joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000abc4
Capabilities:
Create process on windows
Enumerate processes

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x268]
sub rsp, 0x360
mov qword [rbp - 0x60], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
lea rdx, str.vmcompute.exe
lea rcx, [rsp + 0x50]
call fcn.14000b708
nop
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
mov dword [rbp + 0x20], 0x238
lea rdx, [rbp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
xor esi, esi
test eax, eax
jne 0x14000ac39
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dl, sil
jmp 0x14000ace0
or r12, 0xffffffffffffffff
xor eax, eax
mov rcx, r12
lea rdi, [rbp + 0x4c]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov r8, rcx
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rdx, qword [rsp + 0x50]
mov rdi, rcx
mov r9, qword [rsp + 0x60]
cmp r9, rcx
cmovb rdi, r9
lea rcx, [rbp + 0x4c]
test rdi, rdi
je 0x14000ac9b
movzx eax, word [rcx]
cmp word [rdx], ax
jne 0x14000ac92
add rdx, 2
add rcx, 2
dec rdi
jne 0x14000ac7b
jmp 0x14000ac9b
sbb eax, eax
and eax, 0xfffffffe
inc eax
jmp 0x14000ac9d
mov eax, esi
movsxd rcx, eax
mov eax, esi
cmp r9, r8
setne al
cmp r9, r8
cmovb eax, r12d
test rcx, rcx
cmovne eax, ecx
test eax, eax
sete al
mov rcx, rbx
test al, al
jne 0x14000acd8
lea rdx, [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14000ac3d
jmp 0x14000ac28
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dl, 1
test dl, dl
sete dil
cmp qword [rsp + 0x68], 8
jb 0x14000acf8
mov rcx, qword [rsp + 0x50]
call fcn.140021190
test dil, dil
je 0x14000adc2
mov edi, 0x68
mov r8d, edi
xor edx, edx
lea rcx, [rbp - 0x50]
call fcn.140025070
mov dword [rbp - 0x50], edi
mov dword [rbp - 0x14], 1
mov word [rbp - 0x10], si
xor eax, eax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
lea rdx, str.powershell.exe_Enable_WindowsOptionalFeature__FeatureName__Containers_DisposableClientVM___All__Online
lea rcx, [rsp + 0x78]
call fcn.14000b708
lea rdx, [rsp + 0x78]
cmp qword [rbp - 0x70], 8
cmovae rdx, qword [rsp + 0x78]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x50]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x14000adaf
or edx, 0xffffffff
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rbp - 0x70], 8
jb 0x14000adcc
mov rcx, qword [rsp + 0x78]
call fcn.140021190
jmp 0x14000adcc
call fcn.1400086e8
call fcn.14000a9b8
lea r11, [rsp + 0x360]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r12, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x14000adec
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x50
lea rcx, str.21:18:32
call fcn.14002479c
call fcn.1400247b4
mov r11d, eax
mov eax, 0x30c30c31
imul r11d
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul edx, edx, 0x15
sub r11d, edx
imul r11d, r11d, 0x2ee0
movsxd rbx, r11d
call fcn.1400247b4
mov r8d, dword [0x7ffe0014]
movsxd rcx, eax
mov dword [rsp + 0x60], r8d
movabs rdi, 0xfe624e212ac18000
mov qword [rsp + 0x68], rcx
mov ecx, dword [0x7ffe001c]
movabs r11, 0x624dd2f1a9fbe77
mov dword [rsp + 0x64], ecx
mov rax, r11
mov r9, qword [rsp + 0x60]
mov dword [rsp + 0x64], ecx
mov dword [rsp + 0x60], r8d
mov rcx, qword [rsp + 0x60]
add r9, rdi
add rcx, rdi
mul r9
sub r9, rdx
mov rax, r11
shr r9, 1
add r9, rdx
shr r9, 9
add r9, rbx
mul rcx
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 9
cmp rcx, r9
jae 0x14000aee9
mov r8d, 0x7ffe0014
lea r10d, [r8 + 8]
inc qword [rsp + 0x68]
mov eax, dword [r8]
mov dword [rsp + 0x60], eax
mov eax, dword [r10]
mov dword [rsp + 0x64], eax
mov rax, r11
mov rcx, qword [rsp + 0x60]
add rcx, rdi
mul rcx
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 9
cmp rcx, r9
jb 0x14000aeb6
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
movzx r11d, word [rsp + 0x3e]
movzx eax, word [rsp + 0x4e]
movzx ecx, word [rsp + 0x4c]
sub eax, r11d
movd xmm1, eax
movzx eax, word [rsp + 0x3c]
sub ecx, eax
cvtdq2pd xmm1, xmm1
movd xmm0, ecx
divsd xmm1, qword [0x14004bd20]
cvtdq2pd xmm0, xmm0
addsd xmm1, xmm0
movsd xmm0, qword [0x14004c8a8]
comisd xmm0, xmm1
ja 0x14000afaa
call fcn.14000a1cc
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, eax
call qword [sym.imp.USER32.dll_PostThreadMessageA]
and qword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
lea r8, [0x140008f04]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
call fcn.140009510
call fcn.14000abc4
or edx, 0xffffffff
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x14000ce58
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x30], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov esi, edx
mov rdi, rcx
or ebx, 0xffffffff
cmp edx, ebx
jne 0x14000ce88
xor eax, eax
jmp 0x14000d097
mov rdx, qword [rcx + 0x48]
cmp qword [rdx], 0
je 0x14000cebb
mov rcx, qword [rcx + 0x60]
movsxd rax, dword [rcx]
add rax, qword [rdx]
cmp qword [rdx], rax
jae 0x14000cebb
add dword [rcx], ebx
mov rcx, qword [rdi + 0x48]
mov rdx, qword [rcx]
lea rax, [rdx + 1]
mov qword [rcx], rax
mov byte [rdx], sil
mov eax, esi
jmp 0x14000d097
cmp qword [rdi + 0x98], 0
je 0x14000d095
mov rdx, qword [rdi + 0x20]
lea rax, [rdi + 0x88]
cmp qword [rdx], rax
jne 0x14000cef3
mov rcx, qword [rdi + 0x78]
mov rax, qword [rdi + 0x70]
mov qword [rdx], rax
mov rax, qword [rdi + 0x40]
mov qword [rax], rcx
sub ecx, ecx
mov rax, qword [rdi + 0x58]
mov dword [rax], ecx
cmp qword [rdi + 0x80], 0
jne 0x14000cf17
movsx ecx, sil
mov rdx, qword [rdi + 0x98]
call fcn.140023620
cmp eax, ebx
cmovne ebx, esi
jmp 0x14000d095
mov byte [rbp + 0x38], sil
mov edx, reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x10], rdx
and qword [rbp - 0x18], 0
mov byte [rbp - 0x28], 0
lea eax, [rdx - 7]
cmp al, 0xfe
jbe 0x14000cf41
lea rcx, str.string_too_long
call fcn.14003a508
int3
xor ecx, ecx
mov qword [rbp - 0x28], rcx
mov qword [rbp - 0x18], rax
lea rax, [rbp - 0x28]
cmp rdx, 0x10
cmovae rax, rcx
mov byte [rax + 8], cl
mov r9, qword [rbp - 0x28]
mov r10, qword [rbp - 0x10]
lea rdx, [rbp - 0x28]
cmp r10, 0x10
cmovae rdx, r9
lea r8, [rbp - 0x28]
cmovae r8, r9
mov rcx, qword [rdi + 0x80]
mov r10, qword [rcx]
add rdx, qword [rbp - 0x18]
lea rax, [rbp + 0x40]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], r8
lea rax, [rbp + 0x48]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x39]
lea r8, [rbp + 0x38]
lea rdx, [rdi + 0x8c]
call qword [r10 + 0x28]
test eax, eax
js 0x14000d085
cmp eax, 1
jg 0x14000d069
lea rax, [rbp - 0x28]
mov r9, qword [rbp - 0x28]
mov r10, qword [rbp - 0x10]
cmp r10, 0x10
cmovae rax, r9
mov r12, qword [rbp + 0x40]
sub r12, rax
je 0x14000d00e
lea rcx, [rbp - 0x28]
cmp r10, 0x10
cmovae rcx, r9
mov r9, qword [rdi + 0x98]
mov r8, r12
mov edx, 1
call fcn.140021c04
cmp r12, rax
jne 0x14000d045
mov r10, qword [rbp - 0x10]
mov r9, qword [rbp - 0x28]
mov byte [rdi + 0x89], 1
lea rax, [rbp + 0x38]
cmp qword [rbp + 0x48], rax
jne 0x14000d052
test r12, r12
jne 0x14000cf62
cmp qword [rbp - 0x18], 0x20
jae 0x14000d047
xor r8d, r8d
lea edx, [r12 + 8]
lea rcx, [rbp - 0x28]
call fcn.1400038d4
jmp 0x14000cf5a
jmp 0x14000d085
cmp r10, 0x10
jb 0x14000d095
mov rcx, r9
jmp 0x14000d090
cmp r10, 0x10
jb 0x14000ceb4
mov rcx, r9
call fcn.140021190
jmp 0x14000ceb4
cmp eax, 3
jne 0x14000d085
movsx ecx, byte [rbp + 0x38]
mov rdx, qword [rdi + 0x98]
call fcn.140023620
cmp eax, ebx
cmovne ebx, esi
jmp 0x14000d085
cmp qword [rbp - 0x10], 0x10
jb 0x14000d095
mov rcx, qword [rbp - 0x28]
call fcn.140021190
mov eax, ebx
mov rbx, qword [rsp + 0xa0]
add rsp, 0x70
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000e218
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rbp
push rdi
push r13
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rbx, rcx
cmp qword [rcx + 0x80], 0
je 0x14000e3ad
cmp byte [rcx + 0x8a], 0
je 0x14000e3ad
mov rax, qword [rcx]
mov edi, 0xffff
mov edx, edi
call qword [rax + 0x18]
cmp di, ax
jne 0x14000e26d
xor al, al
jmp 0x14000e3af
mov edx, reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x10], rdx
and qword [rbp - 0x18], 0
mov byte [rbp - 0x28], 0
lea r13d, [rdx - 7]
cmp r13b, 0xfe
jbe 0x14000e296
lea rcx, str.string_too_long
call fcn.14003a508
int3
xor ecx, ecx
mov qword [rbp - 0x28], rcx
mov qword [rbp - 0x18], r13
lea rax, [rbp - 0x28]
cmp rdx, 0x10
cmovae rax, rcx
mov byte [rax + 8], cl
mov r9, qword [rbp - 0x28]
mov r10, qword [rbp - 0x10]
lea rdx, [rbp - 0x28]
cmp r10, 0x10
cmovae rdx, r9
lea r8, [rbp - 0x28]
cmovae r8, r9
mov rcx, qword [rbx + 0x80]
mov r10, qword [rcx]
mov rax, qword [rbp - 0x18]
lea r9, [rdx + rax]
lea rax, [rbp + 0x20]
mov qword [rsp + 0x20], rax
lea rdx, [rbx + 0x8c]
call qword [r10 + 0x30]
test eax, eax
je 0x14000e2fb
dec eax
jne 0x14000e372
jmp 0x14000e302
mov byte [rbx + 0x8a], 0
lea rax, [rbp - 0x28]
mov r9, qword [rbp - 0x28]
mov r10, qword [rbp - 0x10]
cmp r10, 0x10
cmovae rax, r9
mov rdi, qword [rbp + 0x20]
sub rdi, rax
je 0x14000e34c
lea rcx, [rbp - 0x28]
cmp r10, 0x10
cmovae rcx, r9
mov r9, qword [rbx + 0x98]
mov r8, rdi
mov edx, 1
call fcn.140021c04
cmp rdi, rax
jne 0x14000e386
mov r10, qword [rbp - 0x10]
mov r9, qword [rbp - 0x28]
cmp byte [rbx + 0x8a], 0
je 0x14000e39f
test rdi, rdi
jne 0x14000e2b7
xor r8d, r8d
mov rdx, r13
lea rcx, [rbp - 0x28]
call fcn.1400038d4
jmp 0x14000e2af
sub eax, 2
je 0x14000e379
jmp 0x14000e386
cmp qword [rbp - 0x10], 0x10
jb 0x14000e3ad
mov rcx, qword [rbp - 0x28]
jmp 0x14000e3a8
cmp qword [rbp - 0x10], 0x10
jb 0x14000e266
mov rcx, qword [rbp - 0x28]
call fcn.140021190
jmp 0x14000e266
cmp r10, 0x10
jb 0x14000e3ad
mov rcx, r9
call fcn.140021190
mov al, 1
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop rdi
pop rbp
ret
Function at 0x1400171c0
Capabilities:
Set socket configuration

Disassembly:
jmp 0x1400198f0
mov dword [rsp + 0x10], edx
sub rsp, 0x38
lea r9, [rsp + 0x48]
mov edx, 0xffff
mov r8d, 0x1002
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
add rsp, 0x38
ret

Function at 0x1400171d0
Capabilities:
Set socket configuration

Disassembly:
jmp 0x140019920
mov dword [rsp + 0x10], edx
sub rsp, 0x38
lea r9, [rsp + 0x48]
mov edx, 0xffff
mov r8d, 0x1001
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
add rsp, 0x38
ret

Function at 0x140019830
Capabilities:
Set socket configuration

Disassembly:
mov dword [rsp + 0x10], edx
sub rsp, 0x38
mov edx, 6
lea r9, [rsp + 0x48]
mov dword [rsp + 0x20], 4
lea r8d, [rdx - 5]
call qword [sym.imp.WS2_32.dll_setsockopt]
add rsp, 0x38
ret

Function at 0x1400198f0
Capabilities:
Set socket configuration

Disassembly:
jmp 0x1400198f0
mov dword [rsp + 0x10], edx
sub rsp, 0x38
lea r9, [rsp + 0x48]
mov edx, 0xffff
mov r8d, 0x1002
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
add rsp, 0x38
ret

Function at 0x140019920
Capabilities:
Set socket configuration

Disassembly:
jmp 0x140019920
mov dword [rsp + 0x10], edx
sub rsp, 0x38
lea r9, [rsp + 0x48]
mov edx, 0xffff
mov r8d, 0x1001
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
add rsp, 0x38
ret

Function at 0x140019950
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
mov dword [rsp + 0x50], 1
mov dword [rsp + 0x48], 0
test edx, edx
jne 0x140019978
lea r9, [rsp + 0x50]
jmp 0x140019982
cmp edx, 1
jne 0x1400199cb
lea r9, [rsp + 0x48]
mov edx, 0xffff
mov r8d, 0xfffffffb
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
lea r9, [rsp + 0x48]
mov edx, 0xffff
mov r8d, 4
mov rcx, rdi
mov dword [rsp + 0x20], 4
mov ebx, eax
call qword [sym.imp.WS2_32.dll_setsockopt]
or eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
cmp edx, 2
jne 0x140019a1e
lea r9, [rsp + 0x48]
mov edx, 0xffff
mov r8d, 0xfffffffb
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
lea r9, [rsp + 0x50]
mov edx, 0xffff
mov r8d, 4
mov rcx, rdi
mov ebx, eax
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
or eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbx, qword [rsp + 0x40]
or eax, 0xffffffff
add rsp, 0x30
pop rdi
ret
Function at 0x140019e40
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rbx, rdx
mov rdi, rcx
lea rdx, [rsp + 0x44]
mov rcx, rbx
mov rbp, r9
mov rsi, r8
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r8d, dword [rsp + 0x60]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x40], eax
mov rax, qword [rsp + 0x40]
cmp rax, rsi
cmovb rax, rsi
xor edx, edx
mov qword [rsp + 0x40], rax
mov ecx, dword [rsp + 0x40]
shr rax, 0x20
mov dword [rsp + 0x20], ecx
mov rcx, rbx
mov r9d, eax
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rcx, rax
mov qword [rdi + 0x10], rax
test rax, rax
jne 0x140019ebe
call fcn.140017120
jmp 0x140019f26
test rsi, rsi
jne 0x140019ed1
mov rax, qword [rsp + 0x40]
sub rax, rbp
mov qword [rdi + 8], rax
jmp 0x140019ed5
mov qword [rdi + 8], rsi
mov edx, dword [rsp + 0x68]
mov rax, qword [rdi + 8]
mov qword [rdi + 0x18], rbp
mov r8d, dword [rdi + 0x1c]
mov r9d, ebp
mov qword [rsp + 0x28], 0
mov dword [rdi + 0x20], edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFileEx]
mov qword [rdi], rax
test rax, rax
jne 0x140019f24
call fcn.140017120
mov rcx, qword [rdi + 0x10]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi + 0x10], 0
mov eax, ebx
jmp 0x140019f26
xor eax, eax
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x14001a010
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x50
xor ebx, ebx
mov rdi, r8
mov rsi, rdx
mov r12, r9
mov dword [rax - 0x38], 0x1c
lea r8, [rax - 0x38]
mov word [rax - 0x30], bx
lea rdx, [rax - 0x30]
cmp dword [rsp + 0x80], ebx
je 0x14001a054
call qword [sym.imp.WS2_32.dll_getsockname]
jmp 0x14001a05a
call qword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
je 0x14001a062
xor eax, eax
jmp 0x14001a0dd
movzx ecx, word [rsp + 0x2a]
mov qword [rsp + 0x60], rbp
movzx ebp, word [rsp + 0x28]
call qword [sym.imp.WS2_32.dll_ntohs]
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x2c]
mov word [r12], ax
movzx eax, word [rsp + 0x28]
movsxd r9, dword [rdi]
cmp eax, 2
mov r8, rsi
cmovne rdx, rcx
mov ecx, eax
call sub.WS2_32.dll_InetNtopW
test rax, rax
je 0x14001a0b8
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, 1
inc eax
mov dword [rdi], eax
jmp 0x14001a0d6
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x57
jne 0x14001a0d6
mov ecx, 0x2e
mov eax, reloc.WS2_32.dll_recv
cmp bp, 2
cmove ecx, eax
mov dword [rdi], ecx
mov rbp, qword [rsp + 0x60]
mov eax, ebx
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r12
ret
Function at 0x14001a120
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rax, rcx
mov rcx, qword [rdx + 8]
mov rbx, rdx
xor edx, edx
mov edi, r9d
mov rsi, r8
test rcx, rcx
je 0x14001a174
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x30], 0x80
lea r9d, [rdx + 1]
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], rdx
mov r8d, 0x80000000
mov rdx, rax
call fcn.140019c90
jmp 0x14001a19e
mov qword [rsp + 0x30], rdx
xor r9d, r9d
mov rcx, rax
lea r8d, [r9 + 1]
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
jne 0x14001a1bd
call fcn.140017120
test eax, eax
jns 0x14001a1c0
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
mov qword [rbx], rax
mov rcx, qword [rbx]
lea rdx, [rsp + 0x5c]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x58], eax
cmp eax, 0xffffffff
jne 0x14001a1e0
call fcn.140017120
test eax, eax
js 0x14001a232
mov rax, qword [rsp + 0x58]
test rax, rax
je 0x14001a220
cmp rax, rdi
ja 0x14001a220
mov rdx, qword [rbx]
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 2
call fcn.140019e40
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
test rax, rax
mov ecx, 0x800700df
mov edx, 0x800703ee
cmove ecx, edx
mov eax, ecx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x14001a450
Capabilities:
Resolve dns

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
movzx eax, word [r8]
mov rdi, r8
movzx ebx, dx
mov r10, rcx
cmp ax, 2
je 0x140019f82
cmp ax, 0x17
je 0x140019f7b
mov ecx, 0x2741
call qword [sym.imp.WS2_32.dll_WSASetLastError]
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov ecx, 0x1c
jmp 0x140019f87
mov ecx, reloc.WS2_32.dll_recv
movzx edx, ax
lea rax, [rsp + 0x50]
mov dword [rsp + 0x50], ecx
mov r9, r8
mov rcx, r10
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_WSAStringToAddressW]
test eax, eax
jne 0x140019f6e
test bx, bx
je 0x140019fbd
movzx ecx, bx
call qword [sym.imp.WS2_32.dll_htons]
mov word [rdi + 2], ax
mov eax, 1
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x100
mov rax, qword [0x140056610]
xor rax, rsp
mov qword [rsp + 0xf0], rax
xor eax, eax
mov rsi, r8
mov rbx, rcx
mov qword [r8 + 2], rax
mov qword [r8 + 0xa], rax
mov qword [r8 + 0x12], rax
mov word [r8 + 0x1a], ax
movzx ebp, dx
lea rcx, [rsp + 0x2c]
lea r8d, [rax + 0x2c]
xor edi, edi
xor edx, edx
mov qword [rsp + 0x20], rdi
call fcn.140025070
movzx eax, word [rsi]
mov dword [rsp + 0x2c], eax
lea rax, [rsp + 0x68]
lea r8d, [rdi + 3]
lea rcx, [rsp + 0x60]
mov rdx, rbx
mov dword [rsp + 0x28], 0xc00
mov qword [rsp + 0x60], rax
call fcn.14001a310
mov rcx, qword [rsp + 0x60]
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x28]
xor edx, edx
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov rcx, qword [rsp + 0x60]
mov ebx, eax
lea rax, [rsp + 0x68]
cmp rcx, rax
je 0x14001a4fb
call fcn.140021a30
test ebx, ebx
je 0x14001a50b
mov ecx, ebx
call qword [sym.imp.WS2_32.dll_WSASetLastError]
xor eax, eax
jmp 0x14001a56e
mov rbx, qword [rsp + 0x20]
mov rdx, rbx
test rbx, rbx
je 0x14001a545
mov eax, dword [rdx + 4]
cmp eax, 2
je 0x14001a530
cmp eax, 0x17
je 0x14001a530
mov rdx, qword [rdx + 0x28]
test rdx, rdx
jne 0x14001a518
jmp 0x14001a545
mov r8, qword [rdx + 0x10]
mov rdx, qword [rdx + 0x20]
mov rcx, rsi
call fcn.1400211b0
mov edi, 1
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
test edi, edi
je 0x14001a561
movzx ecx, bp
call qword [sym.imp.WS2_32.dll_htons]
mov word [rsi + 2], ax
jmp 0x14001a56c
mov ecx, 0x2af9
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov eax, edi
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.1400252d0
mov rbx, qword [rsp + 0x138]
add rsp, 0x100
pop rdi
pop rsi
pop rbp
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, r8
movzx esi, dx
mov rdi, rcx
call fcn.1400196f0
mov r8, rbx
movzx edx, si
mov word [rbx], ax
mov rcx, rdi
test ax, ax
je 0x14001a5e2
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x140019f40
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x14001a450
Function at 0x14001a5a0
Capabilities:
Resolve dns

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
movzx eax, word [r8]
mov rdi, r8
movzx ebx, dx
mov r10, rcx
cmp ax, 2
je 0x140019f82
cmp ax, 0x17
je 0x140019f7b
mov ecx, 0x2741
call qword [sym.imp.WS2_32.dll_WSASetLastError]
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov ecx, 0x1c
jmp 0x140019f87
mov ecx, reloc.WS2_32.dll_recv
movzx edx, ax
lea rax, [rsp + 0x50]
mov dword [rsp + 0x50], ecx
mov r9, r8
mov rcx, r10
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_WSAStringToAddressW]
test eax, eax
jne 0x140019f6e
test bx, bx
je 0x140019fbd
movzx ecx, bx
call qword [sym.imp.WS2_32.dll_htons]
mov word [rdi + 2], ax
mov eax, 1
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x100
mov rax, qword [0x140056610]
xor rax, rsp
mov qword [rsp + 0xf0], rax
xor eax, eax
mov rsi, r8
mov rbx, rcx
mov qword [r8 + 2], rax
mov qword [r8 + 0xa], rax
mov qword [r8 + 0x12], rax
mov word [r8 + 0x1a], ax
movzx ebp, dx
lea rcx, [rsp + 0x2c]
lea r8d, [rax + 0x2c]
xor edi, edi
xor edx, edx
mov qword [rsp + 0x20], rdi
call fcn.140025070
movzx eax, word [rsi]
mov dword [rsp + 0x2c], eax
lea rax, [rsp + 0x68]
lea r8d, [rdi + 3]
lea rcx, [rsp + 0x60]
mov rdx, rbx
mov dword [rsp + 0x28], 0xc00
mov qword [rsp + 0x60], rax
call fcn.14001a310
mov rcx, qword [rsp + 0x60]
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x28]
xor edx, edx
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov rcx, qword [rsp + 0x60]
mov ebx, eax
lea rax, [rsp + 0x68]
cmp rcx, rax
je 0x14001a4fb
call fcn.140021a30
test ebx, ebx
je 0x14001a50b
mov ecx, ebx
call qword [sym.imp.WS2_32.dll_WSASetLastError]
xor eax, eax
jmp 0x14001a56e
mov rbx, qword [rsp + 0x20]
mov rdx, rbx
test rbx, rbx
je 0x14001a545
mov eax, dword [rdx + 4]
cmp eax, 2
je 0x14001a530
cmp eax, 0x17
je 0x14001a530
mov rdx, qword [rdx + 0x28]
test rdx, rdx
jne 0x14001a518
jmp 0x14001a545
mov r8, qword [rdx + 0x10]
mov rdx, qword [rdx + 0x20]
mov rcx, rsi
call fcn.1400211b0
mov edi, 1
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
test edi, edi
je 0x14001a561
movzx ecx, bp
call qword [sym.imp.WS2_32.dll_htons]
mov word [rsi + 2], ax
jmp 0x14001a56c
mov ecx, 0x2af9
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov eax, edi
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.1400252d0
mov rbx, qword [rsp + 0x138]
add rsp, 0x100
pop rdi
pop rsi
pop rbp
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, r8
movzx esi, dx
mov rdi, rcx
call fcn.1400196f0
mov r8, rbx
movzx edx, si
mov word [rbx], ax
mov rcx, rdi
test ax, ax
je 0x14001a5e2
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x140019f40
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x14001a450