joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d2fc0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rbx]
add rax, 0x10
pxor xmm0, xmm1
sub rcx, 0xc
je 0x4d2fff
jb 0x4d3014
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x20]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x30]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x40]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x50]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x60]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x70]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x80]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x90]
aesenclast xmm0, xmm1
movups xmmword [rdx], xmm0
ret
Function at 0x4d3080
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x20]
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
add rbx, 0x10
pxor xmm4, xmm4
cmp ecx, 0xc
je 0x4d3150
jb 0x4d31af
movups xmm2, xmmword [rax + 0x10]
movups xmmword [rbx], xmm2
add rbx, 0x10
aeskeygenassist xmm1, xmm2, 1
call fcn.004d2f60
aeskeygenassist xmm1, xmm0, 1
call fcn.004d2f80
aeskeygenassist xmm1, xmm2, 2
call fcn.004d2f60
aeskeygenassist xmm1, xmm0, 2
call fcn.004d2f80
aeskeygenassist xmm1, xmm2, 4
call fcn.004d2f60
aeskeygenassist xmm1, xmm0, 4
call fcn.004d2f80
aeskeygenassist xmm1, xmm2, 8
call fcn.004d2f60
aeskeygenassist xmm1, xmm0, 8
call fcn.004d2f80
aeskeygenassist xmm1, xmm2, 0x10
call fcn.004d2f60
aeskeygenassist xmm1, xmm0, 0x10
call fcn.004d2f80
aeskeygenassist xmm1, xmm2, 0x20
call fcn.004d2f60
aeskeygenassist xmm1, xmm0, 0x20
call fcn.004d2f80
aeskeygenassist xmm1, xmm2, 0x40
call fcn.004d2f60
jmp 0x4d321d
movq xmm2, qword [rax + 0x10]
aeskeygenassist xmm1, xmm2, 1
call fcn.004d2ec0
aeskeygenassist xmm1, xmm2, 2
call fcn.004d2f20
aeskeygenassist xmm1, xmm2, 4
call fcn.004d2ec0
aeskeygenassist xmm1, xmm2, 8
call fcn.004d2f20
aeskeygenassist xmm1, xmm2, 0x10
call fcn.004d2ec0
aeskeygenassist xmm1, xmm2, 0x20
call fcn.004d2f20
aeskeygenassist xmm1, xmm2, 0x40
call fcn.004d2ec0
aeskeygenassist xmm1, xmm2, 0x80
call fcn.004d2f20
jmp 0x4d321d
aeskeygenassist xmm1, xmm0, 1
call fcn.004d2e80
aeskeygenassist xmm1, xmm0, 2
call fcn.004d2e80
aeskeygenassist xmm1, xmm0, 4
call fcn.004d2e80
aeskeygenassist xmm1, xmm0, 8
call fcn.004d2e80
aeskeygenassist xmm1, xmm0, 0x10
call fcn.004d2e80
aeskeygenassist xmm1, xmm0, 0x20
call fcn.004d2e80
aeskeygenassist xmm1, xmm0, 0x40
call fcn.004d2e80
aeskeygenassist xmm1, xmm0, 0x80
call fcn.004d2e80
aeskeygenassist xmm1, xmm0, 0x1b
call fcn.004d2e80
aeskeygenassist xmm1, xmm0, 0x36
call fcn.004d2e80
sub rbx, 0x10
movups xmm1, xmmword [rbx]
movups xmmword [rdx], xmm1
dec rcx
movups xmm1, xmmword [rbx - 0x10]
aesimc xmm0, xmm1
movups xmmword [rdx + 0x10], xmm0
sub rbx, 0x10
add rdx, 0x10
dec rcx
jne 0x4d322a
movups xmm0, xmmword [rbx - 0x10]
movups xmmword [rdx + 0x10], xmm0
ret
Function at 0x4d4240
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d43fc
