joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140131480
Capabilities:
Set socket configuration
Terminate process

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x90
lea rdi, [rsp + 0x30]
mov ecx, 0x18
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0xa0]
mov rax, qword [0x140575740]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rcx, qword [rsp + 0xa0]
call fcn.14012a670
mov rax, qword [rax]
mov qword [rsp + 0x68], rax
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0xa0]
call fcn.14012c8f0
movzx eax, word [rsp + 0x38]
cmp eax, 0x17
jne 0x1401314f7
mov dword [rsp + 0x78], 0xa
jmp 0x1401314ff
mov dword [rsp + 0x78], 0xa
movzx eax, word [rsp + 0x38]
cmp eax, 0x17
jne 0x140131513
mov dword [rsp + 0x7c], 0x29
jmp 0x14013151b
mov dword [rsp + 0x7c], 0
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0xa8]
mov r8d, dword [rsp + 0x78]
mov edx, dword [rsp + 0x7c]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x140131573
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], 0
mov r9d, eax
mov r8d, 0x129
lea rdx, [0x1405571b0]
xor ecx, ecx
call fcn.14014da80
mov ecx, 0xfd
call fcn.14038e600
nop
mov rcx, rsp
lea rdx, reloc.WS2_32.dll_accept
call fcn.14037c300
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14037c650
add rsp, 0x90
pop rdi
ret

Function at 0x1401315b0
Capabilities:
Set socket configuration
Terminate process

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x90
lea rdi, [rsp + 0x30]
mov ecx, 0x18
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0xa0]
mov rax, qword [0x140575740]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rcx, qword [rsp + 0xa0]
call fcn.14012a670
mov rax, qword [rax]
mov qword [rsp + 0x68], rax
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0xa0]
call fcn.14012c8f0
movzx eax, word [rsp + 0x38]
cmp eax, 0x17
jne 0x140131627
mov dword [rsp + 0x78], ntohs
jmp 0x14013162f
mov dword [rsp + 0x78], ntohs
movzx eax, word [rsp + 0x38]
cmp eax, 0x17
jne 0x140131643
mov dword [rsp + 0x7c], 0x29
jmp 0x14013164b
mov dword [rsp + 0x7c], 0
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0xa8]
mov r8d, dword [rsp + 0x78]
mov edx, dword [rsp + 0x7c]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x1401316a3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], 0
mov r9d, eax
mov r8d, 0x137
lea rdx, str.C:UsersyfjvyDownloadsMeshAgent_mastermicrostackILibAsyncUDPSocket.c
xor ecx, ecx
call fcn.14014da80
mov ecx, 0xfd
call fcn.14038e600
nop
mov rcx, rsp
lea rdx, reloc.WS2_32.dll_accept
call fcn.14037c300
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14037c650
add rsp, 0x90
pop rdi
ret

Function at 0x1401316e0
Capabilities:
Set socket configuration

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov rcx, qword [rsp + 0x50]
call fcn.14012a670
mov rax, qword [rax]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x58]
mov r8d, 0x20
mov edx, 0xffff
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_setsockopt]
nop
add rsp, 0x40
pop rdi
ret
Function at 0x140132700
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
lea rdi, [rsp + 0x20]
mov ecx, ntohs
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 1
cmp qword [rsp + 0x60], 0
jne 0x14013275d
xor eax, eax
jmp 0x1401328b9
xor r9d, r9d
xor r8d, r8d
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x60]
call fcn.1401370a0
lea r8, [0x1405572d8]
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.140392bf0
cmp qword [rsp + 0x28], 0
je 0x1401328b4
mov rax, qword [rsp + 0x68]
cmp qword [rax], 0
jne 0x140132831
mov r8d, 2
xor edx, edx
mov rcx, qword [rsp + 0x28]
call fcn.1403b6030
mov rcx, qword [rsp + 0x28]
call fcn.1403b7090
cdqe
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x70]
cmp qword [rsp + 0x38], rax
jbe 0x1401327da
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x38], rax
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x28]
call fcn.1403b6030
mov rax, qword [rsp + 0x38]
inc rax
mov r9d, 0x144
lea r8, [0x1405572e0]
mov edx, 1
mov rcx, rax
call fcn.1403ba980
mov rcx, qword [rsp + 0x68]
mov qword [rcx], rax
mov rax, qword [rsp + 0x68]
cmp qword [rax], 0
jne 0x14013282f
mov rcx, qword [rsp + 0x28]
call fcn.1403b3fa0
xor eax, eax
jmp 0x1401328b9
jmp 0x14013283e
mov rax, qword [rsp + 0x70]
dec rax
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x48], 0
je 0x140132898
mov rax, qword [rsp + 0x38]
cmp qword [rsp + 0x40], rax
jae 0x140132898
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
mov r9, qword [rsp + 0x28]
mov r8, rax
mov edx, 1
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax]
call fcn.1403b55a0
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
jmp 0x14013283e
mov rax, qword [rsp + 0x68]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x40]
mov byte [rax + rcx], 0
mov rcx, qword [rsp + 0x28]
call fcn.1403b3fa0
nop
mov rax, qword [rsp + 0x40]
mov rdi, rax
mov rcx, rsp
lea rdx, reloc.WS2_32.dll_accept
call fcn.14037c300
mov rax, rdi
add rsp, 0x50
pop rdi
ret
Function at 0x140132ac0
Capabilities:
Copy file

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
mov eax, 0x4080
call fcn.14037c5f0
sub rsp, rax
lea rdi, [rsp + 0x30]
mov ecx, 0x1014
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x4090]
mov rax, qword [0x140575740]
xor rax, rsp
mov qword [rsp + 0x4070], rax
mov dword [rsp + 0x28], 0x1000
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
mov r8, qword [rsp + 0x4090]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [rsp + 0x28], 0x1000
lea rax, [rsp + 0x2060]
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
mov r8, qword [rsp + 0x4098]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov r8d, dword [rsp + 0x40a0]
lea rdx, [rsp + 0x2060]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
mov rdi, rax
mov rcx, rsp
lea rdx, reloc.WS2_32.dll_bind
call fcn.14037c300
mov rax, rdi
mov rcx, qword [rsp + 0x4070]
xor rcx, rsp
call fcn.14037c650
add rsp, 0x4080
pop rdi
ret

Function at 0x140132de0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rdi
sub rsp, 0x260
lea rdi, [rsp + 0x20]
mov ecx, 0x90
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140575740]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov qword [rsp + 0x238], 0
mov qword [rsp + 0x240], 0
mov eax, dword [0x1405771cc]
inc eax
mov dword [0x1405771cc], eax
cmp dword [0x1405771cc], 1
jle 0x140132e40
jmp 0x140132f1f
xor edx, edx
xor ecx, ecx
call fcn.140326750
xor edx, edx
mov ecx, 0x200002
call fcn.140326750
xor edx, edx
mov ecx, 2
call fcn.1401ccc70
xor edx, edx
mov ecx, ntohs
call fcn.1401ccc70
xor edx, edx
mov ecx, 4
call fcn.1401ccc70
xor edx, edx
mov ecx, 8
call fcn.1401ccc70
mov r8d, 0x800
xor edx, edx
lea rcx, str.ADVAPI32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov qword [rsp + 0x238], rax
cmp qword [rsp + 0x238], 0
je 0x140132eca
lea rdx, str.SystemFunction036
mov rcx, qword [rsp + 0x238]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x240], rax
cmp qword [rsp + 0x240], 0
je 0x140132f05
mov edx, 0x40
lea rcx, [rsp + 0x30]
call qword [rsp + 0x240]
movzx eax, al
test eax, eax
je 0x140132f05
movsd xmm2, qword [0x140434790]
mov edx, 0x40
lea rcx, [rsp + 0x30]
call fcn.1401d60b0
nop
cmp qword [rsp + 0x238], 0
je 0x140132f1f
mov rcx, qword [rsp + 0x238]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
mov rcx, rsp
lea rdx, reloc.WS2_32.dll_accept
call fcn.14037c300
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.14037c650
add rsp, 0x260
pop rdi
ret
Function at 0x140134e00
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x60
movsxd rax, dword [0x1405575a0]
xor edx, edx
mov rcx, rax
call fcn.140137490
mov qword [rsp + 0x50], rax
xor edx, edx
lea rcx, str.ILibIPAddressMonitor
call fcn.140137750
mov rcx, qword [rsp + 0x50]
mov qword [rcx + 0x30], rax
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x78]
mov qword [rax + 0x40], rcx
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x80]
mov qword [rax + 0x48], rcx
mov r9d, __WSAFDIsSet
lea r8, str.C:UsersyfjvyDownloadsMeshAgent_mastermicrostackILibIPAddressMonitor.c
mov edx, 1
mov ecx, gethostname
call fcn.1403ba980
xor r9d, r9d
xor r8d, r8d
mov edx, 0x20
mov rcx, rax
call fcn.1401375b0
mov rcx, qword [rsp + 0x50]
mov qword [rcx + 0x60], rax
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 0x60]
mov rcx, qword [rsp + 0x50]
mov qword [rax + 0x18], rcx
xor r8d, r8d
mov edx, 2
mov ecx, 2
call qword [sym.imp.WS2_32.dll_socket]
mov rcx, qword [rsp + 0x50]
mov qword [rcx + 0x50], rax
mov rax, qword [rsp + 0x50]
add rax, 0x58
lea rcx, [0x140134cf0]
mov qword [rsp + 0x40], rcx
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx + 0x60]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 0x28000017
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax + 0x50]
call qword [sym.imp.WS2_32.dll_WSAIoctl]
mov rax, qword [rsp + 0x50]
lea rcx, [0x140134db0]
mov qword [rax + 0x10], rcx
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x70]
call fcn.14013c810
mov rax, qword [rsp + 0x50]
add rsp, 0x60
pop rdi
ret
Function at 0x140135c10
Capabilities:
Send data
Send data on socket
Set socket configuration

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov dword [rsp + 0x30], 0
jmp 0x140135c3d
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 0xb8]
cmp dword [rsp + 0x30], eax
jge 0x140135d5d
cmp qword [rsp + 0x78], 0
je 0x140135c81
movsxd rax, dword [rsp + 0x30]
imul rax, rax, 0x10
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx + 0xb0]
mov rdx, qword [rsp + 0x78]
mov eax, dword [rcx + rax + 4]
cmp dword [rdx + 4], eax
jne 0x140135d58
movsxd rax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx + 0x50]
cmp qword [rcx + rax*8], 0
je 0x140135d58
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax + 0x40]
call fcn.140131730
mov qword [rsp + 0x38], rax
movsxd rax, dword [rsp + 0x30]
imul rax, rax, 0x10
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx + 0xb0]
lea rax, [rcx + rax + 4]
mov dword [rsp + 0x20], 4
mov r9, rax
mov r8d, 9
xor edx, edx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rax, qword [rsp + 0x50]
add rax, 0x68
mov dword [rsp + 0x20], 4
mov r9, rax
mov r8d, 0xa
xor edx, edx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.WS2_32.dll_setsockopt]
nop
mov dword [rsp + 0x34], 0
jmp 0x140135d21
mov eax, dword [rsp + 0x34]
inc eax
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x70]
cmp dword [rsp + 0x34], eax
jge 0x140135d58
mov dword [rsp + 0x28], reloc.WS2_32.dll_recv
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, dword [rsp + 0x68]
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.WS2_32.dll_sendto]
nop
jmp 0x140135d17
jmp 0x140135c33
add rsp, 0x40
pop rdi
ret

Function at 0x140135d70
Capabilities:
Send data
Send data on socket
Set socket configuration

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov dword [rsp + 0x30], 0
jmp 0x140135d9d
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 0xc8]
cmp dword [rsp + 0x30], eax
jge 0x140135e5b
movsxd rax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx + 0xc0]
lea rax, [rcx + rax*4]
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx + 0x48]
call fcn.140131730
mov dword [rsp + 0x20], 4
mov rcx, qword [rsp + 0x38]
mov r9, rcx
mov r8d, 9
mov edx, 0x29
mov rcx, rax
call qword [sym.imp.WS2_32.dll_setsockopt]
nop
mov dword [rsp + 0x34], 0
jmp 0x140135e13
mov eax, dword [rsp + 0x34]
inc eax
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x70]
cmp dword [rsp + 0x34], eax
jge 0x140135e56
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax + 0x48]
call fcn.140131730
mov dword [rsp + 0x28], 0x1c
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov r8d, dword [rsp + 0x68]
mov rdx, qword [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.WS2_32.dll_sendto]
nop
jmp 0x140135e09
jmp 0x140135d93
add rsp, 0x40
pop rdi
ret
Function at 0x1401375b0
Capabilities:
Terminate process

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
cmp qword [rsp + 0x60], 0
jne 0x140137619
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
mov r9d, 0xfe
mov r8d, 0x449
lea rdx, [0x140559710]
xor ecx, ecx
call fcn.14014da80
mov r8d, 0x449
lea rdx, [0x140559760]
lea rcx, [0x1405597a8]
call fcn.140015e70
mov ecx, 0xfe
call fcn.14038e600
nop
cmp qword [rsp + 0x70], 0
jbe 0x14013762c
mov qword [rsp + 0x40], 0x18
jmp 0x140137635
mov qword [rsp + 0x40], 0
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x40]
lea rax, [rax + rcx + 0x18]
mov r8, rax
xor edx, edx
mov rcx, qword [rsp + 0x60]
call fcn.140410c60
mov rax, qword [rsp + 0x60]
add rax, 0x18
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
mov qword [rax], rcx
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x70]
mov qword [rax + 8], rcx
mov eax, 4
imul rax, rax, 0
lea rcx, [0x1405597cc]
mov rdx, qword [rsp + 0x60]
mov eax, dword [rcx + rax]
mov dword [rdx + 0x10], eax
mov rax, qword [rsp + 0x60]
mov ecx, dword [rsp + 0x78]
mov dword [rax + 0x14], ecx
cmp qword [rsp + 0x70], 0
jbe 0x140137734
mov rax, qword [rsp + 0x30]
cmp qword [rax - 0x10], 0
jbe 0x1401376dc
mov rax, qword [rsp + 0x30]
mov rax, qword [rax - 0x18]
mov rcx, qword [rsp + 0x30]
lea rax, [rcx + rax + 0x18]
mov qword [rsp + 0x48], rax
jmp 0x1401376e5
mov qword [rsp + 0x48], 0
mov rax, qword [rsp + 0x48]
sub rax, 0x18
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x70]
mov qword [rax], rcx
mov rax, qword [rsp + 0x38]
mov qword [rax + 8], 0
mov eax, 4
imul rax, rax, 0
lea rcx, [0x1405597d4]
mov rdx, qword [rsp + 0x38]
mov eax, dword [rcx + rax]
mov dword [rdx + 0x10], eax
mov rax, qword [rsp + 0x38]
mov dword [rax + 0x14], 2
mov rax, qword [rsp + 0x30]
add rsp, 0x50
pop rdi
ret
Function at 0x140138010
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
mov rax, 0xffffffffffffffff
sub rax, qword [rsp + 0x68]
cmp qword [rsp + 0x60], rax
jae 0x140138052
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
add rcx, rax
mov rax, rcx
cmp rax, 0xfffffffffffffff7
jb 0x14013809a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
mov r9d, 0xfe
mov r8d, 0x4ea
lea rdx, [0x140559890]
xor ecx, ecx
call fcn.14014da80
mov r8d, 0x4ea
lea rdx, [0x1405598e0]
lea rcx, [0x140559928]
call fcn.140015e70
mov ecx, 0xfe
call fcn.14038e600
nop
cmp qword [rsp + 0x68], 0
jbe 0x1401380ad
mov qword [rsp + 0x38], 8
jmp 0x1401380b6
mov qword [rsp + 0x38], 0
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
add rcx, rax
mov rax, rcx
add rax, qword [rsp + 0x38]
mov r9d, 0x4ec
lea r8, [0x140559950]
mov edx, 1
mov rcx, rax
call fcn.1403ba980
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x14013813a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
mov r9d, 0xfe
mov r8d, 0x4ed
lea rdx, [0x1405599a0]
xor ecx, ecx
call fcn.14014da80
mov r8d, 0x4ed
lea rdx, [0x1405599f0]
lea rcx, [0x140559a38]
call fcn.140015e70
mov ecx, 0xfe
call fcn.14038e600
nop
cmp qword [rsp + 0x68], 0
jbe 0x14013814d
mov qword [rsp + 0x40], 8
jmp 0x140138156
mov qword [rsp + 0x40], 0
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
add rcx, rax
mov rax, rcx
add rax, qword [rsp + 0x40]
mov r8, rax
xor edx, edx
mov rcx, qword [rsp + 0x30]
call fcn.140410c60
cmp qword [rsp + 0x68], 0
jbe 0x1401381c5
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov ecx, 8
imul rcx, rcx, 0
mov rdx, qword [rsp + 0x68]
mov qword [rax + rcx], rdx
cmp qword [rsp + 0x78], 0
je 0x1401381c3
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x60]
lea rax, [rax + rcx + 8]
mov rcx, qword [rsp + 0x78]
mov qword [rcx], rax
jmp 0x1401381d9
cmp qword [rsp + 0x78], 0
je 0x1401381d9
mov rax, qword [rsp + 0x78]
mov qword [rax], 0
cmp qword [rsp + 0x70], 0
je 0x1401381ee
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x30]
mov qword [rax], rcx
mov rax, qword [rsp + 0x30]
add rsp, 0x50
pop rdi
ret
Function at 0x140139260
Capabilities:
Terminate process

Disassembly:
push rdi
sub rsp, 0x8d0
lea rdi, [rsp + 0x30]
mov ecx, 0x228
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140575740]
xor rax, rsp
mov qword [rsp + 0x8c0], rax
mov r9d, 0x27a0
lea r8, [0x14055eec0]
mov edx, 1
mov ecx, 0x48
call fcn.1403ba980
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x1401392fd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
mov r9d, 0xfe
mov r8d, 0x27a0
lea rdx, [0x14055ef10]
xor ecx, ecx
call fcn.14014da80
mov r8d, 0x27a0
lea rdx, [0x14055ef60]
lea rcx, [0x14055efa8]
call fcn.140015e70
mov ecx, 0xfe
call fcn.14038e600
nop
mov r8d, 0x48
xor edx, edx
mov rcx, qword [rsp + 0x30]
call fcn.140410c60
xor r9d, r9d
mov r8d, 0x40
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
mov rcx, qword [rsp + 0x30]
mov qword [rcx + 0x28], rax
cmp qword [0x1405772f0], 0
je 0x140139387
mov rax, qword [rsp + 0x30]
add rax, 0x28
mov dword [rsp + 0x28], 0x27a3
lea rcx, [0x14055efd0]
mov qword [rsp + 0x20], rcx
mov r9, rax
lea r8, [0x14055f018]
mov edx, 0x200
lea rcx, [rsp + 0x50]
call fcn.140015f80
mov r8d, 1
mov rdx, qword [0x1405772f8]
lea rcx, [rsp + 0x50]
call qword [0x1405772f0]
nop
xor r9d, r9d
mov r8d, 0x40
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
mov rcx, qword [rsp + 0x30]
mov qword [rcx + 0x20], rax
cmp qword [0x1405772f0], 0
je 0x140139402
mov rax, qword [rsp + 0x30]
add rax, 0x20
mov dword [rsp + 0x28], 0x27a4
lea rcx, [0x14055f030]
mov qword [rsp + 0x20], rcx
mov r9, rax
lea r8, [0x14055f078]
mov edx, 0x200
lea rcx, [rsp + 0x270]
call fcn.140015f80
mov r8d, 1
mov rdx, qword [0x1405772f8]
lea rcx, [rsp + 0x270]
call qword [0x1405772f0]
nop
xor r9d, r9d
mov r8d, 0x40
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
mov rcx, qword [rsp + 0x30]
mov qword [rcx + 0x18], rax
cmp qword [0x1405772f0], 0
je 0x14013947d
mov rax, qword [rsp + 0x30]
add rax, 0x18
mov dword [rsp + 0x28], 0x27a5
lea rcx, [0x14055f090]
mov qword [rsp + 0x20], rcx
mov r9, rax
lea r8, [0x14055f0d8]
mov edx, 0x200
lea rcx, [rsp + 0x490]
call fcn.140015f80
mov r8d, 1
mov rdx, qword [0x1405772f8]
lea rcx, [rsp + 0x490]
call qword [0x1405772f0]
nop
xor r9d, r9d
mov r8d, 0x40
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
mov rcx, qword [rsp + 0x30]
mov qword [rcx + 0x30], rax
cmp qword [0x1405772f0], 0
je 0x1401394f8
mov rax, qword [rsp + 0x30]
add rax, 0x30
mov dword [rsp + 0x28], 0x27a6
lea rcx, [0x14055f0f0]
mov qword [rsp + 0x20], rcx
mov r9, rax
lea r8, [0x14055f138]
mov edx, 0x200
lea rcx, [rsp + 0x6b0]
call fcn.140015f80
mov r8d, 1
mov rdx, qword [0x1405772f8]
lea rcx, [rsp + 0x6b0]
call qword [0x1405772f0]
nop
mov rax, qword [rsp + 0x30]
lea rcx, [fcn.140152410]
mov qword [rax + 0x10], rcx
mov rax, qword [rsp + 0x30]
mov rdi, rax
mov rcx, rsp
lea rdx, reloc.WS2_32.dll_connect
call fcn.14037c300
mov rax, rdi
mov rcx, qword [rsp + 0x8c0]
xor rcx, rsp
call fcn.14037c650
add rsp, 0x8d0
pop rdi
ret
Function at 0x140139b50
Capabilities:
Read file on windows
Terminate process

