joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003d680
Capabilities:
Get token membership

Disassembly:
push rbx
sub rsp, 0x60
xor ebx, ebx
mov dword [rsp + 0x78], 0
lea rax, [rsp + 0x80]
mov word [rsp + 0x7c], 0x500
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x78]
mov dword [rsp + 0x48], ebx
mov r9d, 0x220
mov dword [rsp + 0x40], ebx
lea r8d, [rbx + 0x20]
mov dword [rsp + 0x38], ebx
mov dl, 2
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
movsxd rcx, eax
call fcn.140171260
test rax, rax
jne 0x14003d6e6
add rsp, 0x60
pop rbx
ret
mov rdx, qword [rsp + 0x80]
lea r8, [rsp + 0x70]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
movsxd rcx, eax
call fcn.140171260
test rax, rax
jne 0x14003d71d
lea rdx, str.failed_CheckTokenMembership__:__m
mov ecx, 0x550003
call fcn.14002d450
mov dword [rsp + 0x70], ebx
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [rsp + 0x70]
add rsp, 0x60
pop rbx
ret

Function at 0x14003d7c0
Capabilities:
Check os version

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x140263bb0]
cmp ecx, 0xffffffff
jne 0x14003d8cb
mov qword [rsp + 0x20], rbx
xor ebx, ebx
cmp dword [0x140263bb4], ecx
jne 0x14003d8c6
cmp dword [0x140279340], ebx
jne 0x14003d816
lea rcx, [0x140279340]
mov dword [0x140279340], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
movsxd rcx, eax
call fcn.140171260
test rax, rax
je 0x14003d8d2
mov edx, dword [0x140279344]
movzx r8d, word [0x140279454]
mov eax, dword [0x140279348]
cmp edx, 0xa
jg 0x14003d88e
jne 0x14003d83c
test eax, eax
jns 0x14003d88e
mov ebx, 6
jmp 0x14003d893
cmp edx, 6
jg 0x14003d835
jne 0x14003d86b
cmp eax, 3
jge 0x14003d835
cmp eax, 2
jge 0x14003d864
cmp eax, 1
jge 0x14003d85d
test eax, eax
js 0x14003d887
mov ebx, 3
jmp 0x14003d893
mov ebx, 4
jmp 0x14003d893
mov ebx, 5
jmp 0x14003d893
cmp edx, 5
jg 0x14003d887
jne 0x14003d893
cmp eax, 2
jge 0x14003d887
cmp eax, 1
jge 0x14003d887
test eax, eax
js 0x14003d893
mov ebx, 1
jmp 0x14003d893
mov ebx, 2
jmp 0x14003d893
mov ebx, 7
mov dword [0x140263bb8], eax
mov ecx, ebx
mov eax, dword [0x14027934c]
mov dword [0x140263bbc], eax
mov eax, dword [0x140279350]
mov dword [0x140263bc0], eax
mov dword [0x140263bb0], ebx
mov dword [0x140263bb4], edx
mov dword [0x140263bc4], r8d
mov rbx, qword [rsp + 0x20]
mov eax, ecx
add rsp, 0x28
ret
lea rdx, str.GetVersionEx_failed__m
mov ecx, 0x55
call fcn.140028d40
int3
Function at 0x14003da00
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov r10d, dword [0x140263bb4]
xor ebx, ebx
mov rsi, r9
mov r14, r8
mov r15, rdx
mov rbp, rcx
cmp r10d, 0xffffffff
je 0x14003da58
mov ebx, dword [0x140263bb0]
mov eax, dword [0x140263bb8]
mov edi, dword [0x140263bbc]
mov r11d, dword [0x140263bc0]
mov r9d, dword [0x140263bc4]
jmp 0x14003db3d
cmp dword [0x140279340], ebx
jne 0x14003da88
lea rcx, [0x140279340]
mov dword [0x140279340], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
movsxd rcx, eax
call fcn.140171260
test rax, rax
je 0x14003db8f
mov r10d, dword [0x140279344]
mov eax, dword [0x140279348]
mov edi, dword [0x14027934c]
mov r11d, dword [0x140279350]
movzx r9d, word [0x140279454]
cmp r10d, 0xa
jg 0x14003db11
jne 0x14003dabd
test eax, eax
jns 0x14003db11
mov ebx, 6
jmp 0x14003db16
cmp r10d, 6
jg 0x14003dab6
jne 0x14003daed
cmp eax, 3
jge 0x14003dab6
cmp eax, 2
jge 0x14003dae6
cmp eax, 1
jge 0x14003dadf
test eax, eax
js 0x14003db0a
mov ebx, 3
jmp 0x14003db16
mov ebx, 4
jmp 0x14003db16
mov ebx, 5
jmp 0x14003db16
cmp r10d, 5
jg 0x14003db0a
jne 0x14003db16
cmp eax, 2
jge 0x14003db0a
cmp eax, 1
jge 0x14003db0a
test eax, eax
js 0x14003db16
mov ebx, 1
jmp 0x14003db16
mov ebx, 2
jmp 0x14003db16
mov ebx, 7
mov dword [0x140263bb0], ebx
mov dword [0x140263bb4], r10d
mov dword [0x140263bb8], eax
mov dword [0x140263bbc], edi
mov dword [0x140263bc0], r11d
mov dword [0x140263bc4], r9d
test rbp, rbp
je 0x14003db45
mov dword [rbp], ebx
test r15, r15
je 0x14003db4d
mov dword [r15], r10d
test r14, r14
je 0x14003db55
mov dword [r14], eax
test rsi, rsi
je 0x14003db5c
mov dword [rsi], edi
mov rax, qword [rsp + 0x60]
test rax, rax
je 0x14003db69
mov dword [rax], r11d
mov rax, qword [rsp + 0x68]
test rax, rax
je 0x14003db76
mov dword [rax], r9d
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
lea rdx, str.GetVersionEx_failed__m
mov ecx, 0x55
call fcn.140028d40
int3
Function at 0x14003dbb0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov r14, rcx
mov qword [rsp + 0x78], 0
mov ebp, r8d
lea rcx, [rsp + 0x58]
mov esi, edx
lea r8, [0x14003dd00]
sub rcx, 8
lea rdx, [rsp + 0x38]
call fcn.140029110
mov edx, 0x104
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x30], 0
mov rdi, rax
or rbx, 0xffffffffffffffff
call fcn.14002aec0
test ebp, ebp
je 0x14003dc45
call qword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
mov ecx, eax
lea rdx, [rsp + 0x30]
call sub.WTSAPI32.dll_WTSQueryUserToken
movsxd rcx, eax
call fcn.140171260
test rax, rax
jne 0x14003dc45
lea rdx, str.failed_get_token_for_active_user__m
mov rcx, rdi
call fcn.14002a280
jmp 0x14003dcbd
mov rax, qword [rsp + 0x78]
xor r9d, r9d
mov r8, qword [rsp + 0x30]
mov edx, esi
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x14003dc6e
lea rdx, str.failed_get_path_for_cid__d
jmp 0x14003dcb2
mov rdx, qword [rsp + 0x78]
mov rcx, r14
call fcn.14002a460
mov rax, qword [r14]
test rax, rax
je 0x14003dcab
cmp byte [rax], 0
je 0x14003dcab
nop dword [rax + rax]
cmp byte [rax + rbx + 1], 0
lea rbx, [rbx + 1]
jne 0x14003dc90
cmp byte [rbx + rax - 1], 0x5c
jne 0x14003dca7
mov byte [rbx + rax - 1], 0
xor ebx, ebx
jmp 0x14003dcca
lea rdx, str.got_empty_path_for__d
mov r8d, esi
mov rcx, rdi
call fcn.14002a330
mov rdx, qword [rdi]
mov ecx, 0x550003
call fcn.14002d450
test ebp, ebp
je 0x14003dcd8
lea rcx, [rsp + 0x30]
call fcn.1400538e0
lea rcx, [rsp + 0x78]
call fcn.14002ae10
mov rbp, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x14003f510
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
movsxd rbx, edx
mov r15, r8
mov edx, 0x3d
movsxd rbp, r9d
mov rsi, rcx
call fcn.140174c6c
mov r14, rbx
test rax, rax
jne 0x14003f54a
lea rax, [rbx + rsi]
movzx ebx, word [rax - 3]
lea rcx, [rsi + 3]
movzx edi, byte [rax - 1]
sub rax, 3
sub rax, rsi
mov rdx, rsi
mov r8, rax
call fcn.140174ed0
mov word [rsi], bx
lea r11, [r14 + rsi]
mov byte [rsi + 2], dil
lea rbx, [r15 + rbp]
cmp byte [rsi], 0
mov r9, r15
je 0x14003f650
lea r10, [r15 + 3]
lea rdi, [0x140263c20]
nop
cmp rsi, r11
jae 0x14003f650
movzx eax, byte [rsi]
cmp al, 0x3d
je 0x14003f5ad
movzx eax, al
cmp byte [rax + rdi], 0xff
je 0x14003f650
xor r8d, r8d
xor eax, eax
or rcx, 0xffffffffffffffff
inc rcx
cmp byte [rsi + rcx], al
jne 0x14003f5b6
cmp rcx, 4
jb 0x14003f673
xor edx, edx
nop word [rax + rax]
movzx ecx, byte [rdx + rsi]
shl eax, 6
cmp cl, 0x3d
jne 0x14003f5e1
inc r8d
jmp 0x14003f5f3
test r8d, r8d
jne 0x14003f673
movzx ecx, cl
movsx ecx, byte [rcx + rdi]
add eax, ecx
inc rdx
cmp rdx, 4
jl 0x14003f5d0
cmp r8d, 2
ja 0x14003f673
cmp eax, 0xffffffff
je 0x14003f673
mov ecx, r8d
add rcx, rbx
cmp r10, rcx
ja 0x14003f673
mov ecx, eax
inc r10
shr ecx, 0x10
mov byte [r9], cl
inc r9
cmp r8d, 2
jae 0x14003f634
mov ecx, eax
shr ecx, 8
mov byte [r9], cl
inc r9
inc r10
cmp r8d, 1
jae 0x14003f643
mov byte [r9], al
inc r9
inc r10
add rsi, 4
cmp byte [rsi], 0
jne 0x14003f590
mov byte [r9], 0
sub r9d, r15d
mov eax, r9d
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
or eax, 0xffffffff
jmp 0x14003f65a
Function at 0x14003f710
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
movsxd r11, edx
mov rbp, r8
add r11, rcx
mov r10, r8
cmp rcx, r11
jae 0x14003f80b
movsxd rax, r9d
lea rsi, [r8 - 4]
add rsi, rax
lea r9, [rcx + 2]
lea r8, [rcx + 1]
lea r14, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
cmp r8, r11
jb 0x14003f75e
xor dil, dil
jmp 0x14003f762
movzx edi, byte [r8]
cmp r9, r11
jb 0x14003f76b
xor bl, bl
jmp 0x14003f76f
movzx ebx, byte [r9]
cmp r10, rsi
jae 0x14003f832
movzx eax, byte [rcx]
shr rax, 2
movzx eax, byte [rax + r14]
mov byte [r10], al
movsx rdx, byte [rcx]
inc rcx
and edx, 3
movzx eax, dil
shr rax, 4
lea rdi, [r10 + 3]
shl rdx, 4
or rdx, rax
movzx eax, byte [rdx + r14]
mov byte [r10 + 1], al
mov byte [rdi], 0x3d
mov byte [r10 + 2], 0x3d
mov byte [r10 + 4], 0
cmp rcx, r11
je 0x14003f82c
movsx rdx, byte [rcx]
inc rcx
and edx, 0xf
movzx eax, bl
shr rax, 6
shl rdx, 2
or rdx, rax
movzx eax, byte [rdx + r14]
mov byte [r10 + 2], al
lea r10, [rdi + 1]
cmp rcx, r11
je 0x14003f80b
movsx rax, byte [rcx]
add r8, 3
and eax, 0x3f
inc rcx
add r9, 3
movzx eax, byte [rax + r14]
mov byte [rdi], al
cmp rcx, r11
jb 0x14003f754
mov byte [r10], 0
sub r10d, ebp
mov eax, r10d
mov rbx, qword [rsp + 0x10]
mov rbp, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
pop r14
ret
add r10, 4
jmp 0x14003f80b
or eax, 0xffffffff
jmp 0x14003f815
Function at 0x140040160
Capabilities:
Connect pipe

Disassembly:
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov r14, rcx
mov edi, r8d
mov esi, edx
lea rcx, [rsp + 0x68]
sub rcx, 8
lea r8, [0x140046910]
lea rdx, [rsp + 0x88]
call fcn.140029110
mov qword [rsp + 0x88], rax
call fcn.140171960
mov r9d, dword [0x1402794ec]
lea rdx, str..pipehola__d__d
mov rcx, qword [rsp + 0x88]
mov r8d, eax
call fcn.14002a330
mov rcx, qword [rsp + 0x88]
mov eax, 7
inc dword [0x1402794ec]
mov r8d, 1
mov qword [rsp + 0x38], 0
test edi, edi
mov dword [rsp + 0x30], 0xffffffff
mov edx, 0x40000003
mov rcx, qword [rcx]
cmovne r8d, eax
mov dword [rsp + 0x28], 0x1000
mov r9d, 0xff
mov dword [rsp + 0x20], 0x1000
call fcn.1400539a0
mov rbp, rax
test eax, eax
je 0x14004030d
mov qword [rsp + 0x70], rbx
xor edx, edx
movsxd rbx, ebp
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
mov rcx, qword [rsp + 0x88]
mov edx, 0x40000000
mov eax, 0xc0000000
mov qword [rsp + 0x30], 0
cmp esi, 1
mov dword [rsp + 0x28], 0x40000000
mov dword [rsp + 0x20], 3
mov rcx, qword [rcx]
cmove edx, eax
xor r9d, r9d
xor r8d, r8d
call fcn.140053920
mov rsi, rax
test eax, eax
je 0x14004031f
mov eax, edi
mov rcx, rbx
neg eax
sbb edx, edx
xor r9d, r9d
and edx, 2
xor r8d, r8d
mov dword [rsp + 0x80], edx
lea rdx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
movsxd rcx, eax
call fcn.140171260
test rax, rax
je 0x140040331
mov eax, 0x44
test edi, edi
mov ebx, 0x24
mov ecx, esi
cmovne ebx, eax
lea rax, [rsp + 0x40]
mov r9d, ebx
mov qword [rsp + 0x20], rax
xor r8d, r8d
xor edx, edx
call fcn.14003f880
mov dword [r14 + 4], eax
mov r9d, ebx
lea rax, [rsp + 0x40]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
mov ecx, ebp
call fcn.14003f880
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov dword [r14], eax
xor eax, eax
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
lea rdx, str.CreateNamedPipe_failed:__m
mov ecx, 0x4b0000
call fcn.14002d920
int3
lea rdx, str.CreateFile_failed:__m
mov ecx, 0x4b0000
call fcn.14002d920
int3
lea rdx, str.SetNamedPipeHandleState_failed:__m
mov ecx, 0x4b0000
call fcn.14002d920
int3
xor r8d, r8d
lea edx, [r8 + 2]
jmp 0x140040160
Function at 0x140040350
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
cmp qword [0x14027e030], 0
mov r14d, r9d
mov rdi, r8
movsxd rsi, ecx
mov r15, rdx
je 0x1400403e6
mov rax, qword gs:[0x58]
mov ecx, 0x22cc
mov r10, qword [rax]
cmp dword [rcx + r10], 0
jne 0x1400403e6
lea rcx, [0x14027dfa0]
call sub.KERNEL32.dll_EnterCriticalSection
mov rax, qword [0x14027e020]
lea rcx, [0x14027dfa0]
mov rbp, rsi
mov rbx, qword [rax + rsi*8]
call sub.KERNEL32.dll_LeaveCriticalSection
test dword [rbx + 0x68], 0x10000000
jne 0x1400403e9
xor eax, eax
mov r9d, r14d
mov qword [rsp + 0x28], rax
mov r8, rdi
mov rdx, r15
mov qword [rsp + 0x20], rax
mov ecx, esi
call fcn.140040530
jmp 0x1400404fa
mov rbp, rsi
lea rcx, [0x14027dfa0]
call sub.KERNEL32.dll_EnterCriticalSection
mov rax, qword [0x14027e020]
lea rcx, [0x14027dfa0]
mov rbx, qword [rax + rbp*8]
call sub.KERNEL32.dll_LeaveCriticalSection
mov eax, dword [rbx + 0x68]
test al, 0x40
je 0x140040513
cmp qword [rbx + 0x40], 0
je 0x14004044d
cmp dword [rbx + 0xc], 2
jne 0x14004044d
cmp word [rbx + 0x6c], 0
je 0x14004044d
xor eax, eax
mov r9d, r14d
mov qword [rsp + 0x28], rax
mov r8, rdi
mov rdx, r15
mov qword [rsp + 0x20], rax
mov rcx, rbx
call fcn.140047f90
jmp 0x1400404fa
test eax, 0x80000004
je 0x140040470
xor eax, eax
mov r9d, r14d
mov r8, rdi
mov dword [rsp + 0x20], eax
mov rdx, r15
mov rcx, rbx
call fcn.140047d70
jmp 0x1400404fa
test al, 1
je 0x1400404d6
movsxd rcx, dword [rbx + 0x70]
mov r9d, r14d
mov r8d, edi
mov rdx, r15
call qword [sym.imp.WS2_32.dll_recv]
movsxd rcx, eax
call fcn.140171260
mov rbx, rax
test eax, eax
jns 0x1400404d1
mov rcx, qword gs:[0x58]
mov eax, 0x2f80
mov rdx, qword [rcx]
mov rax, qword [rax + rdx]
test rax, rax
jne 0x1400404b5
call fcn.1401762d4
cmp dword [rax], 0x2738
jne 0x1400404d1
mov r8, rdi
lea rdx, str.buf_to_small___d__for_packet_recv
mov ecx, 0x4b0003
call fcn.14002d450
movsxd rax, ebx
jmp 0x1400404fa
lea r9, str.invalid_type:__d
mov dword [rsp + 0x20], eax
mov r8d, 0x75c
lea rdx, str.vsock_recv
mov ecx, 0x4b0202
call fcn.14002d680
cdqe
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
lea rdx, str.recv_from_non_packet_socket
mov ecx, 0x4b0000
call fcn.14002d920
int3
Function at 0x1400435d0
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
push rbx
push rdi
push r14
sub rsp, 0x2c0
mov r14, r8
lea rcx, [rsp + 0x2d8]
mov rbx, rdx
lea r8, [0x140046910]
sub rcx, 8
lea rdx, [rsp + 0x30]
mov rdi, r9
call fcn.140029110
xor edx, edx
mov qword [rsp + 0x30], rax
lea rcx, [0x1401ab510]
mov qword [rsp + 0x80], rdx
mov qword [rsp + 0x68], rcx
lea rcx, [0x1401ab518]
mov qword [rsp + 0x70], rcx
lea rcx, str.except
mov qword [rsp + 0x78], rcx
xor ecx, ecx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x38], rcx
test rbx, rbx
je 0x140043800
mov qword [rsp + 0x2e0], rbp
mov rax, rbx
mov qword [rsp + 0x2b8], rsi
mov ebp, edx
mov qword [rsp + 0x2b0], r12
mov qword [rsp + 0x2a8], r13
mov qword [rsp + 0x2a0], r15
cmp dword [rax], 0
mov esi, edx
jbe 0x1400437c1
mov r15, qword [rsp + rbp + 0x48]
lea r12, [rsp + 0x90]
cmp rax, rdi
lea r13, [rsp + 0x90]
lea rcx, [rsp + 0x90]
cmovne r12, rdx
cmp rax, r14
lea r14, [rax + 8]
cmovne r13, rdx
cmp rax, rbx
cmovne rcx, rdx
mov qword [rsp + 0x40], rcx
nop word [rax + rax]
movsxd rdi, dword [r14]
lea rax, [rsp + 0x38]
mov rdx, rcx
mov qword [rsp + 0x98], rdi
mov ecx, 1
mov qword [rsp + 0x20], rax
mov r9, r12
mov dword [rsp + 0x90], 1
mov r8, r13
call qword [sym.imp.WS2_32.dll_select]
movsxd rcx, eax
call fcn.140171260
test eax, eax
jns 0x140043793
lea rcx, [0x14027dfa0]
call sub.KERNEL32.dll_EnterCriticalSection
mov edx, dword [0x14027dfd0]
xor eax, eax
mov r8, qword [0x14027e020]
xor ebx, ebx
test edx, edx
jle 0x140043758
mov rcx, qword [r8 + rax*8]
test rcx, rcx
je 0x140043758
cmp dword [rcx + 0x70], edi
je 0x140043758
inc ebx
inc rax
cmp ebx, edx
jl 0x140043741
cmp ebx, edx
je 0x140043763
cmp qword [r8 + rax*8], 0
jne 0x140043766
or ebx, 0xffffffff
lea rcx, [0x14027dfa0]
call sub.KERNEL32.dll_LeaveCriticalSection
mov r8, qword [rsp + rbp + 0x68]
lea rdx, str._s__d__osfd_d_vfd_d_
mov rcx, qword [rsp + 0x30]
mov r9d, esi
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], edi
call fcn.140029f80
mov rcx, qword [rsp + 0x40]
inc esi
add r14, 8
cmp esi, dword [r15]
jb 0x1400436e0
mov rbx, qword [rsp + 0x2e8]
xor edx, edx
mov rdi, qword [rsp + 0x2f8]
mov r14, qword [rsp + 0x2f0]
mov rax, qword [rsp + rbp + 0x50]
add rbp, 8
test rax, rax
jne 0x140043694
mov rax, qword [rsp + 0x30]
mov r15, qword [rsp + 0x2a0]
mov r13, qword [rsp + 0x2a8]
mov r12, qword [rsp + 0x2b0]
mov rsi, qword [rsp + 0x2b8]
mov rbp, qword [rsp + 0x2e0]
lea rdx, [0x1401ab540]
mov rcx, rax
call fcn.14002aa10
mov r8, qword [rsp + 0x30]
lea rdx, str.vsock_select__:_a_member_of_fd_set_was_invalid:__s
mov ecx, 0x4b0000
mov r8, qword [r8]
call fcn.14002d920
int3
Function at 0x140043930
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov rax, qword gs:[0x58]
mov rbx, rcx
mov esi, 0x2f80
add rsi, qword [rax]
mov rax, qword [rsi]
test rax, rax
jne 0x14004395c
call fcn.1401762d4
mov r14d, dword [rax]
xor ecx, ecx
mov rax, qword [rbx + 0x138]
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], rcx
mov rax, qword [rbx + 0x138]
mov qword [rax + 0x18], rbx
lock inc dword [rbx + 0x120]
mov rcx, qword [rbx + 0x80]
or dword [rbx + 0x68], 0x400
call fcn.14005a1e0
mov rcx, qword [rbx + 0x80]
lea r9, [rsp + 0x60]
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x70]
call fcn.14005a110
mov rcx, rbx
call fcn.140048f80
movsxd rcx, dword [rbx + 0x70]
lea rax, [0x1400418d0]
mov r9, qword [rbx + 0x138]
mov r8d, dword [rsp + 0x60]
mov rdx, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadFileEx]
movsxd rcx, eax
call fcn.140171260
xor edi, edi
mov rbp, rax
test eax, eax
jne 0x140043ae7
mov rax, qword [rsi]
test rax, rax
jne 0x140043a08
call fcn.1401762d4
mov ecx, dword [rax]
mov edx, 4
mov dword [rsp + 0x28], reloc.WS2_32.dll_setsockopt
mov r9d, 0xe8
mov dword [rsp + 0x20], 6
lea r8d, [rdx - 3]
call fcn.14003fba0
test eax, eax
je 0x140043b0a
lea rcx, [0x14027dfa0]
call sub.KERNEL32.dll_EnterCriticalSection
cmp rbx, qword [0x14027dfe8]
mov rcx, qword [rbx + 0xf0]
jne 0x140043a5b
mov qword [0x14027dfe8], rcx
jmp 0x140043a70
mov rax, qword [rbx + 0xf8]
mov qword [rax + 0xf0], rcx
mov rcx, qword [0x14027dfe8]
mov rdx, qword [rbx + 0xf0]
test rdx, rdx
je 0x140043a8c
mov rax, qword [rbx + 0xf8]
mov qword [rdx + 0xf8], rax
jmp 0x140043a9f
test rcx, rcx
je 0x140043a9f
mov rax, qword [rbx + 0xf8]
mov qword [rcx + 0xf8], rax
lea rcx, [0x14027dfa0]
mov qword [rbx + 0xf0], rdi
mov qword [rbx + 0xf8], rdi
call sub.KERNEL32.dll_LeaveCriticalSection
or dword [rbx + 0x68], 0x4100000
mov rcx, rbx
call fcn.140049020
and dword [rbx + 0x68], 0xfffffbff
or eax, 0xffffffff
lock xadd dword [rbx + 0x120], eax
cmp eax, 1
jne 0x140043ae7
mov rcx, rbx
call fcn.140040f80
mov rax, qword [rsi]
test rax, rax
jne 0x140043af4
call fcn.1401762d4
test ebp, ebp
mov dword [rax], r14d
sete dil
mov eax, edi
add rsp, 0x30
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
lea rdx, str.cant_read_from_handle:__m
mov ecx, 0x4b0000
call fcn.14002d920
int3
Function at 0x140043b20
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
xor ecx, ecx
mov rax, qword [rbx + 0x138]
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], rcx
mov rax, qword [rbx + 0x138]
mov qword [rax + 0x18], rbx
lock inc dword [rbx + 0x120]
or dword [rbx + 0x68], 0x400
mov rcx, rbx
call fcn.140048f80
movsxd rcx, dword [rbx + 0x70]
lea rax, [0x1400418d0]
mov r9, qword [rbx + 0x138]
lea rdx, [rbx + 0x164]
mov r8d, 1
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadFileEx]
movsxd rdi, eax
mov rcx, rdi
call fcn.140171260
test rax, rax
jne 0x140043be3
mov rcx, qword gs:[0x58]
mov eax, 0x2f80
mov rdx, qword [rcx]
mov rax, qword [rax + rdx]
test rax, rax
jne 0x140043bbf
call fcn.1401762d4
mov ecx, dword [rax]
mov edx, 3
mov dword [rsp + 0x20], 6
lea r9d, [rdx + 0x6a]
lea r8d, [r9 + 0x7b]
call fcn.14003fba0
test eax, eax
je 0x140043ca9
test edi, edi
jne 0x140043c9e
lea rcx, [0x14027dfa0]
call sub.KERNEL32.dll_EnterCriticalSection
cmp rbx, qword [0x14027dfe8]
mov rcx, qword [rbx + 0xf0]
jne 0x140043c10
mov qword [0x14027dfe8], rcx
jmp 0x140043c25
mov rax, qword [rbx + 0xf8]
mov qword [rax + 0xf0], rcx
mov rcx, qword [0x14027dfe8]
mov rdx, qword [rbx + 0xf0]
test rdx, rdx
je 0x140043c41
mov rax, qword [rbx + 0xf8]
mov qword [rdx + 0xf8], rax
jmp 0x140043c54
test rcx, rcx
je 0x140043c54
mov rax, qword [rbx + 0xf8]
mov qword [rcx + 0xf8], rax
xor eax, eax
lea rcx, [0x14027dfa0]
mov qword [rbx + 0xf0], rax
mov qword [rbx + 0xf8], rax
call sub.KERNEL32.dll_LeaveCriticalSection
and dword [rbx + 0x68], 0xfffffbff
or eax, 0xffffffff
lock xadd dword [rbx + 0x120], eax
cmp eax, 1
jne 0x140043c8f
mov rcx, rbx
call fcn.140040f80
or dword [rbx + 0x68], 0x100000
mov rcx, rbx
call fcn.140049020
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
lea rdx, str.cant_read_from_handle:__m
mov ecx, 0x4b0000
call fcn.14002d920
int3
Function at 0x1400444b0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x40
test dword [rcx + 0x68], 0x2000
mov rbx, rcx
je 0x1400444cd
call sub.ntdll.dll_NtTestAlert
add rsp, 0x40
pop rbx
ret
mov rcx, qword [rcx + 0x88]
lea r8, [rsp + 0x50]
mov qword [rsp + 0x60], rbp
lea rdx, [rsp + 0x58]
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rdi
call fcn.14005a580
cmp dword [rsp + 0x50], 0
je 0x14004468e
mov rax, qword [rbx + 0x140]
or dword [rbx + 0x68], 0x2000
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], rcx
mov rax, qword [rbx + 0x140]
mov qword [rax + 0x18], rbx
lock inc dword [rbx + 0x120]
mov rcx, rbx
call fcn.140049140
movsxd rcx, dword [rbx + 0x70]
lea rax, [0x140041a00]
mov r9, qword [rbx + 0x140]
mov r8d, dword [rsp + 0x50]
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteFileEx]
movsxd rcx, eax
call fcn.140171260
mov ebp, 0x2f80
mov rsi, rax
test eax, eax
jne 0x140044660
mov rcx, qword gs:[0x58]
mov edi, ebp
add rdi, qword [rcx]
mov rax, qword [rdi]
test rax, rax
jne 0x140044590
call fcn.1401762d4
cmp dword [rax], 0xe8
jne 0x1400446b1
mov rax, qword [rdi]
test rax, rax
jne 0x1400445a9
call fcn.1401762d4
cmp dword [rax], 0xe8
jne 0x140044660
lea rcx, [0x14027dfa0]
call sub.KERNEL32.dll_EnterCriticalSection
cmp rbx, qword [0x14027dff0]
mov rcx, qword [rbx + 0xe0]
jne 0x1400445da
mov qword [0x14027dff0], rcx
jmp 0x1400445ef
mov rax, qword [rbx + 0xe8]
mov qword [rax + 0xe0], rcx
mov rcx, qword [0x14027dff0]
mov rdx, qword [rbx + 0xe0]
test rdx, rdx
je 0x14004460b
mov rax, qword [rbx + 0xe8]
mov qword [rdx + 0xe8], rax
jmp 0x14004461e
test rcx, rcx
je 0x14004461e
mov rax, qword [rbx + 0xe8]
mov qword [rcx + 0xe8], rax
xor eax, eax
lea rcx, [0x14027dfa0]
mov qword [rbx + 0xe0], rax
mov qword [rbx + 0xe8], rax
call sub.KERNEL32.dll_LeaveCriticalSection
mov eax, dword [rbx + 0x68]
btr eax, 0xd
bts eax, 0x1a
mov dword [rbx + 0x68], eax
or eax, 0xffffffff
lock xadd dword [rbx + 0x120], eax
cmp eax, 1
jne 0x140044660
mov rcx, rbx
call fcn.140040f80
cmp dword [rsp + 0x50], 0
je 0x14004468e
test esi, esi
jne 0x14004469c
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov rax, qword [rbp + rcx]
test rax, rax
jne 0x140044686
call fcn.1401762d4
cmp dword [rax], 0xe8
jne 0x14004469c
mov eax, dword [rbx + 0x68]
test al, 0x10
jne 0x14004469c
btr eax, 0xd
mov dword [rbx + 0x68], eax
mov rsi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x30]
add rsp, 0x40
pop rbx
ret
lea rdx, str.WriteFileEx_failed:__m
mov ecx, 0x4b0000
call fcn.14002d920
int3