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x50], rdi
lea r9, [rsi + 7]
sar r9, 0x3f
shr r9, 0x3d
lea rbx, [r9 + rsi]
lea rbx, [rbx + 7]
sar rbx, 3
cmp rcx, rbx
jl 0x4d4287
nop
jae 0x4d42fe
jmp 0x4d43f0
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x50], rdi
cmp rbx, 1
jne 0x4d42cb
lea rax, [0x004eebc0]
mov ebx, 1
mov rcx, rbx
call fcn.00446fe0
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x50]
mov r8, qword [rsp + 0x60]
mov ebx, 1
mov ecx, 1
jmp 0x4d42fe
mov qword [rsp + 0x20], rbx
lea rcx, [rbx + 4]
mov qword [rsp + 0x18], rcx
lea rax, [0x004eebc0]
call fcn.00446fe0
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x50]
mov r8, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x18]
mov rdx, rsi
xor r9d, r9d
jmp 0x4d4313
bswap r8
mov qword [rax + r9*8], r8
inc r9
mov r8, r10
cmp rsi, 8
jl 0x4d4345
mov r10, r8
sub r8, rsi
add r8, 8
neg r8
sar r8, 0x3f
add rsi, 0xfffffffffffffff8
and r8, rsi
nop
mov r8, qword [rdi + r8]
cmp r9, rbx
jb 0x4d4306
nop dword [rax + rax]
jmp 0x4d43e5
test rsi, rsi
jle 0x4d4352
xor r8d, r8d
xor r9d, r9d
jmp 0x4d43ae
jmp 0x4d4357
dec rbx
test rbx, rbx
jle 0x4d4366
mov rsi, qword [rax + rbx*8 - 8]
test rsi, rsi
je 0x4d4354
cmp rbx, rcx
ja 0x4d4375
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov rdx, rcx
mov rcx, rbx
nop dword [rax + rax]
call fcn.00460640
cmp r8, 0x40
sbb r11, r11
lea r12, [r8 + 8]
movzx r13d, byte [rsi + rdi - 1]
mov rsi, rcx
mov rcx, r8
shl r13, cl
and r13, r11
or r9, r13
mov rcx, rsi
mov rsi, r10
mov r8, r12
test rsi, rsi
jle 0x4d43be
lea r10, [rsi - 1]
cmp rdx, r10
ja 0x4d4385
jmp 0x4d43d9
lea rsi, [rbx - 1]
cmp rbx, rsi
jbe 0x4d43ce
mov qword [rax + rbx*8 - 8], r9
jmp 0x4d4352
mov rax, rsi
mov rcx, rbx
call fcn.004605c0
mov rax, r10
mov rcx, rdx
nop
call fcn.004605c0
mov rax, r9
mov rcx, rbx
call fcn.004605c0
mov rdx, rcx
mov rcx, rbx
call fcn.00460640
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
call fcn.0045df60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
nop dword [rax]
jmp fcn.004d4240
Function at 0x4d7920
Capabilities:
Encode data using xor

Disassembly:
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov r15, qword [rsp + 0x18]
mov r8, qword [rdi]
mov r9, qword [rdi + 8]
mov r10, qword [rdi + 0x10]
mov r11, qword [rdi + 0x18]
mov r12, qword [rdi + 0x20]
cmp r15, 0x10
jb 0x4d79e7
add r8, qword [rsi]
adc r9, qword [rsi + 8]
adc r10, 1
lea rsi, [rsi + 0x10]
mov rax, r11
mul r8
mov rbx, rax
mov rcx, rdx
mov rax, r11
mul r9
add rcx, rax
adc rdx, 0
mov r13, r11
imul r13, r10
add r13, rdx
mov rax, r12
mul r8
add rcx, rax
adc rdx, 0
mov r8, rdx
mov r14, r12
imul r14, r10
mov rax, r12
mul r9
add r13, rax
adc r14, rdx
add r13, r8
adc r14, 0
mov r8, rbx
mov r9, rcx
mov r10, r13
and r10, 3
mov rbx, r13
and rbx, 0xfffffffffffffffc
add r8, rbx
adc r9, r14
adc r10, 0
shrd r13, r14, 2
shr r14, 2
add r8, r13
adc r9, r14
adc r10, 0
