success_n
call fcn.140001010
mov eax, r13d
mov rcx, qword [rbp + 0x1f90]
xor rcx, rsp
call fcn.140004020
mov rbx, qword [rsp + 0x20f8]
add rsp, 0x20a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140003eb0
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f80]
mov eax, 0x2080
call fcn.14001cf10
sub rsp, rax
mov rax, qword [0x14002b008]
xor rax, rsp
mov qword [rbp + 0x1f70], rax
mov r14d, dword [reloc.WS2_32.dll_connect]
mov rdi, r8
movzx esi, byte [0x1400276c8]
mov r13, rdx
mov rbx, qword [rdx + 0x2c]
mov r15, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
movsxd rdx, dword [rdi]
xor r12d, r12d
mov qword [rsp + 0x48], rdx
xor r9d, r9d
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x30], 0x424d53fe
lea ecx, [rdx + 1]
mov qword [rsp + 0x34], 0x10040
mov dword [rdi], ecx
lea r8d, [r12 + 1]
movups xmm2, xmmword [0x140027460]
mov dword [rsp + 0x54], r8d
lea rdx, [rsp + 0x70]
mov dword [rsp + 0x3c], 0x1f0004
lea r8d, [r12 + 0x48]
movaps xmm0, xmmword [rsp + 0x30]
mov rcx, r15
movups xmmword [rsp + 0x73], xmm0
mov dword [rsp + 0x20], r12d
movzx eax, word [rsp + 0x21]
mov qword [rsp + 0x40], 0x30
movaps xmm1, xmmword [rsp + 0x40]
mov qword [rsp + 0x58], rbx
movaps xmm0, xmmword [rsp + 0x50]
movups xmmword [rbp - 0x5d], xmm2
mov word [rsp + 0x70], ax
mov byte [rsp + 0x72], 0x44
movups xmmword [rbp - 0x7d], xmm1
mov dword [rbp - 0x4d], r14d
movups xmmword [rbp - 0x6d], xmm0
mov byte [rbp - 0x49], sil
call qword [sym.imp.WS2_32.dll_send]
xor r9d, r9d
mov r8d, 0x2000
mov rdx, r13
mov rcx, r15
call qword [sym.imp.WS2_32.dll_recv]
mov edx, dword [r13 + 0xc]
test edx, edx
je 0x140003fd3
lea rcx, str.____SMB_Tree_Disconnect_failed_with_status_code_0x_x_n
call fcn.140001010
mov eax, r12d
jmp 0x140003fe4
lea rcx, str.___SMB_Tree_Disconnect_success_n
call fcn.140001010
mov eax, 1
mov rcx, qword [rbp + 0x1f70]
xor rcx, rsp
call fcn.140004020
mov rbx, qword [rsp + 0x20d8]
add rsp, 0x2080
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x140004b00
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140004b4a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140004b4a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140004b4a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140004b4a
cmp dword [rcx + 0x84], 0xe
jbe 0x140004b4a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140004b4c
xor al, al
add rsp, 0x28
ret
Function at 0x14000d508
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14000d373
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000d373
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000d373
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000d373
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000d373
cmp dword [rcx + 0x84], 0xe
jbe 0x14000d373
cmp dword [rcx + 0xf8], 0
je 0x14000d373
mov ecx, ebx
call fcn.14000d424
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14000d200
nop
cmp dword [rbp + 0x20], 0
je 0x14000d3c1
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14000d3cc
int3
xor r8d, r8d
xor edx, edx
jmp 0x14000d304
Function at 0x140012b40
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movsxd r15, ecx
lea r9, [0x14002c7a0]
mov rax, r15
mov rbp, r15
and eax, 0x3f
sar rbp, 6
mov ecx, 4
xor esi, esi
mov r14, rdx
lea rdi, [rax + rax*8]
mov rax, qword [r9 + rbp*8]
lea r13d, [rcx + 6]
mov r10, qword [rax + rdi*8 + 0x28]
test r8, r8
je 0x140012b97
cmp word [rdx], r13w
jne 0x140012b97
or byte [rax + rdi*8 + 0x38], cl
jmp 0x140012b9c
and byte [rax + rdi*8 + 0x38], 0xfb
lea r8, [rdx + r8*2]
mov rbx, r14
cmp r14, r8
jae 0x140012cc1
mov r11d, recv
lea r12d, [r11 - 0xb]
movzx ecx, word [rdx]
cmp cx, 0x1a
je 0x140012ce2
lea r9, [rdx + 2]
cmp cx, r11w
je 0x140012bd5
mov rdx, r9
mov word [rbx], cx
jmp 0x140012bfc
cmp r9, r8
jae 0x140012c0c
cmp word [r9], r13w
mov rax, r12
mov ecx, 4
cmove rax, rcx
add rdx, rax
mov eax, r13d
cmp word [r9], r13w
cmovne ax, r11w
mov word [rbx], ax
mov rax, r12
add rbx, rax
cmp rdx, r8
jb 0x140012bb6
jmp 0x140012cc1
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rsi
mov r8d, r12d
lea rdx, [rsp + 0x70]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140012cb6
cmp dword [rsp + 0x80], esi
je 0x140012cb6
lea r8, [0x14002c7a0]
mov rax, qword [r8 + rbp*8]
test byte [rax + rdi*8 + 0x38], 0x48
je 0x140012c8e
movzx eax, word [rsp + 0x70]
cmp ax, r13w
jne 0x140012c5e
mov word [rbx], r13w
jmp 0x140012cbe
mov ecx, recv
mov word [rsp + 0x78], ax
mov word [rbx], cx
mov rax, qword [r8 + rbp*8]
lea rcx, [rax + rdi*8]
mov al, byte [rsp + rsi + 0x78]
mov byte [rcx + rsi + 0x3a], al
inc rsi
cmp rsi, r12
jl 0x140012c6b
mov rax, qword [r8 + rbp*8]
mov byte [rax + rdi*8 + 0x3c], r13b
jmp 0x140012cbe
cmp word [rsp + 0x70], r13w
jne 0x140012c9b
cmp rbx, r14
je 0x140012c58
mov rdx, 0xfffffffffffffffe
mov ecx, r15d
lea r8d, [rdx + 3]
call fcn.14001a350
cmp word [rsp + 0x70], r13w
je 0x140012cc1
mov ecx, recv
mov word [rbx], cx
add rbx, r12
sub rbx, r14
sar rbx, 1
lea eax, [rbx + rbx]
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea r8, [0x14002c7a0]
mov rdx, qword [r8 + rbp*8]
mov al, byte [rdx + rdi*8 + 0x38]
test al, 0x40
jne 0x140012cbb
or al, r12b
mov byte [rdx + rdi*8 + 0x38], al
jmp 0x140012cc1
Function at 0x140014b0c
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x140014b93
mov rsi, rbx
cmp word [rax], bp
je 0x140014b52
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140014b3c
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140014b38
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.14001039c
mov rdi, rax
test rax, rax
je 0x140014b80
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.1400078c0
mov rbp, rdi
xor ecx, ecx
call fcn.14000f724
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400190e8
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x1400190fe
mov al, 1
jmp 0x14001915e
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x14001910f
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x14001915c
mov ecx, dword [rcx + 0x18]
nop
call fcn.1400154b0
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14001915c
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14001915c
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14001915c
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x14001915e
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x14001be50
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14001a350
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14001a350
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x14001bfa0
cmp rax, 0xffffffffffffffff
je 0x14001bfa0
xor edi, edi
test rbp, rbp
jle 0x14001bf4b
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14000f6ac
mov rbx, rax
test rax, rax
jne 0x14001bed8
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x14001bf41
mov edx, 0x8000
mov ecx, r14d
call fcn.14000e824
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.140016fb8
cmp eax, 0xffffffff
je 0x14001bf21
cdqe
sub rbp, rax
test rbp, rbp
jg 0x14001bee8
mov edx, r15d
mov ecx, r14d
call fcn.14000e824
jmp 0x14001bf41
cmp byte [rsi + 0x38], dil
je 0x14001bf38
cmp dword [rsi + 0x34], 5
jne 0x14001bf38
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], send
cmp byte [rsi + 0x30], dil
je 0x14001bf41
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14000f724
jmp 0x14001bfb4
jns 0x14001bfb4
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14001a350
cmp rax, 0xffffffffffffffff
jne 0x14001bf6c
cmp byte [rsi + 0x30], dil
je 0x14001bfb4
mov edi, dword [rsi + 0x2c]
jmp 0x14001bfb4
mov ecx, r14d
call fcn.1400154b0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x14001bfb4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, recv
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], send
jmp 0x14001bfb4
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x14001bfad
mov eax, dword [rsi + 0x2c]
jmp 0x14001bfb2
mov eax, socket
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14001a350
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x14001ce50
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14001ce78
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14001ce78
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret