joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14008d2e0
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x140144098]
xor rax, rsp
mov qword [rsp + 0x68], rax
xor esi, esi
mov dword [rsp + 0x20], 4
mov eax, esi
lea r9, [rsp + 0x50]
cmp byte [rcx + 0x98b], al
mov rdi, rdx
mov rbx, rcx
mov edx, 0xffff
setne al
lea r8d, [rsi + 8]
mov rcx, rdi
mov dword [rsp + 0x50], eax
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
js 0x14008d3a6
mov ecx, dword [rbx + 0x914]
mov dword [rsp + 0x58], 1
call fcn.14008d5b0
mov ecx, dword [rbx + 0x918]
imul edx, eax, 0x3e8
mov dword [rsp + 0x50], edx
mov dword [rsp + 0x5c], edx
call fcn.14008d5b0
imul edx, eax, 0x3e8
lea r9d, [rsi + 0xc]
mov qword [rsp + 0x40], rsi
lea rax, [rsp + 0x54]
mov qword [rsp + 0x38], rsi
lea r8, [rsp + 0x58]
mov qword [rsp + 0x30], rax
mov rcx, rdi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x50], edx
mov dword [rsp + 0x60], edx
mov edx, 0x98000004
mov qword [rsp + 0x20], rsi
call qword [sym.imp.WS2_32.dll_WSAIoctl]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1400a9630
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x14008d3d0
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x38
mov rcx, rdx
mov dword [rsp + 0x50], 1
mov edx, 6
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x50]
lea r8d, [rdx - 5]
call qword [sym.imp.WS2_32.dll_setsockopt]
add rsp, 0x38
ret
Function at 0x14008d920
Capabilities:
Get common file path

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x20
mov rbx, rcx
xor ebp, ebp
lea rcx, [0x14011e548]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdi, rax
test rax, rax
jne 0x14008d94a
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
lea rdx, str.LoadLibraryExA
mov qword [rsp + 0x48], r14
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x14011e568]
mov rcx, rbx
mov r14, rax
call fcn.1400da508
test rax, rax
je 0x14008d9ad
mov rcx, rbx
test r14, r14
je 0x14008d997
xor edx, edx
lea r8d, [rdx + 8]
call r14
mov r14, qword [rsp + 0x48]
mov rbp, rax
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r14, qword [rsp + 0x48]
mov rbp, rax
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
test r14, r14
je 0x14008d9e5
lea rdx, str.AddDllDirectory
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14008d9e5
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call r14
mov r14, qword [rsp + 0x48]
mov rbp, rax
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
xor edx, edx
mov qword [rsp + 0x50], r15
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov r15d, eax
test eax, eax
je 0x14008daa8
mov qword [rsp + 0x40], rsi
mov rsi, 0xffffffffffffffff
mov rdx, rsi
nop
inc rdx
cmp byte [rbx + rdx], bpl
jne 0x14008da10
lea ecx, [rax + 1]
add rcx, rdx
call qword [fcn.1400baec0]
mov rdi, rax
test rax, rax
je 0x14008da9a
mov edx, r15d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x14008da9a
mov rax, rsi
cmp byte [rdi + rax + 1], bpl
lea rax, [rax + 1]
jne 0x14008da40
mov ecx, 0x5c
mov word [rax + rdi], cx
inc rsi
cmp byte [rdi + rsi], bpl
jne 0x14008da54
mov rcx, rdi
sub rcx, rbx
add rcx, rsi
nop word [rax + rax]
movzx eax, byte [rbx]
mov byte [rcx + rbx], al
lea rbx, [rbx + 1]
test al, al
jne 0x14008da70
mov rcx, rdi
test r14, r14
je 0x14008da91
xor edx, edx
lea r8d, [rdx + 8]
call r14
jmp 0x14008da97
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbp, rax
mov rcx, rdi
call qword [fcn.1400baeb8]
mov rsi, qword [rsp + 0x40]
mov r15, qword [rsp + 0x50]
mov rax, rbp
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
Function at 0x14008db10
Capabilities:
Initialize winsock library

Disassembly:
sub rsp, 0x1e8
mov rax, qword [0x140144098]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
test cl, 2
je 0x14008db76
mov ecx, 0x202
lea rdx, [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x14008db59
movzx eax, word [rsp + 0x30]
cmp al, 2
jne 0x14008db53
shr ax, 8
cmp al, 2
je 0x14008db76
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 2
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.1400a9630
add rsp, 0x1e8
ret
call fcn.1400a2650
test eax, eax
jne 0x14008dbef
lea rcx, str.iphlpapi.dll
call fcn.14008d920
mov qword [0x140145370], rax
test rax, rax
je 0x14008dbbc
lea rdx, str.if_nametoindex
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140145368]
test rax, rax
cmovne rcx, rax
mov qword [0x140145368], rcx
xor edx, edx
mov dword [rsp + 0x20], 3
mov r9d, 2
xor r8d, r8d
lea ecx, [rdx + 6]
call fcn.1400a1590
test al, al
lea rcx, [0x140146f30]
setne byte [0x140146f28]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xor eax, eax
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.1400a9630
add rsp, 0x1e8
ret

Function at 0x14008dc90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
movzx ebp, byte [rcx]
mov rsi, rdx
mov rbx, rcx
test bpl, bpl
je 0x14008dcde
movzx ecx, byte [rsi]
test cl, cl
je 0x14008dcde
call fcn.14008dc20
movzx ecx, bpl
movzx edi, al
call fcn.14008dc20
cmp al, dil
jne 0x14008dd03
movzx ebp, byte [rbx + 1]
inc rbx
inc rsi
test bpl, bpl
jne 0x14008dcb2
xor ecx, ecx
mov eax, ecx
cmp byte [rbx], al
sete al
cmp byte [rsi], cl
setne cl
xor eax, ecx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
xor eax, eax
jmp 0x14008dcee
Function at 0x140097220
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rdi, r9
mov rbx, r8
mov rsi, rdx
mov rbp, rcx
test rdx, rdx
je 0x14009724a
cmp dword [rdx], 0
jne 0x140097260
test rbx, rbx
je 0x140097255
cmp dword [r8], 0
jne 0x140097260
test rdi, rdi
je 0x1400972ac
cmp dword [r9], 0
je 0x1400972ac
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x48]
call fcn.1400a4640
test rdi, rdi
je 0x140097279
cmp dword [rdi], 0
jne 0x14009727b
xor edi, edi
test rbx, rbx
je 0x140097285
cmp dword [rbx], 0
jne 0x140097287
xor ebx, ebx
test rsi, rsi
je 0x140097291
cmp dword [rsi], 0
jne 0x140097293
xor esi, esi
lea ecx, [rbp + 1]
mov qword [rsp + 0x20], rax
mov r9, rdi
mov r8, rbx
mov rdx, rsi
call qword [sym.imp.WS2_32.dll_select]
jmp 0x1400972b6
mov rcx, qword [rsp + 0x60]
call fcn.1400971d0
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x140098a90
Capabilities:
Resolve dns

Disassembly:
push rbp
push r12
push r13
push r15
sub rsp, 0x28
mov r13, r9
xor ebp, ebp
mov qword [r9], rbp
xor r15d, r15d
lea r9, [rsp + 0x68]
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov r12d, eax
test eax, eax
jne 0x140098c19
mov qword [rsp + 0x60], rdi
mov rdi, qword [rsp + 0x68]
test rdi, rdi
je 0x140098bfe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x20], r14
nop
mov rax, qword [rdi + 0x18]
test rax, rax
je 0x140098afe
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x140098af0
inc rbx
jmp 0x140098b00
xor ebx, ebx
mov eax, dword [rdi + 4]
cmp eax, 2
jne 0x140098b0e
lea r14d, [rax + 0xe]
jmp 0x140098b1b
cmp eax, 0x17
jne 0x140098bb4
lea r14d, [rax + 5]
cmp qword [rdi + 0x20], 0
je 0x140098bb4
mov rax, qword [rdi + 0x10]
test rax, rax
je 0x140098bb4
cmp rax, r14
jb 0x140098bb4
lea rcx, [rbx + 0x30]
add rcx, r14
call qword [fcn.1400baec0]
mov rsi, rax
test rax, rax
je 0x140098bc3
mov ecx, dword [rdi]
mov r8, r14
mov dword [rax], ecx
mov ecx, dword [rdi + 4]
mov dword [rax + 4], ecx
mov ecx, dword [rdi + 8]
mov dword [rax + 8], ecx
mov ecx, dword [rdi + 0xc]
mov dword [rax + 0xc], ecx
lea rcx, [rsi + 0x30]
mov dword [rax + 0x10], r14d
xor eax, eax
mov qword [rsi + 0x18], rax
mov qword [rsi + 0x28], rax
mov qword [rsi + 0x20], rcx
mov rdx, qword [rdi + 0x20]
call fcn.1400ab500
test rbx, rbx
je 0x140098ba1
mov rcx, qword [rsi + 0x20]
mov r8, rbx
add rcx, r14
mov qword [rsi + 0x18], rcx
mov rdx, qword [rdi + 0x18]
call fcn.1400ab500
test rbp, rbp
cmove rbp, rsi
test r15, r15
je 0x140098bb1
mov qword [r15 + 0x28], rsi
mov r15, rsi
mov rdi, qword [rdi + 0x28]
test rdi, rdi
jne 0x140098ae0
jmp 0x140098bc9
mov r12d, 8
mov rcx, qword [rsp + 0x68]
mov r14, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
test rcx, rcx
je 0x140098be8
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
test r12d, r12d
je 0x140098bf9
mov rcx, rbp
call fcn.140098a60
xor ebp, ebp
jmp 0x140098c0d
test rbp, rbp
jne 0x140098c0d
mov r12d, 0x2af9
mov ecx, r12d
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov rdi, qword [rsp + 0x60]
mov eax, r12d
mov qword [r13], rbp
add rsp, 0x28
pop r15
pop r13
pop r12
pop rbp
ret
Function at 0x14009c740
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov r14, rcx
mov ebx, 1
mov edx, ebx
xor ecx, ecx
xor ebp, ebp
call qword [fcn.1400baec8]
mov rdi, rax
test rax, rax
je 0x14009c7bd
nop word [rax + rax]
mov r8d, ebx
mov rdx, rdi
mov rcx, r14
mov rbp, rdi
mov esi, ebx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov ebx, eax
test eax, eax
je 0x14009c7e8
cmp ebx, esi
je 0x14009c7e8
cmp ebx, 0x8000
ja 0x14009c7e8
cmp ebx, esi
jb 0x14009c7e3
mov edx, ebx
mov rcx, rdi
call qword [fcn.1400baec8]
mov rdi, rax
test rax, rax
jne 0x14009c780
mov rcx, rbp
call qword [fcn.1400baeb8]
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov rax, rdi
jmp 0x14009c7c8
mov rcx, rdi
jmp 0x14009c7c0
jmp 0x14009c740

Function at 0x14009c7f0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov r14, rcx
mov ebx, 1
mov edx, ebx
xor ecx, ecx
xor ebp, ebp
call qword [fcn.1400baec8]
mov rdi, rax
test rax, rax
je 0x14009c7bd
nop word [rax + rax]
mov r8d, ebx
mov rdx, rdi
mov rcx, r14
mov rbp, rdi
mov esi, ebx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov ebx, eax
test eax, eax
je 0x14009c7e8
cmp ebx, esi
je 0x14009c7e8
cmp ebx, 0x8000
ja 0x14009c7e8
cmp ebx, esi
jb 0x14009c7e3
mov edx, ebx
mov rcx, rdi
call qword [fcn.1400baec8]
mov rdi, rax
test rax, rax
jne 0x14009c780
mov rcx, rbp
call qword [fcn.1400baeb8]
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov rax, rdi
jmp 0x14009c7c8
mov rcx, rdi
jmp 0x14009c7c0
jmp 0x14009c740
Function at 0x1400a4cf0
Capabilities:
Get file size
Read file on windows

Disassembly:
push rbx
push rbp
push r12
push r13
push r15
sub rsp, 0x180
mov rax, qword [0x140144098]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov qword [rsp + 0x50], rcx
mov r15, r8
mov rcx, rdx
mov r12, rdx
xor ebp, ebp
xor ebx, ebx
call fcn.1400f451c
mov r13, rax
test rax, rax
jne 0x1400a4d6e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, 0x100
lea rdx, [rsp + 0x60]
mov ecx, eax
call fcn.14009f950
mov r9, rax
lea rdx, str.schannel:_invalid_path_name_for_CA_file__s:__s
mov r8, r12
mov rcx, r15
call fcn.14008afe0
xor ecx, ecx
lea ebx, [rbp + 0x4d]
call qword [fcn.1400baeb8]
jmp 0x1400a4f28
xor r9d, r9d
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov rcx, r13
mov qword [rsp + 0x170], r14
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r14, rax
cmp rax, 0xffffffffffffffff
jne 0x1400a4de1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, 0x100
lea rdx, [rsp + 0x60]
mov ecx, eax
call fcn.14009f950
mov r9, rax
lea rdx, str.schannel:_failed_to_open_CA_file__s:__s
mov r8, r12
mov rcx, r15
call fcn.14008afe0
xor ecx, ecx
lea ebx, [r14 + 0x4e]
jmp 0x1400a4f12
lea rdx, [rsp + 0x48]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x1400a4e2a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, 0x100
lea rdx, [rsp + 0x60]
mov ecx, eax
call fcn.14009f950
mov r9, rax
lea rdx, str.schannel:_failed_to_determine_size_of_CA_file__s:__s
mov r8, r12
mov rcx, r15
call fcn.14008afe0
mov ebx, 0x4d
jmp 0x1400a4f06
mov qword [rsp + 0x178], rdi
mov rdi, qword [rsp + 0x48]
cmp rdi, 0x100000
jle 0x1400a4e5f
mov r8d, 0x100000
lea rdx, str.schannel:_CA_file_exceeds_max_size_of__u_bytes
mov rcx, r15
call fcn.14008afe0
mov ebx, 0x4d
jmp 0x1400a4efe
lea rcx, [rdi + 1]
call qword [fcn.1400baec0]
mov rbp, rax
test rax, rax
jne 0x1400a4e79
lea ebx, [rax + 0x1b]
jmp 0x1400a4efe
mov qword [rsp + 0x1c8], rsi
test rdi, rdi
je 0x1400a4ed8
nop word [rax + rax]
mov r8d, edi
mov dword [rsp + 0x40], 0
sub r8d, ebx
mov esi, ebx
lea rdx, [rbx + rbp]
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400a4f4a
mov eax, dword [rsp + 0x40]
test eax, eax
jne 0x1400a4ecf
mov edi, esi
jmp 0x1400a4ed1
add ebx, eax
mov eax, ebx
cmp rax, rdi
jb 0x1400a4e90
mov rcx, qword [rsp + 0x50]
mov r9, r12
mov r8, rdi
mov byte [rdi + rbp], 0
mov rdx, rbp
mov qword [rsp + 0x20], r15
call fcn.1400a4ad0
mov ebx, eax
mov rsi, qword [rsp + 0x1c8]
mov rdi, qword [rsp + 0x178]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbp
call qword [fcn.1400baeb8]
mov rcx, r13
call fcn.1400baeb8
mov r14, qword [rsp + 0x170]
mov eax, ebx
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1400a9630
add rsp, 0x180
pop r15
pop r13
pop r12
pop rbp
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, 0x100
lea rdx, [rsp + 0x60]
mov ecx, eax
call fcn.14009f950
mov r9, rax
lea rdx, str.schannel:_failed_to_read_from_CA_file__s:__s
mov r8, r12
mov rcx, r15
call fcn.14008afe0
mov ebx, 0x4d
jmp 0x1400a4ef6
Function at 0x1400a6f40
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov r8, rdx
xor edx, edx
mov rdi, rcx
call fcn.1400abbb0
mov r9d, 2
mov r8d, ebx
mov rdx, rdi
xor ecx, ecx
call sub.bcrypt.dll_BCryptGenRandom
mov rbx, qword [rsp + 0x30]
neg eax
sbb eax, eax
and eax, 2
add rsp, 0x20
pop rdi
ret

Function at 0x1400a72d0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbx, rcx
mov ebp, r8d
mov r14, rdx
lea ecx, [rax + rax]
mov eax, dword [rbx + 0x20]
add rax, 0x18
add rcx, rax
call qword [fcn.1400baec0]
mov rdi, rax
test rax, rax
jne 0x1400a7312
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
mov qword [rsp + 0x48], rsi
mov qword [rdi + 0x10], rax
cmp ebp, dword [rbx + 0x1c]
jbe 0x1400a7359
call qword [rbx]
mov rcx, qword [rdi + 8]
mov r8d, ebp
mov rdx, r14
call qword [rbx + ioctlsocket]
mov r14d, dword [rbx + 0x18]
add r14, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
mov rcx, r14
call qword [rbx + reloc.WS2_32.dll_recv]
mov rcx, qword [rdi + 8]
mov ebp, dword [rbx + 0x20]
call qword [rbx]
mov rcx, qword [rdi + 0x10]
call qword [rbx]
xor esi, esi
test rbp, rbp
je 0x1400a73b2
mov rsi, rbp
nop dword [rax + rax]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rdi + 8]
call qword [rbx + ioctlsocket]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x5c
lea r14, [r14 + 1]
mov byte [rsp + 0x40], al
mov r8d, 1
mov rcx, qword [rdi + 0x10]
call qword [rbx + ioctlsocket]
sub rbp, 1
jne 0x1400a7370
mov eax, dword [rbx + 0x1c]
cmp rsi, rax
jae 0x1400a73f3
nop word [rax + rax]
mov rcx, qword [rdi + 8]
lea rdx, [0x140121ea9]
mov r8d, 1
call qword [rbx + ioctlsocket]
mov rcx, qword [rdi + 0x10]
lea rdx, [0x140121eaa]
mov r8d, 1
call qword [rbx + ioctlsocket]
mov eax, dword [rbx + 0x1c]
inc rsi
cmp rsi, rax
jb 0x1400a73c0
mov rsi, qword [rsp + 0x48]
mov rax, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
Function at 0x1400bb2d8
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov esi, r8d
mov ebx, edx
mov r14d, ecx
test r8d, r8d
jne 0x1400bb010
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400bb010
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400bb010
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400bb010
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400bb010
cmp dword [rcx + 0x84], 0xe
jbe 0x1400bb010
cmp dword [rcx + 0xf8], esi
je 0x1400bb010
mov ecx, r14d
call fcn.1400bb1e0
mov ecx, 2
call fcn.1400f71ac
nop
cmp byte [0x140145bb8], 0
jne 0x1400bb0da
mov r15d, 1
mov eax, r15d
xchg dword [0x140145ba8], eax
test ebx, ebx
jne 0x1400bb083
mov rdi, qword [0x140144098]
mov edx, edi
and edx, 0x3f
lea ecx, [rbx + 0x40]
sub ecx, edx
xor eax, eax
ror rax, cl
xor rax, rdi
mov rcx, qword [0x140145bb0]
cmp rcx, rax
je 0x1400bb07a
xor rdi, rcx
mov ecx, edx
ror rdi, cl
mov rcx, rdi
call qword [0x140115670]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rdi
lea rcx, [0x140145f20]
jmp 0x1400bb08f
cmp ebx, r15d
jne 0x1400bb095
lea rcx, [0x140145f38]
call fcn.1400f1f1c
nop
test ebx, ebx
jne 0x1400bb0ac
lea rdx, [0x1401158c0]
lea rcx, [0x1401158a0]
call fcn.1400f25a0
lea rdx, [0x1401158d0]
lea rcx, [0x1401158c8]
call fcn.1400f25a0
movzx eax, byte [0x140145bb8]
test esi, esi
cmove eax, r15d
mov byte [0x140145bb8], al
jmp 0x1400bb0da
mov ecx, 2
call fcn.1400f7200
test esi, esi
jne 0x1400bb0f1
mov ecx, r14d
call fcn.1400bb10c
int3
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
xor r8d, r8d
xor edx, edx
jmp 0x1400bafa0
Function at 0x1400fc744
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x1400fc36c
call fcn.1400b9d28
mov dword [rax], socket
call fcn.1400b9b7c
or eax, 0xffffffff
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x1400fc354
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x1400fc354
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x10]
shr ecx, 1
test cl, 1
je 0x1400fc39e
lock or dword [rax + 0x14], 0x10
jmp 0x1400fc354
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x1400fc3bb
mov rcx, qword [rbp + 0x10]
call fcn.14010b320
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.1400fa0d4
mov rdx, qword [rbp + 0x10]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.1400f4d58
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x10]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 1
ja 0x1400fc412
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x10]
and dword [rax + 0x10], 0
jmp 0x1400fc354
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x1400fc47e
mov rcx, qword [rbp + 0x10]
call fcn.1400fa0d4
cmp eax, 0xffffffff
je 0x1400fc465
mov rcx, qword [rbp + 0x10]
call fcn.1400fa0d4
cmp eax, 0xfffffffe
je 0x1400fc465
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.1400fa0d4
movsxd rdi, eax
lea rsi, [0x1401469c0]
mov rcx, rbx
sar rdi, 6
call fcn.1400fa0d4
and eax, 0x3f
shl rax, 6
add rax, qword [rsi + rdi*8]
jmp 0x1400fc46c
lea rax, [0x1401444a0]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x1400fc47e
mov rax, qword [rbp + 0x10]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x10]
cmp dword [rax + 0x20], 0x200
jne 0x1400fc4b4
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x1400fc4b0
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x1400fc4b0
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x10]
dec dword [rax + 0x10]
mov rcx, qword [rax]
movzx edx, byte [rcx]
inc rcx
mov qword [rax], rcx
mov eax, edx
jmp 0x1400fc357
jmp 0x1400fc324
Function at 0x180001000
Capabilities:
Access pe header

Disassembly:
mov qword [rsp + 0x10], rdx
push r12
push r13
push r14
push r15
sub rsp, 0x58
mov r14, qword [rsp + 0xa0]
mov r12, r9
movzx r13d, r8b
mov r15, rcx
test r14, r14
jne 0x18000103a
mov eax, 0xc000000d
add rsp, 0x58
pop r15
pop r14
pop r13
pop r12
ret
mov qword [rsp + 0x80], rbx
xor ecx, ecx
mov qword [rsp + 0x90], rbp
mov qword [rsp + 0x98], rsi
mov qword [rsp + 0x50], rdi
call fcn.1800042e0
mov rbp, rax
test rax, rax
je 0x1800010e8
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_RtlImageNtHeader]
mov rdi, rax
test rax, rax
jne 0x180001082
mov eax, 0xc000007b
jmp 0x1800010ed
lea rsi, [rax + 0x108]
movzx eax, word [rax + 6]
mov rbx, rsi
lea rcx, [rax + rax*4]
lea rax, [rsi + rcx*8]
cmp rsi, rax
jae 0x1800010e8
nop dword [rax]
mov rdx, r15
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
mov rdx, rbx
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
mov r8b, 1
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_RtlCompareString]
test eax, eax
je 0x180001117
movzx eax, word [rdi + 6]
add rbx, 0x28
lea rcx, [rax + rax*4]
lea rax, [rsi + rcx*8]
cmp rbx, rax
jb 0x1800010a0
mov eax, 0xc0000225
mov rsi, qword [rsp + 0x98]
mov rbp, qword [rsp + 0x90]
mov rbx, qword [rsp + 0x80]
mov rdi, qword [rsp + 0x50]
add rsp, 0x58
pop r15
pop r14
pop r13
pop r12
ret
mov ecx, dword [rbx + 8]
lea rax, [rsp + 0xa0]
mov r9d, dword [rbx + 0xc]
sub ecx, 0x1000
mov qword [rsp + 0x28], rax
add r9, rbp
mov qword [rsp + 0x20], rcx
mov r8, r12
mov rcx, qword [rsp + 0x88]
movzx edx, r13b
mov qword [rsp + 0xa0], 0
call fcn.180001cc0
test eax, eax
js 0x1800010ed
mov ecx, dword [rsp + 0xa0]
sub ecx, ebp
mov dword [r14], ecx
jmp 0x1800010ed

Function at 0x1800019c0
Capabilities:
Access pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r15
sub rsp, 0x30
mov edi, r9d
mov dword [rsp + 0x20], 0
mov r15d, r8d
mov esi, edx
mov rbp, rcx
call qword [sym.imp.ntoskrnl.exe_RtlImageNtHeader]
mov rbx, rax
test rax, rax
jne 0x1800019fa
mov eax, edi
jmp 0x180001a95
movzx eax, word [rax + 0x18]
mov ecx, 0x10b
mov qword [rsp + 0x50], r14
cmp ax, cx
je 0x180001a1d
mov ecx, 0x20b
cmp ax, cx
jne 0x180001a82
mov r14, qword [rbx + 0x30]
jmp 0x180001a21
mov r14d, dword [rbx + 0x34]
mov r8d, 5
lea r9, [rsp + 0x20]
mov dl, 1
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe_RtlImageDirectoryEntryToData]
test rax, rax
je 0x180001a86
mov ecx, dword [rsp + 0x20]
test ecx, ecx
je 0x180001a86
mov rbx, rbp
sub rbx, r14
nop word [rax + rax]
mov edx, dword [rax + 4]
test edx, edx
je 0x180001a82
sub ecx, edx
lea r8, [rax + 8]
mov dword [rsp + 0x20], ecx
add edx, 0xfffffff8
mov ecx, dword [rax]
mov r9, rbx
add rcx, rbp
shr edx, 1
call fcn.1800018a0
test rax, rax
je 0x180001a82
mov ecx, dword [rsp + 0x20]
test ecx, ecx
jne 0x180001a50
jmp 0x180001a8e
mov eax, edi
jmp 0x180001a90
test byte [rbx + 0x16], 1
cmovne esi, r15d
mov eax, esi
mov r14, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop rdi
pop rsi
ret