sub r15, 0x10
cmp r15, 0x10
jae 0x4d794c
test r15, r15
je 0x4d7a2a
mov rbx, 1
xor rcx, rcx
xor r13, r13
add rsi, r15
shld rcx, rbx, 8
shl rbx, 8
mov r13b, byte [rsi - 1]
xor rbx, r13
dec rsi
dec r15
jne 0x4d79fc
add r8, rbx
adc r9, rcx
adc r10, 0
mov r15, 0x10
jmp 0x4d795b
mov qword [rdi], r8
mov qword [rdi + 8], r9
mov qword [rdi + 0x10], r10
ret
Function at 0x4d8740
Capabilities:
Encode data using xor

Disassembly:
xor r10, r10
xor r11, r11
xor r12, r12
cmp r9, 0xd
jne 0x4d87e7
mov r10, qword [rcx]
mov r11, qword [rcx + 5]
shr r11, 0x18
mov r12, 1
mov rax, qword [rbp]
mov r15, rax
mul r10
mov r13, rax
mov r14, rdx
mov rax, qword [rbp]
mul r11
imul r15, r12
add r14, rax
adc r15, rdx
mov rax, qword [rbp + 8]
mov r8, rax
mul r10
add r14, rax
adc rdx, 0
mov r10, rdx
mov rax, qword [rbp + 8]
mul r11
add r15, rax
adc rdx, 0
imul r8, r12
add r15, r10
adc r8, rdx
mov r10, r13
mov r11, r14
mov r12, r15
and r12, 3
mov r13, r15
and r13, 0xfffffffffffffffc
mov r14, r8
shrd r15, r8, 2
shr r8, 2
add r10, r13
adc r11, r14
adc r12, 0
add r10, r15
adc r11, r8
adc r12, 0
ret
cmp r9, 0x10
jb 0x4d888a
add r10, qword [rcx]
adc r11, qword [rcx + 8]
adc r12, 1
lea rcx, [rcx + 0x10]
sub r9, 0x10
mov rax, qword [rbp]
mov r15, rax
mul r10
mov r13, rax
mov r14, rdx
mov rax, qword [rbp]
mul r11
imul r15, r12
add r14, rax
adc r15, rdx
mov rax, qword [rbp + 8]
mov r8, rax
mul r10
add r14, rax
adc rdx, 0
mov r10, rdx
mov rax, qword [rbp + 8]
mul r11
add r15, rax
adc rdx, 0
imul r8, r12
add r15, r10
adc r8, rdx
mov r10, r13
mov r11, r14
mov r12, r15
and r12, 3
mov r13, r15
and r13, 0xfffffffffffffffc
mov r14, r8
shrd r15, r8, 2
shr r8, 2
add r10, r13
adc r11, r14
adc r12, 0
add r10, r15
adc r11, r8
adc r12, 0
jmp 0x4d87e7
cmp r9, 0
je 0x4d8943
xor r13, r13
xor r14, r14
xor r15, r15
add rcx, r9
shld r14, r13, 8
shl r13, 8
mov r15b, byte [rcx - 1]
xor r13, r15
dec rcx
dec r9
jne 0x4d88a0
add r10, r13
adc r11, r14
adc r12, 1
mov rax, qword [rbp]
mov r15, rax
mul r10
mov r13, rax
mov r14, rdx
mov rax, qword [rbp]
mul r11
imul r15, r12
add r14, rax
adc r15, rdx
mov rax, qword [rbp + 8]
mov r8, rax
mul r10
add r14, rax
adc rdx, 0
mov r10, rdx
mov rax, qword [rbp + 8]
mul r11
add r15, rax
adc rdx, 0
imul r8, r12
add r15, r10
adc r8, rdx
mov r10, r13
mov r11, r14
mov r12, r15
and r12, 3
mov r13, r15
and r13, 0xfffffffffffffffc
mov r14, r8
shrd r15, r8, 2
shr r8, 2
add r10, r13
adc r11, r14
adc r12, 0
add r10, r15
adc r11, r8
adc r12, 0
ret
Function at 0x14003173c
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movsxd r8, dword [0x14000003c]
lea rsi, [0x140000000]
add r8, rsi
mov rbx, rdx
mov rdi, rcx
cmp dword [r8 + 0x84], 0xd
jbe 0x1400317b4
mov r10d, dword [r8 + 0xf0]
xor r9d, r9d
test r10d, r10d
je 0x1400317b4
movzx ecx, word [r8 + 0x14]
movzx r11d, word [r8 + 6]
add rcx, 0x18
mov r10d, dword [r10 + rsi + 0xc]
add rcx, r8
test r11d, r11d
je 0x1400317b4
mov eax, dword [rcx + 0xc]
cmp r10d, eax
jb 0x1400317a8
mov edx, dword [rcx + 8]
add eax, edx
cmp r10d, eax
jb 0x1400317c6
inc r9d
add rcx, 0x28
cmp r9d, r11d
jb 0x140031796
xor eax, eax
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
mov dword [rdi], edx
mov eax, dword [rcx + 0x24]
mov dword [rbx], eax
mov eax, dword [rcx + 0xc]
add rax, rsi
jmp 0x1400317b6

Function at 0x140033300
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14003334a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14003334a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14003334a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14003334a
cmp dword [rcx + 0x84], 0xe
jbe 0x14003334a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14003334c
xor al, al
add rsp, 0x28
ret

Function at 0x14003c094
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14003bdf8

Function at 0x140045fb0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140045fd8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140045fd8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x140f6ba3c
Capabilities:
Encode data using xor

Disassembly:
jmp 0x140f6ba46
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x140f6ba6f
pop rbp
sub rbp, 0x33
sub rbp, 0xf6ba3c
sub rsp, 0x20
jmp 0x140f6ba8e
mov rax, 0xf6ba3c
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0xfffffffff40ec4c7
xor byte [rax], dl
inc rax
dec rcx
jne 0x140f6baad
jmp 0x140f6bac4
invalid
Function at 0x1400b44d0
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x470
mov rax, qword [0x14020cc58]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov ebx, ecx
lea rcx, [0x14020e0e8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp qword [0x1401ffb90], 0xffffffffffffffff
jne 0x1400b459c
lea rdx, [rsp + 0x40]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea rax, str.Everything_Service_Debug_Log.txt
lea r8, str.Everything_Debug_Log.txt
test ebx, ebx
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x250]
cmovne r8, rax
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
xor ebx, ebx
lea rcx, [rsp + 0x250]
mov qword [rsp + 0x30], rbx
lea r8d, [rbx + 1]
xor r9d, r9d
mov edx, 0x40000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov qword [0x1401ffb90], rax
je 0x1400b459c
cmp dword [0x14020e110], ebx
jne 0x1400b4592
test rax, rax
jne 0x1400b4592
mov dword [0x14020e114], ebx
jmp 0x1400b459c
mov dword [0x14020e114], 1
lea rcx, [0x14020e0e8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.1401a8fb0
add rsp, 0x470
pop rbx
ret

Function at 0x1400b6780
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
xor esi, esi
mov qword [rsp + 0x30], rbx
cmp dword [rdi + 0x128], esi
jne 0x1400b67b5
mov rax, qword [rdi + 0x118]
test rax, rax
je 0x1400b684f
mov eax, dword [rax + 8]
mov dword [rdi + 0x128], eax
mov rdx, qword [rdi + 0x118]
movsxd r8, dword [rdi + 0x128]
xor r9d, r9d
movsxd rcx, dword [rdx + 8]
sub rcx, r8
lea rdx, [rcx + rdx + 0x10]
mov rcx, qword [rdi]
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x1400b6842
test eax, eax
je 0x1400b6813
sub dword [rdi + 0x128], eax
jne 0x1400b6794
mov rax, qword [rdi + 0x118]
mov rcx, rax
mov rbx, qword [rax]
call fcn.1400cf780
test rbx, rbx
mov qword [rdi + 0x118], rbx
jne 0x1400b6794
mov qword [rdi + 0x120], rsi
jmp 0x1400b6794
mov rdx, qword [0x140200708]
mov rcx, rdi
mov r8, qword [rdx + 0x22f0]
mov rdx, qword [rdx + 0x2278]
call fcn.1400b57d0
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x1400b6864
mov eax, 1
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov rdx, qword [0x140200708]
mov rcx, rdi
mov r8, qword [rdx + 0x2318]
mov rdx, qword [rdx + 0x2278]
mov r9d, eax
call fcn.1400b57d0
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x1400c2680
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
sub rsp, 0x20
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rdi
mov rsi, rcx
mov qword [rsp + 0x40], r12
xor ebp, ebp
nop
cmp dword [rsi + 0x90], ebp
jne 0x1400c26ba
mov rax, qword [rsi + 0x68]
test rax, rax
je 0x1400c271f
mov eax, dword [rax + 8]
mov dword [rsi + 0x90], eax
mov rax, qword [rsi + 0x68]
movsxd r8, dword [rsi + 0x90]
mov rcx, qword [rsi]
movsxd rdx, dword [rax + 8]
xor r9d, r9d
add rdx, qword [rax + 0x10]
sub rdx, r8
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x1400c2874
test eax, eax
je 0x1400c2828
sub dword [rsi + 0x90], eax
jne 0x1400c26a0
mov rax, qword [rsi + 0x68]
mov rbx, rax
mov rcx, qword [rax + 0x10]
mov rdi, qword [rax]
call fcn.1400cf780
mov rcx, rbx
call fcn.1400cf780
test rdi, rdi
mov qword [rsi + 0x68], rdi
jne 0x1400c26a0
mov qword [rsi + 0x70], rbp
jmp 0x1400c26a0
cmp dword [rsi + 0x94], ebp
je 0x1400c2881
cmp qword [rsi + 0xc0], 0xffffffffffffffff
je 0x1400c285f
lea rcx, [rsi + 0xe0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [rsi + 0xc8]
mov r12d, dword [rsi + 0xb8]
mov ebx, dword [rsi + 0x10c]
lea rcx, [rsi + 0xe0]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test edi, edi
je 0x1400c27f9
nop
mov rcx, qword [rsi]
movsxd rax, edi
movsxd rdx, r12d
sub rdx, rax
xor r9d, r9d
mov r8d, edi
add rdx, qword [rsi + 0xb0]
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
mov ebx, eax
je 0x1400c281b
test eax, eax
je 0x1400c2828
lea rcx, [rsi + 0xe0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [rsi + 0xe0]
sub edi, ebx
mov dword [rsi + 0xc8], edi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [rsi + 0xe0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [rsi + 0xc8]
mov r12d, dword [rsi + 0xb8]
mov ebx, dword [rsi + 0x10c]
lea rcx, [rsi + 0xe0]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test edi, edi
jne 0x1400c2770
cmp ebx, 1
jne 0x1400c2844
cmp dword [rsi + 0x110], ebp
jne 0x1400c2881
mov rcx, qword [rsi]
mov edx, ebx
mov dword [rsi + 0x110], ebx
call qword [sym.imp.WS2_32.dll_shutdown]
mov eax, ebx
jmp 0x1400c282a
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x1400c2881
xor eax, eax
mov r12, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret
cmp ebx, 2
je 0x1400c2828
test ebx, ebx
jne 0x1400c2881
mov rcx, qword [rsi + 0xd8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
lea eax, [rbx + 1]
jmp 0x1400c282a
mov rcx, qword [rsi]
mov edx, 1
call qword [sym.imp.WS2_32.dll_shutdown]
mov eax, 1
jmp 0x1400c282a
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x1400c2828
mov eax, 1
jmp 0x1400c282a
Function at 0x1400c7840
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x198
mov rax, qword [0x14020cc58]
xor rax, rsp
mov qword [rsp + 0x180], rax
lea r13, str.main.css
xor esi, esi
mov rbp, rdx
mov rdi, r13
mov r12, rcx
mov ebx, esi
nop
nop
nop
mov rdx, qword [rdi]
mov rcx, rbp
call fcn.14016eed0
test eax, eax
je 0x1400c78a0
add ebx, 1
add rdi, 0x18
cmp ebx, 8
jb 0x1400c7880
jmp 0x1400c7aad
mov rcx, qword [0x14020e210]
movsxd rax, ebx
mov qword [rsp + 0x190], r15
lea r15, [rax + rax*2]
mov r8d, 0xa
movzx edx, word [r13 + r15*8 + 0x10]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
mov rbx, rax
je 0x1400c7aa5
mov rcx, qword [0x14020e210]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
movsxd r13, eax
jle 0x1400c7aa5
mov rcx, qword [0x14020e210]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
mov rbp, rax
je 0x1400c7aa5
mov rcx, rax
mov qword [rsp + 0x1e0], r14
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
mov r14, rax
je 0x1400c7a94
lea rcx, [rsp + 0x60]
call fcn.140177280
mov rdx, qword [0x14020e210]
lea rcx, [rsp + 0x60]
call fcn.1400d97f0
mov rcx, qword [rsp + 0x68]
lea rdx, [rsp + 0x38]
call fcn.1400d9fa0
lea rcx, [rsp + 0x60]
call fcn.14017d580
mov r11, qword [rsp + 0x40]
lea rbx, str.main.css
mov rbx, qword [rbx + r15*8 + 8]
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x30], r11
call fcn.140177280
lea rdx, str.200_OK_r_n
mov rcx, r12
call fcn.1400c1db0
lea rdx, str.HTTP_1.0_200_OK_r_n
mov rcx, r12
call fcn.1400c2fe0
lea rdx, str.Server:_Everything_HTTP_Server_r_n
mov rcx, r12
call fcn.1400c2fe0
lea rdx, str.Content_Type:__s_r_n
mov r8, rbx
mov rcx, r12
call fcn.1400c2fe0
lea rdx, str.Content_Length:__I64u_r_n
mov r8, r13
mov rcx, r12
call fcn.1400c2fe0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x60]
call fcn.1400c1a90
mov r8, qword [rsp + 0x68]
lea rdx, str.Date:__s_r_n
mov rcx, r12
call fcn.1400c2fe0
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x60]
call fcn.1400c1a90
mov r8, qword [rsp + 0x68]
lea rdx, str.Last_Modified:__s_r_n
mov rcx, r12
call fcn.1400c2fe0
lea rdx, str.Cache_Control:_private__max_age3600_r_n
mov rcx, r12
call fcn.1400c2fe0
lea rdx, str.Connection:_Close_r_n
mov rcx, r12
call fcn.1400c2fe0
mov rdx, qword [0x14020dfb0]
cmp byte [rdx], sil
je 0x1400c7a60
mov rcx, r12
call fcn.1400c3250
lea rdx, [0x1401b0f68]
mov rcx, r12
call fcn.1400c2fe0
lea rcx, [rsp + 0x60]
call fcn.14017d580
mov r8d, r13d
mov rdx, r14
mov rcx, r12
call fcn.1400c2eb0
mov rcx, r12
call fcn.1400c2890
mov esi, 1
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov r14, qword [rsp + 0x1e0]
mov r15, qword [rsp + 0x190]
mov eax, esi
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.1401a8fb0
add rsp, 0x198
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400c89b0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rdi, rcx
xor r15d, r15d
mov rax, qword [rdi + 0x58]
cmp qword [rdi + 0x50], rax
jne 0x1400c8a1a
mov ecx, 0x10000
call fcn.1400cf700
cmp qword [rdi + 0x40], r15
mov r11, rax
je 0x1400c89f8
mov rax, qword [rdi + 0x48]
mov qword [rax], r11
jmp 0x1400c89fc
mov qword [rdi + 0x40], rax
mov qword [r11], r15
add dword [rdi + 0x60], 1
lea rax, [r11 + 0x10000]
mov qword [rdi + 0x58], rax
lea rax, [r11 + 8]
mov qword [rdi + 0x48], r11
mov qword [rdi + 0x50], rax
mov r8d, dword [rdi + 0x58]
mov rdx, qword [rdi + 0x50]
mov rcx, qword [rdi]
sub r8d, dword [rdi + 0x50]
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recv]
movsxd r13, eax
cmp r13d, 0xffffffff
je 0x1400c8bac
test eax, eax
je 0x1400c8ba8
mov rsi, qword [rdi + 0x50]
mov rbx, r15
lea rax, [rsi + r13]
mov qword [rdi + 0x50], rax
cmp byte [rsi], 0xa
jne 0x1400c8b5d
test rbx, rbx
mov byte [rsi], r15b
je 0x1400c8a7e
mov rdx, rbx
mov rcx, rdi
call fcn.1400c7c10
add rsi, 1
mov rbx, rsi
jmp 0x1400c8b61
mov ecx, dword [rdi + 0x60]
cmp ecx, 1
jne 0x1400c8aa2
mov rdx, qword [rdi + 0x48]
mov rcx, rdi
add rdx, 8
call fcn.1400c7c10
add rsi, 1
mov rbx, rsi
jmp 0x1400c8b61
mov eax, esi
sub eax, dword [rdi + 0x48]
sub eax, 8
movsxd rdx, eax
lea eax, [rcx - 1]
movsxd rcx, eax
imul rcx, rcx, 0xfff8
lea rcx, [rdx + rcx + 1]
call fcn.1400cf700
mov rbp, qword [rdi + 0x40]
cmp rbp, qword [rdi + 0x48]
mov r14, rax
mov r12, rax
je 0x1400c8b0e
nop
nop
nop
mov rbx, qword [rbp]
lea rdx, [rbp + 8]
mov r8d, 0xfff8
mov rcx, r12
call fcn.1401a8fe0
mov rcx, rbp
add r12, 0xfff8
call fcn.1400cf780
cmp rbx, qword [rdi + 0x48]
mov rbp, rbx
jne 0x1400c8ae0
mov rdx, qword [rdi + 0x48]
mov eax, esi
mov rcx, r12
sub eax, dword [rdi + 0x48]
add rdx, 8
sub eax, 8
movsxd r8, eax
call fcn.1401a8fe0
sub r12, qword [rdi + 0x48]
mov rdx, r14
mov byte [r12 + rsi - 8], r15b
mov rax, qword [rdi + 0x48]
mov rcx, rdi
mov qword [rdi + 0x40], rax
mov dword [rdi + 0x60], 1
call fcn.1400c7c10
mov rcx, r14
call fcn.1400cf780
add rsi, 1
mov rbx, rsi
jmp 0x1400c8b61
add rsi, 1
sub r13d, 1
jne 0x1400c8a56
test rbx, rbx
je 0x1400c89d2
mov eax, dword [rdi + 0x50]
mov rcx, qword [rdi + 0x48]
mov rdx, rbx
sub eax, ebx
add rcx, 8
movsxd r8, eax
call fcn.1401a8fe0
mov r11d, dword [rdi + 0x50]
mov rax, qword [rdi + 0x48]
sub r11d, ebx
movsxd rcx, r11d
lea rcx, [rcx + rax + 8]
mov qword [rdi + 0x50], rcx
jmp 0x1400c89d2
xor eax, eax
jmp 0x1400c8bbe
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
sete r15b
mov eax, r15d
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret