joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400d22e0
Capabilities:
Get system information on windows
Initialize winsock library

Disassembly:
push rbp
mov rbp, rsp
push r12
mov r12, rdx
push rsi
push rbx
mov ebx, ecx
mov ecx, 0x202
and rsp, 0xfffffffffffffff0
sub rsp, 0x200
lea rdx, [rsp + 0x60]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x1400d2420
mov rax, qword [0x1403e76f0]
mov rcx, qword [rax]
xor eax, eax
test rcx, rcx
je 0x1400d2337
xor r9d, r9d
lea r8, str.debug_reactor
lea rdx, [0x1402c14ab]
call fcn.1400c10e0
lea rsi, [rsp + 0x30]
mov byte [0x1403f25c0], al
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [rsp + 0x50]
cmp ebx, edx
cmova rbx, rdx
test ebx, ebx
je 0x1400d23f0
mov dword [0x1402515b0], ebx
lea rdx, [rbx*8]
mov ecx, 1
call sub.msvcrt.dll_calloc
mov qword [0x1403f25c8], rax
test rax, rax
je 0x1400d2553
call fcn.1400c2850
test eax, eax
jne 0x1400d2461
mov rcx, r12
call fcn.1401098d0
call fcn.1400d2bb0
mov r12d, eax
test eax, eax
jne 0x1400d2524
mov eax, dword [0x1402515b0]
mov r9d, 2
xor edx, edx
xor ecx, ecx
lea r8, str.dap_events
mov dword [rsp + 0x28], eax
lea rax, str.Initialized_event_socket_reactor_for__u_threads
mov qword [rsp + 0x20], rax
call fcn.14005a160
mov eax, r12d
mov dword [0x1403f25d0], 1
lea rsp, [rbp - 0x18]
pop rbx
pop rsi
pop r12
pop rbp
ret
mov dword [0x1402515b0], edx
shl rdx, 3
jne 0x1400d236b
mov qword [0x1403f25c8], 0
mov r12d, 0xffffffff
lea rsp, [rbp - 0x18]
mov eax, r12d
pop rbx
pop rsi
pop r12
pop rbp
ret
mov dword [rsp + 0x28], eax
mov r9d, 8
mov edx, 0xe4
lea rax, str.Couldnt_init_Winsock_DLL__error:__d
mov qword [rsp + 0x20], rax
lea r8, str.dap_events
lea rcx, str.dap_events_init
mov r12d, 2
call fcn.14005a160
lea rsp, [rbp - 0x18]
mov eax, r12d
pop rbx
pop rsi
pop r12
pop rbp
ret
lea rax, str.Cant_init_client_submodule_dap_context___
mov r9d, 8
lea r8, str.dap_events
mov edx, 0xf5
mov qword [rsp + 0x20], rax
lea rcx, str.dap_events_init
call fcn.14005a160
lea rax, str.Deinit_events_subsystem
mov r9d, 7
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
lea r8, str.dap_events
call fcn.14005a160
call fcn.1400fd750
call fcn.1400d2770
call fcn.140109700
mov eax, dword [0x1402515b0]
test eax, eax
je 0x1400d24f8
xor ebx, ebx
nop dword [rax + rax]
mov rax, qword [0x1403f25c8]
mov edx, ebx
add ebx, 1
mov rax, qword [rax + rdx*8]
mov rdx, rsi
mov rax, qword [rax + 0x70]
mov rcx, qword [rax + 0x38]
call fcn.1400337d0
cmp ebx, dword [0x1402515b0]
jb 0x1400d24d0
mov rcx, qword [0x1403f25c8]
test rcx, rcx
je 0x1400d2509
call sub.msvcrt.dll_free
mov dword [0x1403f25d0], 0
mov r12d, 0xffffffff
call qword [sym.imp.WS2_32.dll_WSACleanup]
jmp 0x1400d2411
lea rax, str.Cant_init_client_submodule_dap_events_socket_init___
mov r9d, 8
lea r8, str.dap_events
mov edx, 0xfb
mov qword [rsp + 0x20], rax
lea rcx, str.dap_events_init
call fcn.14005a160
jmp 0x1400d248b
or r12d, 0xffffffff
jmp 0x1400d2411
Function at 0x1400d25a0
Capabilities:
Set socket configuration

Disassembly:
push r12
mov r12, rdx
push rsi
push rbx
mov ebx, ecx
sub rsp, 0x50
cmp ecx, 1
je 0x1400d2600
test ecx, 0xfffffff7
je 0x1400d26a0
lea rax, str.Cant_create_socket_type__d
mov dword [rsp + 0x28], ecx
xor r12d, r12d
mov r9d, 8
mov qword [rsp + 0x20], rax
lea r8, str.dap_events_socket
mov edx, 0x1d3
lea rcx, str.dap_events_socket_create
call fcn.14005a160
add rsp, 0x50
mov rax, r12
pop rbx
pop rsi
pop r12
ret
mov edx, 2
xor r8d, r8d
mov ecx, 2
call qword [sym.imp.WS2_32.dll_socket]
lea r8, [rsp + 0x4c]
mov edx, 0x8004667e
mov dword [rsp + 0x4c], 1
mov rsi, rax
mov rcx, rax
call qword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
jne 0x1400d26b0
mov rdx, r12
mov rcx, rsi
call fcn.1400d3840
mov r12, rax
test rax, rax
je 0x1400d26e8
mov dword [rax + 0x34], ebx
mov rax, qword [0x1403e7720]
lea r8, str.dap_events_socket
cmp byte [rax], 0
mov eax, 0
mov dword [rsp + 0x30], ebx
cmove r8, rax
lea rax, str.Created_socket__llu_type__d
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x28], rsi
xor ecx, ecx
mov qword [rsp + 0x20], rax
call fcn.14005a160
add rsp, 0x50
mov rax, r12
pop rbx
pop rsi
pop r12
ret
mov edx, 1
jmp 0x1400d2605
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r9d, 7
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], eax
lea rax, str.Error_ioctl__d
lea r8, str.dap_events_socket
mov qword [rsp + 0x20], rax
call fcn.14005a160
jmp 0x1400d2635
lea rax, str.Cant_allocate_memory_for_the_new_esocket
mov r9d, 8
lea r8, str.dap_events_socket
mov edx, 0x1e9
mov qword [rsp + 0x20], rax
lea rcx, str.dap_events_socket_create
call fcn.14005a160
jmp 0x1400d25ef

Function at 0x1400d2b20
Capabilities:
Send data
Send data on socket

Disassembly:
push rbp
mov edx, 2
mov rbp, rsp
push r12
and rsp, 0xfffffffffffffff0
sub rsp, 0x40
movzx eax, word [rcx + 0x1c]
mov r12, qword [rcx]
mov ecx, 0x7f000001
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov word [rsp + 0x30], dx
mov word [rsp + 0x32], ax
call qword [sym.imp.WS2_32.dll_htonl]
xor r9d, r9d
mov rcx, r12
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x34], eax
lea rax, [rsp + 0x30]
mov r8d, 1
lea rdx, [0x1402c1b38]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_sendto]
cmp eax, 0xffffffff
je 0x1400d2ba0
mov r12, qword [rbp - 8]
xor eax, eax
leave
ret
mov r12, qword [rbp - 8]
leave
jmp qword [sym.imp.WS2_32.dll_WSAGetLastError]
Function at 0x1400d2ff0
Capabilities:
Send data
Send data on socket

Disassembly:
push rbp
mov rbp, rsp
push r12
push rbx
mov rbx, rcx
and rsp, 0xfffffffffffffff0
sub rsp, 0x50
mov rax, qword [0x1403e7720]
mov qword [rbp + 0x18], rdx
cmp byte [rax], 0
je 0x1400d304f
mov eax, 0xffffffff
test rcx, rcx
je 0x1400d301e
mov eax, dword [rcx]
mov dword [rsp + 0x38], eax
mov rax, qword [rbp + 0x18]
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x30], rbx
lea r8, str.dap_events_socket
xor ecx, ecx
mov qword [rsp + 0x28], rax
lea rax, str.Sent_ptr__p_to_esocket_queue__p___d_
mov qword [rsp + 0x20], rax
call fcn.14005a160
mov edx, 0x10
mov ecx, 0x20
call qword [sym.imp.msvcrt.dll__aligned_malloc]
mov rdx, rax
mov rax, qword [rbp + 0x18]
mov qword [rdx + 0x10], rax
mov rcx, qword [rbx + 0x2f8]
call qword [sym.imp.KERNEL32.dll_InterlockedPushEntrySList]
test rax, rax
je 0x1400d3090
xor eax, eax
lea rsp, [rbp - 0x10]
pop rbx
pop r12
pop rbp
ret
movzx eax, word [rbx + 0x1c]
mov edx, 2
mov r12, qword [rbx]
mov ecx, 0x7f000001
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
mov word [rsp + 0x40], dx
mov word [rsp + 0x42], ax
call qword [sym.imp.WS2_32.dll_htonl]
xor r9d, r9d
lea rdx, [rbp + 0x18]
mov rcx, r12
mov dword [rsp + 0x44], eax
lea rax, [rsp + 0x40]
mov r8d, 8
mov dword [rsp + 0x28], 0x10
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_sendto]
cmp eax, 0xffffffff
jne 0x1400d307c
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
jmp 0x1400d307e
Function at 0x1400d32a0
Capabilities:
Send data
Send data on socket

Disassembly:
push rbp
mov rbp, rsp
push r13
push r12
push rsi
mov rsi, rdx
mov edx, 8
push rbx
mov rbx, rcx
mov ecx, 1
and rsp, 0xfffffffffffffff0
sub rsp, 0x60
call sub.msvcrt.dll_calloc
test rax, rax
je 0x1400d3409
mov qword [rax], rsi
mov r12, rax
mov rbx, qword [rbx + 0x28]
mov qword [rsp + 0x48], rax
mov rax, qword [0x1403e7720]
cmp byte [rax], 0
je 0x1400d3324
mov eax, 0xffffffff
test rbx, rbx
je 0x1400d32f7
mov eax, dword [rbx]
mov dword [rsp + 0x38], eax
lea rax, str.Sent_ptr__p_to_esocket_queue__p___d_
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x30], rbx
lea r8, str.dap_events_socket
xor ecx, ecx
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rax
call fcn.14005a160
mov edx, 0x10
mov ecx, 0x20
call qword [sym.imp.msvcrt.dll__aligned_malloc]
mov rdx, rax
mov rax, qword [rsp + 0x48]
mov qword [rdx + 0x10], rax
mov rcx, qword [rbx + 0x2f8]
call qword [sym.imp.KERNEL32.dll_InterlockedPushEntrySList]
test rax, rax
je 0x1400d3360
lea rsp, [rbp - 0x20]
pop rbx
pop rsi
pop r12
pop r13
pop rbp
ret
movzx eax, word [rbx + 0x1c]
mov edx, 2
mov r13, qword [rbx]
mov ecx, 0x7f000001
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
mov word [rsp + 0x50], dx
mov word [rsp + 0x52], ax
call qword [sym.imp.WS2_32.dll_htonl]
xor r9d, r9d
lea rdx, [rsp + 0x48]
mov rcx, r13
mov dword [rsp + 0x54], eax
lea rax, [rsp + 0x50]
mov r8d, 8
mov dword [rsp + 0x28], 0x10
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_sendto]
cmp eax, 0xffffffff
jne 0x1400d3352
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
je 0x1400d3352
lea rax, str.Cant_send__llu_uuid_in_queue
mov qword [rsp + 0x28], rsi
xor ecx, ecx
xor edx, edx
mov qword [rsp + 0x20], rax
mov r9d, 7
lea r8, str.dap_events_socket
call fcn.14005a160
lea rsp, [rbp - 0x20]
mov rcx, r12
pop rbx
pop rsi
pop r12
pop r13
pop rbp
jmp sub.msvcrt.dll_free
lea rax, [0x1402c1aee]
mov r9d, 8
lea r8, str.dap_events_socket
mov edx, 0x6b3
mov qword [rsp + 0x20], rax
lea rcx, str.dap_events_socket_remove_and_delete_mt
call fcn.14005a160
jmp 0x1400d3352

Function at 0x1400d47a0
Capabilities:
Read file on windows

Disassembly:
test rcx, rcx
je 0x1400d4800
push r12
mov r12, rdx
push rbx
sub rsp, 0x28
test rdx, rdx
je 0x1400d47f0
mov qword [rdx], 0
mov rbx, r8
test r8, r8
je 0x1400d47ca
mov qword [r8], 0
lea rdx, [0x1403e4b55]
call sub.msvcrt.dll_fopen
mov rcx, rax
test rax, rax
je 0x1400d47f0
add rsp, 0x28
mov r8, rbx
mov rdx, r12
pop rbx
pop r12
jmp fcn.140125cd0
add rsp, 0x28
xor eax, eax
pop rbx
pop r12
ret
xor eax, eax
ret

Function at 0x1400d4810
Capabilities:
Check if file exists
Get file attributes

Disassembly:
test rcx, rcx
je 0x1400d4830
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
setne al
add rsp, 0x28
ret
xor eax, eax
ret

Function at 0x1400d4840
Capabilities:
Check if file exists
Get file attributes

Disassembly:
test rcx, rcx
je 0x1400d4870
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400d4860
shr al, 7
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret
xor eax, eax
ret
Function at 0x1400d4c00
Capabilities:
Enumerate files on windows

Disassembly:
push rbp
mov rbp, rsp
push r15
push r14
xor r14d, r14d
push r13
push r12
mov r12, rcx
push rdi
push rsi
push rbx
and rsp, 0xfffffffffffffff0
sub rsp, 0x160
call sub.msvcrt.dll_strlen
lea rdi, [rsp + 0x4c]
lea rcx, [rax + 2]
mov rbx, rax
call sub.msvcrt.dll_malloc
mov r8, rbx
mov rdx, r12
mov r13, rax
mov rcx, rax
call sub.msvcrt.dll_memcpy
mov byte [r13 + rbx], 0x2a
mov rcx, r13
mov byte [r13 + rbx + 1], 0
lea rbx, [rsp + 0x20]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rsi, qword [sym.imp.KERNEL32.dll_FindNextFileA]
mov r12, rax
nop
mov rdx, rbx
mov rcx, r12
call rsi
test eax, eax
je 0x1400d4cc4
cmp dword [rsp + 0x20], 0x10
jne 0x1400d4c70
cmp word [rdi], 0x2e2e
je 0x1400d4cf0
cmp word [rdi], 0x2e
je 0x1400d4c70
mov ecx, 0x10
call sub.msvcrt.dll_malloc
mov rcx, rdi
mov r15, rax
call fcn.140100eb0
mov qword [r15 + 8], 0
mov qword [r15], rax
test r14, r14
jne 0x1400d4d00
mov r14, r15
mov rdx, rbx
mov rcx, r12
call rsi
test eax, eax
jne 0x1400d4c7c
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, r13
call sub.msvcrt.dll_free
lea rsp, [rbp - 0x38]
mov rax, r14
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
cmp byte [rdi + 2], 0
je 0x1400d4c70
jmp 0x1400d4c8a
mov rax, r14
nop dword [rax + rax]
mov rdx, rax
mov rax, qword [rax + 8]
test rax, rax
jne 0x1400d4d08
mov qword [rdx + 8], r15
jmp 0x1400d4c70
Function at 0x1400dbbd0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r15
push r14
push r13
push r12
sub rsp, 0x58
test r8, r8
je 0x1400dbd99
lea rax, str.Checking_url_path__s
mov r12, r8
xor r9d, r9d
mov r15, rcx
mov qword [rsp + 0x28], r8
xor ecx, ecx
mov r14, rdx
lea r8, str.dap_http_folder
mov qword [rsp + 0x20], rax
xor edx, edx
call fcn.14005a160
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400dbd20
test al, 0x10
je 0x1400dbd20
lea rax, str.File_service_for__s____s
mov qword [rsp + 0x30], r12
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
mov r9d, 2
lea r8, str.dap_http_folder
mov qword [rsp + 0x28], r14
call fcn.14005a160
mov edx, 0x1008
mov ecx, 1
call sub.msvcrt.dll_calloc
mov r13, rax
test rax, rax
je 0x1400dbddf
mov r8d, 0xfff
mov rdx, r12
mov rcx, rax
call sub.msvcrt.dll_strncpy
mov ecx, 0x492
call fcn.1400019f8
mov qword [r13 + 0x1000], rax
mov rcx, rax
test rax, rax
je 0x1400dbda2
lea rdx, str.data.mag
call fcn.140001b7e
mov r12d, eax
test eax, eax
jne 0x1400dbd50
lea rax, [0x1400dbe30]
xor r9d, r9d
mov r8, r13
mov rdx, r14
mov qword [rsp + 0x40], rax
lea rax, [0x1400dbe20]
mov rcx, r15
mov qword [rsp + 0x38], rax
lea rax, [0x1400dbf80]
mov qword [rsp + 0x30], rax
lea rax, [0x1400dbf20]
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
call fcn.1400d94f0
add rsp, 0x58
mov eax, r12d
pop r12
pop r13
pop r14
pop r15
ret
lea rax, str.Directory_Not_Found_
mov qword [rsp + 0x20], rax
mov r9d, 7
xor edx, edx
xor ecx, ecx
lea r8, str.dap_http_folder
mov r12d, 0xfffffff5
call fcn.14005a160
jmp 0x1400dbd0b
lea rax, str.Cant_load_MIME_magic_detection_database
mov r9d, 8
lea r8, str.dap_http_folder
mov edx, 0x8c
mov qword [rsp + 0x20], rax
lea rcx, str.dap_http_folder_add
mov r12d, 0xfffffffe
call fcn.14005a160
mov rcx, qword [r13 + 0x1000]
call fcn.140001b59
mov rcx, r13
call sub.msvcrt.dll_free
jmp 0x1400dbd0b
lea rax, str.Directory_Path_parameter_is_empty_
jmp 0x1400dbd27
lea rax, str.Cant_init_MIME_detection_library
mov r9d, 8
lea r8, str.dap_http_folder
mov edx, 0x81
mov qword [rsp + 0x20], rax
lea rcx, str.dap_http_folder_add
mov r12d, 0xffffffff
call fcn.14005a160
mov rcx, r13
call sub.msvcrt.dll_free
jmp 0x1400dbd0b
lea rax, [0x1402be518]
mov r9d, 8
or r12d, 0xffffffff
mov edx, 0x79
mov qword [rsp + 0x20], rax
lea r8, str.dap_http_folder
lea rcx, str.dap_http_folder_add
call fcn.14005a160
jmp 0x1400dbd0b
Function at 0x1400f8db0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push rbp
mov rbp, rsp
push r12
push rdi
push rsi
push rbx
sub rsp, 0x20
test rcx, rcx
je 0x1400f8f15
cmp byte [rcx], 0
mov r12, rcx
je 0x1400f8f15
call sub.msvcrt.dll_strlen
mov rbx, rax
lea r8, [rax + 1]
lea rax, [rax + 0x10]
shr rax, 4
shl rax, 4
call fcn.140035990
xor edx, edx
sub rsp, rax
lea rsi, [rsp + 0x20]
mov rcx, rsi
call sub.msvcrt.dll_memset
mov rdx, r12
mov rcx, rsi
mov r8, rbx
call sub.msvcrt.dll_memcpy
movzx eax, byte [rsp + 0x20]
mov rdx, rsi
mov ecx, eax
and ecx, 0xffffffdf
sub ecx, 0x41
cmp cl, 0x19
jbe 0x1400f8ed1
mov rdi, qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
nop
xor ebx, ebx
test al, al
je 0x1400f8e50
cmp al, 0x5c
je 0x1400f8eb0
cmp al, 0x2f
je 0x1400f8eb0
movzx eax, byte [rdx + 1]
xor ebx, ebx
add rdx, 1
test al, al
jne 0x1400f8e36
nop dword [rax]
mov rcx, rsi
call rdi
cmp eax, 0xffffffff
je 0x1400f8e5e
test al, 0x10
jne 0x1400f8e72
mov rcx, rsi
call sub.msvcrt.dll__mkdir
mov r12d, eax
cmp eax, 0xffffffff
je 0x1400f8efb
test rbx, rbx
je 0x1400f8ec0
movzx eax, byte [rbx + 1]
mov byte [rbx], 0x5c
lea rdx, [rbx + 1]
xor ebx, ebx
test al, al
jne 0x1400f8e9c
jmp 0x1400f8e50
movzx eax, byte [rdx + 1]
add rdx, 1
test al, al
je 0x1400f8e30
cmp al, 0x5c
je 0x1400f8e90
cmp al, 0x2f
je 0x1400f8e90
jmp 0x1400f8e30
mov byte [rdx], 0
mov rbx, rdx
jmp 0x1400f8e50
xor r12d, r12d
lea rsp, [rbp - 0x20]
mov eax, r12d
pop rbx
pop rsi
pop rdi
pop r12
pop rbp
ret
cmp byte [rsp + 0x21], 0x3a
jne 0x1400f8e28
movzx ecx, byte [rsi + 2]
cmp cl, 0x5c
je 0x1400f8eee
cmp cl, 0x2f
jne 0x1400f8e28
movzx eax, byte [rsi + 3]
lea rdx, [rsi + 3]
jmp 0x1400f8e28
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], 0x14
lea rsp, [rbp - 0x20]
mov eax, r12d
pop rbx
pop rsi
pop rdi
pop r12
pop rbp
ret
call qword [sym.imp.msvcrt.dll__errno]
mov r12d, 0xffffffff
mov dword [rax], 0x16
jmp 0x1400f8ec3
Function at 0x1400f98d0
Capabilities:
Resolve dns

Disassembly:
push rbp
mov eax, 2
mov rbp, rsp
push r12
push rsi
mov rsi, r8
push rbx
mov ebx, edx
and rsp, 0xfffffffffffffff0
sub rsp, 0x60
cmp edx, 2
mov edx, 0x17
cmovne eax, edx
lea r9, [rsp + 0x28]
lea r8, [rsp + 0x30]
xor edx, edx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x30], 2
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov rcx, qword [rsp + 0x28]
mov r12d, eax
test eax, eax
jne 0x1400f99b8
test rcx, rcx
je 0x1400f99d6
mov rdx, rcx
jmp 0x1400f996e
mov rdx, qword [rdx + 0x28]
mov qword [rsp + 0x28], rdx
test rdx, rdx
je 0x1400f99d0
cmp dword [rdx + 4], ebx
jne 0x1400f9960
cmp ebx, 2
je 0x1400f99a8
cmp ebx, 0x17
jne 0x1400f9960
mov rax, qword [rdx + 0x20]
mov rdx, qword [rax + 0x10]
mov rax, qword [rax + 8]
mov qword [rsi + 8], rdx
mov qword [rsi], rax
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
lea rsp, [rbp - 0x18]
mov eax, r12d
pop rbx
pop rsi
pop r12
pop rbp
ret
mov rax, qword [rdx + 0x20]
mov eax, dword [rax + 4]
mov dword [rsi], eax
jmp 0x1400f9990
test rcx, rcx
jne 0x1400f9990
lea rsp, [rbp - 0x18]
mov eax, r12d
pop rbx
pop rsi
pop r12
pop rbp
ret
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
lea rsp, [rbp - 0x18]
mov r12d, 0xffffffff
pop rbx
mov eax, r12d
pop rsi
pop r12
pop rbp
ret

Function at 0x1400f9bd0
Capabilities:
Send data
Send data on socket

Disassembly:
cmp qword [0x1403ee810], 0
je 0x1400f9c00
sub rsp, 0x28
call fcn.140100eb0
mov rcx, qword [0x1403ee810]
add rsp, 0x28
mov rdx, rax
jmp fcn.1400d2ff0
xor eax, eax
ret
Function at 0x1400fd460
Capabilities:
Send data
Send data on socket

Disassembly:
push r12
push rbp
mov rbp, rcx
push rdi
mov rdi, r8
push rsi
mov rsi, rdx
push rbx
mov ebx, r9d
sub rsp, 0x50
cmp r9d, 3
jg 0x1400fd508
mov edx, 0x18
mov ecx, 1
call sub.msvcrt.dll_calloc
mov r12, rax
test rax, rax
je 0x1400fd549
mov qword [rax], rsi
lea r8, str.dap_proc_queue
mov qword [rax + 8], rdi
mov dword [rax + 0x14], ebx
mov rax, qword [0x1403e7720]
cmp byte [rax], 0
mov eax, 0
mov dword [rsp + 0x40], ebx
cmove r8, rax
lea rax, str.Requested_l_msg:_p__callback:__p__p__pri:__d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x38], rdi
xor r9d, r9d
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rax
call fcn.14005a160
mov rax, qword [rbp + 8]
mov rdx, r12
mov rcx, qword [rax + 8]
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp fcn.1400d2ff0
lea rax, str.Priority_level__d_is_incorrect__should_be_is_in_range__d__d_
mov dword [rsp + 0x28], r9d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
mov r9d, 5
mov ebx, 2
lea r8, str.dap_proc_queue
mov dword [rsp + 0x38], 3
mov dword [rsp + 0x30], 1
call fcn.14005a160
jmp 0x1400fd480
add rsp, 0x50
mov eax, 0xfffffff4
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x1400fd560
Capabilities:
Send data
Send data on socket

Disassembly:
push r13
mov r13, rcx
push r12
push rdi
mov rdi, r8
push rsi
mov rsi, rdx
push rbx
mov ebx, r9d
sub rsp, 0x50
cmp r9d, 3
jg 0x1400fd608
mov edx, 0x18
mov ecx, 1
call sub.msvcrt.dll_calloc
mov r12, rax
test rax, rax
je 0x1400fd649
mov qword [rax], rsi
lea r8, str.dap_proc_queue
mov qword [rax + 8], rdi
mov dword [rax + 0x14], ebx
mov rax, qword [0x1403e7720]
cmp byte [rax], 0
mov eax, 0
mov dword [rsp + 0x40], ebx
cmove r8, rax
lea rax, str.Requested_inter_l_msg:_p__callback:__p__p__pri:__d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x38], rdi
xor r9d, r9d
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rax
call fcn.14005a160
add rsp, 0x50
mov rdx, r12
mov rcx, r13
pop rbx
pop rsi
pop rdi
pop r12
pop r13
jmp fcn.1400d3100
lea rax, str.Priority_level__d_is_incorrect__should_be_is_in_range__d__d_
mov dword [rsp + 0x28], r9d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
mov r9d, 5
mov ebx, 2
lea r8, str.dap_proc_queue
mov dword [rsp + 0x38], 3
mov dword [rsp + 0x30], 1
call fcn.14005a160
jmp 0x1400fd581
add rsp, 0x50
mov eax, 0xfffffff4
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret
Function at 0x1400fd8f0
Capabilities:
Send data
Send data on socket

Disassembly:
push r12
push rbp
mov rbp, r8
push rdi
mov rdi, rcx
mov ecx, 1
push rsi
mov rsi, r9
push rbx
mov rbx, rdx
mov edx, 0x10
sub rsp, 0x40
call sub.msvcrt.dll_calloc
test rax, rax
je 0x1400fd97d
mov qword [rax], rbp
mov r12, rax
lea r8, str.dap_proc_thread
mov r9d, 1
mov qword [rax + 8], rsi
mov rax, qword [0x1403e7720]
cmp byte [rax], 0
mov eax, 0
mov qword [rsp + 0x30], rbx
cmove r8, rax
lea rax, str.Msg_with_arg__p____worker__zu
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rax
call fcn.14005a160
mov rax, qword [rdi + 0x28]
mov rdx, r12
mov rcx, qword [rax + rbx*8]
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp fcn.1400d3100
lea rax, [0x1402c2548]
mov r9d, 8
lea r8, str.dap_proc_thread
mov edx, 0x1a5
mov qword [rsp + 0x20], rax
lea rcx, str.dap_proc_thread_worker_exec_callback_inter
call fcn.14005a160
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x1400fec40
Capabilities:
Create new key via cryptacquirecontext
Generate random numbers via winapi

Disassembly:
sub rsp, 0x48
xor r8d, r8d
xor edx, edx
mov r9d, 1
mov dword [rsp + 0x20], 0xf0000000
lea rcx, [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x1400fec70
movzx eax, word [rsp + 0x36]
add rsp, 0x48
ret
mov rcx, qword [rsp + 0x38]
lea r8, [rsp + 0x36]
mov edx, 2
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x1400fec66
mov rcx, qword [rsp + 0x38]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
movzx eax, word [rsp + 0x36]
add rsp, 0x48
ret

Function at 0x1400feca0
Capabilities:
Delete directory
Delete file

Disassembly:
jmp qword [sym.imp.msvcrt.dll__rmdir]
push r14
mov r14, rcx
push r13
push r12
sub rsp, 0x20
call fcn.140035ff0
mov r12, rax
test rax, rax
je 0x1400fed3e
nop
mov rcx, r12
call fcn.140036200
test rax, rax
je 0x1400fed0d
cmp byte [rax + 8], 0x2e
lea rdx, [rax + 8]
jne 0x1400fecdd
cmp byte [rdx + 1], 0
je 0x1400fecc0
cmp byte [rdx], 0x2e
je 0x1400fed30
xor r8d, r8d
mov rcx, r14
call fcn.1400753b0
mov r13, rax
mov rcx, rax
call fcn.1400feca0
mov rcx, r13
call sub.msvcrt.dll_free
mov rcx, r12
call fcn.140036200
test rax, rax
jne 0x1400feccd
mov rcx, r12
call fcn.140036450
add rsp, 0x20
mov rcx, r14
pop r12
pop r13
pop r14
jmp 0x140044950
cmp byte [rdx + 1], 0x2e
jne 0x1400fece2
cmp byte [rdx + 2], 0
je 0x1400fecc0
jmp 0x1400fece2
add rsp, 0x20
mov rcx, r14
pop r12
pop r13
pop r14
jmp fcn.140044840
Function at 0x140106ea0
Capabilities:
Send data
Send data on socket

Disassembly:
test rcx, rcx
je 0x140106eb0
test rdx, rdx
je 0x140106eb0
jmp fcn.1400d32a0
ret

Function at 0x140109900
Capabilities:
Write file on windows

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
test r8, r8
je 0x1401099cb
test r9d, r9d
je 0x1401099cb
movsxd r9, r9d
mov rbx, r8
shl r9, 4
lea rdi, [r8 + r9]
cmp r8, rdi
jae 0x1401099c7
mov r12, qword [sym.imp.KERNEL32.dll_WriteFile]
mov rbp, rcx
xor esi, esi
lea r13, [rsp + 0x3c]
jmp 0x14010995d
add rbx, 0x10
add esi, dword [rsp + 0x3c]
cmp rdi, rbx
jbe 0x1401099b8
mov qword [rsp + 0x20], 0
mov r9, r13
mov r8d, dword [rbx + 8]
mov rcx, rbp
mov dword [rsp + 0x3c], 0
mov rdx, qword [rbx]
call r12
test eax, eax
jne 0x140109950
cmp qword [rsp + 0xa0], 0
je 0x14010999d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, qword [rsp + 0xa0]
mov dword [rdx], eax
mov rax, 0xffffffffffffffff
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
add rsp, 0x48
mov eax, esi
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
xor eax, eax
jmp 0x1401099a4
lea rax, str.Bad_input_data
mov r9d, 7
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
lea r8, [0x1403e3250]
call fcn.14005a160
mov rax, 0xffffffffffffffff
jmp 0x1401099a4

Function at 0x14010aa50
Capabilities:
Encode data using xor

Disassembly:
test rdx, rdx
je 0x14010aa70
test r8, r8
je 0x14010aa70
test rcx, rcx
je 0x14010aa70
test r9, r9
je 0x14010aa70
cmp qword [rcx + 0x20], 0
je 0x14010aa70
jmp fcn.140071fb0
mov eax, 0xffffffff
ret