joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004fd80
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140067040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14004fdad
xor eax, eax
jmp 0x14004ff19
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x14004fde7
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x14004fde7
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x14004ff19
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x14004ff0c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14004fe2a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x14004fe55
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14004ff11
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14004fec4
sub eax, 1
je 0x14004fec4
cmp eax, 2
jne 0x14004ff0c
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14004ff11
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x14004fef2
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x14004ff0c
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x14004ff11
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140054130
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x1400503a0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140067040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140050473
cmp byte [rcx + 0x71], 0
je 0x140050473
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14005046f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140050434
sub eax, 1
je 0x140050438
cmp eax, 2
jne 0x14005046f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140054130
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140050466
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14005046f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14005041c
xor al, al
jmp 0x14005041c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140054130
add rsp, 0x60
pop rbx
ret

Function at 0x1400505c0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
sub rsp, 0x30
mov rax, qword [0x140067040]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rbp, rcx
lea r8, [0x140058110]
xor ebx, ebx
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s]
mov rsi, qword [rsp + 0x20]
test rsi, rsi
jne 0x140050607
mov eax, 0xfffffffd
jmp 0x1400506c0
xor edx, edx
mov r8d, 2
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
je 0x140050626
mov ebx, 0xfffffffd
jmp 0x1400506b3
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
test eax, eax
js 0x14005061c
je 0x1400506b3
movsxd rbx, eax
lea rdx, [0x140056820]
mov qword [rsp + 0x60], rdi
lea rcx, [rbx + 1]
call fcn.140054660
mov rdi, rax
test rax, rax
jne 0x14005065c
mov ebx, 0xfffffffe
jmp 0x1400506ae
xor r8d, r8d
mov byte [rbx + rax], 0
xor edx, edx
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
mov r9, rsi
mov r8, rbx
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp rax, rbx
je 0x140050696
mov rcx, rdi
call fcn.1400543cc
mov ebx, 0xfffffffd
jmp 0x1400506ae
mov r8, rax
mov rdx, rdi
mov rcx, rbp
call fcn.140051ab0
mov rcx, rdi
mov ebx, eax
call fcn.1400543cc
mov rdi, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov eax, ebx
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140054130
add rsp, 0x30
pop rsi
pop rbp
pop rbx
ret
Function at 0x140054d8c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140054dd6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140054dd6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140054dd6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140054dd6
cmp dword [rcx + 0x84], 0xe
jbe 0x140054dd6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140054dd8
xor al, al
add rsp, 0x28
ret
Function at 0x140002820
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0x90
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x4f], rax
movdqa xmm0, xmmword [0x140005270]
xor ecx, ecx
movdqa xmm1, xmmword [0x1400052b0]
