joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401503c0
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rax, qword [0x140430040]
xor rax, rsp
mov qword [rsp + 0x48], rax
test rcx, rcx
je 0x140150407
mov rsi, rcx
lea r8, [rsp + 0x2c]
mov dword [r8], 0xaaaaaaaa
movaps xmm0, xmmword [0x1403d4b30]
movaps xmmword [rsp + 0x30], xmm0
mov ecx, 2
mov rdx, rsi
call fcn.140177d60
test eax, eax
je 0x140150428
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
cmp rcx, qword [0x140430040]
je 0x140150420
call fcn.140278ca0
int3
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
lea r8, [rsp + 0x30]
mov ecx, reloc.WS2_32.dll_socket
mov rdx, rsi
call fcn.140177d60
test eax, eax
jne 0x140150407
mov rcx, rsi
call fcn.14029c0d0
mov rdi, rax
mov rcx, rsi
mov edx, reloc.WLDAP32.dll_Ordinal_46
mov r8, rax
call fcn.140177c50
test rax, rax
je 0x140150488
sub rax, rsi
mov rcx, rsi
mov edx, reloc.WLDAP32.dll_Ordinal_46
mov r8, rax
call fcn.140177c50
test rax, rax
je 0x140150488
inc rax
add rdi, rsi
sub rdi, rax
jmp 0x14015048a
mov eax, 5
jmp 0x140150409
xor eax, eax
test rax, rax
cmovne rsi, rax
test rdi, rdi
jle 0x140150481
add rdi, rsi
mov eax, 0x1505
mov rbx, rax
shl rbx, 5
add rbx, rax
mov cl, byte [rsi]
inc rsi
call fcn.1401515e0
movzx eax, al
xor rax, rbx
cmp rsi, rdi
jb 0x14015049e
movzx eax, al
jmp 0x140150409

Function at 0x1401579c0
Capabilities:
Initialize winsock library

Disassembly:
push rsi
push rdi
sub rsp, 0x1c8
mov rax, qword [0x140430040]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
test cl, 2
je 0x140157a42
lea rsi, [rsp + 0x28]
mov r8d, 0x198
mov rcx, rsi
mov dl, 0xaa
call fcn.1402b6a10
mov cx, 0x202
mov rdx, rsi
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x140157a31
mov esi, 2
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
cmp rcx, qword [0x140430040]
je 0x140157a25
call fcn.140278ca0
int3
mov eax, esi
add rsp, 0x1c8
pop rdi
pop rsi
ret
cmp word [rsp + 0x28], 0x202
je 0x140157a42
call qword [sym.imp.WS2_32.dll_WSACleanup]
jmp 0x140157a06
call fcn.140199810
mov esi, eax
test eax, eax
jne 0x140157a0b
lea rcx, str.iphlpapi.dll
call fcn.140157b30
mov qword [0x14044a1a8], rax
test rax, rax
je 0x140157a81
lea rdx, str.if_nametoindex
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140157a81
mov qword [0x14044a1a0], rax
lea rdi, [rsp + 0x34]
xor esi, esi
mov r8d, 0x110
mov rcx, rdi
xor edx, edx
call fcn.1402b6a10
movabs rax, 0x60000011c
mov qword [rdi - 0xc], rax
mov dword [rdi - 4], 0
mov dword [rdi + 4], 2
mov rdi, qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
xor ecx, ecx
mov edx, 2
mov r8b, 3
call rdi
mov rcx, rax
mov edx, 1
mov r8b, 3
call rdi
mov rcx, rax
mov edx, 0x20
mov r8b, 3
call rdi
mov rcx, rax
mov edx, reloc.WS2_32.dll_recv
mov r8b, 3
call rdi
mov rcx, rax
mov edx, 8
mov r8b, 1
call rdi
lea rcx, [rsp + 0x28]
mov edx, 0x33
mov r8, rax
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
setne byte [0x14044a1b0]
lea rcx, [0x14044a1b8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
jmp 0x140157a0b
Function at 0x140157b30
Capabilities:
Get common file path

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rcx
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140157ba2
mov rbx, rax
lea rdx, [0x1403fbcd0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
lea rdx, [0x1403db840]
mov rcx, rdi
call fcn.14029dbb4
test rax, rax
je 0x140157bb4
test rsi, rsi
je 0x140157be2
mov r9, qword [str._a_]
mov rcx, rdi
xor edx, edx
mov r8d, 8
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp r9
xor r14d, r14d
mov rax, r14
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
test rsi, rsi
je 0x140157c0c
lea rdx, str.AddDllDirectory
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140157c0c
mov r9, qword [str._a_]
mov rcx, rdi
xor edx, edx
mov r8d, 0x800
jmp 0x140157b91
mov rcx, rdi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp qword [sym.imp.KERNEL32.dll_LoadLibraryW]
xor r14d, r14d
mov rax, qword [fcn.140119970]
mov rcx, rbx
call qword [str._a_]
jmp 0x140157ba5
xor r14d, r14d
xor ecx, ecx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x140157ba5
mov r15d, eax
mov rcx, rdi
call fcn.14029c474
mov rdx, qword [fcn.140119a10]
lea ecx, [r15 + 1]
add rcx, rax
add rcx, rcx
mov rax, rdx
call qword [str._a_]
mov rbx, rax
test rax, rax
je 0x140157bf7
mov rcx, rbx
mov edx, r15d
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x140157bf7
mov rcx, rbx
call fcn.14029c474
lea rcx, [rbx + rax*2]
lea rdx, [0x1403dac18]
call fcn.14029da34
mov rcx, rbx
call fcn.14029c474
lea rcx, [rbx + rax*2]
mov rdx, rdi
call fcn.14029da34
mov rcx, rbx
test rsi, rsi
je 0x140157ca7
xor edx, edx
mov r8d, 8
mov rax, rsi
call qword [str._a_]
mov r14, rax
jmp 0x140157bfa
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x140157c9f
Function at 0x1401587a0
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x128
mov rdi, r9
mov rbx, r8
mov rsi, rcx
mov r12, qword [rsp + 0x190]
mov rax, qword [0x140430040]
xor rax, rsp
mov qword [rsp + 0x120], rax
movsxd rbp, edx
mov r14, qword [rcx + rbp*8 + 0x4c0]
mov rax, qword [rcx + 0x698]
test byte [rax + 0x7c], 3
je 0x140158803
lea rax, [0x140158a00]
cmp qword [rsi + rbp*8 + 0x4e8], rax
je 0x1401588c1
mov rcx, r14
mov rdx, rbx
mov r8d, edi
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_send]
mov dword [r12], 0
cmp eax, 0xffffffff
je 0x140158852
cdqe
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
cmp rcx, qword [0x140430040]
je 0x14015883e
call fcn.140278ca0
int3
add rsp, 0x128
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x14015886b
mov dword [r12], 0x51
xor eax, eax
jmp 0x140158824
mov edi, eax
lea rbx, [rsp + 0x20]
mov r8d, 0x100
mov rcx, rbx
mov dl, 0xaa
call fcn.1402b6a10
mov r8d, 0x100
mov ecx, edi
mov rdx, rbx
call fcn.14017a680
mov rcx, qword [rsi]
lea rdx, str.Send_failure:__s
mov r8, rax
call fcn.140158420
mov rax, qword [rsi]
mov dword [rax + 0x11b0], edi
mov dword [r12], gethostname
mov rax, 0xffffffffffffffff
jmp 0x140158824
shl rbp, 5
lea r13, [rsi + rbp]
add r13, 0x508
mov r15, qword [r13 + 8]
sub r15, qword [r13 + 0x10]
cmp qword [r13], 0
sete al
test r15, r15
setne cl
or cl, al
cmp cl, 1
jne 0x140158803
mov rcx, r14
mov rdx, 0xffffffffffffffff
mov r8, 0xffffffffffffffff
xor r9d, r9d
call fcn.1401801e0
cmp eax, 0xffffffff
sete cl
test al, 1
sete al
or al, cl
jne 0x140158803
add rbp, rsi
add rbp, 0x518
mov rax, qword [r13]
test rax, rax
je 0x140158959
mov rdx, qword [rbp]
add rdx, rax
mov rcx, r14
mov r8d, r15d
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x140158803
mov eax, eax
add qword [rbp], rax
jmp 0x140158803
mov rax, qword [rsi]
movsxd rcx, dword [rax + 0xb70]
add rcx, rcx
mov qword [r13 + 8], rcx
mov rax, qword [fcn.140119a10]
call qword [str._a_]
mov qword [r13], rax
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
test rax, rax
je 0x14015898f
mov r15, qword [r13 + 8]
xor edx, edx
jmp 0x140158934
mov qword [r13 + 8], 0
jmp 0x140158803

Function at 0x140158fa0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, r9
xor edi, edi
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
je 0x140158fc7
cdqe
mov qword [rsi], rax
mov eax, edi
add rsp, 0x28
pop rdi
pop rsi
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
mov eax, 0x51
mov edi, gethostname
cmove edi, eax
xor eax, eax
jmp 0x140158fbb
Function at 0x14015d8d0
Capabilities:
Set socket configuration

Disassembly:
push rsi
sub rsp, 0x40
mov rax, qword [0x140430040]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x34], 0x4020
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x2c], 4
mov eax, dword [0x14044a1c0]
cmp eax, 2
je 0x14015d996
mov rsi, rcx
test eax, eax
jne 0x14015d944
mov ecx, 6
xor edx, edx
mov r8d, 2
mov r9d, 3
call fcn.140157cb0
test al, al
je 0x14015d93a
mov dword [0x14044a1c0], 2
jmp 0x14015d996
mov dword [0x14044a1c0], 1
lea rax, [rsp + 0x2c]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
mov rcx, rsi
mov edx, 0xffff
mov r8d, 0x1001
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x14015d975
cmp dword [rsp + 0x30], 0x4020
jg 0x14015d996
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x34]
mov rcx, rsi
mov edx, 0xffff
mov r8d, 0x1001
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
cmp rcx, qword [0x140430040]
je 0x14015d9ad
call fcn.140278ca0
int3
add rsp, 0x40
pop rsi
ret
Function at 0x14015e610
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub rsp, 0x38
mov rax, qword [0x140430040]
xor rax, rsp
mov qword [rsp + 0x30], rax
cmp byte [rcx + 0x558], 1
je 0x14015e659
mov rcx, qword [rcx + 0x4c0]
cmp rcx, 0xffffffffffffffff
je 0x14015e655
lea rdx, [rsp + 0x2f]
mov byte [rdx], 0xaa
mov r8d, 1
mov r9d, 2
call qword [sym.imp.WS2_32.dll_recv]
jmp 0x14015e65e
xor eax, eax
jmp 0x14015e664
call fcn.14014bdc0
test eax, eax
je 0x14015e655
mov al, 1
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
cmp rcx, qword [0x140430040]
je 0x14015e67b
call fcn.140278ca0
int3
add rsp, 0x38
ret

Function at 0x14015fed0
Capabilities:
Inspect section memory permissions

Disassembly:
mov r9d, r8d
xor r8d, r8d
jmp 0x14015fee0
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x40
mov ebx, r8d
mov rsi, rdx
mov r14, rcx
cmp byte [rdx + 0x17], 0
jns 0x14015ff01
mov rsi, qword [rsi]
mov edi, r9d
and edi, 0xfffffff
test r9b, 4
je 0x14015ff21
cmp byte [r14 + 0x50], 1
je 0x14015ffac
or edi, 0x20000000
test dil, 8
jne 0x14015ffb7
xor r15d, r15d
cmp byte [r14 + 0x60], 0
mov r12d, 0
je 0x14015ff3f
mov r12, qword [r14 + 0x58]
cmp byte [r14 + 0x48], 0
mov r13d, 0
je 0x14015ff50
mov r13, qword [r14 + 0x40]
cmp byte [r14 + 0x38], 1
je 0x14015ffde
cmp byte [r14 + 0x18], 1
je 0x14015ffef
xor r9d, r9d
mov edx, 1
test ebx, ebx
jne 0x14015ffff
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r15
mov rcx, rsi
mov r8d, edi
call qword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoW]
mov esi, eax
test eax, eax
jne 0x14015ffd4
test esi, esi
sete al
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
or edi, 0x80000000
jmp 0x14015ff21
cmp byte [r14 + 0x68], 1
jne 0x14015ffc9
or edi, 0x40000000
jmp 0x14015ff2b
or edi, 0x10000000
jmp 0x14015ff2b
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x14015ff97
lea rcx, [r14 + 0x20]
call fcn.1400d22b0
mov r15, rax
jmp 0x14015ff5b
mov rcx, r14
call fcn.1400d22b0
mov r9, rax
jmp 0x14015ff69
cmp ebx, 4
jne 0x14016000e
mov edx, 6
jmp 0x14015ff76
lea eax, [rbx - 2]
cmp eax, 2
jae 0x140160020
mov edx, 7
jmp 0x14015ff76
cmp ebx, 1
jne 0x14016002f
mov edx, 4
jmp 0x14015ff76
xor edx, edx
jmp 0x14015ff76
Function at 0x14015fee0
Capabilities:
Inspect section memory permissions

Disassembly:
mov r9d, r8d
xor r8d, r8d
jmp 0x14015fee0
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x40
mov ebx, r8d
mov rsi, rdx
mov r14, rcx
cmp byte [rdx + 0x17], 0
jns 0x14015ff01
mov rsi, qword [rsi]
mov edi, r9d
and edi, 0xfffffff
test r9b, 4
je 0x14015ff21
cmp byte [r14 + 0x50], 1
je 0x14015ffac
or edi, 0x20000000
test dil, 8
jne 0x14015ffb7
xor r15d, r15d
cmp byte [r14 + 0x60], 0
mov r12d, 0
je 0x14015ff3f
mov r12, qword [r14 + 0x58]
cmp byte [r14 + 0x48], 0
mov r13d, 0
je 0x14015ff50
mov r13, qword [r14 + 0x40]
cmp byte [r14 + 0x38], 1
je 0x14015ffde
cmp byte [r14 + 0x18], 1
je 0x14015ffef
xor r9d, r9d
mov edx, 1
test ebx, ebx
jne 0x14015ffff
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r15
mov rcx, rsi
mov r8d, edi
call qword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoW]
mov esi, eax
test eax, eax
jne 0x14015ffd4
test esi, esi
sete al
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
or edi, 0x80000000
jmp 0x14015ff21
cmp byte [r14 + 0x68], 1
jne 0x14015ffc9
or edi, 0x40000000
jmp 0x14015ff2b
or edi, 0x10000000
jmp 0x14015ff2b
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x14015ff97
lea rcx, [r14 + 0x20]
call fcn.1400d22b0
mov r15, rax
jmp 0x14015ff5b
mov rcx, r14
call fcn.1400d22b0
mov r9, rax
jmp 0x14015ff69
cmp ebx, 4
jne 0x14016000e
mov edx, 6
jmp 0x14015ff76
lea eax, [rbx - 2]
cmp eax, 2
jae 0x140160020
mov edx, 7
jmp 0x14015ff76
cmp ebx, 1
jne 0x14016002f
mov edx, 4
jmp 0x14015ff76
xor edx, edx
jmp 0x14015ff76

Function at 0x140160040
Capabilities:
Inspect section memory permissions

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x40
mov ebx, r8d
mov rsi, rdx
mov r15, rcx
mov edi, r9d
and edi, 0xfffffff
test r9b, 4
je 0x140160078
cmp byte [r15 + 0x50], 1
je 0x14016010f
or edi, 0x20000000
test dil, 8
jne 0x14016011a
xor r14d, r14d
cmp byte [r15 + 0x60], 0
mov r12d, 0
je 0x140160096
mov r12, qword [r15 + 0x58]
cmp byte [r15 + 0x48], 0
mov r13d, 0
je 0x1401600a7
mov r13, qword [r15 + 0x40]
cmp byte [r15 + 0x38], 1
je 0x140160141
cmp byte [r15 + 0x18], 1
je 0x140160152
xor r9d, r9d
cmp ebx, 4
jne 0x140160100
mov edx, 6
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r14
mov rcx, rsi
mov r8d, edi
call qword [sym.imp.ADVAPI32.dll_SetSecurityInfo]
mov esi, eax
test eax, eax
jne 0x140160137
test esi, esi
sete al
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea eax, [rbx - 2]
cmp eax, 2
jae 0x140160162
mov edx, 7
jmp 0x1401600ca
or edi, 0x80000000
jmp 0x140160078
cmp byte [r15 + 0x68], 1
jne 0x14016012c
or edi, 0x40000000
jmp 0x140160082
or edi, 0x10000000
jmp 0x140160082
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1401600eb
lea rcx, [r15 + 0x20]
call fcn.1400d22b0
mov r14, rax
jmp 0x1401600b2
mov rcx, r15
call fcn.1400d22b0
mov r9, rax
jmp 0x1401600c0
mov edx, 1
test ebx, ebx
je 0x1401600ca
cmp ebx, 1
jne 0x14016017e
mov edx, 4
jmp 0x1401600ca
xor edx, edx
jmp 0x1401600ca
Function at 0x140165890
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x1401658a5
mov dword [rsi], eax
cmp eax, 0xffffffff
setne al
add rsp, 0x20
pop rsi
ret

Function at 0x14016a970
Capabilities:
Write file on windows

Disassembly:
push rsi
sub rsp, 0x40
mov rax, qword [0x140430040]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov esi, 0xffffffff
cmp r8, rsi
cmovae r8, rsi
lea r9, [rsp + 0x34]
mov dword [r9], 0xaaaaaaaa
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14016a9d5
mov eax, dword [rsp + 0x34]
cmp rax, rsi
je 0x14016a9de
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
cmp rcx, qword [0x140430040]
je 0x14016a9cf
call fcn.140278ca0
int3
add rsp, 0x40
pop rsi
ret
mov rax, 0xffffffffffffffff
jmp 0x14016a9b8
int3
mov rcx, qword [rcx + 8]
jmp 0x14016a970

Function at 0x14016a9f0
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x140430040]
xor rax, rsp
mov ebx, 0xffffffff
cmp r8, rbx
cmovb rbx, r8
mov qword [rsp + 0x30], rax
lea r14, [rsp + 0x2c]
mov r15, qword [sym.imp.KERNEL32.dll_ReadFile]
mov r12, qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0x2c], 0xaaaaaaaa
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov rdx, rsi
mov r8d, ebx
mov r9, r14
call r15
test eax, eax
je 0x14016aa9d
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x14016aa89
cmp eax, 0xffffffff
je 0x14016aa9a
mov eax, eax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
cmp rcx, qword [0x140430040]
je 0x14016aa7b
call fcn.140278ca0
int3
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov rcx, rdi
call r12
cmp eax, 3
je 0x14016aa31
mov eax, dword [rsp + 0x2c]
jmp 0x14016aa62
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
xor eax, eax
cmp ecx, 0x6d
setne al
neg rax
jmp 0x14016aa64

Function at 0x14016af70
Capabilities:
Clear file content

Disassembly:
push rsi
push rdi
sub rsp, 0x168
mov rdi, rcx
mov rax, qword [0x140430040]
xor rax, rsp
mov qword [rsp + 0x160], rax
xor esi, esi
xor edx, edx
xor r8d, r8d
call fcn.14016ae90
test rax, rax
jne 0x14016afaf
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov sil, 1
test eax, eax
je 0x14016afd5
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
cmp rcx, qword [0x140430040]
je 0x14016afc9
call fcn.140278ca0
int3
mov eax, esi
add rsp, 0x168
pop rdi
pop rsi
ret
mov ecx, 2
call fcn.14021c050
test al, al
je 0x14016b02b
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_file_io_win.cc
lea rsi, [rsp + 0x28]
mov rcx, rsi
mov r8d, 0xfb
mov r9d, 2
call fcn.1402f6330
lea rcx, [rsp + 0x38]
lea rdx, [0x1403fd532]
mov r8d, recv
call fcn.1401f8290
mov rcx, rsi
call fcn.1402f63a0
xor esi, esi
jmp 0x14016afaf
Function at 0x14016b4e0
Capabilities:
Write file on windows

Disassembly:
push rsi
sub rsp, 0x40
mov rax, qword [0x140430040]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov esi, 0xffffffff
cmp r8, rsi
cmovae r8, rsi
lea r9, [rsp + 0x34]
mov dword [r9], 0xaaaaaaaa
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14016a9d5
mov eax, dword [rsp + 0x34]
cmp rax, rsi
je 0x14016a9de
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
cmp rcx, qword [0x140430040]
je 0x14016a9cf
call fcn.140278ca0
int3
add rsp, 0x40
pop rsi
ret
mov rax, 0xffffffffffffffff
jmp 0x14016a9b8
int3
mov rcx, qword [rcx + 8]
jmp 0x14016a970
Function at 0x14016f1e0
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
push rdi
sub rsp, 0x28
cmp qword [0x14044c110], 0
jne 0x14016f21d
mov rsi, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x14016f210
mov dword [rdi], eax
mov dword [0x14044c118], eax
mov qword [0x14044c110], rsi
cmp eax, 0xffffffff
setne al
add rsp, 0x28
pop rdi
pop rsi
ret
int3

Function at 0x140172ac0
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov edi, 1
xor r14d, r14d
mov r15, qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov rax, qword [fcn.140119a60]
mov edx, edi
mov rcx, r14
call qword [str._a_]
test rax, rax
je 0x140172b1d
mov rbx, rax
mov rcx, rsi
mov rdx, rax
mov r8d, edi
call r15
test eax, eax
je 0x140172b29
cmp eax, edi
je 0x140172b29
cmp eax, 0x8001
jae 0x140172b29
mov r14, rbx
cmp eax, edi
mov edi, eax
jae 0x140172add
jmp 0x140172b3b
mov rax, qword [fcn.140119970]
mov rcx, r14
jmp 0x140172b33
mov rax, qword [fcn.140119970]
mov rcx, rbx
call qword [str._a_]
xor ebx, ebx
mov rax, rbx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140176840
Capabilities:
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov rdi, r9
mov rsi, r8
mov rbx, rdx
mov r14, rcx
mov ebp, dword [rsp + 0xb0]
mov rax, qword [0x140430040]
xor rax, rsp
mov qword [rsp + 0x50], rax
xor eax, eax
lea r15, [rsp + 0x48]
mov qword [r15], rax
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x3c], 0
mov dword [rsp + 0x38], 4
mov dword [rsp + 0x34], edi
mov rcx, r8
xor edx, edx
mov r8, r9
call fcn.1402b6a10
mov dword [rsp + 0x20], 0xf0000040
mov rcx, r15
xor edx, edx
xor r8d, r8d
mov r9d, ebp
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x14017696e
mov edx, dword [rsp + 0xb8]
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x14017694c
mov rcx, qword [rsp + 0x40]
mov rdx, r14
mov r8d, ebx
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x14017694c
mov rcx, qword [rsp + 0x40]
mov dword [rsp + 0x20], 0
lea r8, [rsp + 0x3c]
lea r9, [rsp + 0x38]
mov edx, 4
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x14017694c
mov eax, dword [rsp + 0x3c]
cmp rdi, rax
jb 0x14017694c
mov rcx, qword [rsp + 0x40]
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x34]
mov edx, 2
mov r8, rsi
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14017695c
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14017696e
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
cmp rcx, qword [0x140430040]
je 0x140176985
call fcn.140278ca0
int3
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140178170
Capabilities:
Move file

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x140430040]
xor rax, rsp
mov qword [rsp + 0x50], rax
movaps xmm0, xmmword [0x1403d4b30]
lea rcx, [rsp + 0x40]
movaps xmmword [rcx], xmm0
call fcn.14017b110
mov r15, qword [sym.imp.KERNEL32.dll_MoveFileExA]
lea rbx, [rsp + 0x30]
lea r14, [rsp + 0x20]
mov r12, qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1401781c8
mov ecx, 1
call r12
mov rcx, rdi
mov rdx, rsi
mov r8d, 1
call r15
test eax, eax
jne 0x140178207
mov rcx, rbx
call fcn.14017b110
movaps xmm0, xmmword [rsp + 0x40]
movaps xmmword [rsp + 0x20], xmm0
mov rcx, rbx
mov rdx, r14
call fcn.14017b1c0
cmp rax, 0x3e8
jbe 0x1401781c0
mov eax, 1
jmp 0x140178209
xor eax, eax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
cmp rcx, qword [0x140430040]
je 0x140178220
call fcn.140278ca0
int3
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x1401800a0
Capabilities:
Get socket status

Disassembly:
push rsi
sub rsp, 0x40
mov r10, qword [rsp + 0x70]
mov rax, qword [0x140430040]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov eax, 0x7fffffff
cmp r10, 0x7fffffff
cmovl rax, r10
test rdx, rdx
je 0x14018019b
cmp dword [rdx], 0
je 0x14018019b
movabs r11, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x30], r11
test r10, r10
js 0x140180182
je 0x140180187
mov r10d, eax
imul r10, r10, 0x10624dd3
shr r10, 0x26
mov dword [rsp + 0x30], r10d
imul r10d, r10d, 0x3e8
sub eax, r10d
imul eax, eax, 0x3e8
lea r10, [rsp + 0x30]
mov dword [r10 + 4], eax
xor eax, eax
test r9, r9
je 0x140180134
cmp dword [r9], 0
cmovne rax, r9
xor r9d, r9d
test r8, r8
je 0x140180144
cmp dword [r8], 0
cmovne r9, r8
xor r8d, r8d
test rdx, rdx
je 0x140180153
cmp dword [rdx], 0
cmovne r8, rdx
inc ecx
mov qword [rsp + 0x20], r10
mov rdx, r8
mov r8, r9
mov r9, rax
call qword [sym.imp.WS2_32.dll_select]
mov esi, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
cmp rcx, qword [0x140430040]
je 0x140180193
call fcn.140278ca0
int3
xor r10d, r10d
jmp 0x140180125
mov dword [rsp + 0x30], 0
xor eax, eax
jmp 0x14018011c
mov eax, esi
add rsp, 0x40
pop rsi
ret
test r8, r8
je 0x1401801aa
cmp dword [r8], 0
jne 0x1401800db
test r9, r9
je 0x1401801b9
cmp dword [r9], 0
jne 0x1401800db
xor esi, esi
test eax, eax
je 0x14018016b
js 0x1401801cb
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14018016b
mov ecx, 0x2726
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov esi, 0xffffffff
jmp 0x14018016b