joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003ce9c
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x14003ceb2
mov al, 1
jmp 0x14003cf12
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x14003cec3
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x14003cf10
mov ecx, dword [rcx + 0x18]
nop
call fcn.14003c99c
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14003cf10
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14003cf10
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14003cf10
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x14003cf12
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x140040a08
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.140034ddc
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x140040a92
cmp byte [rbp - 0x21], r15b
je 0x140040a8d
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x140040ac8
call fcn.1400382f8
test eax, eax
jne 0x140040ab4
cmp byte [rbp - 0x21], r15b
je 0x140040aac
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x140040ac8
cmp byte [rbp - 0x21], r15b
je 0x140040ac5
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.14003bf18
test eax, eax
jne 0x140040b68
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.140034ddc
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x140040b07
cmp byte [rbp - 0x21], r15b
je 0x140040b3c
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x140040b3c
call fcn.1400382f8
test eax, eax
jne 0x140040b28
cmp byte [rbp - 0x21], r15b
je 0x140040b21
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x140040b3c
cmp byte [rbp - 0x21], r15b
je 0x140040b39
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.14003bf18
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x140040b68
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x140040b6b
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x140040b79
mov rcx, rdi
call fcn.140037518
cmp byte [rbp + 0x3f], r15b
je 0x140040b88
mov rcx, qword [rbp + 0x27]
call fcn.140037518
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x140004210
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push rdi
push r15
sub rsp, 0x78
mov rax, qword [0x1400cb008]
xor rax, rsp
mov qword [rsp + 0x68], rax
xorps xmm1, xmm1
mov rsi, rdx
xorps xmm0, xmm0
lea rdx, [rsp + 0x38]
movups xmmword [rcx], xmm0
xor eax, eax
mov rbx, rcx
mov qword [rcx + 0x10], rax
mov rdi, r8
mov rcx, rsi
movups xmmword [rsp + 0x38], xmm1
movups xmmword [rsp + 0x48], xmm1
movups xmmword [rsp + 0x58], xmm1
call fcn.140055ea0
test eax, eax
js 0x140004403
lfence
lea rdx, [0x1400983bc]
mov rcx, rsi
call fcn.140055c70
mov r15, rax
test rax, rax
je 0x140004403
mov qword [rsp + 0x70], r14
movsxd r14, dword [rsp + 0x4c]
lea rsi, [r14 + 1]
mov rcx, rsi
cmp rsi, 0xf4240
jae 0x140004408
mov qword [rsp + 0xa0], rbp
xor ebp, ebp
mov dword [rsp + 0x20], esi
mov qword [rsp + 0x24], rbp
test rdi, rdi
je 0x140004373
add rcx, 8
mov rax, 0xffffffffffffffff
cmovb rcx, rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdx, rax
test rax, rax
je 0x14000440e
mov rcx, qword [rdi]
add rax, 8
mov qword [rdx], rcx
mov qword [rdi], rdx
lfence
mov qword [rsp + 0x30], rax
test rsi, rsi
je 0x1400042fb
mov byte [rax], bpl
movups xmm0, xmmword [rsp + 0x20]
movsd xmm1, qword [rsp + 0x30]
movups xmmword [rbx], xmm0
movsd qword [rbx + 0x10], xmm1
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x140004323
cmp dword [rbx + 8], ebp
jl 0x140004323
movsxd rbp, dword [rbx + 4]
add rbp, rax
mov r9, r15
mov r8, r14
mov edx, 1
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rdx, rax
test rax, rax
jns 0x14000439e
test rdi, rdi
je 0x140004390
mov rcx, qword [rdi]
test rcx, rcx
je 0x140004390
mov rdx, qword [rbx + 0x10]
lea rax, [rcx + 8]
cmp rax, rdx
mov rax, qword [rcx]
je 0x140004387
mov rdi, rcx
mov rcx, rax
test rax, rax
jne 0x140004350
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
jmp 0x1400043d0
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
test rax, rax
je 0x14000440e
jmp 0x1400042eb
mov qword [rdi], rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
jmp 0x1400043d0
cmp qword [rbx + 0x10], 0
je 0x140004414
mov ecx, dword [rbx + 8]
test ecx, ecx
js 0x140004414
add eax, 0xf4240
cmp eax, 0x1e847f
ja 0x140004414
add edx, ecx
js 0x140004414
mov ecx, dword [rbx + 4]
add ecx, edx
cmp ecx, dword [rbx]
jg 0x140004414
mov rcx, rbx
mov dword [rbx + 8], edx
call fcn.140003710
lfence
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rbp, qword [rsp + 0xa0]
mov rax, rbx
mov r14, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14008aca0
add rsp, 0x78
pop r15
pop rdi
pop rsi
pop rbx
ret
mov rax, rbx
jmp 0x1400043ec
call fcn.140002fa0
int3
call fcn.14000ede0
int3
lea r8, str.buf_inc_len_ret__read_size_
mov edx, 0x57a
lea rcx, str.C:Users_vagrant_buildbotwindows_server_2019_static_msbuildopenvpn_srcopenvpn_buffer.c
call fcn.14000ed60
int3
Function at 0x14000ede0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.OpenVPN:_Out_of_Memory_n
call fcn.14000e720
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3

Function at 0x14000f470
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [0x1400cb9c4], 0
mov ebx, ecx
jne 0x14000f495
call fcn.14001bdc0
call fcn.140085ce0
call fcn.140020a70
call fcn.140057650
mov ecx, ebx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3

Function at 0x1400102c0
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1400cb008]
xor rax, rsp
mov qword [rsp + 0x28], rax
movsxd rcx, ecx
lea r8, [rsp + 0x20]
mov edx, 0x8004667e
mov dword [rsp + 0x20], 1
call qword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
je 0x14001031d
mov ecx, 0x110
call fcn.14000ec70
test al, al
je 0x140010311
lea rdx, str.Set_socket_to_non_blocking_mode_failed
mov ecx, 0x110
call fcn.14000e820
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__exit]
int3
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14008aca0
add rsp, 0x38
ret
Function at 0x140015800
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov ebx, dword [rcx + 0xd28]
mov rdi, rcx
test bl, 0xc0
je 0x14001582d
mov rcx, qword [0x1400d3e98]
test rcx, rcx
je 0x14001599b
call fcn.140027060
test bl, 2
je 0x140015844
mov rcx, rdi
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.140014450
test bl, 8
je 0x14001585b
mov rcx, rdi
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.140014c30
test bl, 1
je 0x1400158c3
mov rcx, rdi
call fcn.1400127a0
mov rax, qword [rdi + 0xa78]
mov ecx, dword [rax]
test ecx, ecx
jne 0x140015990
mov qword [rsp + 0x30], rsi
mov rsi, qword [rdi + 0xd40]
test rsi, rsi
jne 0x140015891
mov rsi, qword [rdi + 0xd30]
mov rbx, qword [rdi + 0x1028]
xor r8d, r8d
mov rdx, rsi
mov rcx, rdi
call fcn.140012bb0
mov r8, rbx
mov rdx, rsi
mov rcx, rdi
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.1400131c0
test bl, 4
je 0x140015990
mov rcx, rdi
call fcn.140013500
mov rax, qword [rdi + 0xa78]
mov ecx, dword [rax]
test ecx, ecx
jne 0x140015990
movsxd rcx, dword [rdi + 0x1020]
test ecx, ecx
jle 0x1400158f7
add qword [rdi + 0xe38], rcx
cmp byte [rdi + 0x1060], 0
mov eax, ecx
je 0x140015926
test ecx, ecx
jle 0x140015926
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, [0x1400983bc]
call fcn.14000e720
mov eax, dword [rdi + 0x1020]
test eax, eax
jle 0x14001595c
cmp dword [rdi + 0x20], 0
jne 0x140015948
cmp byte [rdi + 0xa48], 0
jne 0x140015948
lea rdx, [rdi + 0x1018]
mov rcx, rdi
call fcn.140013890
lea r8, [rdi + 0x1018]
mov edx, getservbyname
mov rcx, rdi
call fcn.1400140b0
cmp dword [rdi + 0x1020], 0
jle 0x140015979
mov dl, 1
mov rcx, rdi
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.140011a40
xor eax, eax
mov qword [rdi + 0x1048], rax
mov dword [rdi + 0x1050], eax
mov qword [rdi + 0x1058], rax
nop
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
lea r8, str.management
mov edx, 0x832
lea rcx, str.C:Users_vagrant_buildbotwindows_server_2019_static_msbuildopenvpn_srcopenvpn_forward.c
call fcn.14000ed60
int3
Function at 0x14001c7f0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x1400cb008]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, rcx
mov edi, edx
mov rcx, qword [rcx + 0x648]
test rcx, rcx
je 0x14001c81f
call fcn.14000ab70
test dil, 1
je 0x14001c910
mov rdi, qword [rbx + 0x760]
test rdi, rdi
je 0x14001c910
cmp dword [rbx + 0xc40], 0
jge 0x14001c910
mov edx, 0x8102
mov r8d, 0x180
mov rcx, rdi
call fcn.140055db0
mov dword [rbx + 0xc40], eax
cmp eax, 0xffffffff
jne 0x14001c88f
cmp dword [0x1400d3ed4], 1
jb 0x14001c910
mov ecx, 0xc000121
call fcn.14000ec70
test al, al
je 0x14001c910
mov r8, rdi
lea rdx, str.Cannot_open___replay_persist_file__s_for_read_write
jmp 0x14001c902
mov r8d, reloc.WS2_32.dll_recv
mov qword [rbx + 0xc38], rdi
lea rdx, [rsp + 0x20]
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__read]
movsxd rcx, eax
cmp rcx, 0x10
jne 0x14001c8d7
mov rax, qword [rsp + 0x20]
mov qword [rbx + 0xc58], rax
mov qword [rbx + 0xc48], rax
mov eax, dword [rsp + 0x28]
mov dword [rbx + 0xc60], eax
mov dword [rbx + 0xc50], eax
jmp 0x14001c910
cmp rcx, 0xffffffffffffffff
jne 0x14001c910
cmp dword [0x1400d3ed4], 1
jb 0x14001c910
mov ecx, 0xc000121
call fcn.14000ec70
test al, al
je 0x14001c910
mov r8, qword [rbx + 0xc38]
lea rdx, str.Read_error_on___replay_persist_file__s
mov ecx, 0xc000121
call fcn.14000e820
nop dword [rax]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14008aca0
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret

Function at 0x140020a70
Capabilities:
Delete file

Disassembly:
mov rcx, qword [0x1400cb9e8]
test rcx, rcx
jne fcn.140055b90
ret
Function at 0x140024c50
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov r11, rsp
push rbx
push rdi
push r15
sub rsp, 0x70
mov rax, qword [0x1400cb008]
xor rax, rsp
mov qword [rsp + 0x68], rax
xor r15d, r15d
mov rdi, rcx
mov ebx, r15d
cmp qword [rcx + 0x2100], r15
je 0x140024e40
mov rcx, qword [rcx + 0x2128]
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], r14
cmp rcx, 0xffffffffffffffff
je 0x140024db3
xorps xmm0, xmm0
mov dword [rsp + 0x50], reloc.WS2_32.dll_recv
lea r8, [r11 - 0x38]
lea rdx, [r11 - 0x30]
movups xmmword [rsp + 0x58], xmm0
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x140024db3
cmp dword [rsp + 0x50], 0x10
jne 0x140024db3
mov ecx, dword [rsp + 0x5c]
call qword [sym.imp.WS2_32.dll_ntohl]
movzx ecx, word [rsp + 0x5a]
mov r14d, eax
call qword [sym.imp.WS2_32.dll_ntohs]
mov rcx, qword [rdi + 0x2100]
lea rdx, [0x14009ce24]
movzx ebp, ax
call fcn.140055c70
mov rsi, rax
test rax, rax
je 0x140024db3
lea ecx, [r15 + 0x48]
mov qword [rsp + 0x20], 0x40
mov dword [rsp + 0x28], r15d
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
test rax, rax
je 0x140024e56
movups xmm0, xmmword [rsp + 0x20]
add rax, 8
mov qword [rbx], r15
mov qword [rsp + 0x30], rax
mov ecx, r14d
movsd xmm1, qword [rsp + 0x30]
movsd qword [rsp + 0x48], xmm1
mov byte [rax], r15b
movups xmmword [rsp + 0x38], xmm0
call qword [sym.imp.WS2_32.dll_htonl]
mov ecx, eax
call qword [sym.imp.WS2_32.dll_inet_ntoa]
mov r8, rax
lea rdx, [0x14008d6e8]
lea rcx, [rsp + 0x38]
call fcn.140003080
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x140024d91
cmp dword [rsp + 0x40], r15d
jl 0x140024d91
movsxd r8, dword [rsp + 0x3c]
add r8, rax
jmp 0x140024d94
mov r8, r15
mov r9d, ebp
lea rdx, str._s_n_d_n
mov rcx, rsi
call fcn.14000e720
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test eax, eax
je 0x140024e10
cmp dword [0x1400d3ed4], 3
jb 0x140024de2
mov ecx, 0x28000003
call fcn.14000ec70
test al, al
je 0x140024de2
mov r8, qword [rdi + 0x2100]
lea rdx, str.MANAGEMENT:_failed_to_write_peer_info_to_file__s
mov ecx, 0x28000003
call fcn.14000e820
mov dword [0x1400d3e80], 0xf
lea rax, str.management_connect_failed
mov qword [0x1400d3e88], rax
mov dword [0x1400d3e84], r15d
test rbx, rbx
je 0x140024e24
nop word [rax + rax]
mov rdi, qword [rbx]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rbx, rdi
test rdi, rdi
jne 0x140024e10
mov rsi, qword [rsp + 0xa0]
mov rbp, qword [rsp + 0x98]
mov r14, qword [rsp + 0xa8]
nop dword [rax]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14008aca0
add rsp, 0x70
pop r15
pop rdi
pop rbx
ret
call fcn.14000ede0
int3
Function at 0x140025b50
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
lea r8, [0x14008d9d9]
mov rcx, qword [rcx + 0x2180]
mov edi, 0x400
mov edx, edi
xor ebp, ebp
call fcn.140003fc0
mov rax, qword [rbx + 0x2180]
test rax, rax
je 0x140025ce3
mov rax, qword [rax]
test rax, rax
je 0x140025ce3
mov rcx, qword [rax + 0x10]
test rcx, rcx
je 0x140025ce3
mov r8d, dword [rax + 8]
cmp r8d, 1
jl 0x140025ce3
movsxd rdx, dword [rax + 4]
cmp r8d, edi
cmovg r8d, edi
add rdx, rcx
mov rcx, qword [rbx + 0x2128]
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_send]
mov ebp, eax
test eax, eax
js 0x140025c78
mov rdi, qword [rbx + 0x2180]
mov rcx, qword [rdi]
test rcx, rcx
je 0x140025ce3
cmp qword [rcx + 0x10], 0
je 0x140025d2c
mov edx, dword [rcx + 8]
test edx, edx
js 0x140025d2c
cmp edx, eax
jl 0x140025d2c
add dword [rcx + 4], eax
sub edx, eax
mov dword [rcx + 8], edx
js 0x140025c25
test edx, edx
jne 0x140025ce3
mov rsi, qword [rdi]
test rsi, rsi
je 0x140025ce3
mov rcx, qword [rsi + 0x10]
mov qword [rsp + 0x30], r14
mov r14, qword [rsi + 0x18]
test rcx, rcx
je 0x140025c49
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], rax
mov rcx, qword [rdi]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
dec dword [rdi + 0x10]
test r14, r14
mov qword [rdi], r14
mov r14, qword [rsp + 0x30]
jne 0x140025ce3
mov qword [rdi + 8], 0
jmp 0x140025ce3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test eax, eax
jne 0x140025c91
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov edi, dword [rax]
cmp edi, 0xb
jmp 0x140025c9d
cmp eax, 0x2733
je 0x140025ce3
cmp eax, 0x2726
je 0x140025ce3
cmp dword [0x1400d3ed4], 3
jb 0x140025cd9
mov ecx, 0x28000003
call fcn.14000ec70
test al, al
je 0x140025cd9
mov ecx, edi
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_strerror]
lea r8, str.send
mov ecx, 0x28000003
mov r9, rax
lea rdx, str.MANAGEMENT:_TCP__s_error:__s
call fcn.14000e820
xor edx, edx
mov rcx, rbx
call fcn.1400251f0
cmp qword [rbx + 0x2128], 0xffffffffffffffff
je 0x140025d15
mov rax, qword [rbx + 0x2180]
test rax, rax
je 0x140025d0b
cmp qword [rax], 0
je 0x140025d0b
mov dword [rbx + 0x2118], 3
jmp 0x140025d15
mov dword [rbx + 0x2118], 2
mov rbx, qword [rsp + 0x38]
mov eax, ebp
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
lea r8, str.buf_advance_buf__n_
mov edx, 0x542
lea rcx, str.C:Users_vagrant_buildbotwindows_server_2019_static_msbuildopenvpn_srcopenvpn_buffer.c
call fcn.14000ed60
int3
Function at 0x1400371c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rdx + 0xc28]
mov rbx, rdx
mov rdi, rcx
mov r8d, dword [rax]
cmp r8d, 0xa
jne 0x1400371f8
mov edx, dword [rdx + 0x520]
test edx, edx
je 0x1400371f8
mov rax, qword [rbx + 0xc28]
mov dword [rax], edx
mov rcx, qword [rbx + 0xc28]
lea rax, [rbx + 0x74]
xor esi, esi
lea rdx, str.client_instance
cmp byte [rax], sil
mov r8d, 0x26000003
cmove rax, rsi
mov qword [0x1400d3ec0], rax
call fcn.140062530
xor r8d, r8d
mov qword [0x1400d3ec0], rsi
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.14002fe20
Function at 0x140055b90
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r15
sub rsp, 0x30
mov rsi, rcx
mov dword [rsp + 0x28], 0
mov r8, rcx
mov qword [rsp + 0x20], 0
mov r15, 0xffffffffffffffff
xor edx, edx
mov r9d, r15d
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rbp, eax
mov rcx, rbp
add rcx, rcx
add rcx, 8
cmovb rcx, r15
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
test rax, rax
je 0x140055c64
mov qword [rsp + 0x40], rdi
mov r9d, r15d
lea rdi, [rax + 8]
mov dword [rsp + 0x28], ebp
mov r8, rsi
mov qword [rsp + 0x20], rdi
xor edx, edx
mov qword [rax], 0
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, eax
nop dword [rax]
mov rdi, qword [rbx]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rbx, rdi
test rdi, rdi
jne 0x140055c30
mov rdi, qword [rsp + 0x40]
test esi, esi
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
setne al
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop r15
ret
call fcn.14000ede0
int3
Function at 0x1400591e0
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
push r14
push r15
sub rsp, 0x50
mov rdi, 0xffffffffffffffff
mov r14, rdx
mov rbx, rdi
mov r15, rcx
nop
inc rbx
cmp byte [rdx + rbx], 0
jne 0x140059200
add rbx, 3
cmp rbx, 0xf4240
jae 0x14005939d
mov qword [rsp + 0x70], rbp
mov rdx, rbx
xor ebp, ebp
mov dword [rsp + 0x20], ebx
mov qword [rsp + 0x24], rbp
lea ecx, [rbp + 1]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov qword [rsp + 0x30], rax
mov rdx, rax
test rax, rax
je 0x1400593a6
movups xmm0, xmmword [rsp + 0x20]
mov qword [rsp + 0x78], rsi
mov rsi, rdi
movsd xmm1, qword [rsp + 0x30]
movups xmmword [rsp + 0x38], xmm0
movsd qword [rsp + 0x48], xmm1
inc rsi
cmp byte [r14 + rsi], bpl
jne 0x140059265
cmp esi, 0xf4240
jae 0x140059384
mov rcx, qword [rsp + 0x20]
shr rcx, 0x20
lea eax, [rcx + rsi]
cmp eax, ebx
jg 0x140059384
movsxd rcx, ecx
add rcx, rdx
je 0x140059384
movsxd rbx, esi
mov rdx, r14
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
test esi, esi
js 0x1400593ac
movsxd rcx, dword [rsp + 0x3c]
lea eax, [rcx + 3]
add eax, esi
cmp eax, dword [rsp + 0x38]
jg 0x1400593ac
mov r14, qword [rsp + 0x48]
lea r8d, [rsi + 3]
lea rdx, [r14 + rcx]
lea rcx, [rbx + rdx]
test rcx, rcx
je 0x1400593ac
movzx eax, word [0x14009835c]
test r8d, r8d
mov word [rcx], ax
mov r8, rdi
movzx eax, byte [0x14009835e]
cmovns rbp, rdx
mov byte [rcx + 2], al
nop dword [rax]
inc r8
cmp byte [r8 + rbp], 0
jne 0x140059300
xor r9d, r9d
mov rdx, rbp
mov rcx, r15
call qword [sym.imp.WS2_32.dll_send]
movsxd rcx, eax
nop dword [rax]
inc rdi
cmp byte [rdi + rbp], 0
jne 0x140059320
cmp rcx, rdi
je 0x14005935a
cmp dword [0x1400d3ed4], 1
jb 0x140059356
mov ecx, 0x1000121
call fcn.14000ec70
test al, al
je 0x140059356
lea rdx, str.send_line:_TCP_port_write_failed_on_send__
mov ecx, 0x1000121
call fcn.14000e820
xor bl, bl
jmp 0x14005935c
mov bl, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rsi, qword [rsp + 0x78]
movzx eax, bl
mov rbx, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x70]
add rsp, 0x50
pop r15
pop r14
pop rdi
ret
lea r8, str.buf_write_buf__src__strlen_src__
mov edx, 0xd7
lea rcx, str.C:Users_vagrant_buildbotwindows_server_2019_static_msbuildopenvpn_srcopenvpnproxy.c
call fcn.14000ed60
int3
mov rcx, rbx
call fcn.140002fa0
int3
call fcn.14000ede0
int3
lea r8, str.buf_write_buf____r_n___3_
mov edx, 0xd8
lea rcx, str.C:Users_vagrant_buildbotwindows_server_2019_static_msbuildopenvpn_srcopenvpnproxy.c
call fcn.14000ed60
int3
Function at 0x140060690
Capabilities:
Get routing table

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov rax, qword [0x1400cb008]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rdi, rcx
mov dword [rsp + 0x20], 0
xor ebx, ebx
lea rdx, [rsp + 0x20]
xor ecx, ecx
lea r8d, [rbx + 1]
call qword [sym.imp.IPHLPAPI.DLL_GetIpForwardTable]
cmp eax, 0x7a
jne 0x140060766
mov ecx, dword [rsp + 0x20]
test rdi, rdi
je 0x140060781
add rcx, 8
mov rax, 0xffffffffffffffff
cmovb rcx, rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
test rax, rax
je 0x140060793
mov rcx, qword [rdi]
lea rbx, [rax + 8]
mov qword [rax], rcx
mov qword [rdi], rax
mov r8d, 1
mov qword [rsp + 0x48], rsi
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.IPHLPAPI.DLL_GetIpForwardTable]
mov esi, eax
test eax, eax
je 0x140060761
cmp dword [0x1400d3ed4], 3
jb 0x14006075f
mov ecx, 3
call fcn.14000ec70
test al, al
je 0x14006075f
mov rdx, rdi
mov ecx, esi
call fcn.14000f4a0
mov r8, rax
lea rdx, str.NOTE:_GetIpForwardTable_returned_error:__s__code_u_
mov r9d, esi
mov ecx, 3
call fcn.14000e820
xor ebx, ebx
mov rsi, qword [rsp + 0x48]
mov rax, rbx
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14008aca0
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
test rax, rax
jne 0x140060708
call fcn.14000ede0
int3