movdqa xmmword [rbp - 9], xmm0
movdqa xmm0, xmmword [0x1400052c0]
movdqa xmmword [rbp + 7], xmm1
movdqa xmm1, xmmword [str.._08]
movdqa xmmword [rbp + 0x17], xmm0
movdqa xmmword [rbp + 0x27], xmm1
mov dword [rbp + 0x37], 0x34030e10
mov dword [rbp + 0x3b], 0x3f0f0910
mov dword [rbp + 0x3f], 0xf4110b12
mov word [rbp + 0x43], 0x100
lea eax, [rcx + 0x35]
xor byte [rbp + rcx - 9], al
inc rcx
cmp rcx, 0x4c
jb 0x14000289a
mov byte [rbp + 0x44], 0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r10d, dword [rcx + r8 + 0x88]
add r10, r8
cmp r10, r8
je 0x140002924
mov r9d, dword [r10 + 0x18]
test r9d, r9d
je 0x140002924
mov ebx, dword [r10 + 0x20]
dec r9d
mov r11d, 0x4c09f5e8
lea rcx, [r8 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r8
mov cl, byte [rdx]
inc rdx
test cl, cl
je 0x14000291f
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [rdx]
inc rdx
test cl, cl
jne 0x140002900
cmp r11d, 0xf3f0b367
je 0x140002929
test r9d, r9d
jne 0x1400028e4
mov rax, qword [rax]
jmp 0x1400028bf
mov ecx, dword [r10 + 0x24]
add rcx, r8
movzx edx, word [rcx + r9*2]
mov r9d, 0x20019
mov ecx, dword [r10 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
lea rcx, [rbp + 0x47]
mov qword [rsp + 0x20], rcx
lea rdx, [rbp - 9]
add rax, r8
mov rcx, 0xffffffff80000002
xor r8d, r8d
call rax
mov rcx, qword gs:[0x60]
mov esi, eax
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
mov r9, qword [rcx + 0x30]
movsxd rdx, dword [r9 + 0x3c]
mov r10d, dword [rdx + r9 + 0x88]
add r10, r9
cmp r10, r9
je 0x1400029d9
mov r8d, dword [r10 + 0x18]
test r8d, r8d
je 0x1400029d9
mov edi, dword [r10 + 0x20]
dec r8d
mov r11d, 0x4cfaecf1
lea rax, [r9 + r8*4]
mov edx, dword [rax + rdi]
add rdx, r9
mov al, byte [rdx]
inc rdx
test al, al
je 0x1400029d4
movsx eax, al
xor eax, r11d
imul r11d, eax, 0x1000193
mov al, byte [rdx]
inc rdx
test al, al
jne 0x1400029b5
cmp r11d, 0xfdc0a2be
je 0x1400029de
test r8d, r8d
jne 0x140002999
mov rcx, qword [rcx]
jmp 0x140002974
mov ecx, dword [r10 + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [r10 + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
mov rcx, qword [rbp + 0x47]
add rax, r9
call rax
test esi, esi
sete al
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.140003d40
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x140002a28
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x70
movaps xmmword [rsp + 0x60], xmm6
movdqa xmm6, xmmword [0x140005280]
call fcn.140002820
test al, al
je 0x140002a3f
movdqu xmmword [rsp + 0x20], xmm6
mov dword [rsp + 0x30], 0x232331
xor ecx, ecx
mov byte [rsp + 0x34], 1
lea eax, [rcx + 0x35]
xor byte [rsp + rcx + 0x20], al
inc rcx
cmp rcx, 0x13
jb 0x140002a5d
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x34], 0
lea rcx, [rsp + 0x38]
call fcn.1400032a8
mov rcx, rax
call fcn.140001178
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r9d, dword [rcx + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x140002aff
mov edx, dword [r9 + 0x18]
test edx, edx
je 0x140002aff
mov edi, dword [r9 + 0x20]
dec edx
mov r11d, 0xfe579389
lea rcx, [r8 + rdx*4]
mov r10d, dword [rcx + rdi]
add r10, r8
mov cl, byte [r10]
inc r10
test cl, cl
je 0x140002afb
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [r10]
inc r10
test cl, cl
jne 0x140002adb
cmp r11d, 0xdc510869
je 0x140002b04
test edx, edx
jne 0x140002abe
mov rax, qword [rax]
jmp 0x140002a9a
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + rdx*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
xor ecx, ecx
add rax, r8
call rax
jmp 0x140002a3f
Function at 0x14000281c
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xd0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x4f], rax
movdqa xmm0, xmmword [0x1400052e0]
xor ecx, ecx
movdqa xmm1, xmmword [0x1400052a0]
movdqa xmmword [rbp - 0x49], xmm0
movdqa xmm0, xmmword [0x140005290]
