joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14006f9a0
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
call fcn.140075320
movsxd rbp, eax
lea r8, [rsp + 0x48]
mov rcx, rbp
mov dword [rsp + 0x48], 1
mov edx, 0x8004667e
call qword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
je 0x14006fa16
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
mov ebx, eax
call fcn.140013400
mov r9, rax
lea rcx, str.SOCKET_failed_to_make_fd__d_non_blocking_:__d___s_n
mov r8d, ebx
mov edx, ebp
call fcn.14001dba0
test rdi, rdi
je 0x14006fa12
mov dword [rdi], 1
xor eax, eax
jmp 0x14006fa40
mov rcx, rbx
call fcn.140070430
mov edx, 2
mov rcx, rax
mov rbx, rax
call fcn.14006b900
mov rcx, rsi
mov qword [rbx + 0x78], rsi
mov dword [rbx + 0x70], ebp
call fcn.140075620
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140070300
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
mov dword [rsp + 0x40], 0
movsxd rcx, dword [rcx + 0x70]
lea rax, [rsp + 0x48]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov edx, 0xffff
mov dword [rsp + 0x48], 4
mov r8d, 0x1007
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
je 0x14007037f
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
mov dword [rdi + 0x80], eax
mov ebx, eax
call fcn.140013400
mov edx, dword [rdi + 0x70]
lea rcx, str.SOCKET_getsockopt_for_connect_on_fd__d_failed_with_error__d_:__s_n
mov r9, rax
mov r8d, ebx
call fcn.14001dba0
mov eax, 1
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov eax, dword [rsp + 0x40]
test eax, eax
je 0x14007039d
mov dword [rdi + 0x80], eax
mov eax, 1
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
movsxd rcx, dword [rdi + 0x70]
lea r8, [rdi + 0x108]
lea rdx, [rdi + 0x88]
mov dword [r8], 0x80
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x1400703fa
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
mov dword [rdi + 0x80], eax
mov ebx, eax
call fcn.140013400
mov edx, dword [rdi + 0x70]
lea rcx, str.SOCKET_getsockname_for_connect_on_fd__d_failed_with_error__d:__s_n
mov r9, rax
mov r8d, ebx
call fcn.14001dba0
mov eax, 1
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov edx, 2
mov rcx, rdi
call fcn.14006b900
mov rdx, qword [rdi + 0x1b8]
mov rcx, rdi
mov rax, qword [rdi + 0x198]
call qword [case.0x140007e54.0]
mov rbx, qword [rsp + 0x50]
xor eax, eax
add rsp, 0x30
pop rdi
ret
Function at 0x140070670
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0xc0
mov rax, qword [0x1400db748]
xor rax, rsp
mov qword [rsp + 0xb0], rax
cmp dword [rcx + 0x70], 0xffffffff
mov rsi, r9
mov rbp, r8
mov dword [rsp + 0x20], 0x80
mov ebx, edx
mov rdi, rcx
jne 0x1400706f0
test edx, edx
je 0x1400706b3
cmp edx, 0x17
jne 0x1400706ca
mov rax, qword [rcx + 0x228]
test rax, rax
je 0x1400706ca
cmp dword [rax + 0x70], 0xffffffff
je 0x1400706ca
mov rdi, rax
jmp 0x1400706f0
test ebx, 0xfffffffd
jne 0x140070773
mov rdi, qword [rcx + 0x220]
test rdi, rdi
je 0x140070773
cmp dword [rdi + 0x70], 0xffffffff
je 0x140070773
movsxd rcx, dword [rdi + 0x70]
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x140070736
test ebx, ebx
je 0x140070715
movzx eax, word [rsp + 0x30]
cmp eax, ebx
jne 0x140070773
mov ebx, dword [rsp + 0x20]
lea rdx, [rsp + 0x30]
cmp dword [rsi], ebx
mov eax, ebx
mov rcx, rbp
cmovl eax, dword [rsi]
movsxd r8, eax
call sub.VCRUNTIME140.dll_memcpy
xor eax, eax
mov dword [rsi], ebx
jmp 0x140070778
mov rcx, rdi
call fcn.14006b3e0
mov rcx, rdi
mov ebx, eax
call fcn.14006baf0
mov edx, eax
lea rcx, [0x1400af598]
mov r8d, ebx
call fcn.14001dba0
lea rdx, str.AsyncTCPSocketGetAddr
lea rcx, str._s:_could_not_locate_socket._n
call fcn.14001dba0
mov eax, 1
jmp 0x140070778
mov eax, 5
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.14006a480
mov rbx, qword [rsp + 0xe8]
add rsp, 0xc0
pop rdi
pop rsi
pop rbp
ret

Function at 0x140070cd0
Capabilities:
Check os version

Disassembly:
sub rsp, 0x158
mov rax, qword [0x1400db748]
xor rax, rsp
mov qword [rsp + 0x140], rax
xor edx, edx
mov dword [rsp + 0x20], 0x114
mov r8d, 0x110
lea rcx, [rsp + 0x24]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0x24], 6
setae al
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14006a480
add rsp, 0x158
ret
Function at 0x140071fc0
Capabilities:
Read file on windows

Disassembly:
push rdi
sub rsp, 0x20
xor eax, eax
mov rdi, rcx
xor ecx, ecx
mov word [rsp + 0x30], ax
mov byte [rsp + 0x32], al
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
cmp rdi, rax
jne 0x140071fe9
xor al, al
add rsp, 0x20
pop rdi
ret
mov edx, 3
mov qword [rsp + 0x38], rbx
mov r9, rdi
lea rcx, [rsp + 0x30]
lea r8d, [rdx - 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp rax, 1
jne 0x140072036
movzx eax, word [0x1400b2330]
cmp ax, word [rsp + 0x30]
jne 0x140072036
movzx eax, byte [0x1400b2332]
cmp al, byte [rsp + 0x32]
jne 0x140072036
mov bl, 1
movzx eax, bl
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
xor bl, bl
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_rewind]
movzx eax, bl
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140073280
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x420
mov rdi, rdx
mov rbx, rcx
call fcn.14001b570
mov r9, rdi
lea rcx, [rsp + 0x20]
mov r8, rbx
mov edx, 0x400
call fcn.140030890
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rdx, rax
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputs]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov r8d, dword [0x140107d40]
lea eax, [r8 + 1]
mov dword [0x140107d40], eax
test r8d, r8d
je 0x14007332f
cmp r8d, 1
jne 0x14007330a
lea rdx, [rsp + 0x20]
lea rcx, str.PANIC:__s
call fcn.14001bf60
lea rcx, str.Panic_loop_n
call fcn.14001bf60
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.Panic_loop_n
call fcn.1400208f0
mov ecx, 1
call fcn.1400412c0
int3
call fcn.14001d660
lea rcx, [rsp + 0x20]
call fcn.140021220
lea rdx, [rsp + 0x20]
lea rcx, str.PANIC:__s
call fcn.14001bf60
xor ecx, ecx
call fcn.140078090
lea rcx, str.user32.dll
call fcn.140021130
test rax, rax
je 0x1400733bd
lea rdx, str.GetGuiResources
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
je 0x1400733bd
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 1
mov rax, rdi
call qword [case.0x140007e54.0]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
xor edx, edx
mov rax, rdi
call qword [case.0x140007e54.0]
mov r8d, ebx
lea rcx, str.Win32_object_usage:_GDI__d__USER__d_n
mov edx, eax
call fcn.14001dba0
cmp byte [reloc.WS2_32.dll_accept], 0
je 0x1400733cb
call fcn.140079080
call fcn.140073220
lea rcx, [rsp + 0x20]
call fcn.140077eb0
lea rcx, str.Exiting_n
call fcn.14001bf60
mov ecx, 0xffffffff
call fcn.1400412c0
int3
Function at 0x140073790
Capabilities:
Get file size
Read file on windows

Disassembly:
push rbp
push rdi
sub rsp, 0x38
mov rbp, rcx
call fcn.140078150
mov rcx, rax
call fcn.140078130
mov rdi, rax
test rax, rax
jne 0x1400737c4
lea rcx, str.Create_BIO_failed._n
call fcn.14001dba0
xor eax, eax
add rsp, 0x38
pop rdi
pop rbp
ret
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x60]
mov rcx, rbp
mov qword [rsp + 0x30], rsi
xor ebx, ebx
mov dword [rsp + 0x58], 0
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1400737fc
cmp dword [rsp + 0x64], ebx
jle 0x14007382c
lea rcx, str.Size_of_SSL_certs_file_is_bigger_than_4GB._n
call fcn.14001dba0
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rcx, str.Unable_to_read_file._n
call fcn.14001dba0
mov rcx, rdi
call fcn.140078110
mov rbx, qword [rsp + 0x50]
xor eax, eax
mov rsi, qword [rsp + 0x30]
add rsp, 0x38
pop rdi
pop rbp
ret
movsxd rsi, dword [rsp + 0x60]
cmp esi, 0xa00000
jle 0x14007384c
mov edx, 0xa00000
lea rcx, str.Size_of_SSL_certs_file_is_larger_than__d_bytes._n
call fcn.14001dba0
jmp 0x1400737fc
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
test rax, rax
jne 0x140073866
lea rcx, str.Unable_to_allocate_buffer._n
jmp 0x1400737f7
lea r9, [rsp + 0x58]
mov qword [rsp + 0x20], 0
mov r8d, esi
mov rdx, rbx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400737fc
mov r8d, esi
mov rdx, rbx
mov rcx, rdi
call fcn.140078160
test eax, eax
jg 0x1400738b7
lea rcx, str.Unable_to_write_to_BIO._n
call fcn.14001dba0
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x140073811
lea rcx, str.Create_Memory_BIO_succeeded._n
call fcn.14001dba0
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rbx, qword [rsp + 0x50]
mov rax, rdi
mov rsi, qword [rsp + 0x30]
add rsp, 0x38
pop rdi
pop rbp
ret

Function at 0x140075420
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp byte [0x140107d7a], 0
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
je 0x140075468
call fcn.140078170
lea r8, [0x140074390]
cmp rax, r8
je 0x140075468
mov r9, rax
lea rdx, str.SSLCheckLockingCallback
lea rcx, str._s:_locking_callback_overwritten__Expected__p__saw__p_n
call fcn.14001dba0
cmp byte [rdi + 0xe], 0
je 0x140075490
mov ecx, 0x271d
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov eax, 0xffffffff
cdqe
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
cmp byte [rdi + 0xc], 0
je 0x1400754d5
call fcn.140078180
mov rcx, qword [rdi]
mov r8d, ebx
mov rdx, rsi
call fcn.140078340
mov rcx, qword [rdi]
mov edx, eax
mov ebx, eax
call fcn.1400747e0
test eax, eax
mov dword [rdi + 0x10], eax
mov ecx, 0xffffffff
cmovne ebx, ecx
movsxd rax, ebx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
movsxd rcx, dword [rdi + 8]
xor r9d, r9d
mov r8d, ebx
mov rdx, rsi
call qword [sym.imp.WS2_32.dll_recv]
cdqe
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140075500
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
cmp byte [0x140107d7a], 0
lea r15, [0x140074390]
mov rbx, r9
mov rbp, r8
mov r14, rdx
mov rsi, rcx
je 0x140075557
call fcn.140078170
cmp rax, r15
je 0x140075557
mov r9, rax
lea rdx, str.SSLCheckLockingCallback
mov r8, r15
lea rcx, str._s:_locking_callback_overwritten__Expected__p__saw__p_n
call fcn.14001dba0
mov rdi, 0xffffffffffffffff
mov dword [rbx], edi
cmp byte [rsi + 0xe], 0
je 0x140075579
mov ecx, 0x271d
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov rax, rdi
jmp 0x140075601
cmp byte [0x140107d7a], 0
je 0x1400755a5
call fcn.140078170
cmp rax, r15
je 0x1400755a5
mov r9, rax
lea rdx, str.SSLCheckLockingCallback
mov r8, r15
lea rcx, str._s:_locking_callback_overwritten__Expected__p__saw__p_n
call fcn.14001dba0
cmp byte [rsi + 0xe], 0
je 0x1400755b8
mov ecx, 0x271d
call qword [sym.imp.WS2_32.dll_WSASetLastError]
jmp 0x1400755fe
cmp byte [rsi + 0xc], 0
je 0x1400755e9
call fcn.140078180
mov rcx, qword [rsi]
mov r8d, ebp
mov rdx, r14
call fcn.140078340
mov rcx, qword [rsi]
mov edx, eax
mov ebx, eax
call fcn.1400747e0
test eax, eax
mov dword [rsi + 0x10], eax
cmovne ebx, edi
mov edi, ebx
jmp 0x1400755fe
movsxd rcx, dword [rsi + 8]
xor r9d, r9d
mov r8d, ebp
mov rdx, r14
call qword [sym.imp.WS2_32.dll_recv]
mov edi, eax
movsxd rax, edi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret

Function at 0x1400761f0
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp byte [0x140107d7a], 0
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
je 0x140076238
call fcn.140078170
lea r8, [0x140074390]
cmp rax, r8
je 0x140076238
mov r9, rax
lea rdx, str.SSLCheckLockingCallback
lea rcx, str._s:_locking_callback_overwritten__Expected__p__saw__p_n
call fcn.14001dba0
cmp byte [rdi + 0xe], 0
je 0x140076260
mov ecx, 0x271d
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov eax, 0xffffffff
cdqe
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
cmp byte [rdi + 0xc], 0
je 0x1400762a5
call fcn.140078180
mov rcx, qword [rdi]
mov r8d, ebx
mov rdx, rsi
call fcn.1400783c0
mov rcx, qword [rdi]
mov edx, eax
mov ebx, eax
call fcn.1400747e0
test eax, eax
mov dword [rdi + 0x10], eax
mov ecx, 0xffffffff
cmovne ebx, ecx
movsxd rax, ebx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
movsxd rcx, dword [rdi + 8]
xor r9d, r9d
mov r8d, ebx
mov rdx, rsi
call qword [sym.imp.WS2_32.dll_send]
cdqe
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140079140
Capabilities:
Get system information on windows

Disassembly:
push rbp
sub rsp, 0x70
cmp byte [0x140108095], 0
mov rbp, rcx
jne 0x1400793b6
xor ecx, ecx
call fcn.140079a40
test al, al
je 0x1400793af
mov qword [rsp + 0x80], rbx
lea rdx, str.panic.commitAddrSpaceReserved
mov qword [rsp + 0x88], rsi
xor ecx, ecx
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x60], r15
call fcn.140013090
lea rdx, str.panic.addrSpaceReservedKB
xor ecx, ecx
movzx ebx, al
call fcn.140013100
movsxd rcx, eax
test eax, eax
je 0x140079263
mov eax, 0x5000
cmp rcx, rax
cmova rcx, rax
xor eax, eax
shl rcx, 0xa
mov qword [0x140108078], rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [rsp + 0x34]
xor edx, edx
mov r10, qword [0x140108078]
mov r8d, 0x2000
dec r10
mov r9d, 1
add r10, rcx
mov rax, r10
div rcx
mov eax, 0x3000
sub r10, rdx
test bl, bl
mov qword [0x140108078], r10
mov rdx, r10
cmovne r8d, eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8, qword [0x140108078]
shr r8, 0xa
mov qword [0x140108070], rax
test r8, r8
je 0x140079263
test rax, rax
je 0x140079263
mov rdx, rax
lea rcx, str.Reserved_virtual_address_space_for_CoreDump_addr:_p__size:_I64uKB__n
call fcn.14001bf60
xor edi, edi
xor ecx, ecx
mov ebx, edi
mov esi, edi
mov r15d, edi
call fcn.140018050
mov r14, rax
test rax, rax
jne 0x14007928c
lea rcx, str.CoreDump:_unable_to_determine_app_data_path_n
call fcn.14001bf60
jmp 0x140079362
xor ecx, ecx
call fcn.140021070
mov rbx, rax
test rax, rax
je 0x140079362
xor edx, edx
mov qword [rsp + 0x28], 0xffffffffffffffff
lea r9, [0x140083cd8]
mov qword [rsp + 0x20], rdi
mov rcx, rax
lea r8, [rdx - 1]
call fcn.140042890
xor edx, edx
mov qword [rsp + 0x28], 0xffffffffffffffff
lea r9, [0x1400836a8]
mov qword [rsp + 0x20], rdi
mov rcx, rbx
mov rsi, rax
lea r8, [rdx - 1]
call fcn.140042890
cmp rsi, 0xffffffffffffffff
je 0x14007930e
cmp rax, 0xffffffffffffffff
je 0x14007930e
cmp rax, rsi
jle 0x14007930e
sub rax, rsi
lea rdx, [rsi + 1]
mov rcx, rbx
lea r8, [rax - 1]
call fcn.140042ce0
jmp 0x140079316
mov rcx, rbx
call fcn.140042340
mov rcx, rax
mov rsi, rax
call fcn.140046b60
test rbp, rbp
lea rdx, str._s_s.dmp
mov r9, rax
mov r15, rax
cmove rbp, r14
xor ecx, ecx
mov r8, rbp
call fcn.140030510
mov rbp, rax
test rax, rax
je 0x140079362
xor r8d, r8d
mov rcx, rax
lea rdx, [r8 - 1]
call fcn.140042490
mov rcx, rbp
mov rdi, rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov r15, qword [rsp + 0x60]
mov r14, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x80]
mov qword [0x140108068], rdi
mov rdi, qword [rsp + 0x90]
mov byte [0x140108095], 1
add rsp, 0x70
pop rbp
ret
Function at 0x140079890
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x50
xor ebx, ebx
mov r14, r8
mov r15, rdx
mov qword [r8], rbx
lea rdx, [rsp + 0x20]
mov r12, r9
mov rdi, rcx
lea r8d, [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140079a05
mov rax, qword [rsp + 0x28]
mov rcx, rdi
mov qword [r14], rax
call fcn.140026e20
mov rsi, rax
test rax, rax
je 0x140079a05
xor r9d, r9d
lea edx, [rbx + 0x10]
lea r8d, [rbx + 0xa]
lea rcx, [0x1401080f8]
call fcn.140025730
mov rdx, qword [r14]
mov r8, r15
mov rcx, rax
mov rbp, rax
call fcn.140025880
test al, al
jne 0x140079960
mov rcx, rsi
call fcn.140021070
mov rsi, rax
test rax, rax
je 0x140079a05
mov rdx, qword [r14]
mov r8, rax
mov rcx, rbp
call fcn.140025860
test al, al
jne 0x14007995d
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rdx, qword [r14]
mov r8, r15
mov rcx, rbp
call fcn.140025880
jmp 0x140079960
mov qword [r15], rsi
mov rsi, qword [r14]
mov edx, 0x40
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x140079a05
movsxd rsi, dword [rsi + 0x3c]
mov edx, 0x108
add rsi, qword [r14]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x140079a05
movzx edx, word [rsi + 0x14]
mov rcx, rsi
add rdx, 0x108
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x140079a05
movzx ebp, word [rsi + 0x14]
lea rcx, [rsi + 0x18]
add rcx, rbp
lea edx, [rax + 0x28]
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x140079a05
sub edi, dword [r14]
movzx r9d, word [rsi + 6]
test r9d, r9d
je 0x140079a05
lea rcx, [rsi + 0x28]
add rcx, rbp
nop word [rax + rax]
mov edx, dword [rcx - 4]
mov eax, dword [rcx]
mov r8d, dword [rcx - 8]
cmp edi, edx
jb 0x1400799fa
cmp eax, r8d
cmovbe eax, r8d
add eax, edx
cmp edi, eax
jbe 0x140079a26
inc ebx
add rcx, 0x28
cmp ebx, r9d
jb 0x1400799e0
xor al, al
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
lea eax, [rbx + 1]
sub edi, edx
mov dword [r12], eax
mov rax, qword [rsp + 0x90]
mov dword [rax], edi
mov al, 1
jmp 0x140079a07
Function at 0x140079a40
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
sub rsp, 0x20
mov eax, dword [0x140108100]
mov rbx, rcx
test eax, eax
je 0x140079a73
test rcx, rcx
je 0x140079bf4
mov rax, qword [0x1401080f0]
mov qword [rcx], rax
movzx eax, byte [0x140108104]
add rsp, 0x20
pop rbx
ret
call fcn.140079040
mov eax, dword [0x140108100]
test eax, eax
jne 0x140079bd6
lea rcx, str.dbghelp.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x1401080f0], rax
test rax, rax
jne 0x140079ab0
lea rcx, str.CoreDump:_Cant_find_DbgHelp.dll__n
call fcn.14001dba0
jmp 0x140079bd6
lea rdx, str.SymInitializeW
mov qword [rsp + 0x30], rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1401080f0]
lea rdx, str.SymGetModuleBase64
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1401080f0]
lea rdx, str.SymLoadModuleExW
mov qword [0x1401080c8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1401080f0]
lea rdx, str.SymSetSearchPathW
mov qword [0x1401080d8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1401080f0]
lea rdx, str.SymFromAddrW
mov qword [0x1401080e0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1401080f0]
lea rdx, str.SymGetSymFromAddr64
mov qword [0x1401080d0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401080e8], rax
test rdi, rdi
jne 0x140079b5d
lea rcx, str.CoreDump:_Cant_find_SymInitializeW__n
jmp 0x140079bcc
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor r8d, r8d
xor edx, edx
mov rcx, rax
mov rax, rdi
call qword [case.0x140007e54.0]
test eax, eax
jne 0x140079b81
lea rcx, str.CoreDump:_SymInitializeW_failed_n
jmp 0x140079bcc
cmp qword [0x1401080c8], 0
je 0x140079bc5
cmp qword [0x1401080d8], 0
je 0x140079bc5
cmp qword [0x1401080e0], 0
je 0x140079bc5
cmp qword [0x1401080d0], 0
jne 0x140079bbc
cmp qword [0x1401080e8], 0
jne 0x140079bbc
lea rcx, str.CoreDump:_Failed_to_resolve_dbghelp.dll_symbols._No_backtrace._____n
jmp 0x140079bcc
mov byte [0x140108104], 1
jmp 0x140079bd1
lea rcx, str.CoreDump:_Failed_to_resolve_dbghelp.dll_symbols__ver._6.3_required___No_backtrace._____n
call fcn.14001dba0
mov rdi, qword [rsp + 0x30]
test rbx, rbx
je 0x140079be5
mov rax, qword [0x1401080f0]
mov qword [rbx], rax
mov dword [0x140108100], 1
call fcn.140079060
movzx eax, byte [0x140108104]
add rsp, 0x20
pop rbx
ret
Function at 0x100002454
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rdi
mov qword [rsp + 0x18], r12
push r13
sub rsp, 0x30
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 8]
xor r12d, r12d
xor eax, eax
lock cmpxchg qword [0x100004758], rdi
je 0x1000024a2
cmp rax, rdi
jne 0x100002495
mov edi, 1
mov r12d, edi
jmp 0x1000024a7
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x100002479
mov edi, 1
mov eax, dword [0x100004750]
cmp eax, edi
jne 0x1000024bd
mov ecx, 0x1f
call fcn.100120000
jmp 0x10000251a
mov eax, dword [0x100004750]
test eax, eax
jne 0x100002514
mov dword [0x100004750], edi
lea r13, [0x100001290]
lea rsi, [0x100001278]
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], eax
cmp rsi, r13
jae 0x100002506
test eax, eax
jne 0x100002506
mov rcx, qword [rsi]
test rcx, rcx
je 0x1000024fb
call rcx
mov dword [rsp + 0x20], eax
add rsi, 8
mov qword [rsp + 0x28], rsi
jmp 0x1000024e4
test eax, eax
je 0x10000251a
mov eax, 0xff
jmp 0x1000025ec
mov dword [0x100004184], edi
mov eax, dword [0x100004750]
cmp eax, edi
jne 0x100002541
lea rdx, [0x100001270]
lea rcx, [0x100001260]
call sub.msvcrt.dll__initterm
mov dword [0x100004750], 2
test r12d, r12d
jne 0x10000254f
xor eax, eax
xchg qword [0x100004758], rax
cmp qword [0x100004760], 0
je 0x100002578
lea rcx, [0x100004760]
call fcn.10000284c
test eax, eax
je 0x100002578
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call qword [0x100004760]
mov r8, qword [0x100004168]
mov rdx, qword [0x100004170]
mov ecx, dword [0x100004160]
call fcn.100001b54
mov dword [0x100004180], eax
cmp dword [0x100004164], 0
jne 0x1000025a8
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x100004184], 0
jne 0x1000025bd
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x100004180]
jmp 0x1000025ec
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov r12, qword [rsp + 0x50]
add rsp, 0x30
pop r13
ret
sub rsp, 0x28
call fcn.100002960
add rsp, 0x28
jmp 0x100002454