joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140016540
Capabilities:
Read file on windows

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0xd0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x48], 0xfffffffffffffffe
mov esi, r8d
mov r14, rdx
mov rdi, rcx
mov eax, r8d
neg eax
movsxd rdx, eax
mov qword [rbp + 0x30], rdx
lea r8, [rbp + 0x34]
mov rcx, qword [rcx + 0x20]
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x14001664b
vxorps xmm0, xmm0, xmm0
vmovups xmmword [r14], xmm0
mov qword [r14 + 0x10], 0
test esi, esi
js 0x1400166df
movsxd rbx, esi
cmp esi, 0x1000
jb 0x1400165d1
lea rcx, [rbx + 0x27]
call fcn.1401c3b4c
mov rcx, rax
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x1400165d9
mov rcx, rbx
call fcn.1401c3b4c
mov qword [r14], rax
lea r15, [rax + rbx]
mov qword [r14 + 0x10], r15
mov r12, r14
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, rbx
call fcn.1401bb600
mov qword [rbp + 0x40], r12
mov qword [r12 + 8], r15
mov rcx, qword [rdi + 0x20]
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0x3c]
mov rdx, r14
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400166e4
mov edx, dword [rbp + 0x3c]
cmp edx, esi
jae 0x140016635
mov rcx, qword [rbp + 0x40]
call fcn.140011980
mov rax, qword [rbp + 0x40]
add rsp, 0xd0
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
lea rsi, [rbp - 0x30]
mov rcx, rsi
call fcn.140011530
lea r8, str.cant_read_from_file__
mov r9d, 0x16
mov rcx, rsi
xor edx, edx
call fcn.140013470
vmovups ymm0, ymmword [rax]
vmovups ymmword [rbp + 0x10], ymm0
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rdx, [0x14021f168]
lea rcx, [rbp + 0x10]
mov r8d, 1
vzeroupper
call fcn.1400056e0
vmovups ymm0, ymmword [rax]
vmovups ymmword [rbp - 0x10], ymm0
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rcx, [rbp - 0x50]
lea rdx, [rbp - 0x10]
vzeroupper
call fcn.140005590
lea rdx, [0x1402702e8]
lea rcx, [rbp - 0x50]
call fcn.1401eba1c
call fcn.1400086c0
lea rcx, [rbp - 0x30]
call fcn.140011530
lea r8, str.cant_read_from_file__
lea rcx, [rbp - 0x30]
mov r9d, 0x16
xor edx, edx
call fcn.140013470
vmovups ymm0, ymmword [rax]
vmovups ymmword [rbp + 0x10], ymm0
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rdx, [0x14021f168]
lea rcx, [rbp + 0x10]
mov r8d, 1
vzeroupper
call fcn.1400056e0
vmovups ymm0, ymmword [rax]
vmovups ymmword [rbp - 0x10], ymm0
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rcx, [rbp - 0x50]
lea rdx, [rbp - 0x10]
vzeroupper
call fcn.140005590
lea rdx, [0x1402702e8]
lea rcx, [rbp - 0x50]
call fcn.1401eba1c
int3
Function at 0x140028730
Capabilities:
Get file attributes

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0xc8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x40], 0xfffffffffffffffe
mov rdi, rcx
lea rbx, [rbp - 0x58]
mov rcx, rbx
call fcn.140011e40
mov rcx, rdi
call fcn.1401f0ed0
lea r9, [rax + rdi]
lea rsi, [rbp + 0x20]
mov rcx, rbx
mov rdx, rsi
mov r8, rdi
