joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400047d0
Capabilities:
Create process on windows

Disassembly:
push rbx
sub rsp, 0xe0
xor edx, edx
mov rbx, rcx
lea rcx, [rsp + 0x70]
lea r8d, [rdx + 0x68]
call fcn.140096590
xor eax, eax
xor r9d, r9d
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x50]
xor r8d, r8d
mov rdx, rbx
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
xor ecx, ecx
mov qword [rsp + 0x40], rax
xor eax, eax
mov dword [rsp + 0x70], WSAGetLastError
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x430
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x140004855
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0xe0
pop rbx
ret
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140004865
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140004875
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0xe0
pop rbx
ret
Function at 0x140006ee0
Capabilities:
Read file on windows
Read pipe

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
lea rbp, [rsp - 0xf70]
mov eax, 0x1070
call fcn.140096530
sub rsp, rax
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rsp + 0x10b0], rbx
mov rax, qword [0x1400f4d50]
xor rax, rsp
mov qword [rbp + 0xf60], rax
mov rsi, rdx
mov r13, rcx
xor edi, edi
mov dword [rsp + 0x30], edi
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x30]
mov r8d, 0x1000
lea rdx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
jne 0x140007052
cmp eax, 0xea
je 0x140006f68
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1400070c8
mov dword [rsp + 0x38], edi
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x140006f5d
mov ecx, dword [rsp + 0x38]
call fcn.140076158
mov r12, rax
mov dword [rsp + 0x34], edi
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x34]
mov r8d, dword [rsp + 0x38]
mov rdx, rax
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140006f5d
mov ebx, dword [rsp + 0x30]
add ebx, dword [rsp + 0x34]
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], rdi
je 0x140006ffa
mov ecx, ebx
call fcn.140076158
mov rdi, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140006ffa
mov qword [rsp + 0x48], rbx
mov r8d, ebx
xor edx, edx
mov rcx, rax
call fcn.140096590
nop
lea rax, [rsp + 0x40]
cmp rsi, rax
je 0x140007015
mov r8, rsi
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.140006e70
nop
test rdi, rdi
je 0x140007022
mov rcx, rdi
call fcn.14009667c
mov r8d, dword [rsp + 0x30]
lea rdx, [rsp + 0x60]
mov rcx, qword [rsi]
call fcn.140095540
mov r8d, dword [rsp + 0x34]
mov ecx, dword [rsp + 0x30]
add rcx, qword [rsi]
mov rdx, r12
call fcn.140095540
mov rcx, r12
call fcn.14009667c
jmp 0x1400070c6
mov ebx, dword [rsp + 0x30]
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], rdi
test rbx, rbx
je 0x14000708c
mov ecx, ebx
call fcn.140076158
mov rdi, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x14000708c
mov qword [rsp + 0x48], rbx
mov r8d, ebx
xor edx, edx
mov rcx, rax
call fcn.140096590
nop
lea rax, [rsp + 0x40]
cmp rsi, rax
je 0x1400070a7
mov r8, rsi
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.140006e70
nop
test rdi, rdi
je 0x1400070b4
mov rcx, rdi
call fcn.14009667c
mov r8d, dword [rsp + 0x30]
lea rdx, [rsp + 0x60]
mov rcx, qword [rsi]
call fcn.140095540
xor eax, eax
mov rcx, qword [rbp + 0xf60]
xor rcx, rsp
call fcn.1400959a0
mov rbx, qword [rsp + 0x10b0]
add rsp, 0x1070
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400070f0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
xor eax, eax
mov rsi, r8
mov r8d, dword [rdx + 8]
mov rdx, qword [rdx]
mov rdi, rcx
mov rcx, qword [rcx + 0x30]
movzx ebx, r9b
lea r9, [rsp + 0x40]
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140007144
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
test bl, bl
jne 0x140007164
mov rcx, qword [rdi + 0x30]
mov rdx, rsi
call fcn.140006ee0
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
xor eax, eax
add rsp, 0x30
pop rdi
ret
Function at 0x14000af60
Capabilities:
Enumerate processes on remote desktop session host

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [rcx + 0x70], 0
mov rbx, rcx
je 0x14000af7e
mov rax, qword [rcx + 0x38]
add rcx, 0x38
call qword [rax + reloc.WS2_32.dll_htonl]
mov byte [rbx + 0x70], 0
lea rcx, [rbx - 8]
add rsp, 0x20
pop rbx
jmp fcn.14000a920
Function at 0x14000b270
Capabilities:
Enumerate processes on remote desktop session host

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x810]
sub rsp, 0x910
mov qword [rbp - 0x78], 0xfffffffffffffffe
mov qword [rsp + 0x960], rbx
mov rax, qword [0x1400f4d50]
xor rax, rsp
mov qword [rbp + 0x800], rax
mov r14, rdx
mov r13, rcx
mov r8d, 0x104
lea rdx, [rbp + 0x1f0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov qword [rsp + 0x40], 0x100
lea rax, [rbp - 0x10]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0x100
lea rax, [rbp + 0x400]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x100
lea r9, [rbp + 0x600]
mov r8d, 3
lea rdx, [rbp - 0x20]
lea rcx, [rbp + 0x1f0]
call fcn.1400966c4
mov qword [rbp - 0x30], 7
xor r15d, r15d
mov qword [rbp - 0x38], r15
mov word [rbp - 0x48], r15w
lea r8d, [r15 + 7]
lea rdx, str.wauditu
lea rcx, [rbp - 0x48]
call fcn.140002510
nop
lea r8, [rbp - 0x10]
lea rdx, [rbp - 0x48]
lea rcx, [rbp - 0x70]
call fcn.14000a3c0
nop
cmp qword [rbp - 0x30], 8
jb 0x14000b35f
mov rcx, qword [rbp - 0x48]
call fcn.140095520
mov esi, dword [r13 + 0x38]
xor r12b, r12b
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
call sub.WTSAPI32.dll_WTSEnumerateProcessesW
test eax, eax
jne 0x14000b38e
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x14000b3f1
mov edi, r15d
mov edx, dword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
test edx, edx
je 0x14000b3e7
mov rbx, r15
cmp esi, 0xffffffff
je 0x14000b3ab
cmp esi, dword [rbx + rcx]
jne 0x14000b3d8
mov rax, qword [rbx + rcx + 8]
test rax, rax
je 0x14000b3d8
lea rdx, [rbp - 0x70]
cmp qword [rbp - 0x58], 8
cmovae rdx, qword [rbp - 0x70]
mov rcx, rax
call fcn.140096b58
mov rcx, qword [rsp + 0x58]
test eax, eax
je 0x14000b3e4
mov edx, dword [rsp + 0x50]
inc edi
add rbx, 0x18
cmp edi, edx
jae 0x14000b3e7
jmp 0x14000b3a1
mov r12b, 1
call sub.WTSAPI32.dll_WTSFreeMemory
test r12b, r12b
jne 0x14000b405
cmp qword [rbp - 0x58], 8
jb 0x14000b401
mov rcx, qword [rbp - 0x70]
call fcn.140095520
xor eax, eax
jmp 0x14000b480
mov qword [rsp + 0x58], r13
lea rcx, [r13 + 0x10]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rax, vtable.CGenericMsg_8001_.0
mov qword [rsp + 0x78], rax
mov dword [rbp - 0x80], 0x1f41
mov dword [rsp + 0x68], 0x1b5a
lea rax, vtable.CDataMsg_unsigned_long_int__7002_.0
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x70], r15d
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x78]
mov rcx, r13
call fcn.14000b080
mov ebx, eax
test eax, eax
jne 0x14000b463
cmp dword [rsp + 0x70], eax
setne dl
mov byte [r14], dl
lea rcx, [r13 + 0x10]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
cmp qword [rbp - 0x58], 8
jb 0x14000b47e
mov rcx, qword [rbp - 0x70]
call fcn.140095520
mov eax, ebx
mov rcx, qword [rbp + 0x800]
xor rcx, rsp
call fcn.1400959a0
mov rbx, qword [rsp + 0x960]
add rsp, 0x910
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000be90
Capabilities:
Enumerate processes on remote desktop session host

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x810]
sub rsp, 0x910
mov qword [rbp - 0x78], 0xfffffffffffffffe
mov qword [rsp + 0x960], rbx
mov rax, qword [0x1400f4d50]
xor rax, rsp
mov qword [rbp + 0x800], rax
mov r14, rdx
mov r12, rcx
mov r8d, 0x104
lea rdx, [rbp + 0x1f0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov qword [rsp + 0x40], 0x100
lea rax, [rbp - 0x10]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0x100
lea rax, [rbp + 0x400]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x100
lea r9, [rbp + 0x600]
mov r8d, 3
lea rdx, [rbp - 0x20]
lea rcx, [rbp + 0x1f0]
call fcn.1400966c4
mov qword [rbp - 0x30], 7
xor r15d, r15d
mov qword [rbp - 0x38], r15
mov word [rbp - 0x48], r15w
lea r8d, [r15 + 9]
lea rdx, str.wauditush
lea rcx, [rbp - 0x48]
call fcn.140002510
nop
lea r8, [rbp - 0x10]
lea rdx, [rbp - 0x48]
lea rcx, [rbp - 0x70]
call fcn.14000a3c0
nop
cmp qword [rbp - 0x30], 8
jb 0x14000bf7f
mov rcx, qword [rbp - 0x48]
call fcn.140095520
mov esi, dword [r12 + 0x40]
xor r13b, r13b
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
call sub.WTSAPI32.dll_WTSEnumerateProcessesW
test eax, eax
jne 0x14000bfaf
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x14000c012
mov edi, r15d
mov edx, dword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
test edx, edx
je 0x14000c008
mov rbx, r15
cmp esi, 0xffffffff
je 0x14000bfcc
cmp esi, dword [rbx + rcx]
jne 0x14000bff9
mov rax, qword [rbx + rcx + 8]
test rax, rax
je 0x14000bff9
lea rdx, [rbp - 0x70]
cmp qword [rbp - 0x58], 8
cmovae rdx, qword [rbp - 0x70]
mov rcx, rax
call fcn.140096b58
mov rcx, qword [rsp + 0x58]
test eax, eax
je 0x14000c005
mov edx, dword [rsp + 0x50]
inc edi
add rbx, 0x18
cmp edi, edx
jae 0x14000c008
jmp 0x14000bfc2
mov r13b, 1
call sub.WTSAPI32.dll_WTSFreeMemory
test r13b, r13b
jne 0x14000c029
cmp qword [rbp - 0x58], 8
jb 0x14000c022
mov rcx, qword [rbp - 0x70]
call fcn.140095520
xor eax, eax
jmp 0x14000c0b4
mov qword [rsp + 0x58], r12
lea rcx, [r12 + 0x18]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rax, vtable.CGenericMsg_8001_.0
mov qword [rsp + 0x78], rax
mov dword [rbp - 0x80], 0x1f41
mov dword [rsp + 0x68], 0x1b5a
lea rax, vtable.CDataMsg_unsigned_long_int__7002_.0
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x70], r15d
mov rcx, r12
call fcn.14000b550
mov ebx, eax
test eax, eax
jne 0x14000c088
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x78]
mov rcx, r12
call fcn.14000bd20
mov ebx, eax
test ebx, ebx
jne 0x14000c096
cmp dword [rsp + 0x70], ebx
setne dl
mov byte [r14], dl
lea rcx, [r12 + 0x18]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
cmp qword [rbp - 0x58], 8
jb 0x14000c0b2
mov rcx, qword [rbp - 0x70]
call fcn.140095520
mov eax, ebx
mov rcx, qword [rbp + 0x800]
xor rcx, rsp
call fcn.1400959a0
mov rbx, qword [rsp + 0x960]
add rsp, 0x910
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000d7b0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov dword [rcx + 0x240], 0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [rbx + 0x240]
cmp eax, 0xea60
jbe 0x14000d7f0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [rbx + 0x38]
lea rdx, [rbx + 0x40]
mov dword [rbx + 0x240], eax
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x140015f80
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rdi
sub rsp, 0x20
mov qword [rsp + 0x40], rsi
mov rdi, rcx
mov rcx, qword [r8 + 8]
mov rsi, r8
mov r8, qword [r8]
cmp r8, rcx
je 0x140015fd2
movzx r9d, byte [rsp + 0x30]
mov rdx, rcx
mov qword [rsp + 0x38], rbx
call fcn.1400504e0
movzx r9d, byte [rsp + 0x30]
mov rdx, qword [rsi + 8]
lea r8, [rsi + 0x18]
mov rcx, rax
mov rbx, rax
call fcn.140014770
mov qword [rsi + 8], rbx
mov rbx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rsi, qword [rsp + 0x40]
sub eax, dword [rdi + 0x238]
cmp eax, 0xea60
jbe 0x140016004
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [rdi + 0x30]
lea rdx, [rdi + 0x38]
mov dword [rdi + 0x238], eax
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
add rsp, 0x20
pop rdi
ret
Function at 0x14001b560
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x1400f4d50]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, rcx
mov rcx, qword [rcx + 0x1a0]
cmp rcx, 0xffffffffffffffff
je 0x14001b5c5
mov edx, 1
call qword [sym.imp.WS2_32.dll_shutdown]
mov rcx, qword [rbx + 0x1a0]
xor r9d, r9d
lea rdx, [rsp + 0x20]
lea r8d, [r9 + 0xa]
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
jg 0x14001b590
mov rcx, qword [rbx + 0x1a0]
call qword [sym.imp.WS2_32.dll_closesocket]
mov qword [rbx + 0x1a0], 0xffffffffffffffff
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400959a0
add rsp, 0x40
pop rbx
ret

Function at 0x14001b5e0
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor r9d, r9d
mov ebx, r8d
mov rdi, rdx
mov rsi, rcx
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x14001b628
cmp eax, ebx
je 0x14001b63e
sub ebx, eax
cdqe
xor r9d, r9d
add rdi, rax
mov r8d, ebx
mov rcx, rsi
mov rdx, rdi
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne case.default.0x14001b637
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
xor eax, eax
add rsp, 0x20
pop rdi
ret

Function at 0x14001b650
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor r9d, r9d
mov ebx, r8d
mov rdi, rdx
mov rsi, rcx
call qword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
je 0x14001b69c
test eax, eax
je 0x14001b6c4
cmp eax, ebx
je 0x14001b6b2
sub ebx, eax
cdqe
xor r9d, r9d
add rdi, rax
mov r8d, ebx
mov rcx, rsi
mov rdx, rdi
call qword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
jne case.default.0x14001b6ab
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.WS2_32.dll_WSAGetLastError]
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov eax, 0x277e
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x20
mov r12, rcx
mov ecx, r8d
mov esi, r8d
mov rbx, rdx
call fcn.140076158
mov rcx, qword [rbx]
mov rdi, rax
cmp rax, rcx
je 0x14001b9cb
call fcn.14009667c
mov r8d, esi
mov rdx, rdi
mov rcx, r12
mov qword [rbx], rdi
mov qword [rbx + 8], rsi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
jmp 0x14001b650
add byte [rax], al
add byte [rax], al
xor byte [rax + rax], 0
je 0x1400bc672
add byte [rax], al
add byte [rax], al
add byte [rax + 0x34], al
xor al, 0
add byte [rax], al
add byte [rax], al
add byte [rax + 0x15], al
adc eax, 0
add byte [rax], al
add byte [rax], 0
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rdx], al
invalid
add byte [rax], al
add byte [rax], al
Function at 0x14001b700
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x14001b733
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rcx, rax
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x14001b776
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r11d, eax
add r11, rbx
and edi, 0xf
jbe 0x14001b771
cmp rbx, r11
jae 0x14001b776
dec edi
movzx eax, word [rbx]
lea rbx, [rbx + rax*2 + 2]
jne 0x14001b760
cmp rbx, r11
jb 0x14001b77a
xor eax, eax
jmp 0x14001b786
xor eax, eax
cmp word [rbx], ax
cmove rbx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x14001b870
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, edx
call qword [sym.imp.WS2_32.dll_htonl]
mov ebx, 4
lea rdx, [rsp + 0x40]
mov r8d, ebx
xor r9d, r9d
mov rcx, rsi
mov dword [rsp + 0x40], eax
lea rdi, [rsp + 0x40]
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x14001b8d3
cmp eax, ebx
je 0x14001b8dd
sub ebx, eax
cdqe
xor r9d, r9d
add rdi, rax
mov r8d, ebx
mov rcx, rsi
mov rdx, rdi
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x14001b8b1
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
jne 0x14001b8df
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x14001b8f0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rbp, rdx
mov ebx, 4
lea rdx, [rsp + 0x40]
xor r9d, r9d
mov r8d, ebx
mov rsi, rcx
mov dword [rsp + 0x40], 0
lea rdi, [rsp + 0x40]
call qword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
je 0x14001b958
test eax, eax
je 0x14001b986
cmp eax, ebx
je 0x14001b962
sub ebx, eax
cdqe
xor r9d, r9d
add rdi, rax
mov r8d, ebx
mov rcx, rsi
mov rdx, rdi
call qword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
jne 0x14001b932
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
jne 0x14001b971
mov ecx, dword [rsp + 0x40]
call qword [sym.imp.WS2_32.dll_ntohl]
mov dword [rbp], eax
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov eax, 0x277e
jmp 0x14001b971
Function at 0x14001b990
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor r9d, r9d
mov ebx, r8d
mov rdi, rdx
mov rsi, rcx
call qword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
je 0x14001b69c
test eax, eax
je 0x14001b6c4
cmp eax, ebx
je 0x14001b6b2
sub ebx, eax
cdqe
xor r9d, r9d
add rdi, rax
mov r8d, ebx
mov rcx, rsi
mov rdx, rdi
call qword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
jne case.default.0x14001b6ab
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.WS2_32.dll_WSAGetLastError]
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov eax, 0x277e
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x20
mov r12, rcx
mov ecx, r8d
mov esi, r8d
mov rbx, rdx
call fcn.140076158
mov rcx, qword [rbx]
mov rdi, rax
cmp rax, rcx
je 0x14001b9cb
call fcn.14009667c
mov r8d, esi
mov rdx, rdi
mov rcx, r12
mov qword [rbx], rdi
mov qword [rbx + 8], rsi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
jmp 0x14001b650
add byte [rax], al
add byte [rax], al
xor byte [rax + rax], 0
je 0x1400bc672
add byte [rax], al
add byte [rax], al
add byte [rax + 0x34], al
xor al, 0
add byte [rax], al
add byte [rax], al
add byte [rax + 0x15], al
adc eax, 0
add byte [rax], al
add byte [rax], 0
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rdx], al
invalid
add byte [rax], al
add byte [rax], al

Function at 0x14001ba30
Capabilities:
Initialize winsock library

Disassembly:
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rbx, rcx
add rcx, 0x10
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
nop
lea rax, vtable.CConsoleComponent.1.0
mov qword [rbx], rax
lea rax, vtable.CConsoleComponent.0
mov qword [rbx + 8], rax
lea rax, vtable.CTCPIPClient.0
mov qword [rbx + 0x38], rax
mov qword [rbx + 0x1d8], 0xffffffffffffffff
lea rdx, [rbx + 0x40]
mov ecx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
nop
lea rcx, [rbx + 0x1e0]
call fcn.14003b4f0
nop
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x14001bc20
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x20
mov rbp, rdx
mov ebx, 4
lea rdx, [rsp + 0x50]
xor r9d, r9d
mov r8d, ebx
mov rdi, rcx
mov dword [rsp + 0x50], 0
lea rsi, [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
je 0x14001bc86
nop word [rax + rax]
test eax, eax
je 0x14001bcb3
cmp eax, ebx
je 0x14001bc90
sub ebx, eax
cdqe
xor r9d, r9d
add rsi, rax
mov r8d, ebx
mov rcx, rdi
mov rdx, rsi
call qword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
jne 0x14001bc60
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
jne 0x14001bcff
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_ntohl]
cmp eax, 0x2a3b0100
je 0x14001bcc5
mov eax, ntohs
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
mov eax, 0x277e
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
lea rdx, [rsp + 0x50]
mov rcx, rdi
mov dword [rsp + 0x50], 0
call fcn.14001b8f0
test eax, eax
jne 0x14001bcff
lea rdx, [rsp + 0x58]
mov rcx, rdi
call fcn.14001b8f0
test eax, eax
jne 0x14001bcff
mov r8d, dword [rsp + 0x50]
mov rdx, rbp
mov rcx, rdi
call fcn.14001b990
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
Function at 0x14001da60
Capabilities:
Get hostname

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x250
mov rax, qword [0x1400f4d50]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rcx
xor edi, edi
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], edi
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x20], 0x104
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], rdi
mov word [rbx], di
test eax, eax
jne 0x14001dabf
xor r8d, r8d
lea rdx, [0x1400bdbf0]
jmp 0x14001dad9
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x30]
xor eax, eax
repne scasw ax, word [rdi]
lea rdx, [rsp + 0x30]
not rcx
lea r8, [rcx - 1]
mov rcx, rbx
call fcn.140002510
mov rax, rbx
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1400959a0
mov rbx, qword [rsp + 0x268]
add rsp, 0x250
pop rdi
ret