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x60
lea rdi, [rsp + 0x30]
mov ecx, ntohs
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x70]
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x48], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x78]
call fcn.1401370a0
lea r8, [0x14055ebec]
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140392bf0
cmp qword [rsp + 0x48], 0
jne 0x140139bca
mov rax, qword [rsp + 0x70]
mov qword [rax], 0
xor eax, eax
jmp 0x140139cee
mov r8d, 2
xor edx, edx
mov rcx, qword [rsp + 0x48]
call fcn.1403b6030
mov rcx, qword [rsp + 0x48]
call fcn.1403b7090
cmp eax, 0x7fffffff
jge 0x140139bfb
mov rcx, qword [rsp + 0x48]
call fcn.1403b7090
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 0
jl 0x140139ce0
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x48]
call fcn.1403b6030
mov eax, dword [rsp + 0x38]
inc eax
cdqe
mov r9d, 0x2554
lea r8, [0x14055ec00]
mov edx, 1
mov rcx, rax
call fcn.1403ba980
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x140139c8c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
mov r9d, 0xfe
mov r8d, 0x2554
lea rdx, [0x14055ec50]
xor ecx, ecx
call fcn.14014da80
mov r8d, 0x2554
lea rdx, [0x14055eca0]
lea rcx, [0x14055ece8]
call fcn.140015e70
mov ecx, 0xfe
call fcn.14038e600
nop
cmp dword [rsp + 0x38], 0
jle 0x140139cb3
movsxd rax, dword [rsp + 0x38]
mov r9, qword [rsp + 0x48]
mov r8, rax
mov edx, 1
mov rcx, qword [rsp + 0x30]
call fcn.1403b55a0
mov dword [rsp + 0x38], eax
movsxd rax, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
mov byte [rcx + rax], 0
mov rcx, qword [rsp + 0x48]
call fcn.1403b3fa0
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x30]
mov qword [rax], rcx
mov eax, dword [rsp + 0x38]
jmp 0x140139cee
mov rax, qword [rsp + 0x70]
mov qword [rax], 0
xor eax, eax
mov rdi, rax
mov rcx, rsp
lea rdx, reloc.WS2_32.dll_accept
call fcn.14037c300
mov rax, rdi
add rsp, 0x60
pop rdi
ret

Function at 0x140139f70
Capabilities:
Copy file

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
mov eax, 0x4070
call fcn.14037c5f0
sub rsp, rax
lea rdi, [rsp + 0x20]
mov ecx, 0x1014
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x4080]
mov rax, qword [0x140575740]
xor rax, rsp
mov qword [rsp + 0x4068], rax
mov r9d, 0x1000
lea r8, [rsp + 0x30]
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x4080]
call fcn.1401370a0
mov r9d, 0x1000
lea r8, [rsp + 0x2050]
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x4088]
call fcn.1401370a0
xor r8d, r8d
lea rdx, [rsp + 0x2050]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x14013a017
mov dword [rsp + 0x4060], 0
jmp 0x14013a022
mov dword [rsp + 0x4060], 1
mov eax, dword [rsp + 0x4060]
mov edi, eax
mov rcx, rsp
lea rdx, reloc.WS2_32.dll_bind
call fcn.14037c300
mov eax, edi
mov rcx, qword [rsp + 0x4068]
xor rcx, rsp
call fcn.14037c650
add rsp, 0x4070
pop rdi
ret
Function at 0x14013a080
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov r9d, 0x14b7
lea r8, [0x14055b260]
mov edx, 1
mov ecx, reloc.WS2_32.dll_recv
call fcn.1403ba980
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x14013a100
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
mov r9d, 0xfe
mov r8d, 0x14b7
lea rdx, [0x14055b2b0]
xor ecx, ecx
call fcn.14014da80
mov r8d, 0x14b7
lea rdx, [0x14055b300]
lea rcx, [0x14055b348]
call fcn.140015e70
mov ecx, 0xfe
call fcn.14038e600
nop
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x58]
mov qword [rax], rcx
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx]
mov qword [rax + 8], rcx
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
mov qword [rax], rcx
add rsp, 0x40
pop rdi
ret