call fcn.140012900
lea rcx, [rbp - 0x58]
call fcn.1400120d0
cmp qword [rbp + 0x38], 8
jb 0x14002878c
mov rsi, qword [rbp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov r8, qword [rbp + 0x38]
cmp r8, 8
jb 0x1400287df
mov rcx, qword [rbp + 0x20]
lea rdx, [r8*2 + 2]
cmp rdx, 0x1000
jb 0x1400287d6
mov rdx, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rdx
cmp rcx, 0x20
jae 0x1400287f0
mov esi, eax
add r8, r8
add r8, 0x29
mov rcx, rdx
mov rdx, r8
jmp 0x1400287d8
mov esi, eax
call fcn.1401c3b44
mov eax, esi
test al, 0x10
sete al
add rsp, 0xc8
pop rbx
pop rdi
pop rsi
pop rbp
ret
call fcn.1401f09f0
int3
Function at 0x14002af30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x60
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rcx]
movzx eax, byte [rcx]
test byte [rsi + 0xb9], 1
je 0x14002af6a
mov rcx, qword [rsi + 0xd0]
mov rcx, qword [rcx + 8]
mov r8, qword [rcx]
mov edx, eax
call qword [r8 + 0x20]
mov rcx, qword [rsi]
mov r8, qword [rdi + 0x20]
test r8, r8
je 0x14002b021
mov rdx, qword [rsi + 0xa0]
lea r9, [rcx + 1]
jmp 0x14002af9d
mov r8, qword [r8 + 0x18]
test r8, r8
je 0x14002b021
mov r10d, dword [r8 + 0xc]
test r10d, r10d
je 0x14002af90
mov r11d, dword [r8]
lea rbx, [rcx + r11]
xor r14d, r14d
mov r15, rcx
test r11d, r11d
je 0x14002aff3
mov r12d, r14d
add r12, qword [r8 + 0x10]
xor r15d, r15d
nop word cs:[rax + rax]
movzx ebp, byte [rcx + r15]
cmp bpl, byte [r12 + r15]
jne 0x14002aff0
inc r15
cmp r11, r15
jne 0x14002afd0
mov r15, rbx
jmp 0x14002aff3
add r15, r9
cmp r15, rdx
je 0x14002b002
add r14d, r11d
cmp r14d, r10d
jb 0x14002afb0
jmp 0x14002af90
cmp rdx, rcx
je 0x14002b021
test byte [rdi + 0xc], 1
mov rcx, rdx
jne 0x14002b141
mov qword [rsi], rcx
mov eax, 1
jmp 0x14002b143
inc rcx
mov r8, qword [rdi + 0x38]
test r8, r8
je 0x14002b111
test byte [rsi + 0xb9], 8
mov ebx, eax
je 0x14002b0dc
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rcx
mov rcx, qword [rsi + 0xd0]
mov byte [rsp + 0x2f], al
mov byte [rsp + 0x2e], al
mov rcx, qword [rcx]
lea r9, [rsp + 0x2f]
mov rax, qword [rcx]
lea rbx, [rsp + 0x40]
lea r14, [rsp + 0x2e]
mov rdx, rbx
mov r8, r14
call qword [rax + 0x20]
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
cmp rax, 0x10
cmovae rbx, rcx
cmp qword [rsp + 0x50], 1
cmovne rbx, r14
movzx ebx, byte [rbx]
cmp rax, 0x10
jb 0x14002b0cd
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14002b0c8
mov rdx, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rdx
cmp rcx, 0x20
jae 0x14002b15d
add rax, 0x28
mov rcx, rdx
mov rdx, rax
call fcn.1401c3b44
movzx eax, byte [rsp + 0x2f]
mov rcx, qword [rsp + 0x30]
mov r8, qword [rsp + 0x38]
mov edx, dword [r8 + 4]
test edx, edx
je 0x14002b111
mov r8, qword [r8 + 8]
xor r9d, r9d
jmp 0x14002b0f9
add r9d, 2
cmp r9d, edx
jae 0x14002b111
mov r10d, r9d
cmp byte [r8 + r10], bl
ja 0x14002b0f0
cmp byte [r10 + r8 + 1], bl
jb 0x14002b0f0
mov rdx, rcx
jmp 0x14002b007
mov rdx, qword [rdi + 0x28]
test rdx, rdx
je 0x14002b152
movzx eax, al
mov r8d, eax
shr r8d, 3
movzx edx, byte [rdx + r8]
and eax, 7
bt edx, eax
setb al
test byte [rdi + 0xc], 1
sete dl
xor dl, al
je 0x14002b014
xor eax, eax
add rsp, 0x60
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
test byte [rdi + 0xc], 1
je 0x14002b141
jmp 0x14002b014
call fcn.1401f09f0
int3
Function at 0x14002c600
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub r8, rdx
je 0x14002c6d8
movabs r10, 0xcbf29ce484222325
movabs rcx, 0x100000001b3
cmp r8, 1
adc r8, 0
cmp r8, 8
jb 0x14002c6af
mov rax, r8
shr rax, 3
xor r9d, r9d
nop dword [rax]
movzx r11d, byte [rdx + r9*8]
xor r11, r10
imul r11, rcx
movzx r10d, byte [rdx + r9*8 + 1]
xor r10, r11
imul r10, rcx
movzx r11d, byte [rdx + r9*8 + 2]
xor r11, r10
imul r11, rcx
movzx r10d, byte [rdx + r9*8 + 3]
xor r10, r11
imul r10, rcx
movzx r11d, byte [rdx + r9*8 + 4]
xor r11, r10
imul r11, rcx
movzx r10d, byte [rdx + r9*8 + 5]
xor r10, r11
imul r10, rcx
movzx r11d, byte [rdx + r9*8 + 6]
xor r11, r10
imul r11, rcx
movzx r10d, byte [rdx + r9*8 + 7]
xor r10, r11
imul r10, rcx
inc r9
cmp rax, r9
jne 0x14002c640
mov r9, r8
and r9, 0xfffffffffffffff8
cmp r9, r8
jae 0x14002c6de
nop dword [rax + rax]
movzx eax, byte [rdx + r9]
xor rax, r10
imul rax, rcx
inc r9
mov r10, rax
cmp r8, r9
jne 0x14002c6c0
ret
mov eax, 0x84222325
ret
mov rax, r10
ret
Function at 0x14005a4c0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
push rax
mov r11d, dword [rsp + 0x68]
mov eax, dword [r8]
test r9, r9
je 0x14005a51e
mov esi, dword [r9]
mov edi, eax
sub edi, esi
lea ebx, [rdi + rdi]
sar edi, 0x1f
xor r10d, r10d
xor edi, ebx
mov dword [rcx], edi
mov dword [rdx], edi
setne r10b
cmp r11d, 2
jl 0x14005a5dc
mov ebx, r11d
dec rbx
cmp r11d, 2
mov qword [rsp], rbx
jne 0x14005a5e4
mov r11d, 1
mov edi, r10d
jmp 0x14005a6a8
lea ecx, [rax + rax]
mov r9d, eax
sar r9d, 0x1f
xor r9d, ecx
mov dword [rdx], r9d
cmp r11d, 2
jl 0x14005a5d5
mov ecx, r11d
lea r9, [rcx - 1]
cmp r11d, 9
jb 0x14005a59a
mov r10, r9
shr r10, 3
mov r11d, 4
vmovdqu ymm0, ymmword [0x1402218a0]
nop word [rax + rax]
vmovdqu ymm1, ymmword [r8 + r11]
vpermd ymm2, ymm0, ymm1
vmovd xmm3, eax
vpblendd ymm2, ymm2, ymm3, 1
vpsubd ymm1, ymm1, ymm2
vpsrad ymm2, ymm1, 0x1f
vpaddd ymm1, ymm1, ymm1
vpxor ymm1, ymm1, ymm2
mov eax, dword [r8 + r11 + 0x1c]
vmovdqu ymmword [rdx + r11], ymm1
add r11, 0x20
dec r10
jne 0x14005a560
mov r10, r9
and r10, 0xfffffffffffffff8
cmp r10, r9
jae 0x14005a5d5
inc r10
nop dword [rax]
mov r9d, dword [r8 + r10*4]
mov r11d, r9d
sub r11d, eax
mov eax, r11d
sar eax, 0x1f
add r11d, r11d
xor r11d, eax
mov dword [rdx + r10*4], r11d
inc r10
mov eax, r9d
cmp rcx, r10
jne 0x14005a5b0
xor eax, eax
jmp 0x14005a6f4
mov edi, r10d
jmp 0x14005a6ee
and rbx, 0xfffffffffffffffe
neg rbx
mov r11d, 1
mov edi, r10d
nop word cs:[rax + rax]
mov r15d, dword [r9 + r11*4]
mov r14d, dword [r8 + r11*4]
sub esi, r15d
sub esi, eax
add esi, r14d
lea r12d, [rsi + rsi]
sar esi, 0x1f
xor ebp, ebp
xor esi, r12d
mov dword [rcx + r11*4], esi
setne bpl
add ebp, r10d
mov r10d, r14d
sub r10d, eax
lea eax, [r10 + r10]
sar r10d, 0x1f
xor r12d, r12d
xor r10d, eax
mov dword [rdx + r11*4], r10d
setne r12b
add r12d, edi
mov esi, dword [r9 + r11*4 + 4]
mov eax, dword [r8 + r11*4 + 4]
sub r15d, esi
sub r15d, r14d
add r15d, eax
lea edi, [r15 + r15]
sar r15d, 0x1f
xor r10d, r10d
xor r15d, edi
mov dword [rcx + r11*4 + 4], r15d
setne r10b
add r10d, ebp
mov r15d, eax
sub r15d, r14d
lea ebp, [r15 + r15]
sar r15d, 0x1f
xor edi, edi
xor r15d, ebp
mov dword [rdx + r11*4 + 4], r15d
setne dil
add edi, r12d
lea r14, [rbx + r11]
add r14, 2
add r11, 2
cmp r14, 1
jne 0x14005a600
test byte [rsp], 1
je 0x14005a6ee
mov r8d, dword [r8 + r11*4]
mov r9d, dword [r9 + r11*4]
add r9d, eax
sub esi, r9d
add esi, r8d
lea r9d, [rsi + rsi]
sar esi, 0x1f
xor ebx, ebx
xor esi, r9d
mov dword [rcx + r11*4], esi
setne bl
add r10d, ebx
sub r8d, eax
lea eax, [r8 + r8]
sar r8d, 0x1f
xor ecx, ecx
xor r8d, eax
mov dword [rdx + r11*4], r8d
setne cl
add edi, ecx
cmp r10d, edi
setb al
add rsp, 8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
vzeroupper
ret
Function at 0x14005a7b0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
mov r11d, dword [rsp + 0x60]
movzx r10d, word [r8]
movzx esi, r10w
test r9, r9
je 0x14005a865
movzx ebp, word [r9]
sub esi, ebp
lea edi, [rsi + rsi]
sar esi, 0x1f
xor eax, eax
xor esi, edi
mov dword [rcx], esi
mov dword [rdx], esi
setne al
cmp r11d, 2
jl 0x14005a93e
mov r11d, r11d
mov edi, 1
mov esi, eax
nop dword [rax + rax]
movzx ebx, word [r9 + rdi*2]
movzx r14d, bp
movzx ebp, r10w
movzx r10d, word [r8 + rdi*2]
mov r15d, ebx
add r15d, ebp
sub r14d, r15d
add r14d, r10d
lea r15d, [r14 + r14]
sar r14d, 0x1f
xor r12d, r12d
xor r14d, r15d
mov dword [rcx + rdi*4], r14d
setne r12b
add eax, r12d
mov r14d, r10d
sub r14d, ebp
lea ebp, [r14 + r14]
sar r14d, 0x1f
xor r15d, r15d
xor r14d, ebp
mov dword [rdx + rdi*4], r14d
setne r15b
add esi, r15d
mov ebp, ebx
inc rdi
cmp r11, rdi
jne 0x14005a800
jmp 0x14005a940
add esi, esi
mov dword [rdx], esi
cmp r11d, 2
jl 0x14005a947
mov ecx, r11d
lea rax, [rcx - 1]
cmp r11d, 5
jb 0x14005a8fb
mov r9, rax
shr r9, 2
lea r11, [rdx + 4]
xor esi, esi
vpcmpeqd xmm0, xmm0, xmm0
nop word cs:[rax + rax]
movzx edi, r10w
mov r10, qword [r8 + rsi*8 + 2]
vmovq xmm1, r10
vpmovzxwd xmm2, xmm1
vpsllq xmm3, xmm1, 0x10
vpinsrw xmm3, xmm3, edi, 0
vpmaxuw xmm3, xmm1, xmm3
vpcmpeqw xmm1, xmm1, xmm3
vpxor xmm1, xmm1, xmm0
vpmovsxwd xmm1, xmm1
vpshufd xmm3, xmm2, 0x90
vpinsrd xmm3, xmm3, edi, 0
vpsubd xmm2, xmm2, xmm3
vpaddd xmm2, xmm2, xmm2
vpxor xmm1, xmm2, xmm1
vmovdqu xmmword [r11], xmm1
inc rsi
shr r10, 0x30
add r11, 0x10
cmp r9, rsi
jne 0x14005a8a0
mov r9, rax
and r9, 0xfffffffffffffffc
cmp r9, rax
jae 0x14005a947
inc r9
xor eax, eax
nop dword [rax]
movzx r11d, word [r8 + r9*2]
movzx esi, r10w
cmp r11w, si
mov edi, 0
sbb edi, edi
mov r10d, r11d
sub r11d, esi
add r11d, r11d
xor r11d, edi
mov dword [rdx + r9*4], r11d
inc r9
cmp rcx, r9
jne 0x14005a910
jmp 0x14005a949
mov esi, eax
cmp eax, esi
setb al
jmp 0x14005a949
xor eax, eax
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x1400731d0
Capabilities:
Enumerate processes

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x188
mov dword [rsp + 0x58], 0x130
xor ebp, ebp
mov ecx, 2
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rsi, rax
lea rdx, [rsp + 0x58]
mov rcx, rax
call sub.KERNEL32.dll_Process32First
lea rdx, [0x14021d143]
test eax, eax
je 0x1400733d7
lea rdx, [rsp + 0x58]
mov rcx, rsi
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x1400733ce
lea rdi, [rsp + 0x84]
lea r14, [rsp + 0x30]
mov qword [rsp + 0x28], rsi
jmp 0x14007326a
mov rsi, qword [rsp + 0x28]
mov rcx, rsi
lea rdx, [rsp + 0x58]
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x1400733ce
mov rbx, qword [0x14029c270]
mov rsi, qword [0x14029c278]
cmp rbx, rsi
je 0x140073250
nop dword [rax]
vxorps xmm0, xmm0, xmm0
vmovups ymmword [rsp + 0x30], ymm0
mov rcx, rdi
vzeroupper
call fcn.1401f0ed0
test rax, rax
js 0x140073402
mov r15, rax
cmp rax, 0xf
ja 0x1400732d0
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], reloc.WS2_32.dll_ntohs
mov rcx, r14
mov rdx, rdi
mov r8, r15
call fcn.1401bb6d0
add r15, rsp
add r15, 0x30
jmp 0x14007333f
mov rbp, r15
or rbp, 0xf
cmp rbp, 0x16
mov r13, rbp
mov eax, 0x16
cmovb r13, rax
cmp r13, 0xfff
jb 0x140073310
add r13, 0x28
mov rcx, r13
call fcn.1401c3b4c
lea r12, [rax + 0x27]
and r12, 0xffffffffffffffe0
mov qword [r12 - 8], rax
jmp 0x14007331f
lea rcx, [r13 + 1]
call fcn.1401c3b4c
mov r12, rax
mov rbp, r13
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], rbp
mov rcx, r12
mov rdx, rdi
mov r8, r15
call fcn.1401bb6d0
add r15, r12
mov byte [r15], 0
mov r8, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
mov rdx, rbx
jb 0x140073354
mov rdx, qword [rbx]
mov r12, qword [rsp + 0x30]
mov r13, qword [rsp + 0x48]
cmp r13, 0x10
mov rcx, r14
cmovae rcx, r12
call fcn.1401f9f90
mov r15d, eax
cmp r13, 0x10
jb 0x1400733a8
lea rdx, [r13 + 1]
cmp rdx, 0x1000
jb 0x1400733a0
mov rax, qword [r12 - 8]
add r12, 0xfffffffffffffff8
sub r12, rax
cmp r12, 0x20
jae 0x140073407
add r13, 0x28
mov r12, rax
mov rdx, r13
mov rcx, r12
call fcn.1401c3b44
mov ebp, 1
test r15d, r15d
je 0x1400733c4
add rbx, 0x20
cmp rbx, rsi
jne 0x140073280
jmp 0x140073250
mov rdx, rdi
mov rsi, qword [rsp + 0x28]
jmp 0x1400733d7
xor ebp, ebp
lea rdx, [0x14021d143]
lea rcx, [0x140294948]
call fcn.1400623f0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebp
add rsp, 0x188
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call fcn.140005120
call fcn.1401f09f0
int3
Function at 0x140073410
Capabilities:
Create thread

Disassembly:
push rbp
push rsi
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov qword [rbp], 0xfffffffffffffffe
mov ecx, 1
call fcn.1401c3b4c
mov rsi, rax
lea rax, [rbp - 0x10]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
lea r8, [0x1400734c0]
xor ecx, ecx
xor edx, edx
mov r9, rsi
call fcn.1401fc0b8
mov qword [rbp - 0x18], rax
test rax, rax
je 0x14007347d
cmp dword [0x14029c290], 0
jne 0x140073492
mov ecx, dword [rbp - 0x10]
mov qword [0x14029c288], rax
mov dword [0x14029c290], ecx
add rsp, 0x58
pop rsi
pop rbp
ret
mov qword [rbp - 8], rsi
mov dword [rbp - 0x10], 0
mov ecx, 6
call fcn.1401c6d4c
call fcn.1401fbf54
int3

Function at 0x140073530
Capabilities:
Terminate thread

Disassembly:
push rsi
sub rsp, 0x30
mov eax, dword [0x14029c290]
test eax, eax
je 0x140073584
mov rsi, qword [0x14029c288]
mov qword [rsp + 0x20], rsi
mov dword [rsp + 0x28], eax
lea rcx, [rsp + 0x20]
call fcn.1401ca0d4
test eax, eax
jne 0x140073584
mov qword [0x14029c288], 0
mov dword [0x14029c290], 0
mov rcx, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
nop
add rsp, 0x30
pop rsi
ret
mov ecx, 1
call fcn.1401c6d4c
int3
Function at 0x140076c00
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
test r8, r8
jle 0x140076c96
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
cmp qword [rcx + 0x68], 0
je 0x140076c9d
mov r15, rsi
jmp 0x140076c5b
cmp r15, r14
cmovb r14, r15
mov rcx, rdi
mov r8, r14
call fcn.1401bb6d0
add rdi, r14
sub r15, r14
mov rax, qword [rbx + 0x50]
sub dword [rax], r14d
mov rax, qword [rbx + 0x38]
add qword [rax], r14
test r15, r15
jle 0x140076c8e
mov rax, qword [rbx + 0x38]
mov rdx, qword [rax]
test rdx, rdx
je 0x140076c73
mov rax, qword [rbx + 0x50]
mov r14d, dword [rax]
test r14d, r14d
jg 0x140076c30
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x140076c8e
mov byte [rdi], al
inc rdi
dec r15
test r15, r15
jg 0x140076c5b
sub rsi, r15
jmp 0x140076d8a
xor esi, esi
jmp 0x140076d8a
mov rax, qword [rbx + 0x38]
mov rdx, qword [rax]
test rdx, rdx
je 0x140076cf0
mov rcx, qword [rbx + 0x50]
movsxd r15, dword [rcx]
test r15, r15
je 0x140076cf0
cmp r15, rsi
cmovae r15, rsi
mov rcx, rdi
mov r8, r15
call fcn.1401bb6d0
add rdi, r15
mov r14, rsi
sub r14, r15
mov rax, qword [rbx + 0x50]
sub dword [rax], r15d
mov rax, qword [rbx + 0x38]
movsxd rcx, r15d
add qword [rax], rcx
cmp qword [rbx + 0x80], 0
jne 0x140076d01
jmp 0x140076d87
mov r14, rsi
cmp qword [rbx + 0x80], 0
je 0x140076d87
mov rcx, qword [rbx + 0x18]
lea rdx, [rbx + 0x70]
cmp qword [rcx], rdx
jne 0x140076d30
mov edx, dword [rbx + 0x90]
mov r8, qword [rbx + 0x88]
mov qword [rcx], r8
mov qword [rax], r8
sub edx, r8d
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
nop word [rax + rax]
cmp r14, 0x1000
jb 0x140076d63
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rdi
call fcn.1401fc960
add rdi, rax
sub r14, rax
cmp rax, 0xfff
je 0x140076d30
jmp 0x140076d87
test r14, r14
je 0x140076d84
mov r9, qword [rbx + 0x80]
mov edx, 1
mov rcx, rdi
mov r8, r14
call fcn.1401fc960
sub r14, rax
jmp 0x140076d87
xor r14d, r14d
sub rsi, r14
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140078290
Capabilities:
Check os version
Initialize winsock library

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x1f0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x168], 0xfffffffffffffffe
mov rsi, rcx
mov eax, 1
lock xadd dword [0x14029c2c8], eax
test eax, eax
jne 0x1400782d9
mov ecx, 2
lea rdx, [rbp - 0x60]
call qword [sym.imp.WS2_32.dll_WSAStartup]
xchg dword [0x14029c2cc], eax
mfence
mov eax, dword [0x14029c2cc]
test eax, eax
je 0x140078304
mov dword [rbp - 0x60], eax
lea rax, str.P__
mov qword [rbp - 0x58], rax
lea rdx, str.winsock
lea rcx, [rbp - 0x60]
call fcn.140077900
mov ecx, 0x38
call fcn.1401c3b4c
mov qword [rbp + 0x158], rax
mov rcx, rax
call fcn.1400794c0
mov dword [rbp - 0x60], eax
lea rdi, str.P__
mov qword [rbp - 0x58], rdi
test eax, eax
je 0x14007833f
lea rdx, str.mutex
lea rcx, [rbp - 0x60]
call fcn.140077900
mov rax, qword [rbp + 0x158]
mov qword [rax + 0x28], rsi
mov ecx, 0xa0
call fcn.1401c3b4c
mov rbx, rax
vxorps xmm0, xmm0, xmm0
vmovups xmmword [rax + 8], xmm0
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], 0
lea rax, [0x140223e50]
mov qword [rbx], rax
vmovups xmmword [rbx + 0x28], xmm0
mov qword [rbx + 0x38], 0
mov dword [rbp - 0x60], 0x94
lea rcx, [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x1400783a3
mov eax, 0xffffffff
cmp dword [rbp - 0x5c], 5
ja 0x1400783a8
mov eax, 0x1f4
lea rcx, [rbx + 0x28]
mov qword [rbp + 0x138], rcx
mov dword [rbx + 0x40], eax
lea rax, [rbx + 0x48]
mov qword [rbp + 0x140], rax
lea r14, [rbx + 0x60]
vxorps xmm0, xmm0, xmm0
vmovups xmmword [rbx + 0x48], xmm0
mov qword [rbp + 0x160], rbx
mov dword [rbx + 0x58], 0
mov rcx, r14
call fcn.1400794c0
mov dword [rbp - 0x60], eax
mov qword [rbp - 0x58], rdi
test eax, eax
je 0x1400783ff
lea rdx, str.mutex
lea rcx, [rbp - 0x60]
call fcn.140077900
vxorps xmm0, xmm0, xmm0
mov rbx, qword [rbp + 0x160]
vmovups xmmword [rbx + 0x88], xmm0
mov qword [rbx + 0x98], 0
mov rcx, 0xffffffffffffffff
xor edx, edx
xor r8d, r8d
mov r9d, 0xffffffff
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov qword [rbx + 0x28], rax
test rax, rax
jne 0x140078481
mov qword [rbp + 0x148], r14
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp - 0x60], eax
mov qword [rbp - 0x58], rdi
test eax, eax
je 0x14007847a
mov rax, qword [rbp + 0x160]
add rax, 0x90
mov qword [rbp + 0x150], rax
lea rdx, str.iocp
lea rcx, [rbp - 0x60]
call fcn.140077900
mov rbx, qword [rbp + 0x160]
mov rcx, qword [rbp + 0x158]
mov qword [rcx + 0x30], rbx
lea rax, vtable.type_info.0
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x20], 0
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rbx
mov rax, rsi
add rsp, 0x1f0
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
Function at 0x1400789d0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0xb8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x30], 0xfffffffffffffffe
mov rsi, rdx
vxorps xmm0, xmm0, xmm0
vmovups xmmword [rbp - 0x1c], xmm0
mov dword [rbp - 0xc], 0
mov qword [rbp - 0x24], 2
mov rdi, qword [rcx]
cmp rdi, 0xffffffffffffffff
je 0x140078a69
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov dword [rbp - 8], 0x1c
lea rdx, [rbp - 0x24]
lea r8, [rbp - 8]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_getsockname]
mov edi, eax
mov ebx, dword [rbp - 8]
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [rbp + 0x20], eax
lea rcx, str.P__
mov qword [rbp + 0x28], rcx
test edi, edi
je 0x140078aa0
vxorps xmm0, xmm0, xmm0
vmovups xmmword [rsi + 8], xmm0
mov dword [rsi + 0x18], 0
mov qword [rsi], 2
test eax, eax
jne 0x140078a8e
jmp 0x140078abb
mov dword [rbp + 0x20], 0x2719
lea rax, str.P__
mov qword [rbp + 0x28], rax
vmovups xmmword [rsi + 8], xmm0
mov dword [rsi + 0x18], 0
mov qword [rsi], 2
lea rdx, str.local_endpoint
lea rcx, [rbp + 0x20]
call fcn.140077900
jmp 0x140078abb
cmp ebx, 0x81
jae 0x140078aca
vmovups xmm0, xmmword [rbp - 0x24]
vmovups xmm1, xmmword [rbp - 0x18]
vmovups xmmword [rsi + 0xc], xmm1
vmovups xmmword [rsi], xmm0
mov rax, rsi
add rsp, 0xb8
pop rbx
pop rdi
pop rsi
pop rbp
ret
mov dword [rbp - 0x38], 0x2726
mov qword [rbp - 0x30], rcx
lea rcx, [rbp - 0x60]
lea rdx, [rbp - 0x38]
call fcn.14007ab00
lea rax, vtable.std::exception.0
mov qword [rbp - 8], rax
lea rdx, [rbp]
vxorps xmm0, xmm0, xmm0
vmovups xmmword [rbp], xmm0
lea rcx, [rbp - 0x58]
call fcn.1401ebac4
mov eax, dword [rbp - 0x48]
mov dword [rbp + 0x10], eax
mov rax, qword [rbp - 0x40]
mov qword [rbp + 0x18], rax
lea rax, vtable.std::system_error.0
mov qword [rbp - 8], rax
lea rdx, [0x14027f3a8]
lea rcx, [rbp - 8]
call fcn.1401eba1c
int3
Function at 0x14007a2a0
Capabilities:
Set socket configuration

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x30
mov rsi, r9
cmp rcx, 0xffffffffffffffff
je 0x14007a385
mov rbx, rdx
mov rdi, rcx
test r8b, r8b
je 0x14007a304
movzx eax, byte [rbx]
test al, 8
je 0x14007a304
mov dword [rsp + 0x2c], 0
or al, 8
mov byte [rbx], al
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x2c]
mov rcx, rdi
mov edx, 0xffff
mov r8d, 0x80
call qword [sym.imp.WS2_32.dll_setsockopt]
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
mov ebp, eax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
mov dword [rsi], eax
lea r14, str.P__
mov qword [rsi + 8], r14
test ebp, ebp
je 0x14007a385
cmp ecx, 0x2733
je 0x14007a340
cmp ecx, 0x4d5
jne 0x14007a3a3
mov dword [rsp + 0x28], 0
lea r8, [rsp + 0x28]
mov rcx, rdi
mov edx, 0x8004667e
call qword [sym.imp.WS2_32.dll_ioctlsocket]
and byte [rbx], 0xfc
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
mov edi, eax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
mov eax, edi
mov dword [rsi], ecx
mov qword [rsi + 8], r14
test edi, edi
jne 0x14007a398
mov dword [rsi], 0
lea rax, [0x140223e70]
mov qword [rsi + 8], rax
xor eax, eax
add rsp, 0x30
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
mov eax, ebp
jmp 0x14007a398