movdqa xmmword [rbp - 0x39], xmm1
movdqa xmm1, xmmword [0x1400052b0]
movdqa xmmword [rbp - 0x29], xmm0
movdqa xmm0, xmmword [0x140005280]
movdqa xmmword [rbp - 0x19], xmm1
movdqa xmm1, xmmword [str._a____]
movdqa xmmword [rbp - 9], xmm0
movdqa xmm0, xmmword [str.__3_b_]
movdqa xmmword [rbp + 7], xmm1
movdqa xmm1, xmmword [0x140005260]
movdqa xmmword [rbp + 0x17], xmm0
movdqa xmmword [rbp + 0x27], xmm1
mov dword [rbp + 0x37], 0x1000016
lea eax, [rcx - 0xe]
xor byte [rbp + rcx - 0x49], al
inc rcx
cmp rcx, 0x82
jb 0x1400028b6
mov byte [rbp + 0x3a], 0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r10d, dword [rcx + r8 + 0x88]
add r10, r8
cmp r10, r8
je 0x140002943
mov r9d, dword [r10 + 0x18]
test r9d, r9d
je 0x140002943
mov ebx, dword [r10 + 0x20]
dec r9d
mov r11d, 0x39a9fc1a
lea rcx, [r8 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r8
mov cl, byte [rdx]
inc rdx
test cl, cl
je 0x14000293e
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [rdx]
inc rdx
test cl, cl
jne 0x14000291f
cmp r11d, 0xeead6211
je 0x140002948
test r9d, r9d
jne 0x140002903
mov rax, qword [rax]
jmp 0x1400028de
mov ecx, dword [r10 + 0x24]
add rcx, r8
movzx edx, word [rcx + r9*2]
mov r9d, 0x20019
mov ecx, dword [r10 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
lea rcx, [rbp + 0x47]
mov qword [rsp + 0x20], rcx
lea rdx, [rbp - 0x49]
add rax, r8
mov rcx, 0xffffffff80000002
xor r8d, r8d
call rax
mov rcx, qword gs:[0x60]
mov esi, eax
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
mov r9, qword [rcx + 0x30]
movsxd rdx, dword [r9 + 0x3c]
mov r10d, dword [rdx + r9 + 0x88]
add r10, r9
cmp r10, r9
je 0x1400029f8
mov r8d, dword [r10 + 0x18]
test r8d, r8d
je 0x1400029f8
mov edi, dword [r10 + 0x20]
dec r8d
mov r11d, 0xaaa49dcf
lea rax, [r9 + r8*4]
mov edx, dword [rax + rdi]
add rdx, r9
mov al, byte [rdx]
inc rdx
test al, al
je 0x1400029f3
movsx eax, al
xor eax, r11d
imul r11d, eax, 0x1000193
mov al, byte [rdx]
inc rdx
test al, al
jne 0x1400029d4
cmp r11d, 0x292b40c0
je 0x1400029fd
test r8d, r8d
jne 0x1400029b8
mov rcx, qword [rcx]
jmp 0x140002993
mov ecx, dword [r10 + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [r10 + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
mov rcx, qword [rbp + 0x47]
add rax, r9
call rax
test esi, esi
sete al
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.140003d60
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x140002a48
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x70
movaps xmmword [rsp + 0x60], xmm6
movdqa xmm6, xmmword [0x1400052c0]
call fcn.14000281c
test al, al
je 0x140002a5f
movdqu xmmword [rsp + 0x20], xmm6
mov dword [rsp + 0x30], 0x606676
xor ecx, ecx
mov byte [rsp + 0x34], 1
lea eax, [rcx - 0xe]
xor byte [rsp + rcx + 0x20], al
inc rcx
cmp rcx, 0x13
jb 0x140002a7d
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x34], 0
lea rcx, [rsp + 0x38]
call fcn.1400032c8
mov rcx, rax
call fcn.140001178
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r9d, dword [rcx + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x140002b1f
mov edx, dword [r9 + 0x18]
test edx, edx
je 0x140002b1f
mov edi, dword [r9 + 0x20]
dec edx
mov r11d, 0x2374b047
lea rcx, [rdi + rdx*4]
mov r10d, dword [rcx + r8]
add r10, r8
mov cl, byte [r10]
inc r10
test cl, cl
je 0x140002b1b
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [r10]
inc r10
test cl, cl
jne 0x140002afb
cmp r11d, 0x9db36287
je 0x140002b24
test edx, edx
jne 0x140002ade
mov rax, qword [rax]
jmp 0x140002aba
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + rdx*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
xor ecx, ecx
add rax, r8
call rax
jmp 0x140002a5f
Function at 0x1400011c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movsxd rax, dword [rcx + 0x3c]
xor r9d, r9d
mov ebx, edx
mov r11, rcx
mov r8d, dword [rax + rcx + 0x88]
add r8, rcx
mov edi, dword [r8 + 0x1c]
mov esi, dword [r8 + 0x24]
add rdi, rcx
mov r10d, dword [r8 + 0x20]
add rsi, rcx
mov r8d, dword [r8 + 0x18]
add r10, rcx
test r8d, r8d
je 0x14000125b
nop dword [rax]
nop dword [rax + rax]
mov edx, dword [r10]
mov eax, 0x436b
add rdx, r11
movzx ecx, byte [rdx]
test cl, cl
je 0x140001246
nop dword [rax]
nop word [rax + rax]
imul eax, eax, 0x7313
lea rdx, [rdx + 1]
movsx ecx, cl
add eax, ecx
movzx ecx, byte [rdx]
test cl, cl
jne 0x140001230
xor eax, 0xab98
cmp ebx, eax
je 0x140001270
inc r9d
add r10, 4
cmp r9d, r8d
jb 0x140001210
xor eax, eax
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
movzx ecx, word [rsi + r9*2]
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov eax, dword [rdi + rcx*4]
mov rdi, qword [rsp + 0x18]
add rax, r11
ret
Function at 0x1400017b3
Capabilities:
Get socket status

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x240
lea r14, str.____tunnel_tran__
mov ebx, ecx
mov r9d, r8d
mov rsi, rdx
mov edi, r8d
mov r8, rdx
mov edx, ecx
lea rcx, str.___Proxy_forwart_to_RemoteHost_0.0.0.0:_d_________s:_d_n
call fcn.1400014e0
mov ecx, ebx
mov edx, 0x1f4
call fcn.140001fc4
mov r13, qword [sym.imp.WS2_32.dll_select]
movsxd r12, eax
mov rbx, r12
lea rbp, [rsp + 0x38]
lea rax, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x30], 0x3c
lea ecx, [rbx + 1]
mov rdx, rbp
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x20], rax
call r13
test eax, eax
js 0x14000188b
jne 0x140001844
mov rcx, r14
call sub.msvcrt.dll_puts
jmp 0x140001800
mov rdx, rbp
mov rcx, r12
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x140001800
mov ecx, ebx
call fcn.140001e2b
mov edx, edi
mov rcx, rsi
mov ebp, eax
call fcn.140001e6e
mov edx, eax
cmp eax, 0xffffffff
jne 0x14000187f
or ecx, 0xffffffff
call fcn.140001fa9
mov ecx, 1
call sub.msvcrt.dll_exit
mov ecx, ebp
call fcn.140002684
jmp 0x140001800
lea rcx, [0x14000b384]
call sub.msvcrt.dll_puts
xor eax, eax
add rsp, 0x240
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
Function at 0x1400018ab
Capabilities:
Create thread
Get socket status

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x4c8
mov dword [rsp + 0x20], r9d
mov rsi, rcx
mov edi, edx
mov rbp, r8
mov r12d, r9d
mov r9, r8
mov r8d, edx
mov rdx, rcx
lea rcx, str.___slave__s:_d_________s:_d_n
call fcn.1400014e0
mov edx, edi
mov rcx, rsi
call fcn.1400022bc
mov ebx, eax
test eax, eax
js 0x1400018ff
mov r14, qword [sym.imp.WS2_32.dll_select]
movsxd r13, eax
jmp 0x140001927
lea rcx, str.____Can_not_get_Control_socket_connect_n
call fcn.1400014e0
mov ecx, ebx
call fcn.140001fa9
jmp 0x140001a43
test eax, eax
jne 0x140001976
lea rcx, str.____wait_time_out_
call sub.msvcrt.dll_puts
lea r15, [rsp + 0x50]
lea rax, [rsp + 0x48]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x48], 0x3c
lea ecx, [rbx + 1]
mov rdx, r15
mov qword [rsp + 0x58], r13
mov dword [rsp + 0x50], 1
mov qword [rsp + 0x20], rax
call r14
cmp eax, 0xffffffff
jne 0x140001917
lea rcx, str.____slave_func_select___error
call sub.msvcrt.dll_perror
mov ecx, 1
call sub.msvcrt.dll_exit
mov rdx, r15
mov rcx, r13
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x140001927
lea rdx, [rsp + 0x45]
mov r8d, 3
mov ecx, ebx
call fcn.140001f8f
mov edx, eax
cmp eax, 3
jne 0x140001a27
cmp byte [rsp + 0x45], 1
jne 0x140001a27
cmp byte [rsp + 0x46], 4
jne 0x140001a27
lea r9, [rsp + 0x25c]
mov rdx, rsi
mov r8d, 0x12c
mov rcx, r9
mov qword [rsp + 0x38], r9
call sub.msvcrt.dll_strncpy
lea rcx, [rsp + 0x38c]
mov rdx, rbp
mov r8d, 0x12c
mov dword [rsp + 0x388], edi
call sub.msvcrt.dll_strncpy
movsx eax, byte [rsp + 0x47]
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], edx
mov r9, qword [rsp + 0x38]
lea r8, [0x140001527]
xor edx, edx
mov dword [rsp + 0x4bc], eax
xor eax, eax
mov dword [rsp + 0x4b8], r12d
mov qword [rsp + 0x28], rax
call qword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x140001927
lea rcx, [0x14000b440]
call fcn.1400014e0
mov r9d, r12d
mov r8, rbp
mov edx, edi
mov rcx, rsi
call fcn.1400018ab
or eax, 0xffffffff
add rsp, 0x4c8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x140001a5a
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
mov r8d, edx
mov dword [rsp + 0x40], ecx
mov dword [rsp + 0x48], edx
mov edx, ecx
lea rcx, str.___Port_Forwarding_0.0.0.0:_d________0.0.0.0:_d_n
call fcn.1400014e0
xor ecx, ecx
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x28], rcx
mov rbx, qword [sym.imp.KERNEL32.dll_CreateThread]
xor ecx, ecx
lea r9, [rsp + 0x40]
mov dword [rsp + 0x20], r8d
lea r8, [0x1400015ee]
call rbx
test eax, eax
jns 0x140001aaa
mov edx, dword [rsp + 0x40]
jmp 0x140001ad8
xor eax, eax
xor edx, edx
lea r9, [rsp + 0x48]
xor ecx, ecx
mov dword [rsp + 0x20], edx
lea r8, [0x1400016ad]
xor edx, edx
mov qword [rsp + 0x28], rax
call rbx
mov rbx, qword [sym.imp.KERNEL32.dll_Sleep]
test eax, eax
jns 0x140001aed
mov edx, dword [rsp + 0x48]
lea rcx, str.Error:______d_start_server_n
call fcn.1400014e0
or eax, 0xffffffff
add rsp, 0x30
pop rbx
ret
mov ecx, 0x2710
call rbx
jmp 0x140001aed
Function at 0x140001df7
Capabilities:
Initialize winsock library

Disassembly:
sub rsp, 0x1c8
mov ecx, 0x202
lea rdx, [rsp + 0x28]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x140001e1e
lea rcx, str.____Windows_WSAStartup_failed
call sub.msvcrt.dll_puts
mov eax, 1
add rsp, 0x1c8
ret

Function at 0x140001e6e
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Get socket status
Resolve dns

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x250
mov r8d, 6
mov rdi, rcx
mov esi, edx
mov ecx, 2
mov edx, 1
call qword [sym.imp.WS2_32.dll_socket]
lea rcx, str.____Create_Socket_Failed
mov rbx, rax
mov ebp, eax
test eax, eax
js 0x140001f66
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_gethostbyname]
test rax, rax
jne 0x140001ecf
mov rdx, rdi
lea rcx, str.____Cannot_retrieve_the_server_IP_for__s_n
call fcn.140001db0
or ebp, 0xffffffff
jmp 0x140001f7f
mov rax, qword [rax + 0x18]
movzx ecx, si
mov word [rsp + 0x38], 2
movsxd rbx, ebx
mov rax, qword [rax]
mov eax, dword [rax]
mov dword [rsp + 0x3c], eax
call qword [sym.imp.WS2_32.dll_htons]
lea rdx, [rsp + 0x38]
mov r8d, 0x10
mov rcx, rbx
mov word [rsp + 0x3a], ax
call qword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x140001f7f
mov r12, qword [sym.imp.WS2_32.dll_select]
lea rsi, [rsp + 0x48]
lea edi, [rbp + 1]
lea rax, [rsp + 0x30]
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x30], 2
mov r8, rsi
mov ecx, edi
mov dword [rsp + 0x48], 1
mov qword [rsp + 0x20], rax
call r12
test eax, eax
jns 0x140001f5d
lea rcx, str.____Connect_failed
call fcn.140001db0
jmp 0x140001ec7
jne 0x140001f70
lea rcx, str.____Connect_timeout
call sub.msvcrt.dll_puts
jmp 0x140001ec7
mov rdx, rsi
mov rcx, rbx
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x140001f1b
mov eax, ebp
add rsp, 0x250
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x140001fc4
Capabilities:
Create tcp socket

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
mov r8d, 6
mov edx, 1
mov esi, ecx
mov ecx, 2
call qword [sym.imp.WS2_32.dll_socket]
xor ecx, ecx
mov word [rsp + 0x20], 2
mov rbx, rax
mov edi, eax
call qword [sym.imp.WS2_32.dll_htonl]
movsxd rbx, ebx
movzx ecx, si
mov dword [rsp + 0x24], eax
call qword [sym.imp.WS2_32.dll_htons]
mov rcx, rbx
lea rdx, [rsp + 0x20]
mov r8d, 0x10
mov word [rsp + 0x22], ax
call qword [sym.imp.WS2_32.dll_bind]
lea rcx, str.____Bind_failed_n
test eax, eax
js 0x140002044
mov edx, 0x7fffffff
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_listen]
test eax, eax
jns 0x140002053
lea rcx, str.____Listen_failed_n
call fcn.140001db0
mov ecx, edi
or edi, 0xffffffff
call fcn.140001fa9
mov eax, edi
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret