joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400b1500
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x48
mov rcx, rdx
mov dword [rsp + 0x30], 1
mov edx, 6
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x30]
lea r8d, [rdx - 5]
call qword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x1400b153b
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
add rsp, 0x48
ret
xor eax, eax
add rsp, 0x48
ret

Function at 0x1400b1550
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, rdx
mov dword [rsp + 0x38], 0x3c
mov rcx, rbx
mov dword [rsp + 0x30], 1
lea r9, [rsp + 0x30]
mov dword [rsp + 0x20], 4
mov edx, 0xffff
mov r8d, 8
call qword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x1400b159b
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
add rsp, 0x40
pop rbx
ret
cmp dword [rsp + 0x30], 0
je 0x1400b15c6
mov edx, 6
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x38]
mov rcx, rbx
lea r8d, [rdx - 3]
call qword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x1400b158f
xor eax, eax
add rsp, 0x40
pop rbx
ret

Function at 0x1400b15d0
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rdx + 0x110], 0xffffffffffffffff
mov esi, r9d
mov rdi, r8
mov dword [rsp + 0x38], 1
mov rbx, rdx
mov rbp, rcx
je 0x1400b160c
mov eax, 0xfffff00e
jmp 0x1400b16e5
lea r8, [rsp + 0x38]
mov edx, 0x8004667e
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
jne 0x1400b162f
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
jmp 0x1400b16e5
xor r8d, r8d
mov rcx, rdi
lea edx, [r8 + 1]
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
jne 0x1400b164e
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1400b16e5
mov rdx, qword [rbp + 0x38]
xor r9d, r9d
mov r8, rdi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
test rax, rax
jne 0x1400b1673
cmp dword [rsp + 0x50], eax
je 0x1400b1643
or dword [rbx + 0x58], 0x80000
mov ecx, dword [0x140732060]
cmp esi, 0x17
mov eax, dword [rbx + 0x58]
cmove ecx, dword [0x14073205c]
bt eax, 0x13
jb 0x1400b16a9
test ecx, ecx
jne 0x1400b16a9
mov dl, 3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFileCompletionNotificationModes]
test eax, eax
je 0x1400b1643
or dword [rbx + 0x58], 0x20000
mov eax, dword [rbx + 0x58]
bt eax, 0x18
jae 0x1400b16bb
mov rdx, rdi
call fcn.1400b1500
test eax, eax
jne 0x1400b16e5
test dword [rbx + 0x58], 0x2000000
je 0x1400b16d0
mov rdx, rdi
call fcn.1400b1550
test eax, eax
jne 0x1400b16e5
mov qword [rbx + 0x110], rdi
cmp esi, 0x17
jne 0x1400b16e3
or dword [rbx + 0x58], 0x400000
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x1400b1970
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov dword [rsp + 0x20], r9d
push rsi
push rdi
push r14
sub rsp, 0x30
cmp qword [rcx + 0x110], 0xffffffffffffffff
mov r14d, r8d
mov rdi, rdx
mov rbx, rcx
jne 0x1400b19ec
movzx ecx, word [rdx]
xor r8d, r8d
lea edx, [r8 + 1]
call qword [sym.imp.WS2_32.dll_socket]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x1400b19be
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
jmp 0x1400b1a51
movzx r9d, word [rdi]
mov r8, rsi
mov rcx, qword [rbx + 8]
mov rdx, rbx
mov dword [rsp + 0x20], 0
call fcn.1400b15d0
mov ebp, eax
test eax, eax
je 0x1400b19ec
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_closesocket]
mov eax, ebp
jmp 0x1400b1a51
cmp word [rdi], 0x17
jne 0x1400b1a1d
mov rcx, qword [rbx + 0x110]
lea r9, [rsp + 0x68]
mov edx, 0x29
mov dword [rsp + 0x68], 0
mov dword [rsp + 0x20], 4
lea r8d, [rdx - 0xe]
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rcx, qword [rbx + 0x110]
mov r8d, r14d
mov rdx, rdi
call qword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x1400b1a48
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2740
jne 0x1400b1a51
mov dword [rbx + 0x118], eax
or dword [rbx + 0x58], 0x2000
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x1400b1db0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
xor eax, eax
lea rbx, [rdx + 0x80]
mov qword [rbx + 0x40], rax
lea r14, [rbx + 0x40]
mov qword [r14 + 8], rax
xor ebp, ebp
mov qword [r14 + 0x10], rax
mov rdi, rdx
mov qword [r14 + 0x18], rax
mov rsi, rcx
or dword [rdx + 0x58], 0x40000
lea rax, [0x140428837]
mov qword [rsp + 0x48], rax
xor eax, eax
mov qword [r14], rax
mov qword [r14 + 8], rax
mov qword [r14 + 0x10], rax
mov qword [r14 + 0x18], rax
test dword [rdx + 0x58], 0x80000
mov dword [rsp + 0x40], ebp
je 0x1400b1e24
mov rax, qword [rbx + 0x70]
or rax, 1
mov qword [rbx + 0x58], rax
mov rcx, qword [rdi + 0x110]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x30], rbp
lea r9, [rsp + 0x78]
mov qword [rsp + 0x28], r14
lea rdx, [rsp + 0x40]
mov r8d, 1
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x70], ebp
call qword [sym.imp.WS2_32.dll_WSARecv]
test eax, eax
jne 0x1400b1eaf
mov eax, dword [rdi + 0x58]
bt eax, 0x11
jae 0x1400b1f17
bts eax, 0x10
mov dword [rdi + 0x58], eax
mov eax, dword [rsp + 0x78]
mov qword [rbx + 0x48], rax
inc dword [rdi + 0x78]
mov qword [rbx + 0x68], rbp
mov rax, qword [rsi + 0x48]
test rax, rax
je 0x1400b1ea2
mov rax, qword [rax + 0x68]
mov qword [rbx + 0x68], rax
mov rax, qword [rsi + 0x48]
mov qword [rax + 0x68], rbx
mov qword [rsi + 0x48], rbx
jmp 0x1400b1f8d
mov qword [rbx + 0x68], rbx
mov qword [rsi + 0x48], rbx
jmp 0x1400b1f8d
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x1400b1f17
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
jg 0x1400b1ece
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
jmp 0x1400b1edc
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
movzx eax, ax
or eax, 0x80070000
cdqe
mov qword [r14], rax
mov qword [rbx + 0x68], rbp
mov rax, qword [rsi + 0x48]
test rax, rax
je 0x1400b1f0a
mov rax, qword [rax + 0x68]
mov qword [rbx + 0x68], rax
mov rax, qword [rsi + 0x48]
mov qword [rax + 0x68], rbx
mov qword [rsi + 0x48], rbx
inc dword [rdi + 0x78]
jmp 0x1400b1f8d
mov qword [rbx + 0x68], rbx
mov qword [rsi + 0x48], rbx
inc dword [rdi + 0x78]
jmp 0x1400b1f8d
or dword [rdi + 0x58], 0x10000
inc dword [rdi + 0x78]
test dword [rdi + 0x58], 0x80000
je 0x1400b1f8d
cmp qword [rbx + 0x78], 0xffffffffffffffff
lea rcx, [rbx + 0x78]
jne 0x1400b1f8d
mov rdx, qword [rbx + 0x70]
lea r8, [0x1400b1a70]
mov dword [rsp + 0x28], 4
mov r9, rbx
mov dword [rsp + 0x20], 0xffffffff
call qword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
test eax, eax
jne 0x1400b1f8d
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x1400b1f6f
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1400b1f7d
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx eax, ax
or eax, 0x80070000
cdqe
mov rdx, rbx
mov rcx, rsi
mov qword [r14], rax
call fcn.1400b14d0
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x1400b2c80
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rsi, rcx
mov rdi, r8
mov rcx, qword [r8 + 0x70]
mov rbx, rdx
cmp rcx, 0xffffffffffffffff
jne 0x1400b2cff
mov eax, dword [rdx + 0x58]
test al, 0x40
je 0x1400b2d77
mov edx, eax
and edx, 0xffffffbf
sub dword [rbx + 0x7c], 1
mov dword [rbx + 0x58], edx
jne 0x1400b2cd5
test dl, 1
jne 0x1400b2cd5
test al, 4
je 0x1400b2cd5
and eax, 0xffffffbb
mov dword [rbx + 0x58], eax
test al, 8
je 0x1400b2cd5
mov rax, qword [rbx + 8]
dec dword [rax + 8]
mov r9, qword [rbx + 0x100]
test r9, r9
je 0x1400b2d77
mov ecx, dword [r8 + 0x40]
call fcn.1400b9aa0
mov ecx, eax
call fcn.1400b8610
mov edx, eax
mov rcx, rbx
call r9
jmp 0x1400b2d77
cmp dword [r8 + 0x40], 0
jl 0x1400b2d54
lea r9, [rdx + 0x110]
mov dword [rsp + 0x20], 8
mov edx, 0xffff
mov r8d, 0x700b
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jne 0x1400b2d54
mov rax, qword [rbx + 0x130]
mov qword [rdi + 0x1a8], rax
mov rax, qword [rbx + 0x100]
mov qword [rbx + 0x130], rdi
test rax, rax
je 0x1400b2d77
xor edx, edx
mov rcx, rbx
call rax
jmp 0x1400b2d77
mov rcx, qword [rdi + 0x70]
call qword [sym.imp.WS2_32.dll_closesocket]
mov qword [rdi + 0x70], 0xffffffffffffffff
test byte [rbx + 0x58], 0x40
je 0x1400b2d77
mov rdx, rdi
mov rcx, rbx
call fcn.1400b1b00
mov ecx, dword [rbx + 0x78]
mov eax, dword [rbx + 0x58]
dec ecx
mov dword [rbx + 0x78], ecx
test al, 1
je 0x1400b2da0
test ecx, ecx
jne 0x1400b2da0
test al, 0x20
jne 0x1400b2da0
or eax, 0x20
mov dword [rbx + 0x58], eax
mov rax, qword [rsi + 0x50]
mov qword [rbx + 0x50], rax
mov qword [rsi + 0x50], rbx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x1400b2db0
Capabilities:
Set socket configuration

Disassembly:
mov dword [rsp + 0x10], edx
push rbx
sub rsp, 0x30
mov rbx, rcx
mov rcx, qword [rcx + 0x110]
cmp rcx, 0xffffffffffffffff
je 0x1400b2dfc
mov edx, 6
mov dword [rsp + 0x48], 1
lea r9, [rsp + 0x48]
mov dword [rsp + 0x20], 4
lea r8d, [rdx - 5]
call qword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x1400b2dfc
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
jne 0x1400b2e05
or dword [rbx + 0x58], 0x1000000
xor eax, eax
add rsp, 0x30
pop rbx
ret
Function at 0x1400b38a0
Capabilities:
Create thread
Resume thread

Disassembly:
push rbx
push rsi
sub rsp, 0x38
lea rcx, str.UV_THREADPOOL_SIZE
mov dword [0x14042884c], 4
call fcn.140225768
test rax, rax
je 0x1400b38cc
mov rcx, rax
call fcn.14022812c
jmp 0x1400b38d2
mov eax, dword [0x14042884c]
test eax, eax
jne 0x1400b38dd
mov eax, 1
jmp 0x1400b38e7
mov ecx, 0x400
cmp eax, ecx
cmova eax, ecx
xor esi, esi
mov dword [0x14042884c], eax
lea rbx, [0x1406b1b10]
mov qword [0x1406b1b38], rbx
cmp eax, 4
jbe 0x1400b3935
mov ecx, eax
shl rcx, 3
test rcx, rcx
je 0x1400b3915
call qword [fcn.140220234]
jmp 0x1400b3918
mov rax, rsi
mov qword [0x1406b1b38], rax
test rax, rax
jne 0x1400b3935
mov dword [0x14042884c], 4
mov qword [0x1406b1b38], rbx
mov qword [rsp + 0x58], rbp
lea rcx, [0x1406b1ad0]
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x30], r15
call qword [sym.imp.KERNEL32.dll_InitializeConditionVariable]
lea rcx, [0x1406b1aa8]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rax, [0x1406b1b80]
xor r9d, r9d
mov qword [0x1406b1b80], rax
xor edx, edx
mov qword [0x1406b1b88], rax
xor ecx, ecx
lea rax, [0x1406b1b70]
mov r8d, 0x7fffffff
mov qword [0x1406b1b70], rax
mov qword [0x1406b1b78], rax
lea rax, [0x1406b1b40]
mov qword [0x1406b1b40], rax
mov qword [0x1406b1b48], rax
call qword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
mov qword [rsp + 0x50], rax
test rax, rax
jne 0x1400b39d4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1400b8610
test eax, eax
jne 0x1400b3ad8
mov eax, dword [0x14042884c]
mov ebp, esi
test eax, eax
je 0x1400b3aae
lea r15, [0x1400b3610]
nop dword [rax + rax]
mov rax, qword [0x1406b1b38]
mov ecx, ebp
lea rbx, [rax + rcx*8]
mov ecx, 0x18
call qword [fcn.140220234]
mov r14, rax
test rax, rax
je 0x1400b3ad8
mov qword [rax], r15
lea r8, [0x1400b81e0]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rsi
mov r9, r14
mov qword [r14 + 8], rax
xor edx, edx
mov dword [rsp + 0x20], 4
xor ecx, ecx
call fcn.140232900
test rax, rax
jne 0x1400b3a69
call fcn.140227d1c
mov edi, dword [rax]
call fcn.140227d1c
mov rcx, r14
mov ebx, dword [rax]
call qword [fcn.14021ff40]
call fcn.140227d1c
mov dword [rax], ebx
test edi, edi
jne 0x1400b3ad8
jmp 0x1400b3a79
mov qword [rbx], rax
mov rcx, rax
mov qword [r14 + 0x10], rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [0x14042884c]
inc ebp
cmp ebp, eax
jb 0x1400b39f0
test eax, eax
je 0x1400b3aae
nop dword [rax]
mov rcx, qword [rsp + 0x50]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x1400b3ad8
inc esi
cmp esi, dword [0x14042884c]
jb 0x1400b3a90
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x1400b3ad8
mov r15, qword [rsp + 0x30]
mov r14, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
add rsp, 0x38
pop rsi
pop rbx
ret
call fcn.14022fe9c
int3
Function at 0x1400b61b0
Capabilities:
Connect pipe
Create pipe

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x40
xor ebp, ebp
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
test r9d, r9d
jne 0x1400b62a5
mov rcx, qword [rdi + 0x120]
mov r9d, 0xff
mov qword [rax - 0x10], rbp
xor r8d, r8d
mov dword [rax - 0x18], ebp
mov edx, 0x40040003
mov dword [rax - 0x20], 0x10000
mov dword [rax - 0x28], 0x10000
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov qword [rbx + 0x70], rax
cmp rax, 0xffffffffffffffff
jne 0x1400b626b
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x1400b6224
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1400b6232
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx eax, ax
or eax, 0x80070000
cdqe
mov qword [rbx + 0x40], rax
mov qword [rbx + 0x68], rbp
mov rax, qword [rsi + 0x48]
test rax, rax
je 0x1400b625e
mov rax, qword [rax + 0x68]
mov qword [rbx + 0x68], rax
mov rax, qword [rsi + 0x48]
mov qword [rax + 0x68], rbx
mov qword [rsi + 0x48], rbx
jmp 0x1400b6351
mov qword [rbx + 0x68], rbx
mov qword [rsi + 0x48], rbx
jmp 0x1400b6351
mov r8, rax
mov dword [rsp + 0x20], ebp
mov rdx, rdi
mov rcx, rsi
call fcn.1400b59b0
test eax, eax
je 0x1400b62a5
mov rcx, qword [rbx + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x70], 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x1400b6224
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1400b6232
xor eax, eax
mov qword [rsp + 0x50], r14
mov qword [rbx + 0x40], rax
lea rdx, [rbx + 0x40]
mov qword [rbx + 0x48], rax
mov qword [rbx + 0x50], rax
mov qword [rbx + 0x58], rax
mov rcx, qword [rbx + 0x70]
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
jne 0x1400b634c
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x1400b634c
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x217
jne 0x1400b62ed
mov rax, rbp
jmp 0x1400b6321
mov rcx, qword [rbx + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x70], 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x1400b6311
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1400b631f
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx eax, ax
or eax, 0x80070000
cdqe
mov qword [rbx + 0x40], rax
mov qword [rbx + 0x68], rbp
mov rax, qword [rsi + 0x48]
test rax, rax
je 0x1400b6344
mov rax, qword [rax + 0x68]
mov qword [rbx + 0x68], rax
mov rax, qword [rsi + 0x48]
mov qword [rax + 0x68], rbx
jmp 0x1400b6348
mov qword [rbx + 0x68], rbx
mov qword [rsi + 0x48], rbx
mov r14, qword [rsp + 0x50]
inc dword [rdi + 0x78]
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x1400b6790
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
test dword [rdx + 0x58], 0x1000000
lea rdi, [rdx + 0x80]
mov rbx, rdx
mov rsi, rcx
je 0x1400b67db
mov qword [rdx + 0x238], 0
lea rcx, [0x1400b6550]
mov rdx, rdi
mov r8d, reloc.WS2_32.dll_recv
call qword [sym.imp.KERNEL32.dll_QueueUserWorkItem]
jmp 0x1400b6895
xor eax, eax
lea rcx, [rdi + 0x40]
mov qword [rcx], rax
mov qword [rcx + 8], rax
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], rax
test dword [rdx + 0x58], 0x80000
je 0x1400b6805
mov rax, qword [rdi + 0x70]
or rax, 1
mov qword [rdi + 0x58], rax
mov qword [rsp + 0x20], rcx
lea rdx, [0x1406b1bd9]
mov rcx, qword [rbx + 0x118]
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1400b6835
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x1400b6899
test dword [rbx + 0x58], 0x80000
je 0x1400b68f0
cmp qword [rdi + 0x70], 0
jne 0x1400b6866
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rdi + 0x70], rax
test rax, rax
je 0x1400b6929
cmp qword [rdi + 0x78], 0xffffffffffffffff
lea rcx, [rdi + 0x78]
jne 0x1400b68f0
mov rdx, qword [rdi + 0x58]
lea r8, [0x1400b1a70]
mov dword [rsp + 0x28], 4
mov r9, rdi
mov dword [rsp + 0x20], 0xffffffff
call qword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
test eax, eax
jne 0x1400b68f0
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x1400b68ab
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1400b68b9
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx eax, ax
or eax, 0x80070000
cdqe
mov qword [rdi + 0x40], rax
mov qword [rdi + 0x68], 0
mov rax, qword [rsi + 0x48]
test rax, rax
je 0x1400b68e6
mov rax, qword [rax + 0x68]
mov qword [rdi + 0x68], rax
mov rax, qword [rsi + 0x48]
mov qword [rax + 0x68], rdi
mov qword [rsi + 0x48], rdi
jmp 0x1400b690f
mov qword [rdi + 0x68], rdi
mov qword [rsi + 0x48], rdi
jmp 0x1400b690f
mov rcx, qword [rbx + 0x128]
test rcx, rcx
je 0x1400b690f
xor r9d, r9d
lea rdx, [0x1400b79b0]
lea r8d, [r9 + 0x32]
call fcn.1400b32e0
or dword [rbx + 0x58], 0x10000
inc dword [rbx + 0x78]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
lea rdx, str.CreateEvent
call fcn.1400b8560
int3
Function at 0x1400b7100
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov rbx, rdx
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov rcx, rbx
movaps xmm0, xmmword [rsp + 0x30]
mov edi, r9d
mov edx, r8d
lea r8, [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
call qword [rbx + 0x68]
mov rdx, qword [rsp + 0x38]
test rdx, rdx
je 0x1400b71bf
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x1400b71bf
mov rcx, qword [rbx + 0x118]
lea r9, [rsp + 0x70]
cmp edi, eax
mov qword [rsp + 0x20], 0
cmova edi, eax
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1400b71a1
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r9, [rsp + 0x40]
mov rdx, rbx
mov r8d, eax
call fcn.1400b7060
xor eax, eax
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
mov edx, dword [rsp + 0x70]
lea r8, [rsp + 0x30]
mov rcx, rbx
call qword [rbx + reloc.WS2_32.dll_WSASetLastError]
mov eax, dword [rsp + 0x70]
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
lea r8, [rsp + 0x30]
mov rdx, 0xfffffffffffff024
mov rcx, rbx
call qword [rbx + reloc.WS2_32.dll_WSASetLastError]
mov rbx, qword [rsp + 0x60]
xor eax, eax
add rsp, 0x50
pop rdi
ret
Function at 0x1400b97f0
Capabilities:
Initialize winsock library

Disassembly:
push rbx
sub rsp, 0x470
mov rax, qword [0x1403df5c8]
xor rax, rsp
mov qword [rsp + 0x460], rax
xor eax, eax
mov ebx, 2
mov qword [0x140732020], rax
xor ecx, ecx
mov word [0x140732020], bx
mov qword [0x140732028], rax
call qword [sym.imp.WS2_32.dll_htons]
lea rdx, [0x140732024]
mov word [0x140732022], ax
lea rcx, str.0.0.0.0
call fcn.1400b9090
test eax, eax
jne 0x1400b9a90
lea r8, [0x140732040]
xor edx, edx
lea rcx, [0x14039c440]
call fcn.1400aaa00
test eax, eax
jne 0x1400b9a90
lea ecx, [rbx + 0x41]
call qword [sym.imp.USER32.dll_GetSystemMetrics]
cmp eax, 1
je 0x1400b99ea
mov ecx, 0x202
lea rdx, [rsp + 0x2c0]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x1400b9a03
mov qword [rsp + 0x480], rdi
xor r8d, r8d
mov edi, 1
mov ecx, ebx
mov edx, edi
call qword [sym.imp.WS2_32.dll_socket]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400b991d
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], 0x274
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov edx, 0xffff
mov r8d, 0x2005
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_getsockopt]
cmp eax, 0xffffffff
je 0x1400b9a12
mov eax, dword [0x140732060]
mov rcx, rbx
test dword [rsp + 0x40], 0x20000
cmove eax, edi
mov dword [0x140732060], eax
call qword [sym.imp.WS2_32.dll_closesocket]
cmp eax, 0xffffffff
je 0x1400b9a27
jmp 0x1400b9944
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x273d
je 0x1400b9a7b
cmp eax, 0x273a
jbe 0x1400b9a7b
cmp eax, 0x2740
jae 0x1400b9a7b
xor r8d, r8d
mov edx, edi
lea ecx, [r8 + 0x17]
call qword [sym.imp.WS2_32.dll_socket]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400b99bb
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], 0x274
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov edx, 0xffff
mov r8d, 0x2005
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_getsockopt]
cmp eax, 0xffffffff
je 0x1400b9a3c
mov eax, dword [0x14073205c]
mov rcx, rbx
test dword [rsp + 0x40], 0x20000
cmove eax, edi
mov dword [0x14073205c], eax
call qword [sym.imp.WS2_32.dll_closesocket]
cmp eax, 0xffffffff
je 0x1400b9a51
jmp 0x1400b99e2
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x273d
je 0x1400b9a66
cmp eax, 0x273a
jbe 0x1400b9a66
cmp eax, 0x2740
jae 0x1400b9a66
mov rdi, qword [rsp + 0x480]
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.1401fe5e0
add rsp, 0x470
pop rbx
ret
lea rdx, str.WSAStartup
mov ecx, eax
call fcn.1400b8560
int3
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
lea rdx, str.getsockopt
call fcn.1400b8560
int3
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
lea rdx, str.closesocket
call fcn.1400b8560
int3
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
lea rdx, str.getsockopt
call fcn.1400b8560
int3
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
lea rdx, str.closesocket
call fcn.1400b8560
int3
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
lea rdx, str.socket
call fcn.1400b8560
int3
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
lea rdx, str.socket
call fcn.1400b8560
int3
call fcn.14022fe9c
int3
Function at 0x1400ec800
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
mov eax, 0x20
call fcn.1401ff2b0
sub rsp, rax
mov rax, qword [rcx + 8]
lea rsi, [r9 + 1]
mov rbx, rdx
mov rdx, qword [rdx + 8]
mov r9, qword [rax + 0xc0]
test byte [r9 + 0x60], 1
je 0x1400ec889
lea rax, [rsi + r8]
cmp rax, rdx
ja 0x1400ec88e
add qword [rbx + 0x20], r8
sub rdx, r8
add qword [rbx + 0x28], r8
sub qword [rbx + 0x10], r8
mov qword [rbx + 8], rdx
mov rax, qword [rbx + 0x20]
mov rcx, qword [rcx + 0x430]
mov qword [rsp + 0x40], rdi
movzx edi, byte [rax + rdx - 1]
call fcn.140006190
mov rcx, rax
call fcn.14010ddb0
mov r8, qword [rbx + 8]
and eax, 0x200000
je 0x1400ec89b
sub r8, rdi
mov eax, 1
dec r8
jmp 0x1400ec956
cmp rsi, rdx
jbe 0x1400ec84c
xor eax, eax
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret
lea rcx, [rdi + rsi]
mov qword [rsp + 0x38], rbp
mov ebp, 0x100
mov r9, r8
sub r9, rcx
mov rax, r8
xor r9, rcx
xor rax, rcx
or r9, rax
xor r9, r8
shr r9, 0x3f
dec r9
cmp r8, rbp
cmovb rbp, r8
xor r10d, r10d
test rbp, rbp
je 0x1400ec92d
mov r11, qword [rbx + 0x20]
mov rsi, rdi
shr rsi, 0x3f
dec r11
add r11, r8
nop word [rax + rax]
mov rax, r10
lea r11, [r11 - 1]
shr rax, 0x3f
mov rcx, rdi
sub rcx, r10
inc r10
shr rcx, 0x3f
xor cl, al
xor al, sil
or cl, al
movzx eax, byte [r11 + 1]
dec cl
movzx edx, cl
mov rcx, rdi
xor rcx, rax
and rdx, rcx
not rdx
and r9, rdx
cmp r10, rbp
jb 0x1400ec8f0
mov rbp, qword [rsp + 0x38]
lea rax, [rdi + 1]
not r9
movzx ecx, r9b
dec rcx
shr rcx, 0x3f
neg rcx
and rax, rcx
sub r8, rax
mov eax, ecx
and eax, 1
not ecx
or eax, ecx
mov rdi, qword [rsp + 0x40]
mov qword [rbx + 8], r8
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret
Function at 0x1400fe2f0
Capabilities:
Set thread local storage value

Disassembly:
mov eax, 0x28
call fcn.1401ff2b0
sub rsp, rax
mov ecx, dword [rcx]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
add rsp, 0x28
ret
Function at 0x1401157b0
Capabilities:
Get thread local storage value

Disassembly:
mov eax, 0x28
call fcn.1401ff2b0
sub rsp, rax
lea rcx, [0x140420568]
add rsp, 0x28
jmp fcn.1400fe150

Function at 0x140124070
Capabilities:
Encode data using xor

Disassembly:
xor r9b, r9b
mov r10, rdx
test r8, r8
je 0x140124097
sub r10, rcx
nop
movzx edx, byte [r10 + rcx]
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
xor dl, al
or r9b, dl
sub r8, 1
jne 0x140124080
movzx eax, r9b
ret